[SOLVED] BSOD Loop ?

[Mobbles]

So making this thread for a friend but will relay ( as his account is locked for some reason )

Anyways, so yeah friend is currently having an issue where everytime he boots - it goes to boot, GIGABYTE Logo with the classic windows loading balls, then it goes to black then it cuts to a BSOD.

SYSTEM_SERVICE_EXCEPTION

The service in question:

win32kfull.sys​

Now leading up to this he told me before this happened he used a spoofer to spoof something, not sure what but I'm going to put my finger on it and say thats what ****** [Moderatorr edit to remove profanity. Remember that this is a family friendly forum.] at the moment, by spoof I mean he possibly changed his IDs for drive, motherboard etc - will get more details on what it actually changed.

Anyway, so far we've been able to boot into safe mode just fine - everything is intact, did a /sfc scannow and it fixed a corrupted file but still no luck and also did a chkdsk ofc

I'm currently lost in what we can try but we're in safe mode and everything loads - its just trying to figure out why its bluescreening now and if we can revert it.

Last resort is backup and reset, any more info needed let me know I believe thats everything at the moment

 

[ubuysa]

If it boots OK into Safe Mode but BSODs on a normal boot then it's most likely a third-party driver that's loaded at boot time that's failing. Whether it's related to whatever it was they were 'spoofing' I have no way of knowing.

What I'd suggest is that your friend try Clean Booting Windows. Initially I would disable all third-party services and all auto-start apps (see the link for details) and check that it boots. Assuming that it does, then leave the auto-start apps disabled and enable half of the third-party services and reboot. If it BSODs the problem service is in the half you enabled, if it doesn't BSOD it's (probably) in the half you didn't. Pick the half where the problem lies and enable/disable half of those and reboot. By using this binary search technique you can quickly home in on the failing service (driver).

If it boots OK with all third-party services enabled then use the same binary search technique on the auto-start apps.

 

[Mobbles]

If it boots OK into Safe Mode but BSODs on a normal boot then it's most likely a third-party driver that's loaded at boot time that's failing. Whether it's related to whatever it was they were 'spoofing' I have no way of knowing.

What I'd suggest is that your friend try Clean Booting Windows. Initially I would disable all third-party services and all auto-start apps (see the link for details) and check that it boots. Assuming that it does, then leave the auto-start apps disabled and enable half of the third-party services and reboot. If it BSODs the problem service is in the half you enabled, if it doesn't BSOD it's (probably) in the half you didn't. Pick the half where the problem lies and enable/disable half of those and reboot. By using this binary search technique you can quickly home in on the failing service (driver).

If it boots OK with all third-party services enabled then use the same binary search technique on the auto-start apps.

Will give it a shot and let you know - thanks king

 

[Mobbles]

If it boots OK into Safe Mode but BSODs on a normal boot then it's most likely a third-party driver that's loaded at boot time that's failing. Whether it's related to whatever it was they were 'spoofing' I have no way of knowing.

What I'd suggest is that your friend try Clean Booting Windows. Initially I would disable all third-party services and all auto-start apps (see the link for details) and check that it boots. Assuming that it does, then leave the auto-start apps disabled and enable half of the third-party services and reboot. If it BSODs the problem service is in the half you enabled, if it doesn't BSOD it's (probably) in the half you didn't. Pick the half where the problem lies and enable/disable half of those and reboot. By using this binary search technique you can quickly home in on the failing service (driver).

If it boots OK with all third-party services enabled then use the same binary search technique on the auto-start apps.

So he went through and disabled everything - and it still seems to bluescreen, is there a way I can provide logs for you with more info as you have little to work with

 

[ubuysa]

So it doesn't BSOD in Safe Mode but it does BSOD with a clean boot and with all third-party service and all auto-start apps disabled?

 

[Mobbles]

So it doesn't BSOD in Safe Mode but it does BSOD with a clean boot and with all third-party service and all auto-start apps disabled?

Apparently so - Safe mode doesn't blue screen at all however clean boot with all third-party services disabled and auto-start apps disabled

"yeah i went to msconfig and checked hide microsoft services then disabled all
then went to startup and disabled them all" - quote from him

 

[Mobbles]

So it doesn't BSOD in Safe Mode but it does BSOD with a clean boot and with all third-party service and all auto-start apps disabled?

Also by spoofing I'm on about hardware identifiers not sure if this is the cause but its the last thing he did before it BSOD and now won't boot

 

[Mobbles]

Managed to fix it - as the program he used to spoof came out with a fix

 

[ubuysa]

Would you care to share exactly what he was 'spoofing', what tools he was using to do that, and what the fix was? I'm sure we'd all appreciate the learning in case this kind of issue crops up for others.

 

[Mobbles]

Would you care to share exactly what he was 'spoofing', what tools he was using to do that, and what the fix was? I'm sure we'd all appreciate the learning in case this kind of issue crops up for others.

I know this is very late, and I don't quite remember how we fixed it, but I believe we disabled some hypervisor element that was used or some virtualization, I'll reply with more details but I believe the tool he used ( to spoof ) came out with a fix as it was a common issue for people using it

 

[stuff and nonesense]

You say he can boot into safe mode, that’s helpful.

From Microsoft.com :

https://learn.microsoft.com/en-us/answers/questions/2137225/how-do-i-fix-win32kfull-sys

The first six options check drivers and configuration, system repair and such. The remaining 2 or 3 lead to resetting Windows. If it got that far I’d reinstall.

 

[ubuysa]

I know this is very late, and I don't quite remember how we fixed it, but I believe we disabled some hypervisor element that was used or some virtualization, I'll reply with more details but I believe the tool he used ( to spoof ) came out with a fix as it was a common issue for people using it

OK, as long as you're happy that it's fixed.