Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD on every start, memory problem?


  • Please log in to reply
18 replies to this topic

#1 chiasmos

chiasmos

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 27 September 2011 - 07:10 AM

Hello, here is my problem. I would be grateful for any help.

I am running Windows Vista Home Premium on a HP G5010EM notebook.

1. Recently I had a virus problem which appears to be sorted now thanks to the help of Bleeping Computer, but as a part of the problem I started getting Blue Screens and for some weeks now have been unable to start my computer without the BSOD happening after sign in.

Consequently I can only use my computer in Safe Mode.

2. I get a 'PC confidential cannot start' message between signing in and the BSOD. I have wanted to uninstall this annoying program which I got some months back somehow, but unfortunately cannot do so in Safe Mode. Perhaps it is related to the problem. I was already having this before the virus and BSOD, and used to ignore it ok.

3. I have read the blue screen, which does not specify the exact cause but suggests I should maybe:
a. free up more memory.
b. update my BIOS.
c. disable BIOS memory options such as cache and shadowing.
d. update drivers.

It follows with a STOP message starting with 0x0000005. And then it says something like it is making a dump file.

4. in answer to (3)
a. I have 26.3 GB free on a 105 GB C-drive (this has always been plenty before). My RAM is 1014MB.
b. My BIOS is already the one currently specified on the HP site for my machine, ie. the original one.
c. Within my BIOS (F 25) there is no option for disabling cache or shadowing memory options.
d. The drivers do not appear to need updating, from what I have seen of the HP site (to be truthful I don't really understand much about drivers so I may be missing something).

5. I downloaded BlueScreenView in order to find the specific problem - e.g. a faulty driver or device - from a dump file, but despite several BSODs since I added BSV, I cannot find any dump files in it the program. I am not sure if they will be got from a 'kernel memory dump' or a 'small memory dump' (64k). The default is kernel memory dump. I have tried setting it to small memory dump, but not only does it not seem to make one, next time I look it has reverted to 'kernel small memory dump'.


Additional possibly relevant information:

6. MBR is ok (it was fixed with the help from Bleeping Computer).
7. I ran a hard disk test and that passed ok.
8. When fighting the virus I donwloaded and used Spyware doctor and registry mechanic. I don't think I did any thing rash, but perhaps I did.
9. Part of why I may have got infected in the first place was down to not getting rid of things like old Java, Adobe etc. Unfortunately I cannot uninstall any programs in safe mode.

I would be very grateful if someone could help me. Thank you.

Edited by chiasmos, 27 September 2011 - 07:11 AM.


BC AdBot (Login to Remove)

 


#2 Allan

Allan

  • BC Advisor
  • 8,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:03 AM

Posted 27 September 2011 - 07:20 AM

1) NEVER use any sort of registry utility. There is no way of knowing if you did any harm with Registry Mechanic at this point.

2) Download BlueScreenView:
http://www.nirsoft.net/utils/blue_screen_view.html
unzip downloaded file and double click on BlueScreenView.exe to run the program.
when scanning is done, go to EDIT - Select All
Go to FILE - SAVE Selected Items, and save the report as BSOD.txt
Open BSOD.txt in Notepad, copy all of the content, and paste it into your next reply

#3 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 27 September 2011 - 07:34 AM

Thank you Allan.

I double clicked on Bluescreenview.exe and it doesn't offer the option of a scan, it just opens a window title Bluescreenview - C:\windows\minidump with two panes, 'Dump File' and 'Filename'. There is nothing in either. At the bottom it says '0 crashes'

#4 Allan

Allan

  • BC Advisor
  • 8,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:03 AM

Posted 27 September 2011 - 07:38 AM

Well, without knowing the exact error message it is next to impossible to diagnose the cause of the blue screen problem. Meanwhile, you can download and run Mike Lin's Startup Control Panel and look at each tab for any references to PC confidential and uncheck them.
http://www.mlin.net/StartupCPL.shtml

#5 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 27 September 2011 - 07:50 AM

I downloaded it and installed Startup Control panel. It said 'Finished!' and that's all. I can't see any tabs and there is no startup facility in my vista control panel. Perhaps this is to do with it being Safe Mode?

Sorry to be so useless.

#6 SteveHilma

SteveHilma

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:03 AM

Posted 27 September 2011 - 11:19 AM

Try this, it worked for me after the Adobe Uninstall start causing my light blue screen freezes just after login.

===================================================================

.... Actually, I have solved the problem myself. I did not mention that I was getting past the login screen before getting the blank light blue screen. I ran across an article where the solution was said to be boot into safe mode, run MSCONFIG, disable the Windows Event Collection, and the Windows Event Log in services, (also stop other erroneous start-up programs), then reboot into normal mode, rename the c:\windows\system32\winevt\logs\system.evtx to *.evtxOLD, and then run MSCONFIG again, re-enable the 2 Windows services and it is fixed.

Further, I then tried installing Adobe Acrobat 6.0 again, which is what I was working on when the problem started, it still would not work, so in an effort to get AA6 working I uninstalled it for a 2nd time and had the same light blue screen freeze up until I went through the above example to fix my laptop again using MSCONFIG.
======================================

hope this helps, Steve

#7 Allan

Allan

  • BC Advisor
  • 8,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:03 AM

Posted 27 September 2011 - 11:26 AM

I downloaded it and installed Startup Control panel. It said 'Finished!' and that's all. I can't see any tabs and there is no startup facility in my vista control panel. Perhaps this is to do with it being Safe Mode?

Sorry to be so useless.

Startup Control Panel does not require installation. Just download and run it.

#8 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 28 September 2011 - 05:32 AM

Allan,

sorry, I used the wrong term. I ran it and it just says finished and that's all. Can't see what tabs are being referred to. Thanks anyway, I will have another look.

Steve,

thanks, I will try that.

#9 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:08:03 PM

Posted 28 September 2011 - 05:56 AM

Depending on which download you chose, Mike Lin's Startup Control Panel may require installation. When installed, you will find an icon labeled Startup in the Control Panel.

Download Startup Control Panel 2.8 (59kb) <<< this is the installation version

Standalone EXE Version (34kb)

http://www.mlin.net/StartupCPL.shtml


Please do the following (and it might be useful if you do it 2 or 3 times since the error message appears to not always be the same one):

Get a look at the error message presented by the BSOD (blue screen of death) ....
  • Start tapping the F8 key after you press the ON button, and continue tapping until you are presented with the "Windows Advanced Options Menu" screen.

    Posted Image
  • Use the UP/DOWN arrow keys to select "Disable automatic restart on system failure" and press the <ENTER> key.
  • Your system will attempt to restart normally, but when it crashes, it will not re-start: Instead, you will see a BSOD with error message.

    Posted Image
  • Record the error message details (contained in the areas outlined in red, in the above example image), and post in your reply.

Edited by AustrAlien, 28 September 2011 - 08:00 AM.

AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#10 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 29 September 2011 - 09:01 AM

Thanks for the replies:

steve I tried your suggestion, and unfortunately it did not work, mainly I think because the event log would not stopp running. But thank you.

AustrAlien/Allan

I managed to get the startup program to work and unchecked startup options such as adobe, open office and and Java. (I couldn't find a referenc eot PC Confidential). Unfortunately, running the laptop again in safe mode (it went BSOd as usual) I see it has duplicated entires for the programs I unchecked. Should these perhaps be renamed or deleted from that list?

In any case, here is the BSOD info you requested AustrAlien:

NB there is no first message of the type in the example you gave, i.e. the sentence starting 'A problem has been detected...etc' is simply followed by 'If this is the first time... etc'

The code in the stop message is what I have noted before:

STOP: 0x0000008E (0xC0000005, 0x81DF5C19, 0xA5C8D91C, 0x00000000)

#11 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:08:03 PM

Posted 29 September 2011 - 06:55 PM

Link to previous topic in MRL forum with m0le:
Hijack.StartMenuinternet infection can't get rid of infection, and pc bluescreens on normal login
----------------

Crash dumps are not always saved for one reason or another ... not necessarily because of your settings. To check your system's "Recoveros" (Recovery) and Page File settings via Windows Management Instrumentation (WMI), please download and then run the following:

Pleased you got Startup Control Panel figured out. However, since PC Confidential 2008 can't be prevented from running on startup using that method, we have will have to try some other way. When using Vista (because of UAC settings) it is normal that you see the startup entries being added back in immediately after trying to make a change. To clear up the "mess", simply right-click the entries that you have created > Delete, and then also delete from the Deleted tab ... and you will be back to normal.


0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).


Source: http://aumha.org/a/stop.htm


Please try Step 1: Perform a clean boot as instructed in the following link:
How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

Let us know if you can then successfully load Windows normally. If you can load Windows normally, then continue with the steps provided in the link until you have determined exactly which item is causing the BSOD on normal startup.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#12 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 01 October 2011 - 08:48 AM

Thanks AustrAlien,

I did the WMI test and have pasted the contents below:

AutoReboot=TRUE
Caption=
DebugFilePath=%SystemRoot%\MEMORY.DMP
DebugInfoType=2
Description=
ExpandedDebugFilePath=C:\Windows\MEMORY.DMP
ExpandedMiniDumpDirectory=C:\Windows\Minidump
KernelDumpOnly=FALSE
MiniDumpDirectory=%SystemRoot%\Minidump
Name=Microsoft® Windows Vista™ Home Premium |C:\Windows|\Device\Harddisk0\Partition1
OverwriteExistingDebugFile=TRUE
SendAdminAlert=FALSE
SettingID=
WriteDebugInfo=TRUE
WriteToSystemLog=TRUE




AllocatedBaseSize=256
Caption=C:\Windows\system32\temppf.sys
CurrentUsage=0
Description=C:\Windows\system32\temppf.sys
InstallDate=20110910130124.248133+060
Name=C:\Windows\system32\temppf.sys
PeakUsage=0
Status=
TempPageFile=TRUE




Unfortunately the clean boot didn't work. I followed the instructions okay but once it restarted and I signed in it did the usual BSOD. Having gone back into Safe Mode it seems as if the changes to msconfig didn't actually take. It seems very hard to make permanent changes in Safe Mode.

I am wondering if I should do a 'reset to factory settings'. I have the files I want safely copied elsewhere. But because my computer came from the salesroom with Vista installed but no disk, I am worried that 'factory settings' might mean it would just be a blank computer with no Vista anymore.

#13 jhayz

jhayz

  • BC Advisor
  • 6,922 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:03 PM

Posted 01 October 2011 - 11:47 PM

Try using Event Viewer to see other error logs http://www.bleepingcomputer.com/forums/topic40108.html

Tekken
 


#14 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:08:03 PM

Posted 02 October 2011 - 04:09 AM

@ jhayz: Checking the Event Viewer log is a good suggestion in this case.

Thanks for posting that link. I hadn't come across that thread before.

Your recoveros result:

AllocatedBaseSize=256
Caption=C:\Windows\system32\temppf.sys
CurrentUsage=0
Description=C:\Windows\system32\temppf.sys
InstallDate=20110910130124.248133+060
Name=C:\Windows\system32\temppf.sys
PeakUsage=0
Status=
TempPageFile=TRUE


It should look more like the following, in order for the crash dumps to be saved:

AllocatedBaseSize=1578
Caption=C:\pagefile.sys
CurrentUsage=730
Description=C:\pagefile.sys
InstallDate=20080720020524.181537-300
Name=C:\pagefile.sys
PeakUsage=859
Status=
TempPageFile=FALSE


When you set the paging file (Pagefile.sys) on your computer to a size that is lower than the recommended size of 12 megabytes (MB) plus the amount of random access memory (RAM), a temporary paging file (Temppf.sys) may be created ...


Please use the following link to access your Virtual Memory settings and change them to "Automatically manage page file sizes for all drives" or "System managed size".
That should enable you to collect a few crash dumps. Attempt a normal startup/Crash the system a few times and you should see minidumps created at:
  • C:\Windows\Minidump <<< minidump files in this folder
  • Then run BlueScreenView and post the resulting output (see Allan's previous post).

You may wish to disable UAC on your system to make life easier, until you get this problem solved.
  • How to disable/enable UAC in Vista
  • http://www.vista4beginners.com/How-to-disable-UAC
  • http://www.petri.co.il/disable_uac_in_windows_vista.htm <<< I have found Method #1 - Using MSCONFIG to be the most reliable method.
Try setting up a clean boot again after disabling UAC and let us know the result. You should then be able to use Startup Control Panel without issue also.

You said: "I am wondering if I should do a 'reset to factory settings'."
That is definitely an option for you to consider. There is likely no need for your concern: "Factory settings" means as it came out of the box (in the shop), with the operating system installed on it. After you did that though, you would need to download and install all the Microsoft updates since that time, and install any programs that you had previously installed yourself.
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image

#15 chiasmos

chiasmos
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:11:03 AM

Posted 02 October 2011 - 08:29 PM

Hi AustrAlien,

thank you.

I tried the page file procedurte your suggested but it doesn't work, because it keeps setting the RAM very low. I have alos tried manually setting it, but once the computer restarts it has reverted.

Tried to remove UAC alo,o but again that resets itself after restart.

So I am going round in circles. So I decided on a reinstall to factory settings.

(Not sure if this should be as new topic?)

I have tried to make a HP recovery disk but it said there was no CD burner in order to make it. I have found I (probably) need Roxio Creator which I think I deleted some time back. I downloaded a trial version of Roxio Creator v 9, so far so good.

But when I tried to install it, it found a bit of the old software there - although as I say it is not there as functioning program anymore - and said I had to uninstall that first. It then told me I can't uninstall it in Safe Mode.

So I am in Safe Mode because my computer won't work normally. And in order to install the software to burn the disk to recover my computer to factory settings... I have to do it in a normal mode I can't get into.

Is there any way to uninstall/install in safe mode in vista? If I can't fix the Roxio software, I won't be able to burn the disk. I don't get why you can't uninstall in Safe Mode, when I am stuck in Safe Mode because of malfunctioning/missing programs in the first place.

Thanks very much for your help and patience so far, by the way, and please do tell me if I should start a new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users