Windows 10 is bluescreening - Tip before a brut force rebuild.

Hello all,

My neighbor's Windows 10 desktop is currently bluescreening (is that now a valid verb? LOL) and I am trying to help her, but I am very stuck now that I have exhausted all the easy fixes.

Bluescreen message - not very helpful
The first fix that I attempted was a system restore point to a date that was sometime before it began to fail. I didn't have great hopes b/c, on other computers, I have attempted system restores about 10 times in the past and none had ever resulted in a successful restore. :(

My neighbor's system restore took about 3 - 4 hours to complete and unfortunately did not resolve the problem. :(

What I have tried today:
- I attempted to do an even earlier System Restore, but now I am suddenly unable to restore to any point. I am not certain why.

System restore - no longer worked on second try
- Tried several modes of Safe Mode and all ended with the same unhelpful Stop Code: Critical Process Died
- Before leaving her to write this "cry for help", I copied what I thought was an event log, SCM.EVM, but now I am uncertain about what this file contains. I can't be read by the Event Viewer on my computer.
   > what logs should I look for when accessing system command line mode (in advanced recovery)?

Any advice is appreciated. I would rather not have to rebuild her Windows, if it can be avoided. :)
LVL 4
S ConnellyTechnical WriterAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

James BunchSystems EngineerCommented:
Can you get into any usable windows at all? Safe mode or anything? If so, there is a tool by Nirsoft, listed below, Bluescreenview that will allow you to look at the stop codes and find the drivers associated with this. Most of the time its a driver on the device that is causing it. Unplug anything that is not necessary and get into a desktop and run that if you can. Let us know if this is possible, or we will go another route.

https://www.nirsoft.net/utils/blue_screen_view.html
S ConnellyTechnical WriterAuthor Commented:
Hi James,

Unfortunately, all Windows safe modes result in the same bluescreen.

That’s for the diagnostic tool tip. I’ll look at this later.

BTW, there is nothing to unplug. This computer is pretty basic with only a keyboard and mouse.

I’m going out for dinner now, but I get back on this project later this evening.

Thanks again.
James BunchSystems EngineerCommented:
I understand, if you have access and the knowledge to do so you can take the hard drive out and plug it into a known working computer and run that tool and it will read the dump files that way also you can diagnose as well. You may also want to try things like unplugging all but one RAM stick and swapping them out to see if you got one that went bad, try to move them around different slots if its got more, etc. Just trying to cover all the bases.
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

nobusCommented:
if the restore took 3-4 hrs, it suggests to me there can be hardware problems
i suggest to test Ram and disk, to be sure about the basics - i use the UBCD for that :
Hardware diagnostic CD    UBCD
---------------------------------------------------
go to the download page, scroll down to the mirror section, and  click on a mirror to start the download
Download the UBCD and make the cd   <<==on a WORKING PC, and boot the problem PC from it
Here 2 links, one to the general site, and a direct link to the download

since the downloaded file is an ISO file, eg ubcd527.iso - so you need to use an ISO burning tool
if you don't have that software, install cdburnerXP : http://cdburnerxp.se/

If you want also the Ram tested - run memtest86+ at least 1 full pass,  - you should have NO errors!
direct download :  http://www.memtest.org/
 
For disk Diagnostics run the disk diag for your disk brand (eg seagate diag for seagate drive)  from the HDD section -  long or advanced diag !  (runs at least for30 minutes)

http://www.ultimatebootcd.com/      

**  you can make a bootable cd - or bootable usb stick
*** note *** for SSD drives  use the tool from the manufacturer, like intel 's toolbox :
https://downloadcenter.intel.com/download/18455/Intel-Solid-State-Drive-Toolbox

for completeness -here's how i handle disk problems : http://www.experts-exchange.com/Storage/Hard_Drives/A_3000-The-bad-hard-disk-problem.html

==>>****in order to be able to  boot from CD or usb - you may have to disable secure boot in the bios

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Warwick ReimanSenior Systems EngineerCommented:
Depending on the issues, Remove hardware in terms of ram or any additional drives. see if it progresses,
Burn a Windows 10 image and initiate a repair process. Otherwise if you have a PC swap the drives over and see if it boots?

If it errors, out you better off getting the data off the drive and trying again assuming windows won't play ball.
JohnBusiness Consultant (Owner)Commented:
I have seen this before. Two cases at clients.  

Case 1: Remove the hard drive, recover documents, use the vendor Recovery media to reinstall Windows and restore data.

Case 2: Vendor replaced hard drive and reinstalled Windows.

It well may be hardware, but if not and if nothing above works, you need to recover what data you can and reinstall Windows.
S ConnellyTechnical WriterAuthor Commented:
Thanks everyone. I appreciate your input.

Diagnosing a problem based on limited information (my bad) is exceedingly difficult.

Nobus,
>if the restore took 3-4 hrs, it suggests to me there can be hardware problems
It might have been as little as 2 hours, which isn't unusual in my experience. Besides, I am confident that this is a hardware issue because... a quick bit of background...
The computer was working until a ISP technician "fiddled" with her computer for about two hours and left her with a non-bootable computer. I have no idea what he did... nor does it make any sense for him to "fiddle" for two hours. I am guessing that he intended to change the IP settings and/or directly configure her new ISP suppled modem/WiFi router.

----
Next Steps

Anyhow, this is what I am about to do... I would like a sanity check on my next steps.
1. I am building a bootable USB stick with Hiren's Recovery image (I was happy to see that it is still supported)
https://www.hirensbootcd.org/download/
2. Boot with Hiren's and review the Windows log files for any clues.
3. Test with https://www.nirsoft.net/utils/blue_screen_view.html - Thanks James
4. If Hiren's tools are unhelpful, I will boot with UBCD - Thanks Nobus
    Memtest86 is on it so there is no need for a separate download. My only minor concern with UBCD is a mention that UEFI isn't supported.
    I will need to look at that to see how that will affect my ability to boot from USB.
5. If the UBCD tools do not help and the physical hardware seems intact, I guess I am down to my last option of doing a complete re-install.
    a) Back up any personal data + use my Acronis to clone the old hardware (for redundancy)
    b) Attempt a Windows system recovery - from her computer
    c) If (b) doesn't work, download a Windows recovery iso from https://www.microsoft.com/en-ca/software-download/windows10
        First, bootup with Hiren and use one of the tools described here: https://www.raymond.cc/blog/easiest-way-to-recover-xp-and-vista-product-key-from-dead-or-unbootable-windows/
       to recovery her Windows 10 key. *UPDATE* A license crawler is included on the Hiren recovery iso. :)
   
6. After I get her computer operational again, make a new HD clone using Acronis. It's a life saver. I will convince her to purchase a license so that a backup bootable image is always up to date.

Thanks again. Additional advice is certainly welcome. :)
JohnBusiness Consultant (Owner)Commented:
Please let us know about your above steps.

USB from the Microsoft Media Creation link above needs Windows to be working (which it isn't). So you need to make the full recovery media from that and better to get the vendors Recovery Media if you need that.
NerdsOfTechTechnology ScientistCommented:
Be prepared to have an external drive and a new hard drive ready, as it sounds like hard drive malfunction/failure.

As a precaution, recover from the drive as soon as possible. The less the drive is taxed, the more likely you can pull data off of it.

Many Linux based Live OS's can help.

Basically, you will want to boot from the Linux Live OS CD/DVD/Flash drive and gain access to the failing drive that has Windows on it (via a file manager, targeting C:/Users/) then copy files onto another flash drive or another backup drive.

http://www.system-rescue-cd.org/Screenshots/

Copy the most critical files first, then try larger batches.

After the recovery is completed. You will want to use another, working Windows computer to download the media creation tool:

https://www.microsoft.com/en-us/software-download/windows10

and create a Windows 10 media disk.

Install the new hard drive, then install Windows 10 onto it. Migrate the backup files to the new drive. Fix the permissions on the migrated files, so that the new system is the 'owner' of the files. Reinstall programs... suggest a system image app for future backup such as Acronis True Image 2019.
nobusCommented:
what desktop model is this?  post some specs
btw - 2 hrs can be normal, depending on the hardware
S ConnellyTechnical WriterAuthor Commented:
Hello all,

Just a short post for now.

The Hiren boot helped determine that there are no apparent hardware faults.

I copied all the event logs. I will inspect them tomorrow, but it appears that I will have to either:
- System Restore (from the built-in diags)
- If the System restore doesn't work, I will need to start from a Windows 10 install disk.

Question:
This computer was upgraded from Windows 7 to Windows 10.
Will I be able to re-install from Windows 10, using the Windows 7 key?

Thanks
S ConnellyTechnical WriterAuthor Commented:
nobus:
>what desktop model is this?  post some specs

I think it is pretty generic. I'm guessing 8 GB with a lower end AMD CPU. Sorry, I think it is a no-name system. I'm going to guess that it's an older NCIX computer purchased about five years ago.
JohnBusiness Consultant (Owner)Commented:
Will I be able to re-install from Windows 10,...?

Windows 10 was running and activated at some point, so you can just install Windows 10 and it should license fine.
nobusCommented:
>>  I think it is a no-name system. <<  then post the mobo, and ram spec
you said " I'm guessing "  how comes you don't know? is the sytem not available to you?
S ConnellyTechnical WriterAuthor Commented:
Nobus:
>you said " I'm guessing "  how comes you don't know? is the sytem not available to you?

I don't recall any branding on the box. The Award bios is pretty old because it is text-based with no mouse support.
nobusCommented:
you can Always open it, and mpost the mobo model

or use a method like here :  https://www.howtogeek.com/208420/how-to-check-your-motherboard-model-number-on-your-windows-pc/
S ConnellyTechnical WriterAuthor Commented:
No way... LOL

I want to be as unintrusive as possible with my neighbor's computer. This is already a pretty annoying and disruptive experience for her.
NerdsOfTechTechnology ScientistCommented:
The Hiren boot helped determine that there are no apparent hardware faults.

In which components?

What is the S.M.A.R.T. status of the hard drive?

Did you run MHDD 4.6 from Hiren? (do the backup of files first of course, before doing anything else)

Precise diagnostic of the mechanical part of a drive, perform Low-level format, Bad Sector Sepair, access raw sectors, manage S.M.A.R.T. (SMART) and other drive parameters such as acoustic management, security, Host Protected Area, etc.

Windows 10 will activate using the Windows 7 key.
nobusCommented:
>>  I want to be as unintrusive as possible with my neighbor's computer.    <<  that's fine - but how will you replace the faulty component then ?
also the hiren cd - what diagnostics did you run?   be a bit precise man, and give us info so we can help you
NerdsOfTechTechnology ScientistCommented:
With evidence pointing to hard drive malfunction (or failure) due to boot failure and longer than usual recovery on the C drive, backup of data should be done first and foremost (to increase the probability of data accessibility and recovery, as well as reduce stress on a possibly failing or failed drive).

After backup, S.M.A.R.T. should be tested; if the drive is healthy, other components should be tested (RAM namely; software-based methodologies first, then physical pulls if needed).

A physical inspection and or cleaning of the system is a highly recommended next step to rule out some hard to diagnose reasons why the system fails to boot. Next, if everything passes the test, either a new hard drive should be installed (as an optional precautionary step as some failing drives will use up 'spare' sectors quickly when dying) or (the riskier route) reuse the old drive after being fully reformatted and check-disked; then, reinstallation of Windows 10 from the latest media creation tool should be done, backup migration, and setup.

Please update us on the progress.
nobusCommented:
keep us posted on your progress
S ConnellyTechnical WriterAuthor Commented:
Hello all,

Apologies for the slow response.

A quick update for now...

  • I reinstalled Windows as a fresh install (previously, it was updated from Windows 7 to 10).
  • No changes to hardware.
  • For the first few days, the newly installed Windows 10 would go into recovery mode upon each reboot (strange).
  • By the end of the first week, it seems to have "stabilized" and boots correctly now. I can't explain the first few days.
  • Oddly, this new install seems slower than the previous Windows 7 -> 10 update. I can't explain.
JohnBusiness Consultant (Owner)Commented:
If the system is now running, run a Windows 10 Repair install from the Media Creation link and Keep Everything. This will re-write the OS and update all drivers.

https://www.microsoft.com/en-us/software-download/windows10
NerdsOfTechTechnology ScientistCommented:
Many of these symptoms point to a hard drive being on its last leg, even the original issue; it running somewhat normally now could be a sign of it using its final 'spare sectors'.

I emphatically recommend checking the drive's SMART status. Does it show as 'HEALTHY'? If my hypothesis is correct, it will show as being bad or unknown.

I would even go as far as saying it's better to be safe than sorry and outright replace the drive. I understand that this involves more than what you're willing to do (open the case, etc). Yet, I have to say this is what I would do.

With the backup of the client's data on an external drive handy, I would install a fresh Windows 10 on the new drive (as the windows 7 key activates windows 10, there's no need to upgrade from 7); then migrate the backup, install programs, etc.
S ConnellyTechnical WriterAuthor Commented:
NerdsofTech:

I emphatically recommend checking the drive's SMART status. Does it show as 'HEALTHY'? If my hypothesis is correct, it will show as being bad or unknown.

It's quite possible that the HD is failing. SMART status is unknown b/c the SMART diagnostics (used two tools) reports that the drive isn't SMART compatible. Too old?

Because of the age of this computer (> 5 years), I recommended a replacement computer. Even a $400 computer will run faster than her current clunker.
JohnBusiness Consultant (Owner)Commented:
So long as backed up, try the Repair, see how it runs, and then try manufacturer's diagnostics for hardware.

At the price point you quoted, that is a consumer machine and probably only good for 3 years. Any new machine with a like price point is also not good for the long term.
NerdsOfTechTechnology ScientistCommented:
Most likely the drive is an IDE drive if SMART isn't available (that would put the age around 10 years plus). At 5 years plus, a new computer would be a far better solution than even a replacement drive, since other components could easily fail or malfunction at that age (motherboard, etc.); you not only would have a new drive to work with but everything else would be new, less likely to fail anytime soon.
S ConnellyTechnical WriterAuthor Commented:
OMG, I completely forgot about this question.

Thank you to everyone for helping. I will complete the task of awarding solutions by the weekend. I need to reread everyone's responses.

BTW, after rebuilding the computer, it strangely stabilized after about 20 or so reboots. It no longer fails on restart.
nobusCommented:
check for dmp files anyway; or even viewer - problems
S ConnellyTechnical WriterAuthor Commented:
Apologies for abandoning this question. The owner eventually decided to take my advice and purchase a new and much faster computer.
S ConnellyTechnical WriterAuthor Commented:
Thanks again for your awesome assistance. Lot's of great advice. :)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 10

From novice to tech pro — start learning today.