[SOLVED] BSOD - Windows 10 Stuck at 10586 - Microsoft Drivers Unsigned

R

rmirwin2

Contributor
Joined
Mar 10, 2019
Posts
16
Hello all!
I'm new to your forum here, drawn by some of the solutions found on these pages. Most impressive protocol I have to say.

So, I'm here because of a Windows update problem. This particular machine (with an Asus Z97A mobo) had been upgraded from Windows 7 to 10. This box, interfaced to some control equipment, didn't get a lot of use and was mostly left off. During December, I left it deliberately on in order for it to catch up on upgrades. But, then I noticed it was was down and from then on there were BSOD's which occur to this day. I've tried a variety of things, including rolling back upgrades and the like, but essentially, nothing has seem to help. Progress forward to the newer versions is entirely unsuccessful with the "Cannot determine if enough space is available" diagnostics.

The machine is stuck on Windows 10 version 10586 and unable to go further. Safeboot won't even load without BSOD's.

It seems that the majority of Microsoft drivers are not recognized as signed and so the machine requires the F8 then F7 treatment to disable Driver Enforcement in order to boot. This is reflected in the Code Integrity part of the Event Log (for example, starting with "Code Integrity was unable to load the Microsoft-Windows-Common-Drivers-minkernel-Package~31bf3856ad364e35~amd64~~10.0.10586.0.cat catalog."), and is apparent in sigverif.exe. I've tried restoring the drivers using the 10586 iso, used DISM and sfc /scannow but can't seem to get Windows to register them properly. Everything is perfectly reproducible, unfortunately.

I've seen all manner of miracles on these pages so far, so am feel I'm in need of one here!

All suggestions appreciated!

· OS - Windows 10
· x64 (64-bit)
· Originally installed OS on the system was W7
· Upgraded from Win 7
· 4 years old approx
· Was upgraded 2 years ago to 10.
· CPU 4970K
· None (Intel graphics but had Nvidia card installed/removed prior to problem)
· MotherBoard - Asus Z97A
· Power Supply - Corsair 600W
· Homebuilt desktop system

Rich
 

Attachments

Last edited:
Disable service AsusFanControlService and update TwinCAT3 program (or uninstall if you don't need it)
 
In case of TwinCAT3 i found it:
ftp://ftp.beckhoffautomation.com/Upload/Spectre_Meltdown_TC3Doc/SpectreMeltdown_HowTo_TwinCAT3.pdf
 
Attached is the CBS log produced by "SFC /scannow".
I have to scurry off to work now but will get back to this later today. Can't remote in to this machine atm.

Thanks all!
Rich
 

Attachments

I ran several of the dumps and they all show -
Code: 
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

Meaning - Driver Verifier is turned ON.

Please disable Driver Verifier.

Bring up an admin CMD screen.

Type/paste -
Code: 
verifier /reset

Then re-boot the system.

Regards. . .

jcgriff2
 
Okay, performed the following:
  1. Stopped AsusFanControlService and set to "Manual" to disable;
  2. Uninstalled Twincat 3 drivers;
  3. Reset Verifier;
Also tried again the following procedure from the 10856 1176 iso extracted by 7zip to C:\temp\windows:
DISM /Export-Image /SourceImageFile:c:\temp\windows\x64\sources\install.esd /SourceIndex:1 /DestinationImageFile:c:\temp\windows\x64\sources\install.wim /compress:max
Dism /Get-WimInfo /wimFile:c:\temp\windows\x64\sources\install.wim:1
DISM /Mount-Wim /WimFile:c:\temp\windows\x64\sources\install.wim /index:1 /mountdir:c:\WIM /ReadOnly
Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:c:\temp\windows\x64\sources\install.wim:1 /limitaccess
Dism /unmount-wim /mountdir:c:\WIM /Discard
--Power down/Restart computer
sfc /scannow

BSOD's still present along with unsigned Windows drivers. Boots into diagnostic mode by disabling driver signing enforcement.

Attached are new scan reports.

Thanks for the suggestions!

Rich
 

Attachments

Last edited:
The files that are "Not Signed" -

Code: 
acpipagr.sys             10/30/2015     None                Not Signed          N/A               
basicdisplay.sys         10/30/2015     10.0.10586.0        Not Signed          N/A               
cdrom.sys                10/30/2015     10.0.10586.0        Not Signed          N/A               
intelppm.sys             10/30/2015     10.0.10586.0        Not Signed          N/A               
kbdhid.sys               10/30/2015     10.0.10586.0        Not Signed          N/A               
kdnic.sys                10/30/2015     6.1.0.0             Not Signed          N/A               
mf.sys                   10/30/2015     10.0.10586.0        Not Signed          N/A               
monitor.sys              10/30/2015     10.0.10586.0        Not Signed          N/A               
mouhid.sys               10/30/2015     10.0.10586.0        Not Signed          N/A               
mskssrv.sys              10/30/2015     10.0.10586.0        Not Signed          N/A               
mspclock.sys             10/30/2015     10.0.10586.0        Not Signed          N/A               
mspqm.sys                10/30/2015     10.0.10586.0        Not Signed          N/A               
mstee.sys                10/30/2015     10.0.10586.0        Not Signed          N/A               
ndisvirtualbus.sys       10/30/2015     10.0.10586.0        Not Signed          N/A               
tunnel.sys               10/30/2015     10.0.10586.0        Not Signed          N/A               
umbus.sys                10/30/2015     10.0.10586.0        Not Signed          N/A               
umpass.sys               10/30/2015     10.0.10586.0        Not Signed          N/A               
wmiacpi.sys              10/30/2015     10.0.10586.0        Not Signed          N/A

All files with version number 10.0.10586.0 + kdnic.sys (version 6.1.0.0) are in fact Microsoft Windows OS related drivers and should be signed.

I am unsure at this time as to what happened to cause them to be "Not Signed" or what the remedy is to get them signed.

Have you run sfc /scannow ?

Regards. . .

jcgriff2
 
Last edited:
It looks like the system crashes every time it's trying to load npsvctrig.sys, Driver Reference Table (DRT) | npsvctrig.sys

I think it's best if we let someone of the WU team have a look at this.
Code: 
0: kd> knL; !dpx
 # Child-SP          RetAddr           Call Site
00 ffffd000`4bd1b948 fffff803`357afab7 nt!KeBugCheckEx
01 ffffd000`4bd1b950 fffff803`359576cf nt! ?? ::NNGAKEGL::`string'+0x4b837 <-- nt!IopLoadDriver
02 ffffd000`4bd1bb20 fffff803`359697fa nt!IopInitializeSystemDrivers+0x137
03 ffffd000`4bd1bbb0 fffff803`35734712 nt!IoInitSystem+0x16
04 ffffd000`4bd1bbe0 fffff803`35242f7d nt!Phase1Initialization+0x2a
05 ffffd000`4bd1bc10 fffff803`35352aa6 nt!PspSystemThreadStartup+0x41
06 ffffd000`4bd1bc60 00000000`00000000 nt!KiStartSystemThread+0x16
Start memory scan  : 0xffffd0004bd1b948 ($csp)
End memory scan    : 0xffffd0004bd1c000 (Kernel Stack Base)

               rbx : 0xffffe00085670340 :  !du "\Driver\npsvctrig"
                r8 : 0xffffe00085670340 :  !du "\Driver\npsvctrig"
                r9 : 0xffffc001b43a7370 :  !du "\SystemRoot\System32\drivers\npsvctrig.sys"
0xffffd0004bd1b960 : 0xffffe00085670340 :  !du "\Driver\npsvctrig"
0xffffd0004bd1b968 : 0xffffc001b43a7370 :  !du "\SystemRoot\System32\drivers\npsvctrig.sys"
0xffffd0004bd1b988 : 0xfffff8033543d6da : nt!ExDeferredFreePool+0xf2a
0xffffd0004bd1b9a8 : 0xffffc001b43a7370 :  !du "\SystemRoot\System32\drivers\npsvctrig.sys"
0xffffd0004bd1b9c0 : 0xffffc001b3932620 :  !du "npsvctrig"
0xffffd0004bd1b9e0 : 0xffffe00085670340 :  !du "\Driver\npsvctrig"
0xffffd0004bd1bab0 : 0xfffff80335979340 :  !du "DependOnGroup"
0xffffd0004bd1bab8 : 0xfffff803356714d8 : nt!IopGetRegistryValue+0xe0
0xffffd0004bd1bac8 : 0xfffff8033595891e : nt!PipCheckDependencies+0x26
0xffffd0004bd1bb18 : 0xfffff803359576cf : nt!IopInitializeSystemDrivers+0x137
0xffffd0004bd1bb88 : 0xfffff803355a3010 : nt!KiSystemStartup
0xffffd0004bd1bb98 : 0xfffff803357346e8 : nt!Phase1Initialization
0xffffd0004bd1bba8 : 0xfffff803359697fa : nt!IoInitSystem+0x16
0xffffd0004bd1bbd8 : 0xfffff80335734712 : nt!Phase1Initialization+0x2a
0xffffd0004bd1bbf0 : 0xfffff803357346e8 : nt!Phase1Initialization
0xffffd0004bd1bc08 : 0xfffff80335242f7d : nt!PspSystemThreadStartup+0x41
0xffffd0004bd1bc50 : 0xfffff8033559d740 : nt!KiInitialThread
0xffffd0004bd1bc58 : 0xfffff80335352aa6 : nt!KiStartSystemThread+0x16
0xffffd0004bd1bc60 : 0xfffff80335527180 : nt!KiInitialPCR+0x180
0xffffd0004bd1bc70 : 0xfffff80335242f3c : nt!PspSystemThreadStartup
 
I agree it seems the crux of the problem is those drivers. I suspect it's a symptom of something deeper, however. I can't entirely rule out an issue with secure boot setting in the machine's BIOS, but toggling between enabled and disabled settings doesn't seem to change the outcome. I'm pretty sure the BIOS settings originally had secure boot enabled. In later versions of Windows there appears to be a secure boot option to toggle, don't see it in this version. Perhaps there's a descriptor somewhere that causes things not to match? I've looked high and low but just don't know where to go from here except to use a torch and matches

Yes, I've tried SFC and DISM multiple times, in particular after trying several times to use the version 10586 ISO. The result is always the same, BSOD's and unsigned Microsoft Drivers.

I am performing trouble-shooting on an SSD containing the image of the original SSD, unfortunately made (too late) after the BSOD's began all of a sudden on 12/26/18. Naturally, multiple unsigned Microsoft drivers was immediately apparent.

I could only find one thread resembling this situation and suggesting a copy-paste operation of certain driver store components from another machine at the same software version. Unfortunately, I don't have one as all my other machines are at the latest version of Windows.

Naturally, I'm not entirely out of options. The last automated full backup point is July 2016, so I may have to drop way back if all else fails, but that also could fail. Starting with a fresh recent build could also happen.

I'll have a look also at npsvctrig.sys,

Thank you!

Rich
 
Please also do the following:

Step 1 - DISM /Get-Drivers


  1. Right-click on the Start button and select Command Prompt (Admin)
  2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter

    Dism /Online /Get-Drivers

  3. When DISM finishes, zip up and attach your DISM log to your next post:

    C:\Windows\Logs\DISM\DISM.log

    and

    C:\Windows\Logs\CBS\CBS.log
 
Okay, DISM was able to access the hive, which means it is not corrupt. Can you please retry upgrading to the latest version of Windows and if it fails, provide the following logs:

C:\Windows.~bt\Sources\Panther\SetupAct.log and SetupErr.log
 
Please hold on this problem for right now.

I've successfully recovered the July 2016 backup from my WHS2011 system, installed it, and now have a fully operational Windows 10 Pro, 10586 1511 system on the affected hardware. Sigverif.exe reports all drivers (including those mentioned above) are properly verified and a restore point made. No issues.

I read over the last month that NVIDIA drivers may have caused some problems with upgrading. I briefly loaded a 980 GPU in there earlier on and removed it, leaving the drivers prior to the upgrade failure. So, today I uninstalled all the NVIDIA drivers and apps from the recovered image and then initiated upgrade to the newest Windows 10, version 1801 via the ISO.

The upgrade is already well past anything I'd seen previously, so I'm betting it's going to complete just fine. I'll know in a few hours.

Meanwhile, hold off on my problem!

Thanks again!
Rich
 
The update almost completed but instead conferred the good old "0C1900101 - 0X4000D" "The installation failed in the "SECOND_BOOT" phase with an error during MIGRATE_DATA operation".

No WIFI adapter to cause an issue so I'll experiment a bit.

Rich
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top