locked
Windows 7 Pro randomly gets a BlueScreen RRS feed

  • Question

  • Hey 

    in the past few weeks i have been getting Window Blue screen errors with the following Error msg:

    Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.1.7601.2.1.0.256.48
      Locale ID: 4105

    Additional information about the problem:
      BCCode: d1
      BCP1: FFFFF8800BEC4000
      BCP2: 0000000000000002
      BCP3: 0000000000000000
      BCP4: FFFFF88004172FA0
      OS Version: 6_1_7601
      Service Pack: 1_0
      Product: 256_1

    Files that help describe the problem:
      C:\Windows\Minidump\071014-37065-01.dmp
      C:\Users\Sheeraz\AppData\Local\Temp\WER-43087-0.sysdata.xml

    Read our privacy statement online:
      http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

    If the online privacy statement is not available, please read our privacy statement offline:
      C:\Windows\system32\en-US\erofflps.txt

    I was hoping someone can help me out or give me a idea of how to fix this issue. Thanks ! 

    My System Specs are:

    Processor: intel(R) Core(TM) i7-4770l CPU@3.50 GHz 3.50 Ghz

    Ram: 16 GB

    65 Bit operating system Windows 7 Pro

    Thursday, July 10, 2014 4:07 PM

Answers

  • Hey, first off thanks for getting back to me so quickly :D

    I hope i did this correctly but here are the DMP files:

    https://onedrive.live.com/redir?resid=403DCDBDEBDE9493!107&authkey=!ADooMZtTHV_L8s0&ithint=file%2c.rar

    Let me know if you need anything else. 

    Thanks again ! 

    BT

    These were Related to e22W7x64.sys Killer e2200 PCI-E Gigabit Ethernet Controller from Qualcomm Atheros.   I would install the newest driver available even if it is th same date as drivers do become corrupt

    Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Ken\Desktop\New folder\071014-37065-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    OK                                             C:\Users\Ken\Desktop
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\Users\Ken\Desktop
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
    Machine Name:
    Kernel base = 0xfffff800`02e06000 PsLoadedModuleList = 0xfffff800`03049890
    Debug session time: Thu Jul 10 11:47:50.620 2014 (UTC - 4:00)
    System Uptime: 0 days 2:11:43.337
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {fffff8800bec4000, 2, 0, fffff88004172fa0}
    
    *** WARNING: Unable to verify timestamp for e22w7x64.sys
    *** ERROR: Module load completed but symbols could not be loaded for e22w7x64.sys
    Probably caused by : e22w7x64.sys ( e22w7x64+19fa0 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: fffff8800bec4000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff88004172fa0, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b3100
    GetUlongFromAddress: unable to read from fffff800030b31c0
     fffff8800bec4000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    e22w7x64+19fa0
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  LolClient.exe
    
    ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
    
    TRAP_FRAME:  fffff8800e5c3670 -- (.trap 0xfffff8800e5c3670)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000000004a rbx=0000000000000000 rcx=fffffa800d4c2748
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88004172fa0 rsp=fffff8800e5c3800 rbp=fffffa800d4c2690
     r8=0000000000000300  r9=0000000000000000 r10=fffffa800dbca280
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    e22w7x64+0x19fa0:
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14 ds:00000000`00000248=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002e7b169 to fffff80002e7bbc0
    
    STACK_TEXT:  
    fffff880`0e5c3528 fffff800`02e7b169 : 00000000`0000000a fffff880`0bec4000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e5c3530 fffff800`02e79de0 : fffff8a0`04fc6124 fffff8a0`00024010 fffff880`0e5c3810 fffffa80`0dbb6b40 : nt!KiBugCheckDispatch+0x69
    fffff880`0e5c3670 fffff880`04172fa0 : fffffa80`0dbb6b40 00000000`00001528 fffffa80`0dbb6b58 fffffa80`0dbb6b40 : nt!KiPageFault+0x260
    fffff880`0e5c3800 fffffa80`0dbb6b40 : 00000000`00001528 fffffa80`0dbb6b58 fffffa80`0dbb6b40 fffffa80`0dbb4a38 : e22w7x64+0x19fa0
    fffff880`0e5c3808 00000000`00001528 : fffffa80`0dbb6b58 fffffa80`0dbb6b40 fffffa80`0dbb4a38 fffff880`04171eb2 : 0xfffffa80`0dbb6b40
    fffff880`0e5c3810 fffffa80`0dbb6b58 : fffffa80`0dbb6b40 fffffa80`0dbb4a38 fffff880`04171eb2 00000000`00000002 : 0x1528
    fffff880`0e5c3818 fffffa80`0dbb6b40 : fffffa80`0dbb4a38 fffff880`04171eb2 00000000`00000002 00000000`00000000 : 0xfffffa80`0dbb6b58
    fffff880`0e5c3820 fffffa80`0dbb4a38 : fffff880`04171eb2 00000000`00000002 00000000`00000000 fffffa80`0d49d820 : 0xfffffa80`0dbb6b40
    fffff880`0e5c3828 fffff880`04171eb2 : 00000000`00000002 00000000`00000000 fffffa80`0d49d820 00000000`0000024c : 0xfffffa80`0dbb4a38
    fffff880`0e5c3830 00000000`00000002 : 00000000`00000000 fffffa80`0d49d820 00000000`0000024c fffffa80`0ddacf50 : e22w7x64+0x18eb2
    fffff880`0e5c3838 00000000`00000000 : fffffa80`0d49d820 00000000`0000024c fffffa80`0ddacf50 fffff880`0417c432 : 0x2
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    e22w7x64+19fa0
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  e22w7x64+19fa0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: e22w7x64
    
    IMAGE_NAME:  e22w7x64.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  50bf79c4
    
    FAILURE_BUCKET_ID:  X64_0xD1_e22w7x64+19fa0
    
    BUCKET_ID:  X64_0xD1_e22w7x64+19fa0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xd1_e22w7x64+19fa0
    
    FAILURE_ID_HASH:  {13809988-6ac7-9638-6d45-c609868649bd}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by Kumar Anup Friday, July 11, 2014 6:11 PM
    • Unproposed as answer by Kumar Anup Friday, July 11, 2014 6:11 PM
    • Marked as answer by ZigZag3143x Saturday, July 26, 2014 4:30 PM
    Friday, July 11, 2014 4:49 PM

All replies

  • Are you using McAfee? I have seen McAfee cause this error before.

    McAfee Removal Tool
    http://service.mcafee.com/FAQDocument.aspx?id=TS100507

    Otherwise, I would check your drivers and make sure they are all up to date.

    Thursday, July 10, 2014 4:38 PM
  • Hey 

    in the past few weeks i have been getting Window Blue screen errors with the following Error msg:

    Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.1.7601.2.1.0.256.48
      Locale ID: 4105

    Additional information about the problem:
      BCCode: d1
      BCP1: FFFFF8800BEC4000
      BCP2: 0000000000000002
      BCP3: 0000000000000000
      BCP4: FFFFF88004172FA0
      OS Version: 6_1_7601
      Service Pack: 1_0
      Product: 256_1

    Files that help describe the problem:
      C:\Windows\Minidump\071014-37065-01.dmp
      C:\Users\Sheeraz\AppData\Local\Temp\WER-43087-0.sysdata.xml

    Read our privacy statement online:
      http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

    If the online privacy statement is not available, please read our privacy statement offline:
      C:\Windows\system32\en-US\erofflps.txt

    I was hoping someone can help me out or give me a idea of how to fix this issue. Thanks ! 

    My System Specs are:

    Processor: intel(R) Core(TM) i7-4770l CPU@3.50 GHz 3.50 Ghz

    Ram: 16 GB

    65 Bit operating system Windows 7 Pro

    We do need the actual log file (called a DMP file) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  
    We prefer at least 2 DMP files to spot trends and confirm the cause.

    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    If you are using Blue screen view, who crashed, or a similar application, don't.  They are wrong at least as often as they are correct


    Wanikiya and Dyami--Team Zigzag

    Thursday, July 10, 2014 6:01 PM
  • Hey, first off thanks for getting back to me so quickly :D

    I hope i did this correctly but here are the DMP files:

    https://onedrive.live.com/redir?resid=403DCDBDEBDE9493!107&authkey=!ADooMZtTHV_L8s0&ithint=file%2c.rar

    Let me know if you need anything else. 

    Thanks again ! 

    Friday, July 11, 2014 2:18 PM
  • I recommend performing the following steps:

    1. Check to make sure you're running the latest BIOS version for your motherboard - if not update to latest version
    2. If you're already running the latest version please clear CMOS and load optimized defaults
    3. Run Memtest 86+ at stock BIOS settings (run extended test = 8 hours or longer)
    4. If Memtest passes scan your PC for viruses / malware / trojans etc.
    5. Run Malwarebytes in safe mode - if any infections are found let MB clean them up
    6. After MB has done it's thing, grab a copy of VipreRescue and follow the instructions for use;http://www.vipreantivirus.com/live/

    Friday, July 11, 2014 3:15 PM
  • Hey, first off thanks for getting back to me so quickly :D

    I hope i did this correctly but here are the DMP files:

    https://onedrive.live.com/redir?resid=403DCDBDEBDE9493!107&authkey=!ADooMZtTHV_L8s0&ithint=file%2c.rar

    Let me know if you need anything else. 

    Thanks again ! 

    BT

    These were Related to e22W7x64.sys Killer e2200 PCI-E Gigabit Ethernet Controller from Qualcomm Atheros.   I would install the newest driver available even if it is th same date as drivers do become corrupt

    Microsoft (R) Windows Debugger Version 6.3.9600.17029 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\Ken\Desktop\New folder\071014-37065-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    OK                                             C:\Users\Ken\Desktop
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\Users\Ken\Desktop
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
    Machine Name:
    Kernel base = 0xfffff800`02e06000 PsLoadedModuleList = 0xfffff800`03049890
    Debug session time: Thu Jul 10 11:47:50.620 2014 (UTC - 4:00)
    System Uptime: 0 days 2:11:43.337
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {fffff8800bec4000, 2, 0, fffff88004172fa0}
    
    *** WARNING: Unable to verify timestamp for e22w7x64.sys
    *** ERROR: Module load completed but symbols could not be loaded for e22w7x64.sys
    Probably caused by : e22w7x64.sys ( e22w7x64+19fa0 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: fffff8800bec4000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff88004172fa0, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b3100
    GetUlongFromAddress: unable to read from fffff800030b31c0
     fffff8800bec4000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    e22w7x64+19fa0
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  LolClient.exe
    
    ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
    
    TRAP_FRAME:  fffff8800e5c3670 -- (.trap 0xfffff8800e5c3670)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000000004a rbx=0000000000000000 rcx=fffffa800d4c2748
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88004172fa0 rsp=fffff8800e5c3800 rbp=fffffa800d4c2690
     r8=0000000000000300  r9=0000000000000000 r10=fffffa800dbca280
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    e22w7x64+0x19fa0:
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14 ds:00000000`00000248=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002e7b169 to fffff80002e7bbc0
    
    STACK_TEXT:  
    fffff880`0e5c3528 fffff800`02e7b169 : 00000000`0000000a fffff880`0bec4000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e5c3530 fffff800`02e79de0 : fffff8a0`04fc6124 fffff8a0`00024010 fffff880`0e5c3810 fffffa80`0dbb6b40 : nt!KiBugCheckDispatch+0x69
    fffff880`0e5c3670 fffff880`04172fa0 : fffffa80`0dbb6b40 00000000`00001528 fffffa80`0dbb6b58 fffffa80`0dbb6b40 : nt!KiPageFault+0x260
    fffff880`0e5c3800 fffffa80`0dbb6b40 : 00000000`00001528 fffffa80`0dbb6b58 fffffa80`0dbb6b40 fffffa80`0dbb4a38 : e22w7x64+0x19fa0
    fffff880`0e5c3808 00000000`00001528 : fffffa80`0dbb6b58 fffffa80`0dbb6b40 fffffa80`0dbb4a38 fffff880`04171eb2 : 0xfffffa80`0dbb6b40
    fffff880`0e5c3810 fffffa80`0dbb6b58 : fffffa80`0dbb6b40 fffffa80`0dbb4a38 fffff880`04171eb2 00000000`00000002 : 0x1528
    fffff880`0e5c3818 fffffa80`0dbb6b40 : fffffa80`0dbb4a38 fffff880`04171eb2 00000000`00000002 00000000`00000000 : 0xfffffa80`0dbb6b58
    fffff880`0e5c3820 fffffa80`0dbb4a38 : fffff880`04171eb2 00000000`00000002 00000000`00000000 fffffa80`0d49d820 : 0xfffffa80`0dbb6b40
    fffff880`0e5c3828 fffff880`04171eb2 : 00000000`00000002 00000000`00000000 fffffa80`0d49d820 00000000`0000024c : 0xfffffa80`0dbb4a38
    fffff880`0e5c3830 00000000`00000002 : 00000000`00000000 fffffa80`0d49d820 00000000`0000024c fffffa80`0ddacf50 : e22w7x64+0x18eb2
    fffff880`0e5c3838 00000000`00000000 : fffffa80`0d49d820 00000000`0000024c fffffa80`0ddacf50 fffff880`0417c432 : 0x2
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    e22w7x64+19fa0
    fffff880`04172fa0 4c39b748020000  cmp     qword ptr [rdi+248h],r14
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  e22w7x64+19fa0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: e22w7x64
    
    IMAGE_NAME:  e22w7x64.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  50bf79c4
    
    FAILURE_BUCKET_ID:  X64_0xD1_e22w7x64+19fa0
    
    BUCKET_ID:  X64_0xD1_e22w7x64+19fa0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xd1_e22w7x64+19fa0
    
    FAILURE_ID_HASH:  {13809988-6ac7-9638-6d45-c609868649bd}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    • Proposed as answer by Kumar Anup Friday, July 11, 2014 6:11 PM
    • Unproposed as answer by Kumar Anup Friday, July 11, 2014 6:11 PM
    • Marked as answer by ZigZag3143x Saturday, July 26, 2014 4:30 PM
    Friday, July 11, 2014 4:49 PM
  • Hi,

    Coming blue screen may cause for several issue, and it is very difficult to identify the root cause, i want to suggest you to download Blue screen viewer, Blue screen viewer is a small software. using this software you and analysis the root cause for this issue.

    1. download Blue screen viewer form internet.

    2. import minidump file from c:\windows\minidumps to Bluescreen viewer.

    http://www.nirsoft.net/utils/blue_screen_view.html 


    Anup Kumar MCTS


    • Edited by Kumar Anup Friday, July 11, 2014 6:19 PM
    Friday, July 11, 2014 6:19 PM