Solved Intermittent 7B on startup

[Tetsuron]

This started happening earlier this week; I get a 7B error (0xFFFFF880003A9928) on startup, but not every time or even every day. Every time it's happened so far, I could simply reboot normally without having to go to safe mode. I ran chkdsk /f which came up with no errors.


I hadn't added any new hardware, touched system settings or even updated any drivers recently so I haven't a clue what might've caused this to start happening now.


I ran a startup repair earlier which came up with an error that it couldn't repair (or it couldn't come up with any errors it could repair?), but I hope the details of that are in this dump file.



Currently it's a minor inconvience at worst, but I'd still like to solve it before/if it gets worse.

 

[axe0]

Have a look at Troubleshooting stop 0x7B and stop 0xED.

 

[Tetsuron]

I got the boot log file which appears to hang at CLASSPNP.SYS

 

[axe0]

The dump present in the logs is a 0x4A which is different from a 0x7B, without a dump of the 0x7B I'm not sure if there happens to be a relation.

The ntbtlog.txt only shows any driver that was(n't) loaded. I'm not sure how useful that is.

Have you had a chance to look at the link I posted in my previous post?

 

[Tetsuron]

Yes, but I'm not sure which one of these apply since they make no distinction between every boot vs occasional boot.


I guess I could give the defender offline thing a go as soon as I have access to another PC.


Also I didn't find a 4A error, where did you see that?

 

[axe0]

I suggest to try options 3 and 6, tests related to the filesystem and hard drive.

The 0x4A is the dump from your logs.

 

[Tetsuron]

You mean the .dmp file? Because I just looked at that myself and noticed there are no events in it since May. That 4A error is over six months old.



According to the windows disk management, the system reserved partition is already active so I guess that leaves me with just #3, I already ran chkdsk /f but I guess I'm supposed to run it with both /f and /r?

 

[axe0]

.dmp is the dump file extension, so yes I mean the .dmp file

/r includes /f and does a little more, /f fixes errors, /r will attempt to recover any data. So only /r is really needed.

I just noticed a small mistake, in my previous post I wrote options 3 and 6, it should actually be options 3 and 7.

 

[Tetsuron]

Well I just finished running chkdsk /r and it still came back clean. I'll run SeaTools next.


Here's the result from the event viewer anyway tho.

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
1194240 file records processed. File verification completed.
16066 large file records processed. 0 bad file records processed. 2 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
1320162 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
1194240 file SDs/SIDs processed. Cleaning up 75 unused index entries from index $SII of file 0x9.
Cleaning up 75 unused index entries from index $SDH of file 0x9.
Cleaning up 75 unused security descriptors.
Security descriptor verification completed.
62962 data files processed. CHKDSK is verifying Usn Journal...
36429480 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
1194224 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
9197256 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

976657407 KB total disk space.
937998860 KB in 976618 files.
539108 KB in 62963 indexes.
0 KB in bad sectors.
1330415 KB in use by the system.
65536 KB occupied by the log file.
36789024 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
9197256 allocation units available on disk.

Internal Info:
00 39 12 00 e8 dc 0f 00 50 d0 1c 00 00 00 00 00 .9......P.......
31 33 01 00 5c 00 00 00 00 00 00 00 00 00 00 00 13..\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[Tetsuron]

SeaTools also passed.

 

[axe0]

Let me know if the problem reoccurs, the changes chkdsk made may just be enough to fix it.

 

[Tetsuron]

Nope, still getting it - and still nothing in boot logs to show it :/


So far it's never happened on a straight reboot, only cold boots and even then only occasionally.

 

[axe0]

The next time it occurs, let me know, I need a dump of the 0x7B to continue.

 

[Tetsuron]

You mean use the log collector and upload the results again?

 

[axe0]

You could do that, but this time I mainly want a dump, anything else is extra.

 

[Tranquil Hegemo]

Have you tried booting memtest from cold? Had an issue a fair while ago now where my PC would blue screen at first boot and then work without issues all day.

Finally traced it down to some sort of issue with the memory for circa 30 secs after booting from cold but I had to boot straight into memtest to see it. If i tried at any other time it would do 8+ passes without issue but when running from cold it you could see the 8000 ish errors in the first 30 seconds and then it would just stop. A bit of a pig of a problem to solve that was...

 

[Tetsuron]

No, but I did try going to safe mode from cold but all I got was a black screen for some reason. It's not even frozen or anything, there's just no menu and I could ctrl+alt+del to reboot fine from there on. Thanks for the tip tho, I'll give that one a try.


I actually hope that's the same problem as I have, replacing RAM would be an easy fix. The symptoms certainly sound alike.


EDIT: I try to run memtest off UBCD but I get a feeling that whatever errors the RAM might produce would have to exist for such a short period that it takes too long for me to navigate the menus to actually catch it happening.

I guess I could swap out the RAM sticks and see what happens.

 

[Tetsuron]

Here's another post-BSOD dump, for whatever it's worth.

 

[axe0]

I found a few eventlogs indicating repair of corrupted files.

Diagnostics Test

 System File Check

Please try following:

• Open an admin command prompt
• Copy/paste "sfc /scannow" (without quotes) and press enter
• When it is finished reboot your system
• Open again an admin command prompt
• Enter sfc/scannow again

If sfc/scannow says "Windows Resource Protection found corrupt files but was unable to fix some of them" after the second SFC, please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

Make a photo of the result and post it.

 

[Tetsuron]

Both runs of sfc /scannow came up with "Windows Resource Protection did not find any integrity violations."



However, as I swapped the RAM sticks for different ones, I think some of the caps on my mobo are swollen and if that's the case, that's probably the most likely cause of this problem.


Unfortunately it's such an old model that it's nearly impossible to find the same make and model of to replace it with. Do you think I could replace it with a suitably similar model like G41C-GS without having to reinstall Windows? They both appear to utilize the same chipsets and are pretty much identical in every respect except that one has additional DDR2 sockets and a PSU fan connector.


My only other option is to buy a whole new mobo and CPU and I'm somewhat reluctant to take that route due to cost concerns, unless I have no other choice.-