asked on

Windows 7 STOP 0x00000051

Hi

About 10 days ago something happened to a Windows 7 PC as all Office programs stopped working - error message was something related to incompatible 32 or 64-bit version, even though it had been working fine for 3-4 years. So, the only way forward was to re-install Windows 7 and all the applications.
So this is what I did and returned the PC back to my client about a week ago. Everything was fine for about 3-4 days when I got a phone call that Windows is crashing with BSOD.

The error message says:
Registry_Error
STOP: 0x00000051

This happens after the user has logged on to the Desktop.

PC loads fine in all Safe Mode options, including Safe Mode with networking

This is what I've done up to now:

Uploaded the .dmp to BlueScreenView where it highlighted ntoskrnl.exe in red (I've also added the dmp file to this thread)
sfc /scannow - nothing
chkdsk - not errors
Tried clean boot (unticked everything from the Startup using msconfig)
Uninstalled Norton
Scanned the registry with CCleaner
Followed instructions here to no avail: https://answers.microsoft.com/en-us/windows/forum/windows_7-update/win7-bsod-registryerror-ntoskrnlexe-bugcheck-code/2f7ab355-0753-4413-89ea-c5ced69ef750

Any help much appreciated.
Thanks!
022319-15724-01.dmp

☠ MASQ ☠

Here's the main part of the minidump but most of this you'll have got from BlueScreen.

It does look like a corrupt or outdated driver but there's not enough information in a single dmp to get any more clues.

The kernel stack information is virtually empty suggesting the system wasn't stable enough to collect all the data needed for the file.

Without multiple dump files (assuming that some get further through than others) there is no "smoking gun" here so only vague advice about making sure your chipset drivers are up to date (in Safe Mode), as are any other device drivers for additonal hardware you know about.

Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24354.amd64fre.win7sp1_ldr_escrow.190108-1700
Machine Name:
Kernel base = 0xfffff800`02e49000 PsLoadedModuleList = 0xfffff800`03082c90
Debug session time: Sat Feb 23 05:07:39.107 2019 (UTC - 5:00)
System Uptime: 0 days 0:02:00.043
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REGISTRY_ERROR (51)
Something has gone badly wrong with the registry.  If a kernel debugger
is available, get a stack trace. It can also indicate that the registry got
an I/O error while trying to read one of its files, so it can be caused by
hardware problems or filesystem corruption.
It may occur due to a failure in a refresh operation, which is used only
in by the security system, and then only when resource limits are encountered.
Arguments:
Arg1: 0000000000000001, (reserved)
Arg2: fffff8a0000232d0, (reserved)
Arg3: 000000000101f000, depends on where Windows bugchecked, may be pointer to hive
Arg4: 0000000000000374, depends on where Windows bugchecked, may be return code of
	HvCheckHive if the hive is corrupt.

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x51

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800031adeca to fffff80002edcba0

STACK_TEXT:  
fffff880`065252f8 fffff800`031adeca : 00000000`00000051 00000000`00000001 fffff8a0`000232d0 00000000`0101f000 : nt!KeBugCheckEx
fffff880`06525300 fffff800`0314ad46 : 00000000`00115da0 00000000`000080f7 00000000`00005527 fffff8a0`00000004 : nt! ?? ::NNGAKEGL::`string'+0x913a
fffff880`06525360 fffff800`03144500 : fffff8a0`000232d0 fffff8a0`000232d0 fffff8a0`00039c00 00000000`00560052 : nt!HvMarkDirty+0x176
fffff880`065253c0 fffff800`0322c45b : 00000000`00000001 fffff8a0`027cea74 fffff8a0`01e7468c fffff8a0`000232d0 : nt!HvMarkCellDirty+0x150
fffff880`06525410 fffff800`03244e04 : fffff8a0`01e7468c 00000000`ffffffff fffff8a0`01e7468c fffff8a0`000232d0 : nt!CmpMarkKeyValuesDirty+0x14b
fffff880`065254b0 fffff800`03245e7a : fffff8a0`000232d0 00000000`ffffffff fffff8a0`01e7468c fffff8a0`000232d0 : nt!CmpFreeKeyValues+0x24
fffff880`065254e0 fffff800`03247018 : fffff8a0`000232d0 00000000`00f5ef08 fffff8a0`01e7468c fffff8a0`00fbe688 : nt!CmpSyncKeyValues+0x7a
fffff880`065255c0 fffff800`032472de : fffff8a0`152a3000 00000000`003fa3b8 fffffa80`00000000 00000000`00000000 : nt!CmpCopySyncTree2+0x2a8
fffff880`06525670 fffff800`032c48d7 : 00000000`00000000 00000000`00000002 fffff8a0`1525d6e0 fffff8a0`153836b0 : nt!CmpCopySyncTree+0x6e
fffff880`065256c0 fffff800`03337a26 : fffff8a0`04d38710 00000000`00000000 00000000`00000001 00000000`00000000 : nt!CmpSaveBootControlSet+0x307
fffff880`065258a0 fffff800`02eeabd3 : fffffa80`083ef750 00000000`00000000 fffff880`06525970 00000000`00000001 : nt!NtInitializeRegistry+0xc6
fffff880`065258f0 fffff800`02ee03b0 : fffff800`033379cf 00000000`00000220 00000000`000bf508 00000000`00220640 : nt!KiSystemServiceCopyEnd+0x13
fffff880`06525a88 fffff800`033379cf : 00000000`00000220 00000000`000bf508 00000000`00220640 00000000`000bf7d0 : nt!KiServiceLinkage
fffff880`06525a90 fffff800`02eeabd3 : fffffa80`083ef750 fffff880`06525b60 fffff880`06525b60 00000000`00000002 : nt!NtInitializeRegistry+0x6f
fffff880`06525ae0 00000000`774ca62a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000bf7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774ca62a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+913a
fffff800`031adeca 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+913a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5c355e0b

FAILURE_BUCKET_ID:  X64_0x51_nt!_??_::NNGAKEGL::_string_+913a

BUCKET_ID:  X64_0x51_nt!_??_::NNGAKEGL::_string_+913a

Followup: MachineOwner
---------

Open in new window

John

In addition to the above (Driver issue), be sure to update BIOS and Chipset and then use the Manufacturer's driver update application to update all drivers.

kirret

ASKER

Thank you.

I've downloaded Fujitsu's DeskUpdate utility and updated the BIOS + 3 other drivers in Safe Mode. BSOD is still happening though in normal Windows.

I also had a look at all the other dump files and they are all the same, no additional info...

John

So, the only way forward was to re-install Windows 7 and all the applications. So this is what I did and returned the PC back to my client about a week ago.

Do you have legacy or non-compliant software installed? That is what appears to be the case.

Get a copy of memtest86.exe and run it to ensure Memory is working correctly.
Get a copy of the Fujitsu hardware test application and run this as well.

kirret

ASKER

The PC had the same set of software on it for 3-4 years, Office 2013, Norton, Adobe reader, I think that might have been it. Not sure what happened to it though, was it an update or something that messed it up so we started getting that 32/64 bit message.

As it was then, it's the same now - only software installed are Office 2013, Adobe Reader and Norton.

I'll try your suggestions regarding memtest and hardware test.

Thank you

John

Office 2013 is fine. Uninstall Adobe Reader, restart and install Adobe Reader DC newest version. make sure Norton is the newest version. I have used Symantec Corporate just fine on Windows 7 when I had a Windows 7 machine.

kirret

ASKER

Sorry, it is Adobe Reader DC and Norton is the latest version as well.

I had also downloaded all the Windows updates to it before I returned it to them a week ago, without any blue screens at all.

John

Those should run fine. Look for other non-compliant software and then run the hardware tests as suggested above.

kirret

ASKER

As I said, there is no other software installed.

I'm running memtest now.

I can only find Fujitsu Hard drive testing tool. Is that what you meant?

John

Yes to the hard drive test.

Also, a Root Kit virus can withstand a simple reinstall.

Get TDSSKiller (Kaspersky) and run that to check

https://usa.kaspersky.com/downloads/tdsskiller

ASKER CERTIFIED SOLUTION

☠ MASQ ☠

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

kirret

ASKER

I re-installed the PC using built-in factory reset option and the installed all the updates.
Didn't image the PC before returning it.

Edmond Hawila

Do you get the BSOD with any user logging in or only with a specific user?

nobus

no errors in event viewer, or in device manager?

kirret

ASKER

@John - 8h of memtest in Safe Mode - zero faults

@Edmond - Not tried creating another user, I'll see if that helps. - Update - new user crashes as well with the same errors code.

@nobus - There are no errors at the time of a crash.

Otherwise, under Applications there are:

System Restore Event ID 8193 notifications
Winlogon Event ID 6000 - yellow exclamation mark

Under System:
Event ID 10005 Distributed COM
Event ID 1014 DNS Client
Event ID 7026 Service Control Manager - The following boot-start or system-start drivers failed to load: discache, spldr, wanarpv6
And then Event 81 and 6008 regarding unexpected system shutdowns and the system has rebooted without shutting down first.

Andrew Leniart

If all else fails, try replacing the PSU (Power Supply Unit) with another one and test again for a few days - the one in the machine could be faulting and causing this issue.

Hope that's helpful.

Regards, Andrew

kirret

ASKER

@Andrew - Not sure the PSU is the cause what triggers BSOD with REGISTRY_ERROR and error code 0x00000051 every single time when in normal Windows but never in Safe Mode.

Andrew Leniart

kirret, if the problem is the PSU, then the reason it's not blue screening in safe mode is that there is a lot less power being drawn from the PSU in safe mode. I've personally seen PSUs cause Blue Screen errors a few times over the years (been in the game for 20+ years) and that's the only reason I suggested it. But as I said, try it if all else fails. A PSU is very easy to replace and worth the test in my opinion.

Hope that's helpful.

Regards, Andrew

nobus

try a system restore to a dtae it was ok https://www.howtogeek.com/howto/windows-vista/using-windows-vista-system-restore/

kirret

ASKER

Sorry guys, I forgot to reply.
I ended up re-installing Windows on this PC and it's been working fine for the last 3 days now.
Thank you all for your suggestions.