Vista BSOD while starting up every 3-4 times

[mesa]

Hi

Since March that I bought a new Toshiba U305-S2804
loaded with Vista Home Premium, I have a recurring startup BSOD.

Every 3 - 4 times I start the machine it crahses.

The blue screen disappears fast,
so I cannot give much info about what is in there
(is there a way to freeze this ?).

Anyway I decided (it takes some time to decide
to attack windows problems...) to check the system diagnostics
and there are a number of them.

I try to "target" the most frequent system errors assuming that
they might be the cause or at least give a hint about it.


I see in the system log a number of EventID=13, Source=ACPI.
They seem to happen daily and even more that once a day.

Also I see a lot of EventID=4385, Source=Servicing,
but they don't show up after April, it seems that some
Windows update fixed this.

Then I have a number of EventId=5007, Source=WerSvc.

Does any of the above, seem to be possibly the source of a BSOD
during starting up ?

Thank you in advance,
mesa

 

[mesa]

Hi again,

I will ad some info, might be relevant.

Checking some other errors I bumped onto s system restore / shadow copy issue.

Now the VSSADMIN prints the following info

Shadow Copy Storage association
For volume: (C\\?\Volume{930d6935-de00-11dc-9cbc-806e6f6e6963}\
Shadow Copy Storage volume: (C\\?\Volume{930d6935-de00-11dc-9cbc-806e6f6e6963}\
Used Shadow Copy Storage space: 20.984 GB
Allocated Shadow Copy Storage space: 21.773 GB
Maximum Shadow Copy Storage space: 22.138 GB


That looks like a lot of storage just for restore points.
I assume that since I have Vista Home Premium I have no shadow copies.

Anyway I counted 26 restore points available when I try to restore from
an older restore point. So 20GB used for 26 restore points, is aounr 800MB
per restore point.
Is that reasonable ?

Is it possible that the limit of this disk space might create the BSOD.
Personally I don't see the connection but who am I to judge the
"greatness" of Vista

mesa

 

[dmex]

Hi Mesa,

The size of VSS doesnt matter because Vista automatically adjusts it as needed

To disable automatic restart so we can start to figure out why your getting a BSOD, press WINDOWS KEY + PAUSE/BREAK to load the System Properties Dialog (you can also access this via the Control Panel > System). Then click on "Advanced Settings":


Then, select Settings in the "Startup and Recovery" area:


This will load the Startup and Recovery window, allowing you to untick the Automatically Restart box and then click OK:



Next time your have a crash in Windows Vista, your PC will not automatically reset and you will be able to view the error message. just write down the Error Code and post it here and I will lookup the cause

Steven

 

[mesa]

Thank you Steven for your suggestion. I applied it and wait for the next BSOD.

Now it's four time in a row that the machine boots OK.
I had a really wild idea that something might be wrong during shutdown.
I usually use the computer through a personal account that is
in the admin group, but there is also the admin account that
there was in the Vista as installed.
So last 4 times I log off from my account, log on to admin
and then shut down.

It takes some more days to see if this solves the problem
for some reason....

mesa

 

[johngalt]

you should not be logging in to that built in Administrator account unless you *really really need* to - a BSOD is not a really really need to situation - being locked out of your other account(s) is.

 

[mesa]

Then yesterday I forgot to log out from Admin and today I got a BSOD.

Here are the BSOD data

The usual text
"A problem has been ....."
"A thread tried to release a resource it did not own"
"...."

STOP: 0x000000E3 (0x80603DE0, 0x8384660, 0x00000000, 0x00000002)
Ci.dll - Address 80603DE0 base at 80539000, DateStump 47ba6222

---------------------------------------------------------------

Is it possible that this is caused b antivirus software ?
I have installed the free version of AVG. The auto update feature
though never managed to keep the settings and work properly.
I always have to do a manual update. But apart from that
it seems to work OK.

@johngalt
Could you please elaborate on why is so really really bad
to work from the Administrator account. As far as I understand
(and it's obviously not that far) this account has some extra
permissions. But you can get these by launching a command tool
with admin permission from other accounts.
So what is the extra gain / protection ?

I post the installed programs as shown in the control panel so that
you might get some idea who is the "bad guy".

Two jpegs as attachments.

mesa

 

[roy69]

ci.dll is a Vista OS file.
It is used for code integrity.
More Info can be found here;

Things just keep getting interestinger... - Wilders Security Forums

 

[mesa]

What I understand from the ci.dll references I read about
some checking of the windows components that are loaded
during startup is performed by CI.DLL. It seems it is a
checking that the files are indeed the ones they are supposed
to be, signatures, hash keys and the like.

So i gather during this checking the CI.DLL crashes
because it releases a resource it does not own.

I suppose that might be some infected or plain "wrong" file
that CI.DLL cannot check properly and boooom.

I uninstalled my antivirus (AVG free) and installed the
AVAST free to see if I will get some different virus scan results
but nothing. 500K of files clean ...

I believe that the key is the periodic nature of this fault.
It does not happen every time, but every 3-4 times.
But I am not sure what to look for, or what to log
so that my sleuthing can continue.

Any ideas would be much appreciated.

mesa

 

[mesa]

Some more info that might be of help.

Checking the event logs recent errors/warnings that are happening frequently


1530:
-----
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-1389560047-2788015056-724000479-1000_Classes:
Process 1048 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1389560047-2788015056-724000479-1000_CLASSES


13:
-----
: The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.

5007
-----
The target file for the Windows Feedback Platform (a DLL file containing the list of problems on this computer that require additional data collection for diagnosis) could not be parsed. The error code was 8014FFF9.

7026
-----
The following boot-start or system-start driver(s) failed to load:
Cdr4_xp

7000
-----
The Parallel port driver service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

(these to 7026, 7000 seem to be related, some time there a list of 10 different
drivers that fail to start...that makes me uneasy! but it might be when I boot in
safe mode ?)

 

[Everlong]

That cdr4_xp is a file needed by optical drivers I think.

 

[mesa]

I downloaded the Microsoft Debug Diagnostic Tool to analyse the
memory dump that I have on C:/.

Interesting enough I realized that this dump is from 29 of May ...?!!
and I have had some crashes since then (just an hour ago while booting...)

But even this old one, did not produce anything, since out of 193MB
the analysis tool did not manage to find something important to
start from:
"failed to locate the PEB (Process Environment Block)"

I thought that for every BSOD a new dump is created.
The parameters in the Startup & Recovery tab
are for Kernel dump at system failure and
for overwriting existing dump files.

Why no dump file is created ?

Can this be a hint for the cause of the problem ?

mesa

 

[roy69]

Take your computer back to the shop.

 

[mesa]

@roy69
Could you please explain your proposed action ?

What do you see that is so severe ?
It has to be a HW thing...

 

[Dwarf]

Hi mesa,

I think that this should explain the reasoning behind Roy's suggestion, which I totally agree with.

You bought your PC in March. It is now August and you have had it for approximately 4 1/2 months. If you have been getting this fault from the beginning, then there is an inherent fault with the PC and it is upto the retailer to put things right. It is clearly 'not fit for purpose'. It sounds as though it could be a faulty hard drive or other component, but it is upto the retailer to determine this. S/he might offer to repair it, but you do not have to accept this if you don't want to - you can demand either a refund or replacement.

The above applies in most countries, but you will need to check the situation as regards the above in your own country, in your case Greece.

Dwarf

 

[mesa]

Thanks dwarf.

I will check with Toshiba locally, since this laptop
was purchased during a trip to the States.
You know strong Euro, weak dollar.
I makes sense unless you are unlucky as it seems in my case...

I will see what applies to these cases.

 

[mesa]

Hey guys,

It's now 4-5 days and no BSOD !!! (I am missing this...)
The last change I made after trying out the MS Diagnostic tool
is to change the settings and instead of a full memory dump
configure it for a minidump instead.

Now for some unknown reason this seems to have fixed the BSOD
for the time being!!
That is something that I can only related to disk space
required for dump and system restore if they are the same.

 

[mesa]

Hi

New chapter in the above issue...

After 20 days of no BSOD (actually the same as my summer
vacations - I suppose BSODs have summer vacations too!),
I got back to the same problem.

Now I believe the triggering event is that the day before yesterday
the computer froze while working, and I was forced to do
a hardware reset.

Nothing was installed lately apart from the latest Vista updates
that was last week I believe.

So it seems the source was not AVG, or the mini/full dump setting.

Now I noticed the following:
I created a new system restore point after getting the system up.
After the restore point was created successfully there was a LOT
of HDD activitiy, without any application running.

I launched the resource monitor and the process writing/reading
was the NT Kernel. There was no network activity at all.
The NT Kernel kept on writing mainly to C:\System Volume Information{...}
for about 8-10 minutes.

I did this two times and it happened in both cases.

Is this behavior normal ? What is the NT Kernel doing with the
System Volume Information ? I can only think of defragmentation,
but then it should not take the same time, in two consecutive runs.

Any ideas.

mesa

 

[johngalt]

it is natural, especially if you are pretty full on your allocated space for System Restore points, or if you have a disk defragmenting program (although, in hindsight, it should not be defragmenting that folder..).

Now, you say it was fine with no errors when you were on vacation - by chance did you take it somewhere else with you? Is you did, that suggests that you either have a power issue or else an Internet connection issue. I'd look at power first.