Windows 10: BSOD while booting. Bugcheck code: 0x5A It can be opened using Safemod

Hi,

I have a 4 years old i7 3820 PC. 16 GB RAM, GTX 1070 graphics card. Asus P79Pro mainboard.

It was running fine until two days ago, after the latest Microsoft update installation, and required restart, it could not restart, but I have faced a BSOD. KB4040724.

I didn't see any BSODs with this computer before, I checked SSD, it seems it doesn't have any bad sector or problem.

It can be started in safe mode, without any problem, I already updated video driver. Here are the minidumps.

Minidump.zip

I don't want to install Windows from scratch. Because tons of applications would need to be reinstalled.

I don't overclock. And I didn't install anything new.

Any ideas?

:)

 

Windows 10 issues after update from Windows 7

I somehow did the reboot into safemode with networking, but in safemode internet doesn't work so i can not be able to check for the updates in safemode too..

Thank you again for all the assistance

Are you able to open Apps in Safemode?

Try boot using Clean boot:

https://support.microsoft.com/en-us/kb/929135

 

BSOD errors bugcheck: 0x00000139

original titleaily BSOD

Hi All

I'm having BSOD errors with my PC on a daily basis.

It's only when I boot the machine for the first time, and always within the first few seconds, normally I wouldn't even get into the desktop before it crashes.

The machine then does the memory dump process, and then proceeds to boot normally.

I've reinstalled Windows, and I'm still having the same issue.

The machine has never blue screened while I've been using it, it's only on the first boot.

The only error I can see is - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000139 (0x0000000000000003, 0xffffd00024e37500, 0xffffd00024e37458, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 9e9dd043-0a15-41fa-bc08-d29f18615c3a.

I have the dump files if they're necessary.

 

Hi Falcon291,

Please follow the posting instructions for the BSOD forum. It will give us more information about your system and potentially what is going wrong. I'd also suggest you compress and upload C:\Windows\MEMORY.dmp to onedrive/googledrive/dropbox/whatever, and post a link here. The larger memory dump will provide us more information about the crash.

That said, I did look at the crash dumps you posted. I found some references to file encryption, which may be due to the system writing the crash dumps to the disk, but it may imply there is a problem with your drive or the drive encryption you are using.

I also see that you have SYMEFASI64.sys (Symantec Extended File Attributes driver) loaded, I would suggest (temporarily) removing Symantec/Norton security entirely. If you cannot normally boot into Windows because it bluescreens too quickly, go into Safe Mode as you've done before.

To run the uninstaller you'll need to allow the installer service to run, and it is disabled by default in Safe Mode. Here is a nice guide by Symantec to enable it.

Code: Start memory scan : 0xffff9881bb228928 ($csp) End memory scan : 0xffff9881bb229000 (Kernel Stack Base) rbx : 0xffffb006b4147c00 : !du "\FileSystem\FileCrypt" rsi : 0xfffff800d55e8c40 : 0xfffff800d55e8cc0 : nt!IopDatabaseResource r8 : 0xffffb006b4147c00 : !du "\FileSystem\FileCrypt" r9 : 0xffffd209bc1a92e0 : !du "\SystemRoot\SysWow64\drivers\filecrypt.sys" 0xffff9881bb228940 : 0xffffb006b4147c00 : !du "\FileSystem\FileCrypt" 0xffff9881bb228948 : 0xffffd209bc1a92e0 : !du "\SystemRoot\SysWow64\drivers\filecrypt.sys" 0xffff9881bb228968 : 0xfffff800d5502bb7 : nt!ExAllocatePoolWithTag+0x817 0xffff9881bb228990 : 0xffffd209bc1a92e0 : !du "\SystemRoot\SysWow64\drivers\filecrypt.sys" 0xffff9881bb2289a8 : 0xffffd209bbe445c0 : !du "FileCrypt" 0xffff9881bb2289c0 : 0xffffb006b4147c00 : !du "\FileSystem\FileCrypt" 0xffff9881bb228aa0 : 0xfffff800d550c2b8 : !du "DependOnGroup" 0xffff9881bb228ab8 : 0xfffff800d5a62ee2 : nt!PipCheckDependencies+0x26 0xffff9881bb228b08 : 0xfffff800d5a61bdb : nt!IopInitializeSystemDrivers+0x137 0xffff9881bb228b38 : 0xfffff800d550fd20 : !du "\Security\TRKWKS_EVENT" 0xffff9881bb228b48 : 0xfffff800d5aad8d0 : nt!IoInitSystem_deviceNameBuffer 0xffff9881bb228b68 : 0xffffd209bbb850a0 : !du ""FSFilter Encryption"" 0xffff9881bb228b88 : 0xfffff800d5683010 : nt!KiSystemStartup 0xffff9881bb228b90 : 0xfffff800d3a55300 : !du ""American Megatrends - 4028D"" 0xffff9881bb228b98 : 0xfffff800d582f470 : nt!Phase1Initialization 0xffff9881bb228ba8 : 0xfffff800d5a78a8e : nt!IoInitSystem+0x16 0xffff9881bb228bd8 : 0xfffff800d582f4ac : nt!Phase1Initialization+0x3c 0xffff9881bb228bf0 : 0xfffff800d582f470 : nt!Phase1Initialization 0xffff9881bb228c08 : 0xfffff800d535ff77 : nt!PspSystemThreadStartup+0x47 0xffff9881bb228c50 : 0xfffff800d567ca40 : nt!KiInitialThread 0xffff9881bb228c58 : 0xfffff800d53f4a06 : nt!KiStartSystemThread+0x16 0xffff9881bb228c70 : 0xfffff800d535ff30 : nt!PspSystemThreadStartup[/quote]

 

As requested I have created the file requested in BSOD Posting Instructions
FALCON_DESKTOP-Per_28_09_2017_225245,39.zip

This file was taken while the computer was started in Safe Mode, otherwise it does not start but ends up with BSOD.

I am trying to get a large memory dump, if I can get it. My system drive is an SSD, thus I need to uninstall some programs first.

By the way I successfully uninstalled Norton, and I don't use any encryption in my computer. I also suspect SSD failure, chkdsk once found something, but when I repeated it when the system drive is offline, it was OK.

Regards,

 

Another thing you may want to try is to open up msconfig, go to the "Boot" tab and enable "Boot log" and "Os boot information".

It looks like the problem is caused when the OS tries to load a driver. The boot log option will place ntbtlog.txt in C:\Windows, try booting (not in safe mode) after setting those options, then if it still crashes, go back into safe mode and copy that file and post it here.

It would also be a good idea to run an error scan with HDTune, any badblocks would be a sign of a failing disk.

 

These boot-start drivers had failed to load:

Code: Event[56171]: Log Name: System Source: Service Control Manager Date: 2017-09-28T22:45:06.397 Event ID: 7026 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: FALCON_DESKTOP Description: The following boot-start or system-start driver(s) did not load: AsIOAsUpIOdameeCtrlEhStorClassFileCryptGpuEnergyDrvnpsvctrigVBoxDrvVBoxUSBMon[/quote] Code: Event[56172]: Log Name: System Source: Microsoft-Windows-WER-SystemErrorReporting Date: 2017-09-28T22:45:10.774 Event ID: 1018 Task: N/A Level: Information Opcode: N/A Keyword: Classic User: N/A User Name: N/A Computer: FALCON_DESKTOP Description: The dump file at location: C:\WINDOWS\MEMORY.DMP was deleted because the disk volume had less than 25 GB free space.[/quote] Consider uninstalling applications that are no longer used or updating these non-Microsoft boot-start drivers:

AsIO.sys Asus PCProbe Utility Official Support | ASUS Global AsUpIO.sys ASUS hardware monitoring software related http://support.asus.com/download/dow...Language=en-us eeCtrl.sys Symantec /Norton Symantec Enterprise Technical Support VBoxDrv.sys VirtualBox Downloads – Oracle VM VirtualBox VBoxUSBMon.sys VirtualBox USB driver Downloads – Oracle VM VirtualBox

 

1. I did try boot log, but it didn't create any file. The crash seems happening before logging started.
2. Scandisk says that my SSD is OK. But I will install and run HDTune. Thanks
3. I already removed Norton, for the next step, I will try to remove Asus PcProbe, and then if it does not work VirtualBox.
4. I tried to get MEMORY. Dmp. I got it, however it got deleted after the next restart, I will again try it.

Nevertheless I am inclined to change the SSD. It is already 4 years old. I want to solve the problem, but at the same time I don't want to spare more time on it. I will keep you updated.

 

Before going out and purchasing a new SSD, you may want to at least try Resetting Windows 10 first.

 

Of course, but it was already small, and I needed an excuse.*Smile
I bought the SSD, but I am now trying to resolve the problem first.

 

To check the integrity of the operating system and drive file system open administrative command prompt and type:
1) sfc /scannow
2) dism /online /cleanup-image /restorehealth
3) chkdsk /x /f /r (this may take hours so plan to run overnight)
4) to find and post the chkdsk report:
Read Chkdsk Log in Event Viewer in Windows 10 Windows 10 Performance Maintenance Tutorials

 

Thank you very much.

The problem just resolved. It was corrupted filecrypt.sys.

Its copy was also corrupted, so I copied it from my laptop, and now it resolved.

I don't know why and how it was corrupted. The SSD seems fine. I will closely observe it for a few days.

Regards,

 

The filecrypt.sys is a windows driver.
Most windows drivers get fixed on their own by automatic windows updates.
The windows drivers may appear in a bluscreenview or whocrashed analysis.
They typically display windows drivers.
To find the misbehaving driver very often requires windbg.
And the windbg debugging can find the non-Microsoft misbehaving drivers.

filecrypt.sys Windows Sandboxing And Encryption Filter Driver Windows Update


Earlier this month there was a non-Microsoft windows driver that was involved in a BSOD.
So over time it could reoccur.
One method to see if it might is windows driver verifier.
Had you used the tool?
If not this is information on the tool:



Driver Verifier-- tracking down a mis-behaving driver. - Microsoft Community

Enable and Disable Driver Verifier in Windows 10 Windows 10 Performance Maintenance Tutorials

BSOD Finding and fixing them - Microsoft Community




Code: 26.09.2017 21:14 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffff8003db5ee4b0 P4: ffff998cedda5a20 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092617-10484-01.dmp \\?\C:\Windows\Temp\WER-11234-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B93.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_91efb66222785da8f21f9e4d2d4e8fcfdd49e5a_00000000_cab_02a03b92 Analysis symbol: Rechecking for solution: 0 Report ID: 827e6acd-245f-4c70-9ccf-844758d4d42f Report Status: 100 Hashed bucket:26.09.2017 20:46 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffff8003db5ee4b0 P4: ffff998cedda5a20 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092617-10484-01.dmp \\?\C:\Windows\Temp\WER-11234-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B93.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_91efb66222785da8f21f9e4d2d4e8fcfdd49e5a_00000000_cab_02a03b92 Analysis symbol: Rechecking for solution: 0 Report ID: 827e6acd-245f-4c70-9ccf-844758d4d42f Report Status: 4 Hashed bucket: 27.09.2017 16:10 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffb006b4147c00 P4: ffffd209bc1a92e0 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092717-17125-01.dmp \\?\C:\Windows\Temp\WER-17265-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5311.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_7fc349bb42ffcef733ba5595cb7d1ac8386c4c4_00000000_cab_02b85311 Analysis symbol: Rechecking for solution: 0 Report ID: 107eb574-e68c-480f-a146-29452094974f Report Status: 4 Hashed bucket: 26.09.2017 21:14 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffb38a039f2c10 P4: ffffc48017e460a0 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092617-14921-01.dmp \\?\C:\Windows\Temp\WER-15093-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A57.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_14881ff3c144acc3409b5bddce17bc61767bb74_00000000_cab_02b44a66 Analysis symbol: Rechecking for solution: 0 Report ID: f57c2385-b96f-40e7-9b63-1b99518a9c31 Report Status: 100 Hashed bucket: 26.09.2017 20:51 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffb38a039f2c10 P4: ffffc48017e460a0 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092617-14921-01.dmp \\?\C:\Windows\Temp\WER-15093-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A57.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_14881ff3c144acc3409b5bddce17bc61767bb74_00000000_cab_02b44a66 Analysis symbol: Rechecking for solution: 0 Report ID: f57c2385-b96f-40e7-9b63-1b99518a9c31 Report Status: 4 Hashed bucket: 27.09.2017 18:02 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffd683541aa1e0 P4: ffff8d033821e860 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092717-14203-01.dmp \\?\C:\Windows\Temp\WER-14390-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4788.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_5e8b5910c5f776284a4ecc458f962cdf625f6f26_00000000_cab_02b04788 Analysis symbol: Rechecking for solution: 0 Report ID: 86da83ce-2f13-4c22-b36c-1f4d50f69a2e Report Status: 4 Hashed bucket: 27.09.2017 16:58 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffe1039f5a4330 P4: ffffcf81113872e0 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092717-16968-01.dmp \\?\C:\Windows\Temp\WER-17125-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5294.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_5d7420fbc214d68189f2edfaf654389bbc265d26_00000000_cab_02bc52a4 Analysis symbol: Rechecking for solution: 0 Report ID: e578c873-2baf-489a-a32d-72917f997831 Report Status: 4 Hashed bucket: 28.09.2017 19:45 Windows Error Reporting Fault bucket , type 0 Event Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: 5a P2: 1 P3: ffffe70ef5d6f270 P4: ffff8d8ef819dfa0 P5: ffffffffc0000034 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\Minidump\092817-12125-01.dmp \\?\C:\Windows\Temp\WER-13906-0.sysdata.xml \\?\C:\WINDOWS\MEMORY.DMP \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER44F8.tmp.WERInternalMetadata.xml These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_5a_b46217672ce398230e041b37d955c8b9811bd8_00000000_cab_02bc4507 Analysis symbol: Rechecking for solution: 0 Report ID: ca0cfe95-27ef-4877-a600-33def95d6e34 Report Status: 4 Hashed bucket:[/quote] Code: 3.09.2017 03:44 Windows Error Reporting Fault bucket LKD_0x141_Tdr:6_IMAGE_nvlddmkm.sys_Pascal_3D, type 0 Event Name: LiveKernelEvent Response: Not available Cab Id: a4eb5df4-c50a-4f6a-95a2-aa28d65b0b68 Problem signature: P1: 141 P2: ffff9a82e8987010 P3: fffff801d717cfec P4: 0 P5: 8 P6: 10_0_15063 P7: 0_0 P8: 256_1 P9: P10: Attached files: \\?\C:\WINDOWS\LiveKernelReports\WATCHDOG\WATCHDOG-20170903-0642.dmp \\?\C:\Windows\Temp\WER-200032859-0.sysdata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EBF.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4ECE.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EEF.tmp.txt \\?\C:\Windows\Temp\WERBB60.tmp.WERDataCollectionStatus.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_141_91994da79d3ad79c1ee0270134f4e262aaec1_00000000_cab_486dc794 Analysis symbol: Rechecking for solution: 0 Report ID: 261ca239-035b-4f0a-9434-ccca148dfb18 Report Status: 268435456 Hashed bucket:[/quote] Code: 31.08.2017 19:41 Windows Error Reporting Fault bucket 0xCFFFFFFF_nt!DbgkpLkmdSnapThreadInContext, type 0 Event Name: AppTermFailureEvent Response: Not available Cab Id: 6e976ad9-6e07-4dac-bc52-850f092fac3d Problem signature: P1: P2: P3: P4: P5: P6: P7: P8: P9: P10: Attached files: \\?\C:\Windows\Temp\WERAFE3.tmpatk.kdmp \\?\C:\Windows\Temp\WERAFF3.tmp.appcompat.txt \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB004.tmp.dmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB17C.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB17B.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1AB.tmp.txt \\?\C:\Windows\Temp\WERB1AC.tmp.xml C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_0_0_00000000_cab_0c36b2a2\memory.hdmp WERGenerationLog.txt \\?\C:\Windows\Temp\WEREBF3.tmp.WERDataCollectionStatus.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_00000000_cab_6bf2f103 Analysis symbol: Rechecking for solution: 0 Report ID: 9d2a8b68-cc57-485f-a424-0634219ff68b Report Status: 268566528 Hashed bucket:31.08.2017 17:35 Windows Error Reporting Fault bucket 0xCFFFFFFF_nt!DbgkpLkmdSnapThreadInContext, type 0 Event Name: AppTermFailureEvent Response: Not available Cab Id: be0a0b82-7a6e-41e7-8a84-fd829ea6576d Problem signature: P1: P2: P3: P4: P5: P6: P7: P8: P9: P10: Attached files: \\?\C:\Windows\Temp\WER1911.tmpatk.kdmp \\?\C:\Windows\Temp\WER1921.tmp.appcompat.txt \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1942.tmp.dmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BC3.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BC2.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C11.tmp.txt \\?\C:\Windows\Temp\WER1C12.tmp.xml C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_0_0_00000000_cab_13431d18\memory.hdmp WERGenerationLog.txt \\?\C:\Windows\Temp\WERDC23.tmp.WERDataCollectionStatus.txt These files may be available here: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_00000000_cab_0e5beac8 Analysis symbol: Rechecking for solution: 0 Report ID: 835ff906-ef81-40fa-affc-c739cffa1627 Report Status: 268566528 Hashed bucket:[/quote]

 

You copied the filecrypt.sys from another disk?

I'm happy to hear you aren't seeing crashes anymore.

 

Thank you very much. Actually your sfc /scannow advice showed that the file was corrupted. Its copy was also corrupted, so I copied it from my laptop (Which is also Windows 10 Pro) and same version. And it worked.

My OS at C and it is a SSD. And the drive seems fine. However my D drive which is a 4 year old WD Black is failing, this corruption might be related with it. Maybe Windows update uploaded the files to D drive (It is also my users drive) and during Windows update it got corrupted.

I am now trying to copy the contents of D drive. When it finishes I will move the new SSD to D and then I will make it the OS drive. And I will have another failed HD.