none
Windows has recovered from an unexpected shutdown: Problem event name: BlueScreen

    Question

  • Hi All,

    I have been receiving this error occasionally when starting up my computer. Here are the details:

    Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.1.7601.2.1.0.256.48
      Locale ID: 1033

    Additional information about the problem:
      BCCode: 9f
      BCP1: 0000000000000003
      BCP2: FFFFFA80071FAA10
      BCP3: FFFFF80000B9C518
      BCP4: FFFFFA800B58DCA0
      OS Version: 6_1_7601
      Service Pack: 1_0
      Product: 256_1

    I have updated my computer with the latest drivers. 

    Please let me know if you need the Minidump file.

    Thanks

    T-Bone

    Thursday, May 30, 2013 10:25 AM

Answers

  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm


    The procedure:

    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    http://www.wikihow.com/Use-SkyDrive

    To ensure minidumps are enabled:

    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.

    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    System specs are extremely useful so please include whatever you know.

    Wanikiya & Dyami--Team Zigzag

    Thursday, May 30, 2013 4:00 PM
  • Iman.m

    These were Related to avfwim.sys Packet filtering kernel driver ( NDIS IM ) from Avira GmbH.  I would remove it and replace with MSE.

    For future reference you should tell us you are using a Mac.

    http://www.microsoft.com/security_essentials/"]Microsoft Security Essentials - Free Antivirus for Windows

     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e1 fffffa80050c8050 00000000 fffff80002d17200-fffffa8005094e10 Success Error Cancel pending
               \Driver\avfwim    nt!PopSystemIrpCompletion
                Args: 00014400 00000000 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-fffffa8005094e10    


    Wanikiya & Dyami--Team Zigzag

    Saturday, June 29, 2013 7:20 AM

All replies

  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm


    The procedure:

    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    http://www.wikihow.com/Use-SkyDrive

    To ensure minidumps are enabled:

    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.

    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    System specs are extremely useful so please include whatever you know.

    Wanikiya & Dyami--Team Zigzag

    Thursday, May 30, 2013 4:00 PM
  • Hello

    I have similar problem and i have uploaded requested data to diagnose my issue:

    http://rapidshare.com/files/3104876546/minidump plus msinfo32.rar

    Please inform me if  you need additional information.

    Regards.....

    Saturday, June 29, 2013 6:22 AM
  • Iman.m

    These were Related to avfwim.sys Packet filtering kernel driver ( NDIS IM ) from Avira GmbH.  I would remove it and replace with MSE.

    For future reference you should tell us you are using a Mac.

    http://www.microsoft.com/security_essentials/"]Microsoft Security Essentials - Free Antivirus for Windows

     [  0, 0]   0  0 00000000 00000000 00000000-00000000    
                Args: 00000000 00000000 00000000 00000000
    >[ 16, 2]   0 e1 fffffa80050c8050 00000000 fffff80002d17200-fffffa8005094e10 Success Error Cancel pending
               \Driver\avfwim    nt!PopSystemIrpCompletion
                Args: 00014400 00000000 00000004 00000002
     [  0, 0]   0  0 00000000 00000000 00000000-fffffa8005094e10    


    Wanikiya & Dyami--Team Zigzag

    Saturday, June 29, 2013 7:20 AM