BSOD while booting. Bugcheck code: 0x5A It can be opened using Safemod

Page 1 of 2 12 LastLast

  1. Posts : 6
    Windows 10 64 bit
       #1

    BSOD while booting. Bugcheck code: 0x5A It can be opened using Safemod


    Hi,

    I have a 4 years old i7 3820 PC. 16 GB RAM, GTX 1070 graphics card. Asus P79Pro mainboard.

    It was running fine until two days ago, after the latest Microsoft update installation, and required restart, it could not restart, but I have faced a BSOD. KB4040724.

    I didn't see any BSODs with this computer before, I checked SSD, it seems it doesn't have any bad sector or problem.

    It can be started in safe mode, without any problem, I already updated video driver. Here are the minidumps.

    Attachment 155364

    I don't want to install Windows from scratch. Because tons of applications would need to be reinstalled.

    I don't overclock. And I didn't install anything new.

    Any ideas?
      My Computer


  2. Posts : 545
    seL4
       #2

    Hi Falcon291,

    Please follow the posting instructions for the BSOD forum. It will give us more information about your system and potentially what is going wrong. I'd also suggest you compress and upload C:\Windows\MEMORY.dmp to onedrive/googledrive/dropbox/whatever, and post a link here. The larger memory dump will provide us more information about the crash.

    That said, I did look at the crash dumps you posted. I found some references to file encryption, which may be due to the system writing the crash dumps to the disk, but it may imply there is a problem with your drive or the drive encryption you are using.

    I also see that you have SYMEFASI64.sys (Symantec Extended File Attributes driver) loaded, I would suggest (temporarily) removing Symantec/Norton security entirely. If you cannot normally boot into Windows because it bluescreens too quickly, go into Safe Mode as you've done before.

    To run the uninstaller you'll need to allow the installer service to run, and it is disabled by default in Safe Mode. Here is a nice guide by Symantec to enable it.

    Code:
    Start memory scan  : 0xffff9881bb228928 ($csp)
    End memory scan    : 0xffff9881bb229000 (Kernel Stack Base)
    
                   rbx : 0xffffb006b4147c00 :  !du "\FileSystem\FileCrypt"
                   rsi : 0xfffff800d55e8c40 : 0xfffff800d55e8cc0 : nt!IopDatabaseResource
                    r8 : 0xffffb006b4147c00 :  !du "\FileSystem\FileCrypt"
                    r9 : 0xffffd209bc1a92e0 :  !du "\SystemRoot\SysWow64\drivers\filecrypt.sys"
    0xffff9881bb228940 : 0xffffb006b4147c00 :  !du "\FileSystem\FileCrypt"
    0xffff9881bb228948 : 0xffffd209bc1a92e0 :  !du "\SystemRoot\SysWow64\drivers\filecrypt.sys"
    0xffff9881bb228968 : 0xfffff800d5502bb7 : nt!ExAllocatePoolWithTag+0x817
    0xffff9881bb228990 : 0xffffd209bc1a92e0 :  !du "\SystemRoot\SysWow64\drivers\filecrypt.sys"
    0xffff9881bb2289a8 : 0xffffd209bbe445c0 :  !du "FileCrypt"
    0xffff9881bb2289c0 : 0xffffb006b4147c00 :  !du "\FileSystem\FileCrypt"
    0xffff9881bb228aa0 : 0xfffff800d550c2b8 :  !du "DependOnGroup"
    0xffff9881bb228ab8 : 0xfffff800d5a62ee2 : nt!PipCheckDependencies+0x26
    0xffff9881bb228b08 : 0xfffff800d5a61bdb : nt!IopInitializeSystemDrivers+0x137
    0xffff9881bb228b38 : 0xfffff800d550fd20 :  !du "\Security\TRKWKS_EVENT"
    0xffff9881bb228b48 : 0xfffff800d5aad8d0 : nt!IoInitSystem_deviceNameBuffer
    0xffff9881bb228b68 : 0xffffd209bbb850a0 :  !du ""FSFilter Encryption""
    0xffff9881bb228b88 : 0xfffff800d5683010 : nt!KiSystemStartup
    0xffff9881bb228b90 : 0xfffff800d3a55300 :  !du ""American Megatrends - 4028D""
    0xffff9881bb228b98 : 0xfffff800d582f470 : nt!Phase1Initialization
    0xffff9881bb228ba8 : 0xfffff800d5a78a8e : nt!IoInitSystem+0x16
    0xffff9881bb228bd8 : 0xfffff800d582f4ac : nt!Phase1Initialization+0x3c
    0xffff9881bb228bf0 : 0xfffff800d582f470 : nt!Phase1Initialization
    0xffff9881bb228c08 : 0xfffff800d535ff77 : nt!PspSystemThreadStartup+0x47
    0xffff9881bb228c50 : 0xfffff800d567ca40 : nt!KiInitialThread
    0xffff9881bb228c58 : 0xfffff800d53f4a06 : nt!KiStartSystemThread+0x16
    0xffff9881bb228c70 : 0xfffff800d535ff30 : nt!PspSystemThreadStartup
      My Computer


  3. Posts : 6
    Windows 10 64 bit
    Thread Starter
       #3

    As requested I have created the file requested in BSOD Posting Instructions
    Attachment 155499

    This file was taken while the computer was started in Safe Mode, otherwise it does not start but ends up with BSOD.

    I am trying to get a large memory dump, if I can get it. My system drive is an SSD, thus I need to uninstall some programs first.

    By the way I successfully uninstalled Norton, and I don't use any encryption in my computer. I also suspect SSD failure, chkdsk once found something, but when I repeated it when the system drive is offline, it was OK.

    Regards,
      My Computer


  4. Posts : 545
    seL4
       #4

    Another thing you may want to try is to open up msconfig, go to the "Boot" tab and enable "Boot log" and "Os boot information".

    It looks like the problem is caused when the OS tries to load a driver. The boot log option will place ntbtlog.txt in C:\Windows, try booting (not in safe mode) after setting those options, then if it still crashes, go back into safe mode and copy that file and post it here.

    It would also be a good idea to run an error scan with HDTune, any badblocks would be a sign of a failing disk.
      My Computer


  5. Posts : 41,413
    windows 10 professional version 1607 build 14393.969 64 bit
       #5

    These boot-start drivers had failed to load:

    Code:
    Event[56171]:  Log Name: System  Source: Service Control Manager  Date: 2017-09-28T22:45:06.397  Event ID: 7026  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: FALCON_DESKTOP  Description: The following boot-start or system-start driver(s) did not load: AsIOAsUpIOdameeCtrlEhStorClassFileCryptGpuEnergyDrvnpsvctrigVBoxDrvVBoxUSBMon
    Code:
    Event[56172]:  Log Name: System  Source: Microsoft-Windows-WER-SystemErrorReporting  Date: 2017-09-28T22:45:10.774  Event ID: 1018  Task: N/A  Level: Information  Opcode: N/A  Keyword: Classic  User: N/A  User Name: N/A  Computer: FALCON_DESKTOP  Description: The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.
    Consider uninstalling applications that are no longer used or updating these non-Microsoft boot-start drivers:

    AsUpIO.sys ASUS hardware monitoring software related http://support.asus.com/download/dow...Language=en-us
      My Computer


  6. Posts : 6
    Windows 10 64 bit
    Thread Starter
       #6

    1. I did try boot log, but it didn't create any file. The crash seems happening before logging started.
    2. Scandisk says that my SSD is OK. But I will install and run HDTune. Thanks
    3. I already removed Norton, for the next step, I will try to remove Asus PcProbe, and then if it does not work VirtualBox.
    4. I tried to get MEMORY. Dmp. I got it, however it got deleted after the next restart, I will again try it.

    Nevertheless I am inclined to change the SSD. It is already 4 years old. I want to solve the problem, but at the same time I don't want to spare more time on it. I will keep you updated.
      My Computer


  7. Posts : 545
    seL4
       #7

    Before going out and purchasing a new SSD, you may want to at least try Resetting Windows 10 first.
      My Computer


  8. Posts : 6
    Windows 10 64 bit
    Thread Starter
       #8

    Spectrum said:
    Before going out and purchasing a new SSD, you may want to at least try Resetting Windows 10 first.
    Of course, but it was already small, and I needed an excuse.:)
    I bought the SSD, but I am now trying to resolve the problem first.
      My Computer


  9. Posts : 41,413
    windows 10 professional version 1607 build 14393.969 64 bit
       #9

    To check the integrity of the operating system and drive file system open administrative command prompt and type:
    1) sfc /scannow
    2) dism /online /cleanup-image /restorehealth
    3) chkdsk /x /f /r (this may take hours so plan to run overnight)
    4) to find and post the chkdsk report:
    Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials
      My Computer


  10. Posts : 6
    Windows 10 64 bit
    Thread Starter
       #10

    Thank you very much.

    The problem just resolved. It was corrupted filecrypt.sys.

    Its copy was also corrupted, so I copied it from my laptop, and now it resolved.

    I don't know why and how it was corrupted. The SSD seems fine. I will closely observe it for a few days.

    Regards,
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:06.
Find Us




Windows 10 Forums