Several Different BSOD Before Getting Into Windows

[avazil]

I've been having a problem with my bootup sequence with my Toshiba Laptop for a few months. I can usually figure out these things on my own, but this has stumped me. Every time I boot up from a powered down state, I have to go through 8 to 11 BSOD before I can get into Windows. It doesn't happen when I restart, only when it's shut off. I tried resetting to factory defaults, but it still happens. I've also done memory diagnostics, check disk, and virus scanning. Based on my own investigation of the dump files, there are a few causes for these blue screens. I don't know how to solve the problems, though.

I'm attaching my BSOD dump files, as per the instructions on how to post about a BSOD issue.

Thanks in advance for any assistance anyone can provide.

 

[carwiz]

Check to see if there's an update for your Symantec/Norton AV. It's the cause of your BSODs.

For test purposes, you might uninstall it and use Microsoft Security Essentials.

 

[avazil]

Thanks for the reply.

Unfortunately, I tried updating and uninstalling Norton, but the BSOD still happens at the same frequency. I did install Microsoft Security Essentials, too. Are there any other causes?

 

[carwiz]

Rerun the BSOD utility and use the Grab All button. Let the utility complete. This can take five minutes or more. Then upload a fresh zip file of all the files.

Forgot to ask: Did you reboot after the uninstall?

 

[avazil]

Here's the new zip file.

And yes, I restarted after the uninstall.

 

[carwiz]

Sorry to be late getting back. Interruptions on the home front.

There's no dumps in the zip file. I checked the system log and the last dump shows a Bug Check of 0x50. This can be hardware or software including malware.

To ensure your system drivers are clean, run SFC /scannow from an elevated command prompt. Use option Two. If it won't run, continue with the items below then run this last. (After reboots on the clean.)

There's numerous suspicious programs running and one hidden at start up (Image below).
You should start in safe mode, with internet, then download and run AdwCleaner.

Run a full scan with MSE.

Forgot the image.

 

[avazil]

Strange. I wonder why there wasn't a dump file...

I did the scannow, but it didn't find anything. I also did the Adwcleaner and security scan. The Adware cleaner found two files, which I removed, but the security scan didn't find anything. The BSOD still happen, regardless.

I'm going to post my files again. This one has a dump file in it.

 

[carwiz]

Did you rerun the utility or just re-zip. The files still include questionable programs.

Did you load another scanner of some type? I don't have a clue what "TobuActivation.exe" might be but it was running at the time of the dump. This could be associated with a "fix all" program that does nothing but infect your machine or it could be a Toshiba backup program that shouldn't be running while debugging.

Uninstall any scan (scam) or fixit programs you've installed recently except those noted above.

Start your PC in Safe Mode with Networking.

Download and install MBAM Free and run it. Don't activate the "Trial" or any other options. Allow it to update and run a full scan. If it comes out clean, reboot to get out of Safe Mode.

Click on the ORB (Start) and type msconfig in the search box and press Enter. (If prompted, click on Continue for the UAC prompt.) Click on the Startup tab and post a snip of that window. Don't change anything at this point. This is to check for the blank entry. We may change some later for a Clean Boot.

Exit msconfig then post that snip .

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa804b7ce6b8, 0, fffff80003f0ff0a, 5}
 
[B][COLOR=darkred]Could not read faulting driver name[/COLOR][/B]
[B][COLOR=darkred]Probably caused by : memory_corruption ( nt!MiGetNextNode+2e )[/COLOR][/B]
[B][COLOR=darkred]Followup: MachineOwner[/COLOR][/B]
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa804b7ce6b8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80003f0ff0a, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
 
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80004115100
 fffffa804b7ce6b8 
FAULTING_IP: 
nt!MiGetNextNode+2e
fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8]
MM_INTERNAL_CODE:  5
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
[B][COLOR=red]PROCESS_NAME:  TobuActivation[/COLOR][/B]
CURRENT_IRQL:  0
TRAP_FRAME:  fffff8800a2ce680 -- (.trap 0xfffff8800a2ce680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa804b7ce6b0 rbx=0000000000000000 rcx=fffffa804b7ce6b0
rdx=fffffa800a222b2a rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003f0ff0a rsp=fffff8800a2ce818 rbp=fffffa800b5e9660
 r8=000000000000000b  r9=0000000000006f8c r10=0000000000000000
r11=fffff8800a2ce700 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!MiGetNextNode+0x2e:
fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8] ds:fffffa80`4b7ce6b8=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80003f5a5b3 to fffff80003eddbc0
STACK_TEXT:  
fffff880`0a2ce518 fffff800`03f5a5b3 : 00000000`00000050 fffffa80`4b7ce6b8 00000000`00000000 fffff880`0a2ce680 : nt!KeBugCheckEx
fffff880`0a2ce520 fffff800`03edbcee : 00000000`00000000 fffffa80`4b7ce6b8 00000000`00000000 fffffa80`0beb4a00 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`0a2ce680 fffff800`03f0ff0a : fffff800`04278490 00000000`00000001 fffffa80`0beb4a00 00000000`00000080 : nt!KiPageFault+0x16e
fffff880`0a2ce818 fffff800`04278490 : 00000000`00000001 fffffa80`0beb4a00 00000000`00000080 00000000`000007ff : nt!MiGetNextNode+0x2e
fffff880`0a2ce820 fffff800`04137ac8 : fffffa80`0befd990 fffff880`0a2ce900 00000000`00000000 00000000`000000d0 : nt!MmEnumerateAndReferenceImages+0x160
fffff880`0a2ce8a0 fffff800`041960fe : fffffa80`0befd990 00000000`00000000 fffffa80`0beb4a00 fffffa80`0befdaf0 : nt! ?? ::NNGAKEGL::`string'+0x204c9
fffff880`0a2cea40 fffff800`041b20d9 : 00000000`7efdb000 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PspExitProcess+0x4e
fffff880`0a2ceaa0 fffff800`041966b8 : 00000000`00000000 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x4e9
fffff880`0a2ceba0 fffff800`03edce53 : fffffa80`0befd990 00000000`00000000 fffffa80`0beb4a00 00000000`005e2dd8 : nt!NtTerminateProcess+0x138
fffff880`0a2cec20 00000000`7700157a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008dcb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7700157a
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MiGetNextNode+2e
fffff800`03f0ff0a 488b4908        mov     rcx,qword ptr [rcx+8]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  nt!MiGetNextNode+2e
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  X64_0x50_nt!MiGetNextNode+2e
BUCKET_ID:  X64_0x50_nt!MiGetNextNode+2e
Followup: MachineOwner

 

[Golden]

TobuActivation.exe is the Toshiba Online backup executable.

Follow carwiz's advice, and then also run this (based on the BugCheck 50):

Run a minimum of 8 passes of MemTest86+, preferably overnight, or until errors occur using.

Use this tutorial to help you use MemTest86+:
http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

 

[avazil]

I reran the utility when I posted those last files.

I did the memory test, but it found nothing after 8 passes. I also did MBAM in Safe Mode with Networking, but that came up blank, too. I don't have any fixit programs installed and really don't do that. Unless System Mechanic counts? I don't see why that would, though.

I want to post the snip, but I'm not sure how to do that on this forum. Did you mean attach it or put on the post itself?

 

[carwiz]

System Mechanic is a prime suspect. It has active services that can interfere with AV programs and Windows services. Did your problems start after installing it or setting active monitor options?

To post an image to the forum, use the paperclip in the message tool ribbon (next to the emoticon menu). A popup will appear for message attachments. Browse your PC for the image, Upload then close the window.

 

[avazil]

Here's the snip. And now I have a newly developed problem. The system now randomly BSOD when it's idle. It happened twice in the past hour, which never happened before. So I reran the diagnostic tool and posted the files. I also uninstalled System Mechanic just now, so hopefully there will be an improvement.

 

[carwiz]

There's only one dump in the last set and it's indicating a complete failure of the memory structure. That lead me back to the system event log and sure enough, there's drive controller errors along with system drivers failing to load. It appears that your disk drive is failing. That's most likely the reason memtest found nothing and the BugCheck codes are all over the place. Windows detected a failure of the drive controller so a check disk (chkdsk) or a drive maintenance/repair will most likely fail too. Your disk is a Seagate Momentus Model ST9500420AS (500GB 7200 RPM 16MB Cache SATA 3.0Gb/s 2.5") and most likely out of warranty. You should start making an attempt to save as much of your data, such as photos, as you can on an external disk or USB drive before the disk fails completely. The problem is that some of the data may already be corrupt.

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See [url=http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx]Kernel patch protection for x64-based operating systems[/url]
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89e3b24f4, Reserved
Arg2: 0000000000000000, Reserved
Arg3: 8e1a57b9f6c5bc5d, Failure type dependent information
Arg4: 0000000000000101, Type of corrupted region, can be
 0 : A generic data region
 1 : Modification of a function or .pdata
 2 : A processor IDT
 3 : A processor GDT
 4 : Type 1 process list corruption
 5 : Type 2 process list corruption
 6 : Debug routine modification
 7 : Critical MSR modification
Debugging Details:
------------------

BUGCHECK_STR:  0x109
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  System
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003e77bc0
STACK_TEXT:  
fffff880`035625d8 00000000`00000000 : 00000000`00000109 a3a039d8`9e3b24f4 00000000`00000000 8e1a57b9`f6c5bc5d : nt!KeBugCheckEx

STACK_COMMAND:  kb
SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME:  Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP:  0
BUCKET_ID:  BAD_STACK
Followup: MachineOwner
---------