Intermittent BSOD only during startup - Win 7

Bluechills · Nov 11, 2012

My BSOD problem is a little different from others I've read.
For the past 6 months, I'll get BSODs only during startup, always a few seconds into the "Starting Windows" window. It always refers to atikmdag.sys, and always claims to have saved a number of dumps. I've never been able to locate those dump files. (For a typical BSOD, see 01_Startup_BSOD.JPG) This happens intermittently, about 50% of the time. I've been unable to predict when it will BSOD and when it boot properly. It may BSOD only once, or it might do it 20 times in a row.

Attached are the files requested, plus a few others.

I've worked ahead to the Driver Verifier. Maybe its behavior will provide a clue.
Following the instructions, I created a restore point.
After setting Driver Verifier as instructed, then rebooting, the system consistently blue screened at the usual time (a few seconds into the "Starting Windows" window) but producing a different error message:
IRQL_NOT_LESS_OR_EQUAL...
(see screen pic, 02-BSOD_after_setting_Driver_Verifier.jpg)

I then booted into Safemode and attempted to restore to the point created prior to setting Driver Verifier. Restore failed, with this message:
System Restore failed to extract the original copy of the directory from the restore point.
Source: %SystemRoot%\registration
Destination: ComPlusStaging
I then attempted to restore to the next older point. Again, Restore failed with the same error message.

Out of curiosity, I started Verifier. Its setting windows are shown in jpegs 03 - 06.
Guessing that Verifier's settings may be preventing me from booting normally, I issued "verifier \reset" in a DOS window. btw - Verifier saved no dump files in C:\Windows\Minidump.
I restarted and the system booted normally into Windows. During the boot, Windows displayed a message stating the restore did not properly complete. From within the normally booted Windows, I again attempted restoring to the same two points as I'd tried before. Both resulted in the same "...failed to extract..." message as earlier.

I've also run Memtest86 from a cold start, 3 passes, no errors. I'll run more Memtests and the disk diags, posting the results.

Your help is VERY much appreciated!

System Info -
· OS - Windows 7
· x64
· What was original installed OS on system? This is the original OS
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? OEM
· Age of system (hardware) 2 years old
· Age of OS installation - have you re-installed the OS? Original OS

· CPU - Intel Core i5-760 2.8 GHz Quad-core Processor
· Video Card - VisonTek Radeon HD 6850
· MotherBoard - Asus P7P55D-E-Pro
· Power Supply - 750W Silverstone Strider Plus Modular

· System Manufacturer - Maingear
· Exact model number - F131 P55

Memory - 8GB (2x4GB) Crucial DDR3-1333

jcgriff2 · Nov 12, 2012

Hi -

Your screenshot of the VERIFIER_ENABLED BSOD as well as the most recent 3 BSODs all named ATI Video -

Code:

[font=lucida console]atikmdag.sys       Thu Sep 27 22:14:57 2012 (50650821)
atikmpag.sys       Thu Sep 27 21:12:52 2012 (5064F994)[/font]

http://www.sysnative.com/drivers/driver.php?id=atikmdag.sys
http://www.sysnative.com/drivers/driver.php?id=atikmpag.sys

Check for updated drivers.

As for system restore - run this command -
START | type cmd.exe | RIGHT-click on cmd.exe | "Run as Administrator" | paste -

Code:

dir /a /q %systemroot%\registration >0 & start notepad 0

A Notepad will open. Attach to next post.

My system output:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>[B]dir /a /q %systemroot%\registration[/B]
 Volume in drive C is Windows7 x64
 Volume Serial Number is 289F-AF69

 Directory of C:\Windows\registration

06/08/2012  03:02    <DIR>          BUILTIN\Administrators .
06/08/2012  03:02    <DIR>          NT SERVICE\TrustedInsta..
07/13/2009  21:34    <DIR>          BUILTIN\Administrators CRMLog
06/10/2009  15:34            22,588 NT AUTHORITY\SYSTEM    R000000000001.clb
03/03/2012  19:09         1,048,576 NT AUTHORITY\SYSTEM    {02D4B3F1-FD88-11D1-960D-00805FC79235}.
{1D629AE3-1E23-4DD5-A495-F8937307BC4A}.crmlog
               2 File(s)      1,071,164 bytes
               3 Dir(s)   8,493,629,440 bytes free

C:\Windows\system32>

Regards. . .

jcgriff2

BSOD SUMMARY

Code:

[font=lucida console]
Debug session time: Sun Nov 11 14:28:37.946 2012 (GMT-5)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\111112-24258-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:24.273
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
BugCheck 1000007E, {ffffffffc0000094, fffff880050952cf, fffff8800417e238, fffff8800417da90}
Probably caused by : atikmdag.sys ( atikmdag+80a2cf )
Bugcheck code 1000007E
Arguments: 
Arg1: ffffffffc0000094, The exception code that was not handled
Arg2: fffff880050952cf, The address that the exception occurred at
Arg3: fffff8800417e238, Exception Record Address
Arg4: fffff8800417da90, Context Record Address
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x7E
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+80a2cf
MaxSpeed:     2800
CurrentSpeed: 2808
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov 11 14:15:51.993 2012 (GMT-5)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\111112-24102-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:24.320
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
BugCheck 1000007E, {ffffffffc0000094, fffff8800505f2cf, fffff88005ff5238, fffff88005ff4a90}
Probably caused by : atikmdag.sys ( atikmdag+80a2cf )
Bugcheck code 1000007E
Arguments: 
Arg1: ffffffffc0000094, The exception code that was not handled
Arg2: fffff8800505f2cf, The address that the exception occurred at
Arg3: fffff88005ff5238, Exception Record Address
Arg4: fffff88005ff4a90, Context Record Address
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x7E
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+80a2cf
MaxSpeed:     2800
CurrentSpeed: 2808
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov 11 00:39:04.369 2012 (GMT-5)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\111112-24180-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:23.696
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
BugCheck 1000007E, {ffffffffc0000094, fffff880050ad2cf, fffff88002e54238, fffff88002e53a90}
Probably caused by : atikmdag.sys ( atikmdag+80a2cf )
Bugcheck code 1000007E
Arguments: 
Arg1: ffffffffc0000094, The exception code that was not handled
Arg2: fffff880050ad2cf, The address that the exception occurred at
Arg3: fffff88002e54238, Exception Record Address
Arg4: fffff88002e53a90, Context Record Address
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x7E
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+80a2cf
MaxSpeed:     2800
CurrentSpeed: 2808
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov  4 22:15:58.017 2012 (GMT-5)
Loading Dump File [C:\Users\PalmDesert\SysnativeBSODApps\110412-49920-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:48.344
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
BugCheck 1000007E, {ffffffffc0000094, fffff880050c82cf, fffff88002bc1238, fffff88002bc0a90}
Probably caused by : atikmdag.sys ( atikmdag+80a2cf )
Bugcheck code 1000007E
Arguments: 
Arg1: ffffffffc0000094, The exception code that was not handled
Arg2: fffff880050c82cf, The address that the exception occurred at
Arg3: fffff88002bc1238, Exception Record Address
Arg4: fffff88002bc0a90, Context Record Address
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x7E
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+80a2cf
MaxSpeed:     2800
CurrentSpeed: 2808
BiosVersion = 1602   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


         
       [color=#000033]J. C. Griffith, Microsoft MVP (jcgriff2)[/color]   
             
           [url=http://mvp.microsoft.com/profiles/Griffith][color=#000055][u]https://mvp.support.microsoft.com/profile/Griffith[/u][/color][/url]   

           [url=https://www.sysnative.com/forums/member.php/1-jcgriff2][color=#000033][u]jcgriff2 - Sysnative Forums[/u][/color][/url]
             
           [url=http://jcgriff2.com][color=#000055][u][url]www.jcgriff2.com[/url][/u][/color][/url] 


¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨


  [/FONT]

Vir Gnarus · Nov 13, 2012

I did notice in the screenshot for one of your crashes - as well as most your crashdumps - show the error code that caused the crash was c0000094, which means integer divide by 0. I can't figure through disassembly what's going on as it's doing a lot of math, but it appears evident it's coming straight from the ATI driver. However, if this has been happening consistently for 6 months, and despite driver updates it still is recurring, I'd have to point finger at the video card itself, as usually it's been either the driver or the card that does division by zero errors.

What confuses me is that this issue is awfully consistent, with it occurring every time at the same piece of code in the graphics driver. It did start happening before you updated your graphics driver to September, however, so I can't blame the most recent driver you have for this, though it's still best to update it.

I recommend a few things beyond what JC has already mentioned. First, strip your system of all motherboard software. I noticed you have AiCharger amongst other things. These gimmicky apps have a high propensity for causing system instability, and often manifest themselves as hardware-based errors. Use Driver Sweeper (free) if necessary to ensure they're all cleaned up, as they have a tendency of leaving stuff behind due to their buggy uninstallers. You'll want to only keep drivers that are related specifically to motherboard components to ensure that they function, any extraneous stuff must go. While you're at it, update your BIOS and mobo drivers, as they're looking relatively old (BIOS itself is from 12/14/2010).

As for my initial speculation, I'm going on this either being a problem with that motherboard software, or a bad CPU/GPU.

Bluechills · Nov 20, 2012

J. C.,

First - The output from your requested command of,
dir /a /q %systemroot%\registration >0 & start notepad 0
can be found in the file,
OUTPUT FROM dir _a _q %systemroot%_registration _0 & start notepad 0.txt
But, to save you time, there is no directory named Windows\registration

Back to your first suggestion - Back in Sept. I'd let Catalyst Control Center's autoupdate run to update the ATI graphics drivers to the new released version. Despite its claim that everything had updated correctly, and on the chance that something may not have updated properly, and the suggestion mentioned in your first link to uninstall Catalyst Control Center; I planned a clean install of the graphics drivers.

Immediately after starting the uninstall of Catalyst Control Center, I got the typical BSOD listing atikmdag.sys as culprit. I could no longer boot into normal Windows so, ended up uninstalling the graphics drivers from within Device Manager while in SAFEMODE. Following that, I was able to uninstall Catalyst Control Center.

Re-installing the drivers only, was another nightmare. Their installation program offered no option to install drivers without installing Catalyst Control Center. (I'd swear that was an option in the past) Anyhow, I was able to locate the folders where the drivers had been unpacked, so installed them by pointing to them from within Device Manager. Now, I am certain I've got the latest graphics drivers, and without Catalyst Control Center.

Hoping that might have solved the problem, I rebooted and still received the same BSOD.

I was about to give you the good news when I noticed the suggestions from Vir.

Vir,

I removed all extraneous ASUS motherboard stuff I could find. (I also uninstalled a bunch of other programs I'd not used in a long time)

There was a new BIOS released a couple of months ago. The only description about the update said it fixed an issue with large drive sizes when used in a RAID setups. Since I don't have a RAID setup, I'd decided at the time not to perform the update.

Today however, on the chance that the update included additional minor fixes that'd been left out of the documentation, (and that I'll try about anything at this point) I decided to update to the latest version. I now have the latest BIOS ver 1703.

Unfortunately, I still get the same BSODs.

(Did I mention earlier that even though each BSOD claims to have saved a dump, actually only about 1 out of 10 ever save anything in the \Minidump folder)

Interesting about the divide by 0 errors.

I ran a new BSOD file collection and attached to this post.

Unless either of you notice something new, I'm prepared to order a replacement graphics card. This time I may switch from ATI to Nvidia, though I've experienced issues with both in the past.

A semi-related question -
I mentioned that I'd uninstalled a number of under-used programs. Now I notice that autoruns.exe lists a number of registry entries refering to files that no longer exist. I've read that I should manually delete those entries. I've also read that I should leave them alone, Windows will cull them out of its own accord. Is either correct?

Many thanks to you both for your help!

writhziden · Nov 20, 2012

I notice these that should be updated:

nusb3hub.sys Thu Jan 21 20:22:18 2010 (4B5919EA)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010 version)
http://www.carrona.org/drivers/driver.php?id=nusb3hub.sys

nusb3xhc.sys
Thu Jan 21 20:22:21 2010 (4B5919ED)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010
version)
http://www.carrona.org/drivers/driver.php?id=nusb3xhc.sys

As you see in the description, the 2010 version is known to cause problems. They may not be related to the display card driver issue you face, but it is a good idea to update them.

Other than that, the recent crash follows the same pattern as previous crashes.

Addressing your concern about the registry: There is no need to delete those entries. If you are concerned about it, you are better off adjusting them in autoruns, but you won't see a performance change either way. Some good reading in this regard: The Assumptions You Make About Your Slow PC (and Why They’re Probably Wrong)

Intermittent BSOD only during startup - Win 7

Bluechills

New member

jcgriff2

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)

Vir Gnarus

BSOD Kernel Dump Expert

Bluechills

New member

writhziden

Administrator, .NET/UWP Developer

Intermittent BSOD only during startup - Win 7

Bluechills

New member

jcgriff2

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Vir Gnarus

BSOD Kernel Dump Expert

Bluechills

New member

writhziden

Administrator, .NET/UWP Developer

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)