Getting BSOD with different error messages after every startup in Windows 8.1

Question

Hi all. I've recently upgraded from Windows 7 to 8.1 and since then started getting BSOD screens after every startup (approx. 1-2 minutes after I go to Desktop). It only happens after the computer has been completely turned off and then started again, i.e. I don't get BSOD screens if I restart the PC. The error messages are different every time. So far, I've had about 30 of them: System_Thread_Exception_Not_Handles, Driver_Verified_Detected_Violation, NTFS_File_System, System_Service_Exception, Memory_Management, Attempted_Execute_Of_Noexecute_Memory, PFN_List_Corrupt, Bad_Pool_Header, etc. etc.).

After the computer restarts by itself, I get a black screen and have to reset it manually. After that, everything is fine until the next shutdown and startup. In the last few weeks, I've updated all my drivers, run a dozen diagnostic tools plus tried solving each error message with different forum suggestions. Nothing worked! Would really appreciate any help with the above issue.

PC specs:

CPU: AMD FX-6100, 3600 MHz

MB: Asus Sabertooth 990FX R2.0

RAM: 4 GB DDR3-1333

Graphics: AMD Radeon HD 7700 Series (1 GB)

HDD: Seagate Barracuda ST2000DM001 (2TB, 7200 RPM, SATA-III)

BIOS: AMI (09/16/2013)

Answer 1

1. I still see all of the problematic Asus drivers loaded. Use Revo to list software and remove any/everything regarding Asus, it's all bloatware - http://www.revouninstaller.com/revo_uninstaller_free_download.html

2. You didn't follow step #2, as the driver is still loaded.

Regards,

Patrick

Answer 2

Hi Patrick. After doing all 3 steps, I got the BSOD screen again with PFN_List_Corrupt message. Then on restart, the Windows repair screen appeared and then "Automatic repair could not repair your PC" message. After a few further manual resets I was able to get into Desktop and run sfc /scannow which came up with "Boot critical file e:\windows\system32\drivers\fltmgr.sys is corrupt". In a zip file I've included SrtTrail and CBS log files as well as DMP files from this morning: http://1drv.ms/Os00Yh. Not sure what to do next...

Answer 3

Thanks!

We have various different bug checks:

MEMORY_MANAGEMENT (1a)

This indicates that a severe memory management error occurred.

BugCheck 1A, {41792, fffff68000006b90, 2000, 0}

- The 1st parameter of the bug check is 41792 which indicates a corrupted PTE has been detected.

0: kd> dt nt!_MMPFN fffff68000006b90

   +0x000 u1               : <unnamed-tag>

   +0x008 u2               : <unnamed-tag>

   +0x010 PteAddress       : (null)

   +0x010 VolatilePteAddress : (null)

   +0x010 Lock             : 0n0

   +0x010 PteLong          : 0

   +0x018 u3               : <unnamed-tag>

   +0x01c NodeBlinkLow     : 0

   +0x01e Unused           : 0y0000

   +0x01e VaType           : 0y0000

   +0x01f ViewCount        : 0 ''

   +0x01f NodeFlinkLow     : 0 ''

   +0x020 OriginalPte      : _MMPTE

   +0x028 u4               : <unnamed-tag>

^^ We can see it's all zeroed out.

-- PROCESS_NAME:  uTorrent.exe

PFN_LIST_CORRUPT (4e)

This indicates that the page frame number (PFN) list is corrupted.

This error is typically caused by a driver passing a bad memory descriptor list. For example, the driver might have called MmUnlockPages twice with the same list.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

This is the general bug check code for fatal errors found by Driver Verifier.

BugCheck C4, {91, 0, ffffe00004007040, 0}

^^ The 1st parameter of the bug check is 91 which indicates a driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout.

Despite all of this said, plus being a VRF bug check, it failed to label a driver.

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)

This indicates that an attempt was made to execute non-executable memory.

-- PROCESS_NAME:  AvastSvc.exe

-----------------

Overall, what's occurring here is avast! appears to be causing NETBIOS conflicts, which is then leading to memory corruption. We can see uTorrent was caught as a process crash, which conflicted with avast!.

Follow all of the recommendations below, please:

1. Remove and replace avast! with Windows 8's built-in Windows Defender for temporary troubleshooting purposes as it's likely causing conflicts:

avast! removal - http://www.avast.com/uninstall-utility

Windows Defender (how to turn on after removal) -http://www.eightforums.com/tutorials/21962-windows-defender-turn-off-windows-8-a.html

2. AODDriver2.sys is listed and loaded in your modules list which is AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. Known BSOD issues in Win7 & 8.

Please uninstall either software ASAP! If you cannot find either software to uninstall, or it's not installed, please navigate to the following filepath:

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

and rename AODDriver2.sys to AODDriver.2old

and then Restart.

3. You have a lot of problematic Asus software installed, such as AiChargerPlus, Asus PC Probe, etc. All of Asus' utility software is unnecessary bloatware that is known to cause issues. Please remove any and all Asus software.

Regards,

Patrick

Answer 4

Hi Patrick. Please find the link with minidump folder content: http://1drv.ms/1kDPHLA

Answer 5

Hi,

In order to assist you, we will need the .DMP files to analyze what exactly occurred at the time of the crash, etc.

If you don't know where .DMP files are located, here's how to get to them:

1. Navigate to the %systemroot%\Minidump folder.

2. Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.

3. Upload the zip containing the .DMP files to Onedrive or a hosting site of your choice and paste in your reply. Prefered sites: Onedrive, Mediafire, Dropbox, etc. Nothing with wait-timers.

4 (optional): The type of .DMP files located in the Minidump folder are known as Small Memory Dumps. In %systemroot% there will be what is known as a Kernel-Dump (if your system is set to generate). It is labeled MEMORY.DMP. The difference between Small Memory Dumps and Kernel-Dumps in the simplest definition is a Kernel-Dump contains much more information at the time of the crash, therefore allowing further debugging of your issue. If your upload speed permits it, and you aren't going against any strict bandwidth and/or usage caps, etc, the Kernel-Dump is the best choice. Do note that Kernel-Dumps are much larger in size due to containing much more info, which is why I mentioned upload speed, etc.

If you are going to use Onedrive but don't know how to upload to it, please visit the following:

Upload photos and files to Onedrive.

Please note that any "cleaner" programs such as TuneUp Utilities, CCleaner, etc, by default will delete .DMP files upon use.

If your computer is not generating .DMP files, please do the following:

1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.

2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all drives'.

3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system log'.

Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.

4. Double check that the WERS is ENABLED:

Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.

If you cannot get into normal mode to do any of this, please do this via Safe Mode.

Regards,

Patrick