Vista Tutorial - Vista BSOD while starting up every 3-4 times

Hi

Since March that I bought a new Toshiba U305-S2804
loaded with Vista Home Premium, I have a recurring startup BSOD.

Every 3 - 4 times I start the machine it crahses.

The blue screen disappears fast,
so I cannot give much info about what is in there
(is there a way to freeze this ?).

Anyway I decided (it takes some time to decide
to attack windows problems...) to check the system diagnostics
and there are a number of them.

I try to "target" the most frequent system errors assuming that
they might be the cause or at least give a hint about it.


I see in the system log a number of EventID=13, Source=ACPI.
They seem to happen daily and even more that once a day.

Also I see a lot of EventID=4385, Source=Servicing,
but they don't show up after April, it seems that some
Windows update fixed this.

Then I have a number of EventId=5007, Source=WerSvc.

Does any of the above, seem to be possibly the source of a BSOD
during starting up ?

Thank you in advance,
mesa

Hi again,

I will ad some info, might be relevant.

Checking some other errors I bumped onto s system restore / shadow copy issue.

Now the VSSADMIN prints the following info

Shadow Copy Storage association
For volume: (C\\?\Volume{930d6935-de00-11dc-9cbc-806e6f6e6963}\
Shadow Copy Storage volume: (C\\?\Volume{930d6935-de00-11dc-9cbc-806e6f6e6963}\
Used Shadow Copy Storage space: 20.984 GB
Allocated Shadow Copy Storage space: 21.773 GB
Maximum Shadow Copy Storage space: 22.138 GB


That looks like a lot of storage just for restore points.
I assume that since I have Vista Home Premium I have no shadow copies.

Anyway I counted 26 restore points available when I try to restore from
an older restore point. So 20GB used for 26 restore points, is aounr 800MB
per restore point.
Is that reasonable ?

Is it possible that the limit of this disk space might create the BSOD.
Personally I don't see the connection but who am I to judge the
"greatness" of Vista

mesa

Hi Mesa,

The size of VSS doesnt matter because Vista automatically adjusts it as needed

To disable automatic restart so we can start to figure out why your getting a BSOD, press WINDOWS KEY + PAUSE/BREAK to load the System Properties Dialog (you can also access this via the Control Panel > System). Then click on "Advanced Settings":


Then, select Settings in the "Startup and Recovery" area:


This will load the Startup and Recovery window, allowing you to untick the Automatically Restart box and then click OK:



Next time your have a crash in Windows Vista, your PC will not automatically reset and you will be able to view the error message. just write down the Error Code and post it here and I will lookup the cause

Steven

Thank you Steven for your suggestion. I applied it and wait for the next BSOD.

Now it's four time in a row that the machine boots OK.
I had a really wild idea that something might be wrong during shutdown.
I usually use the computer through a personal account that is
in the admin group, but there is also the admin account that
there was in the Vista as installed.
So last 4 times I log off from my account, log on to admin
and then shut down.

It takes some more days to see if this solves the problem
for some reason....

mesa

you should not be logging in to that built in Administrator account unless you *really really need* to - a BSOD is not a really really need to situation - being locked out of your other account(s) is.

Then yesterday I forgot to log out from Admin and today I got a BSOD.

Here are the BSOD data

The usual text
"A problem has been ....."
"A thread tried to release a resource it did not own"
"...."

STOP: 0x000000E3 (0x80603DE0, 0x8384660, 0x00000000, 0x00000002)
Ci.dll - Address 80603DE0 base at 80539000, DateStump 47ba6222

---------------------------------------------------------------

Is it possible that this is caused b antivirus software ?
I have installed the free version of AVG. The auto update feature
though never managed to keep the settings and work properly.
I always have to do a manual update. But apart from that
it seems to work OK.

@johngalt
Could you please elaborate on why is so really really bad
to work from the Administrator account. As far as I understand
(and it's obviously not that far) this account has some extra
permissions. But you can get these by launching a command tool
with admin permission from other accounts.
So what is the extra gain / protection ?

I post the installed programs as shown in the control panel so that
you might get some idea who is the "bad guy".

Two jpegs as attachments.

mesa

[IMG]file:///C:/Documents%20and%20Settings/msam/Desktop/toshiba_pograms_1l.jpg[/IMG]

ci.dll is a Vista OS file.
It is used for code integrity.
More Info can be found here;

Things just keep getting interestinger... - Wilders Security Forums

What I understand from the ci.dll references I read about
some checking of the windows components that are loaded
during startup is performed by CI.DLL. It seems it is a
checking that the files are indeed the ones they are supposed
to be, signatures, hash keys and the like.

So i gather during this checking the CI.DLL crashes
because it releases a resource it does not own.

I suppose that might be some infected or plain "wrong" file
that CI.DLL cannot check properly and boooom.

I uninstalled my antivirus (AVG free) and installed the
AVAST free to see if I will get some different virus scan results
but nothing. 500K of files clean ...

I believe that the key is the periodic nature of this fault.
It does not happen every time, but every 3-4 times.
But I am not sure what to look for, or what to log
so that my sleuthing can continue.

Any ideas would be much appreciated.

mesa

Some more info that might be of help.

Checking the event logs recent errors/warnings that are happening frequently


1530:
-----
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1389560047-2788015056-724000479-1000_Classes:
Process 1048 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1389560047-2788015056-724000479-1000_CLASSES


13:
-----
: The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.

5007
-----
The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.

7026
-----
The following boot-start or system-start driver(s) failed to load:
Cdr4_xp

7000
-----
The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

(these to 7026, 7000 seem to be related, some time there a list of 10 different
drivers that fail to start...that makes me uneasy! but it might be when I boot in
safe mode ?)

That cdr4_xp is a file needed by optical drivers I think.