83 replies to this topic

[ichase]

Greetings all,
Normally I can work through most Windows issues and come to some sort of repair or fix option but I have one in my possession that has got me a little stumped.
Owner of laptop reports the following:

Viewing pictures in "My Documents" Viewing pictures in screenshow option.  By approximately 14th picture, Windows goes into BSOD, Physical Memory Dump, force restart.  After Toshiba Screen gets black screen with blinking cursor on top left of screen

I get the laptop and confirm on startup that in fact after the Toshiba screen, OS fails to load, no errors black screen w/ blinking cursor.
I attempt restart, F8 to try to go into Safe Mode.  The same, black screen w/ cursor

Run Windows 7 (64Bit) Recovery console from CD  (It's just the recovery console, no OS to load) (Have one for all OS from XP up to 7 32bit and 64bit where applicable)  Chose run from Command Prompt, it goes into Command Prompt fine.  CD to C: and run chkdsk /r  I receive no errors after this ran for a couple of hours.  Rebooted and still same blinking cursor.

Booted back into Recovery Console.  Attempted to restore from previous day.  Chose last restore point 2/12/2012.  Failed to restore.  Error code 0x80000ffff which I am sure some of you have seen before.  I have never found exactly what that error code is supposed to mean.  Other restore points yield the same result.

Booted Parted Magic (Linux) CD, looked at partitions to see if there was a recovery partition.  Ahhhhh, there was a 9 GB HDD Recovery Partition.  Looked online to find out that the "Secret Squirral Handshake" to get into the HDD Recovery Partition on a Toshiba Satelite was "Hold the '0' key down while turning on the laptop.  Release at Toshiba screen and then proceed to tap '0' key until it goes into the recovery suite"
I had no intention on restoring the system, just wanted to see if it would go in.  Only thing different was the blinking cursor became a solid non blinking cursor.  So it looks like you can't even get into the Recovery Partition to restore to factory settings if it came to that.

So at this point, I plan on running a memory test this evening.  Let it run a few times to see if it could be memory related (I doubt it) but do not want to leave no stone unturned.  I will then work on getting the owners important files off the HDD (just in case) no, he had no backup what so ever.

So, I am up for any and all suggestions you may have.

Thanks and All the best,

Ian

[lewmur]

Greetings all,
Normally I can work through most Windows issues and come to some sort of repair or fix option but I have one in my possession that has got me a little stumped.
Owner of laptop reports the following:


I get the laptop and confirm on startup that in fact after the Toshiba screen, OS fails to load, no errors black screen w/ blinking cursor.
I attempt restart, F8 to try to go into Safe Mode.  The same, black screen w/ cursor

Run Windows 7 (64Bit) Recovery console from CD  (It's just the recovery console, no OS to load) (Have one for all OS from XP up to 7 32bit and 64bit where applicable)  Chose run from Command Prompt, it goes into Command Prompt fine.  CD to C: and run chkdsk /r  I receive no errors after this ran for a couple of hours.  Rebooted and still same blinking cursor.

Booted back into Recovery Console.  Attempted to restore from previous day.  Chose last restore point 2/12/2012.  Failed to restore.  Error code 0x80000ffff which I am sure some of you have seen before.  I have never found exactly what that error code is supposed to mean.  Other restore points yield the same result.

Booted Parted Magic (Linux) CD, looked at partitions to see if there was a recovery partition.  Ahhhhh, there was a 9 GB HDD Recovery Partition.  Looked online to find out that the "Secret Squirral Handshake" to get into the HDD Recovery Partition on a Toshiba Satelite was "Hold the '0' key down while turning on the laptop.  Release at Toshiba screen and then proceed to tap '0' key until it goes into the recovery suite"
I had no intention on restoring the system, just wanted to see if it would go in.  Only thing different was the blinking cursor became a solid non blinking cursor.  So it looks like you can't even get into the Recovery Partition to restore to factory settings if it came to that.

So at this point, I plan on running a memory test this evening.  Let it run a few times to see if it could be memory related (I doubt it) but do not want to leave no stone unturned.  I will then work on getting the owners important files off the HDD (just in case) no, he had no backup what so ever.

So, I am up for any and all suggestions you may have.

Thanks and All the best,

Ian

Can you boot a LiveCD of a "regular" distro that will allow you to mount the HDD and see if you can read the files?  

[LilBambi]

That is a very weird thing.

Are you using a wireless keyboard/mouse? Maybe hook up a USB keyboard/mouse and see if it makes a difference. Could be driver issues.

They have some other ideas too but they are much less promising then having it turn out to be a keyboard/mouse driver...

The suggestions they have about fixing mbr, etc. won't help if you can't boot to an install disk (not a recovery disc or partition).

But some of the items listed here or here maybe helpful..don't know...

[V.T. Eric Layton]

Not being an MS Windows expert leaves me with only one method to fix this:

Big Hammer Method



Nuke it!



Reinstall fresh MS Win OS.

All better.

[Temmu]

the "no os found" may be because an attached device has no os on it - examples:
- floppy disk
- cd or dvd
- usb storage (flash drive / external drive)

the cure in that case is to either remove said device(s) or go into bios and set boot order to hdd first.

[ichase]

@Fran - Thanks for the links.  Will be checking those out shortly.  Had seen a few things online in regards to a potential driver issue and will definitely try the external keyboard.

@lewmur - I booted Parted Magic (My #1 Linux tool) and was able to mount the file system and read all files.

@Eric - I LOVE the way you think.  

@temmu - Not sure what you are saying.  There is no attached USB device, external HDD or CD in the slot.  It's not booting into the OS (Win 7 on the internal HDD)  No error, nothing saying OS won't boot.  OS just does not boot.  After the Toshiba screen, you will normally get a black screen with the cursor blinking on the top left for a second then the OS starts to boot.  (At least that is what the Wifes Toshiba laptop does) on this particular laptop, it never leaves the black screen with the blinking cursor.

Thanks for all the replies.  The laptop in question is currently running MemTest86 which I expect will come back fine.  Like I said, do not want to leave no stone unturned with a customer's computer.

Is there a good hardware diagnostic tool that will check HDD, Southbridge, Northbridge etc?  I very rarely run into un-obvious hardware issues.  95% of my work is either virus related, or someone dropped their laptop and OMG ALL MY KIDS PICTURES ARE ON THE LAPTOP.  And normally there is no backup on external or DVDs.

[V.T. Eric Layton]

@Eric - I LOVE the way you think.  

It's a time-saving method. I highly recommend it. Life is too short to be wasting time trying to fix corrupted Windows installations.

Step 1: Boot Linux Live CD
Step 2: Copy Documents to thumb drive
Step 3: NUKE!
Step 4: Reinstall/Update Windows
Step 5: Restore Documents from thumb drive backup
Step 6: Return lappy to happy customer



Optional: Give them a dual boot with Linux on the lappy. Tell them to stop doing silly slideshow porn stuff in Windows.

[LilBambi]

Yep. That was my first thought too. But sometimes you can find the driver issue and correct it. Hard to say. Would depend on how quickly Ian can find it. I sure hope it's not the hard drive/chipset drivers...

[jcgriff2]

If you are able to recover files, please get the dump files -

\windows\minidump

I'd love to see if they reveal any clues.

[LilBambi]

Excellent point, J.C.!

[lewmur]

@Fran - Thanks for the links.  Will be checking those out shortly.  Had seen a few things online in regards to a potential driver issue and will definitely try the external keyboard.

@lewmur - I booted Parted Magic (My #1 Linux tool) and was able to mount the file system and read all files.

@Eric - I LOVE the way you think.  

@temmu - Not sure what you are saying.  There is no attached USB device, external HDD or CD in the slot.  It's not booting into the OS (Win 7 on the internal HDD)  No error, nothing saying OS won't boot.  OS just does not boot.  After the Toshiba screen, you will normally get a black screen with the cursor blinking on the top left for a second then the OS starts to boot.  (At least that is what the Wifes Toshiba laptop does) on this particular laptop, it never leaves the black screen with the blinking cursor.

Thanks for all the replies.  The laptop in question is currently running MemTest86 which I expect will come back fine.  Like I said, do not want to leave no stone unturned with a customer's computer.

Is there a good hardware diagnostic tool that will check HDD, Southbridge, Northbridge etc?  I very rarely run into un-obvious hardware issues.  95% of my work is either virus related, or someone dropped their laptop and OMG ALL MY KIDS PICTURES ARE ON THE LAPTOP.  And normally there is no backup on external or DVDs.

If the computer is running Win7, you should be able to boot a Win7 DVD and use the "Repair boot problems" option.

[Temmu]

@temmu - Not sure what you are saying.  There is no attached USB device, ...

i speak plainly and point out an obvious problem -
if an external storage device with no os on it is attached,
and if bios is set to hhd 2nd or 3rd, then the system will never boot

i mention this because i have seen it dozens of times.

[Corrine]

If you are able to recover files, please get the dump files -

\windows\minidump

I'd love to see if they reveal any clues.

And, if there are any clues, you're the one who can find them!

[jolphil]

Just another point to consider..Follow the great suggestions you got from the other posters but first, either from a live cd or from a caddy that can mount both Sata and IDE drives to a USB  cable, retrieve your children's pictures just in case the worst happens..
PS I purchased a Star Tech docking station about a year ago and it has proved a worth while investment..The fact it will accept both drive types makes it more universal IMHO..
jolphil

[LilBambi]

Just another point to consider..Follow the great suggestions you got from the other posters but first, either from a live cd or from a caddy that can mount both Sata and IDE drives to a USB  cable, retrieve your children's pictures just in case the worst happens..
PS I purchased a Star Tech docking station about a year ago and it has proved a worth while investment..The fact it will accept both drive types makes it more universal IMHO..
jolphil

Excellent idea! I have a very nice Rosewill SATA 2.5/3.5 drive dock from NewEgg to do that too.

Good to backup all your data just in case before trying further.

[ichase]

I have recovered all of the customer's important files using Live CD and have them on an external device.  There were a total of 4 dump files within the /windows/minidump folder and I have also recovered all 4 of those.  I have them zipped.  How can I upload a zip file so you can see them jolphil?

Thanks a bunch,

Ian

[Corrine]

It is jcgriff2 who wants to see the dump files.  I checked a couple of the sites where he does much of the BSOD analysis and he isn't online.  I sent him a message pointing him here so he can advise how to proceed.

[jcgriff2]

I sent Ian a PM w/ email address.

[Corrine]

Thanks, jcgriff2!  It will be interesting to see if you spot something that will help.

[ichase]

Sorry, thread starts getting longer and you mixed up the screen names.  File sent to jcgriff.  You are not the only one Corrine that is definitely currious as to what he may find.  

Thanks again everyone for taking the time to help with this one.  I have not been stumped in a while and actually, its ones like this that increases my knowledge so I kind of look forward to them.  

All the best,

Ian

[LilBambi]

Thanks, jcgriff2!

As Corrine and Ian said, definitely will be interested to see what you find.

Could help others in the future.

[Corrine]

Could help others in the future.

Not unless they know how to analyze the report.   There are BSOD self-analyzing programs just like the old on-line HJT analyzers.  Unfortunately, more often than not do not point out the correct causes of the BSOD.

[LilBambi]

True! But if you could see some of the driver issues that have been happening along the way...

[ichase]

I picked up a program called BlueScreenView (not saying it's the topshelf) but there were a total of 4 minidump files 2 point to volsnap.sys and 2 point to kdcom.dll I would rather have someone with jcgriff's knowledge and background make the final conclusion.  

[LilBambi]

Hmmm, that's not good. volsnap.sys is one of the things that Rootkit TDSS hits....

http://greatis.com/blog/rootkit/volsnap-sys-rootkit-tdss.htm

(look at the reader comments on the small middle column)

BleepingComputers: please help get rid of volsnap sys virus:
http://www.bleepingcomputer.com/forums/topic403125.html

MSE tried  to Clean volsnap.sys TDSS on a Windows XP computer and it would never boot again. I had to reinstall the OS after lifeboating their data.