locked
Many unexpected shutdowns RRS feed

  • Question

  • I have a Dell laptop, XPS L702X. I have Windows 7 Home Premium installed -- Version 6.1 Build 7601, Service Pack 1. All of the updates are loaded. I am beginning to wonder if that may be the cause of my problem.

    This *is* a home PC, there is no "server."

    Upon finding my PC frozen this morning -- yet again, after at least a dozen such mornings -- I looked in my Event Log and found this:

    Log Name:      System
    Source:        EventLog
    Date:          10/21/2015 11:21:38 AM
    Event ID:      6008
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      Dana-PC
    Description:
    The previous system shutdown at 1:04:59 AM on ‎10/‎21/‎2015 was unexpected.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="EventLog" />
        <EventID Qualifiers="32768">6008</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2015-10-21T16:21:38.000000000Z" />
        <EventRecordID>339649</EventRecordID>
        <Channel>System</Channel>
        <Computer>Dana-PC</Computer>
        <Security />
      </System>
      <EventData>
        <Data>1:04:59 AM</Data>
        <Data>‎10/‎21/‎2015</Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>23664</Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Binary>DF070A0003001500010004003B005A02DF070A0003001500060004003B005A02201C00003C00000001000000201C000000000000100E00000100000000000000</Binary>
      </EventData>
    </Event>


    The page at URL https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.0&EvtID=6008&EvtSrc=EventLog&LCID=1033 

    tells me: 

    Explanation
    This event indicates that an inconsistency exists between the Browser service and the server service.
       
    User Action

    Contact the person with administrative rights on your computer if this message is in the Event Log in Event Viewer more than six times. Otherwise, stopping and restarting the server will eliminate the error.

    Well, I am "the person with administrative rights on [my] computer." This has happened more than six times. 

    What do I do?

    Please note, I have seen the 2012 query at URL https://social.technet.microsoft.com/Forums/windows/en-US/f27c145c-9e48-4994-8bc4-a194f2cd7251/microsoft-product-windows-operating-system-version-61760016385-event-id-6008-event-source?forum=w7itproperf

    I have reviewed the questions and suggestions there.

    What task was I doing before shutdown?  None. The computer was idle, had been for perhaps two hours. It was not locked, and the screensaver does not require a password.

    My BIOS is not overclocked.

    The most recent file in C:\Windows\Minidump was created in April 2015. I am writing this on 21 October 2015.

    I have reviewed the KnowledgeBase article at https://support.microsoft.com/en-us/kb/326564 .  It seems to have no information to add. Since it addresses Windows 2000, I have not downloaded the "hot fix" that it offers.

    By the way, I have received MS's offer to download Windows 10. Dell has not tested my PC with Windows 10 and thus does not guarantee that it will work on it. I plan to wait until January 2016 to download and install it -- I intend to let others be Microsoft's "early adopter" guinea pigs.

    What can I do? What should I do?  What do I do?

    Wednesday, October 21, 2015 5:40 PM

Answers

  • Hi,

    It is hard to determine the exact reason just according to the event which you upload. The event log just displayed an event ID for the unexpected shutdown and have no further useful information. There are many reasons could cause the unexpected shut down, and you can follow my suggestions below to check the issue.

    1. Scan the virus in safe mode due to virus could cause the issue.
    2. Check the usage of CPU, memory and other hardware. The overload hardware usage will also leads to the unexpected shut down. You can determine which process occupied the usage and disable it if it is not a system process via Resource Monitor. Then uninstall the software which related to the process.
    3. Perform System Restore to restore system if the issue occurs recently.

    http://windows.microsoft.com/en-us/windows/what-is-system-restore#1TC=windows-7

    In addition to that, we suggest you upload your dump file to us so that we can help you better. For you said that “The most recent file in C:\Windows\Minidump was created in April 2015,” it is strange due to every time your system crash, the system will create a dump file for it. I suggest you right click “This Computer” in desktop, then click “Advanced system settings” > “Advanced” > “Startup and Recovery”. The you will see the location which the dump file saved.

    Wish you fix it smoothly.

    Best Regards

    Simon


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    • Marked as answer by Dana Netherton Saturday, November 14, 2015 6:26 PM
    Monday, October 26, 2015 5:18 AM
  • The crash was related to your nVidia video driver

    Completely remove the current driver and install the newest driver available.  For instructions on how to do that Read all about updating drivers by my partner JMH3143 here http://answers.microsoft.com/en-us/windows/wiki/windows_other-hardware/updating-a-driver/a5e6345e-af9b-4099-bef0-8d22254aa1c1?tm=1436753520149

    In addition your event viewer log shows these issues

    Product: Adobe Acrobat Reader DC - Update '{AC76BA86-7AD7-0000-2550-AC0F094E6D00}' could not be installed.

    The PC Tools Browser Defender Driver service depends on the following service: PCTCore. This service might not be installed.  This should be removed

    The description for Event ID 0 from source BstHdAndroidSvc cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted.

    The description for Event ID 0 from source CyberGhost VPN Client Service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted.

    The BlueStacks Android Service service terminated with the following error:
    An exception occurred in the service when handling the control request.

    Many, many more

    Please run a system file check (SFC) & DISM (if necessary) if you are on win 8 or higher.  It will find errors

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.



    Frankly there are so many issues I would consider clean installing win 7

    Microsoft (R) Windows Debugger Version 10.0.10563.566 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\DANA-MEMORY.DMP]
    Kernel Summary Dump File: Kernel address space is available, User address space may not be available.
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
    Machine Name:
    Kernel base = 0xfffff800`03416000 PsLoadedModuleList = 0xfffff800`0365a890
    Debug session time: Sat Apr  4 03:21:43.493 2015 (UTC - 4:00)
    System Uptime: 0 days 13:27:18.727
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................................................
    Loading User Symbols
    
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 7E, {ffffffffc0000005, fffff88005a163e0, fffff880009dc0e8, fffff880009db940}
    
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
    Probably caused by : nvlddmkm.sys ( nvlddmkm+1af3e0 )
    
    Followup:     MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88005a163e0, The address that the exception occurred at
    Arg3: fffff880009dc0e8, Exception Record Address
    Arg4: fffff880009db940, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:  System SKUNumber
    
    BIOS_DATE:  11/11/2011
    
    BASEBOARD_PRODUCT:  0K4H3G
    
    BASEBOARD_VERSION:  FAB1
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff88005a163e0
    
    BUGCHECK_P3: fffff880009dc0e8
    
    BUGCHECK_P4: fffff880009db940
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    nvlddmkm+1af3e0
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4
    
    EXCEPTION_RECORD:  fffff880009dc0e8 -- (.exr 0xfffff880009dc0e8)
    ExceptionAddress: fffff88005a163e0 (nvlddmkm+0x00000000001af3e0)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000058
    Attempt to read from address 0000000000000058
    
    CONTEXT:  fffff880009db940 -- (.cxr 0xfffff880009db940)
    rax=0000000000000002 rbx=fffffa8009e32990 rcx=0000000000000000
    rdx=00000000000090f1 rsi=0000000000080000 rdi=0000000000000000
    rip=fffff88005a163e0 rsp=fffff880009dc320 rbp=0000000000000000
     r8=0000000000000000  r9=0000000000000000 r10=fffff88005a1d64c
    r11=fffff880009dc430 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=fffffa800b544000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
    nvlddmkm+0x1af3e0:
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4 ds:002b:00000000`00000058=????????
    Resetting default scope
    
    CPU_COUNT: 4
    
    CPU_MHZ: 95a
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 2a
    
    CPU_STEPPING: 7
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000058
    
    READ_ADDRESS:  0000000000000058 
    
    FOLLOWUP_IP: 
    nvlddmkm+1af3e0
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4
    
    BUGCHECK_STR:  0x7E
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    ANALYSIS_VERSION: 10.0.10563.566 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff88005a17295 to fffff88005a163e0
    
    STACK_TEXT:  
    fffff880`009dc320 fffff880`05a17295 : fffffa80`09e32990 fffffa80`09e46f30 00000000`00001000 fffffa80`09e32990 : nvlddmkm+0x1af3e0
    fffff880`009dc350 fffff880`05bb22de : fffffa80`09e32990 fffffa80`44092401 fffffa80`0f67eb30 00000000`0007f000 : nvlddmkm+0x1b0295
    fffff880`009dc380 fffff880`05ceea7b : fffffa80`0b544000 fffffa80`09e21a30 00000000`00000000 fffffa80`0b544000 : nvlddmkm+0x34b2de
    fffff880`009dc3f0 fffff880`05afa4b6 : fffffa80`09e215a0 fffffa80`0b551000 fffffa80`0b551000 fffffa80`0b536710 : nvlddmkm+0x487a7b
    fffff880`009dc460 fffff880`05b00eec : fffffa80`0b551000 fffffa80`09e51a90 fffffa80`09e21a30 00000000`00000001 : nvlddmkm+0x2934b6
    fffff880`009dc4c0 fffff880`05b03593 : fffffa80`070506f0 fffffa80`0b551000 00000000`00000000 00000000`00000000 : nvlddmkm+0x299eec
    fffff880`009dc500 fffff880`05a6e5c1 : 00000000`00000017 00000000`00002300 fffffa80`0b544000 00000000`00000016 : nvlddmkm+0x29c593
    fffff880`009dc560 fffff880`05c24aa1 : fffffa80`0b544000 fffffa80`0b54d000 fffffa80`0b544000 fffffa80`0b5ae000 : nvlddmkm+0x2075c1
    fffff880`009dc610 fffff880`05c24931 : fffffa80`0b544000 00000000`00000400 fffffa80`0b55c000 00000000`00000000 : nvlddmkm+0x3bdaa1
    fffff880`009dc650 fffff880`059e4ba8 : fffffa80`00000001 fffffa80`0b544000 00000000`00000400 fffffa80`0b544000 : nvlddmkm+0x3bd931
    fffff880`009dc680 fffff880`05949726 : 00000000`00000004 fffff880`009dc8b0 00000000`00000004 fffff880`00000000 : nvlddmkm+0x17dba8
    fffff880`009dc7b0 fffff880`05949045 : fffffa80`0a2a2000 00000020`00000000 fffff880`009dc8f0 fffffa80`06d32b50 : nvlddmkm+0xe2726
    fffff880`009dc920 fffff880`0599bc57 : fffffa80`0fb40200 fffffa80`0fb400a0 fffffa80`0fb400a0 fffffa80`0fb400a0 : nvlddmkm+0xe2045
    fffff880`009dca70 fffff800`035a8165 : 00000000`00000001 00000000`11000059 00000000`00000001 fffffa80`0fb40148 : nvlddmkm+0x134c57
    fffff880`009dcb50 fffff800`03729b8a : 00000000`00000000 fffffa80`06d32b50 00000000`00000080 00000000`00000000 : nt!PopIrpWorker+0x3c5
    fffff880`009dcc00 fffff800`0347c8e6 : fffff880`031d7180 fffffa80`06d32b50 fffff880`031e1fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`009dcc40 00000000`00000000 : fffff880`009dd000 fffff880`009d7000 fffff880`009dbe10 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nvlddmkm+1af3e0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nvlddmkm
    
    IMAGE_NAME:  nvlddmkm.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  550304cc
    
    STACK_COMMAND:  .cxr 0xfffff880009db940 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_nvlddmkm+1af3e0
    
    BUCKET_ID:  X64_0x7E_nvlddmkm+1af3e0
    
    PRIMARY_PROBLEM_CLASS:  X64_0x7E_nvlddmkm+1af3e0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_nvlddmkm+1af3e0
    
    FAILURE_ID_HASH:  {187372ac-2a13-5a99-3981-a80230b8954e}
    
    Followup:     MachineOwner
    ---------
    
    0: kd> lmvm nvlddmkm
    Browse full module list
    start             end                 module name
    fffff880`05867000 fffff880`06272000   nvlddmkm   (no symbols)           
        Loaded symbol image file: nvlddmkm.sys
        Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
        Image name: nvlddmkm.sys
        Browse all global symbols  functions  data
        Timestamp:        Fri Mar 13 11:39:56 2015 (550304CC)
        CheckSum:         009CE879
        ImageSize:        00A0B000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    • Marked as answer by Dana Netherton Saturday, November 14, 2015 6:03 PM
    Friday, October 30, 2015 10:41 AM
  • Hi,

    Thank you for your reply.

    According to the dump file which you offered, it seems a driver called “nvlddmkm.sys” cause the issue.

    After researching, we found this driver belonged to Nvidia. We suggest you download the latest driver version from the Nvidia official website. Pay attention to that the driver version matches for system version bit.

    If it doesn’t work, you can contact your PC manufacturer for help due to we consider it is the hardware issue.

    Good luck with you.

    Best Regards

    Simon


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Monday, November 2, 2015 12:56 AM

All replies

  • Please read this wiki to find out how to find and upload your event viewer logs

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Wednesday, October 21, 2015 6:26 PM
  • Hi,

    It is hard to determine the exact reason just according to the event which you upload. The event log just displayed an event ID for the unexpected shutdown and have no further useful information. There are many reasons could cause the unexpected shut down, and you can follow my suggestions below to check the issue.

    1. Scan the virus in safe mode due to virus could cause the issue.
    2. Check the usage of CPU, memory and other hardware. The overload hardware usage will also leads to the unexpected shut down. You can determine which process occupied the usage and disable it if it is not a system process via Resource Monitor. Then uninstall the software which related to the process.
    3. Perform System Restore to restore system if the issue occurs recently.

    http://windows.microsoft.com/en-us/windows/what-is-system-restore#1TC=windows-7

    In addition to that, we suggest you upload your dump file to us so that we can help you better. For you said that “The most recent file in C:\Windows\Minidump was created in April 2015,” it is strange due to every time your system crash, the system will create a dump file for it. I suggest you right click “This Computer” in desktop, then click “Advanced system settings” > “Advanced” > “Startup and Recovery”. The you will see the location which the dump file saved.

    Wish you fix it smoothly.

    Best Regards

    Simon


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    • Marked as answer by Dana Netherton Saturday, November 14, 2015 6:26 PM
    Monday, October 26, 2015 5:18 AM
  • Thank you, Simon. I tried to follow your suggestions. Here are the steps I followed, and their responses. Please note, though I did locate the file MEMORY.DMP, I do not know how to examine it, and I do not see a way to share it with you guys.

    26 Oct 2015: After signed in, clicked on Start, to run anti virus program. Computer froze. Mouse still moves the cursor, num lock etc still works. Manual shut down.

    Safe mode again. After signed in, right clicked on "Computer." Clicked on Properties, then etc. %SystemRoot%\Memory Dump.

    Clicked on Explorer on task bar to go there. Computer froze. Num lock etc still works. This time, CTR-ALT-DEL. Locked computer, then logged in. It took the password, then froze. Rotating circle next to "Welcome" did not rotate. "Start" key visible at bottom left corner. Etc.

    CTR-ALT-DEL, "Lock this computer." Logged back in. Same result.

    CTR-ALT-DEL. "Start Task Manager." Came up. Top process using memory Anti Malware Service Executable., 26,604K. Next, Windows Explorer, 23,992K. Next, Microsoft Help & Support, 11,120K. The rest, less than 7,000K. Closed by clicking on "x." Screen & computer froze.

    CTR-ALT-DEL. Logged off. Logged in. Filename MEMORY.DMP. Found no "root" directory with that for. Searched "Computer." Found Genie zip files on backup hard drive. Latest, Apr 2013.

    Tried again, OS (C:). Search ran, no results.

    So tried virus scan, using Microsoft Security Essentials. Quick Scan. 21 minutes. No threats detected. Closed MSE.

    Looked in C:\ for MEMORY.DMP. Not there. Found it in C:\Windows., date 4/4/2015. size 533,005 kb.

    Restart normal. Verified file location. Then started Chrome. While home page loading, computer froze.

    CTR-ALT-DEL. No reaction. Manual stop.

    Normal start. Logged in. Screen went dark. CTR-ALT-DEL. Locked, signed in, got regular screen.

    Checked file. Same date, same size.

    Note, Threatfire reports no malware and no suspicious activities in last 90 days, on 28 Oct 2015.

    Thursday, October 29, 2015 8:10 PM
  • Reboot into safemode and download /run malwarebytes.  Maybe your computer ran windows updates and broke. Perhaps the quickest method is to re-format your machine. 
    Thursday, October 29, 2015 8:17 PM
  • Ah! I think I found out how to send you guys my Memory Dump File.  Please go to this public Dropbox link:

    https://dl.dropboxusercontent.com/u/44771144/DANA-MEMORY.DMP

    Thursday, October 29, 2015 8:22 PM
  • Thank you. In case this might help, please go to this public Dropbox link:

    https://dl.dropboxusercontent.com/u/44771144/Dana-Errors.evtx

    For some reason, the Forum software refuses to let me insert links until I "verify my account."  Since I don't see anything in the Forum's FAQ telling me how to "verify my account," I am simply giving the URL as plain text.

    I hope this helps.

    Thursday, October 29, 2015 8:26 PM
  • The crash was related to your nVidia video driver

    Completely remove the current driver and install the newest driver available.  For instructions on how to do that Read all about updating drivers by my partner JMH3143 here http://answers.microsoft.com/en-us/windows/wiki/windows_other-hardware/updating-a-driver/a5e6345e-af9b-4099-bef0-8d22254aa1c1?tm=1436753520149

    In addition your event viewer log shows these issues

    Product: Adobe Acrobat Reader DC - Update '{AC76BA86-7AD7-0000-2550-AC0F094E6D00}' could not be installed.

    The PC Tools Browser Defender Driver service depends on the following service: PCTCore. This service might not be installed.  This should be removed

    The description for Event ID 0 from source BstHdAndroidSvc cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted.

    The description for Event ID 0 from source CyberGhost VPN Client Service cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted.

    The BlueStacks Android Service service terminated with the following error:
    An exception occurred in the service when handling the control request.

    Many, many more

    Please run a system file check (SFC) & DISM (if necessary) if you are on win 8 or higher.  It will find errors

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.



    Frankly there are so many issues I would consider clean installing win 7

    Microsoft (R) Windows Debugger Version 10.0.10563.566 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\DANA-MEMORY.DMP]
    Kernel Summary Dump File: Kernel address space is available, User address space may not be available.
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*E:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18741.amd64fre.win7sp1_gdr.150202-1526
    Machine Name:
    Kernel base = 0xfffff800`03416000 PsLoadedModuleList = 0xfffff800`0365a890
    Debug session time: Sat Apr  4 03:21:43.493 2015 (UTC - 4:00)
    System Uptime: 0 days 13:27:18.727
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .............................................................
    Loading User Symbols
    
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 7E, {ffffffffc0000005, fffff88005a163e0, fffff880009dc0e8, fffff880009db940}
    
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
    Probably caused by : nvlddmkm.sys ( nvlddmkm+1af3e0 )
    
    Followup:     MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88005a163e0, The address that the exception occurred at
    Arg3: fffff880009dc0e8, Exception Record Address
    Arg4: fffff880009db940, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    SYSTEM_SKU:  System SKUNumber
    
    BIOS_DATE:  11/11/2011
    
    BASEBOARD_PRODUCT:  0K4H3G
    
    BASEBOARD_VERSION:  FAB1
    
    BUGCHECK_P1: ffffffffc0000005
    
    BUGCHECK_P2: fffff88005a163e0
    
    BUGCHECK_P3: fffff880009dc0e8
    
    BUGCHECK_P4: fffff880009db940
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    nvlddmkm+1af3e0
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4
    
    EXCEPTION_RECORD:  fffff880009dc0e8 -- (.exr 0xfffff880009dc0e8)
    ExceptionAddress: fffff88005a163e0 (nvlddmkm+0x00000000001af3e0)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000058
    Attempt to read from address 0000000000000058
    
    CONTEXT:  fffff880009db940 -- (.cxr 0xfffff880009db940)
    rax=0000000000000002 rbx=fffffa8009e32990 rcx=0000000000000000
    rdx=00000000000090f1 rsi=0000000000080000 rdi=0000000000000000
    rip=fffff88005a163e0 rsp=fffff880009dc320 rbp=0000000000000000
     r8=0000000000000000  r9=0000000000000000 r10=fffff88005a1d64c
    r11=fffff880009dc430 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=fffffa800b544000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
    nvlddmkm+0x1af3e0:
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4 ds:002b:00000000`00000058=????????
    Resetting default scope
    
    CPU_COUNT: 4
    
    CPU_MHZ: 95a
    
    CPU_VENDOR:  GenuineIntel
    
    CPU_FAMILY: 6
    
    CPU_MODEL: 2a
    
    CPU_STEPPING: 7
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000058
    
    READ_ADDRESS:  0000000000000058 
    
    FOLLOWUP_IP: 
    nvlddmkm+1af3e0
    fffff880`05a163e0 83795804        cmp     dword ptr [rcx+58h],4
    
    BUGCHECK_STR:  0x7E
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    ANALYSIS_VERSION: 10.0.10563.566 amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff88005a17295 to fffff88005a163e0
    
    STACK_TEXT:  
    fffff880`009dc320 fffff880`05a17295 : fffffa80`09e32990 fffffa80`09e46f30 00000000`00001000 fffffa80`09e32990 : nvlddmkm+0x1af3e0
    fffff880`009dc350 fffff880`05bb22de : fffffa80`09e32990 fffffa80`44092401 fffffa80`0f67eb30 00000000`0007f000 : nvlddmkm+0x1b0295
    fffff880`009dc380 fffff880`05ceea7b : fffffa80`0b544000 fffffa80`09e21a30 00000000`00000000 fffffa80`0b544000 : nvlddmkm+0x34b2de
    fffff880`009dc3f0 fffff880`05afa4b6 : fffffa80`09e215a0 fffffa80`0b551000 fffffa80`0b551000 fffffa80`0b536710 : nvlddmkm+0x487a7b
    fffff880`009dc460 fffff880`05b00eec : fffffa80`0b551000 fffffa80`09e51a90 fffffa80`09e21a30 00000000`00000001 : nvlddmkm+0x2934b6
    fffff880`009dc4c0 fffff880`05b03593 : fffffa80`070506f0 fffffa80`0b551000 00000000`00000000 00000000`00000000 : nvlddmkm+0x299eec
    fffff880`009dc500 fffff880`05a6e5c1 : 00000000`00000017 00000000`00002300 fffffa80`0b544000 00000000`00000016 : nvlddmkm+0x29c593
    fffff880`009dc560 fffff880`05c24aa1 : fffffa80`0b544000 fffffa80`0b54d000 fffffa80`0b544000 fffffa80`0b5ae000 : nvlddmkm+0x2075c1
    fffff880`009dc610 fffff880`05c24931 : fffffa80`0b544000 00000000`00000400 fffffa80`0b55c000 00000000`00000000 : nvlddmkm+0x3bdaa1
    fffff880`009dc650 fffff880`059e4ba8 : fffffa80`00000001 fffffa80`0b544000 00000000`00000400 fffffa80`0b544000 : nvlddmkm+0x3bd931
    fffff880`009dc680 fffff880`05949726 : 00000000`00000004 fffff880`009dc8b0 00000000`00000004 fffff880`00000000 : nvlddmkm+0x17dba8
    fffff880`009dc7b0 fffff880`05949045 : fffffa80`0a2a2000 00000020`00000000 fffff880`009dc8f0 fffffa80`06d32b50 : nvlddmkm+0xe2726
    fffff880`009dc920 fffff880`0599bc57 : fffffa80`0fb40200 fffffa80`0fb400a0 fffffa80`0fb400a0 fffffa80`0fb400a0 : nvlddmkm+0xe2045
    fffff880`009dca70 fffff800`035a8165 : 00000000`00000001 00000000`11000059 00000000`00000001 fffffa80`0fb40148 : nvlddmkm+0x134c57
    fffff880`009dcb50 fffff800`03729b8a : 00000000`00000000 fffffa80`06d32b50 00000000`00000080 00000000`00000000 : nt!PopIrpWorker+0x3c5
    fffff880`009dcc00 fffff800`0347c8e6 : fffff880`031d7180 fffffa80`06d32b50 fffff880`031e1fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`009dcc40 00000000`00000000 : fffff880`009dd000 fffff880`009d7000 fffff880`009dbe10 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  nvlddmkm+1af3e0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nvlddmkm
    
    IMAGE_NAME:  nvlddmkm.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  550304cc
    
    STACK_COMMAND:  .cxr 0xfffff880009db940 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_nvlddmkm+1af3e0
    
    BUCKET_ID:  X64_0x7E_nvlddmkm+1af3e0
    
    PRIMARY_PROBLEM_CLASS:  X64_0x7E_nvlddmkm+1af3e0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_nvlddmkm+1af3e0
    
    FAILURE_ID_HASH:  {187372ac-2a13-5a99-3981-a80230b8954e}
    
    Followup:     MachineOwner
    ---------
    
    0: kd> lmvm nvlddmkm
    Browse full module list
    start             end                 module name
    fffff880`05867000 fffff880`06272000   nvlddmkm   (no symbols)           
        Loaded symbol image file: nvlddmkm.sys
        Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
        Image name: nvlddmkm.sys
        Browse all global symbols  functions  data
        Timestamp:        Fri Mar 13 11:39:56 2015 (550304CC)
        CheckSum:         009CE879
        ImageSize:        00A0B000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    


    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    • Marked as answer by Dana Netherton Saturday, November 14, 2015 6:03 PM
    Friday, October 30, 2015 10:41 AM
  • Hi,

    Thank you for your reply.

    According to the dump file which you offered, it seems a driver called “nvlddmkm.sys” cause the issue.

    After researching, we found this driver belonged to Nvidia. We suggest you download the latest driver version from the Nvidia official website. Pay attention to that the driver version matches for system version bit.

    If it doesn’t work, you can contact your PC manufacturer for help due to we consider it is the hardware issue.

    Good luck with you.

    Best Regards

    Simon


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Monday, November 2, 2015 12:56 AM
  • Thank you for your reply. I apologize for the delay in my response. It has taken me this long to carve out the time and attention I needed to sit down for about 3 1/2 hours and parse this out. (While fending off my wife's attempts to pay attention to her.)

    Since your reply was the most complete, I'll respond to yours ... inline.

    You said:

    "The crash was related to your nVidia video driver

    Completely remove the current driver and install the newest driver available." etc

    Thank you. Yesterday (13 Nov 2015) I removed that driver, and replaced it with the newest one that was available from the Microsoft Compatibility Hardware Publisher.

    While downloading NVIDIA's latest driver, I noticed that NVIDIA warned that their newest drivers have not been tested to be compatible with my hardware. So I allowed the MSCHP to do its thing. As far as I am concerned, no more NVIDIA driver updates for this laptop.

    You also wrote:

    "In addition your event viewer log shows these issues

    Product: Adobe Acrobat Reader DC - Update '{AC76BA86-7AD7-0000-2550-AC0F094E6D00}' could not be installed.

    The PC Tools Browser Defender Driver service depends on the following service: PCTCore. This service might not be installed.  This should be removed"

    Thanks. When I uninstalled PC Tools with the Windows 7 Control Panel, clearly not all of PC Tools was actually uninstalled. Using Task Manager I stopped that "service," and then deleted the files and directories that Control Panel had left inside my Windows directory.

    You also wrote:

    "Many, many more

    Please run a system file check (SFC) & DISM (if necessary) if you are on win 8 or higher.  It will find errors

    All instructions are in our Wiki article below...
    Should you have any questions please ask us.


    As I noted in my Original Post, I am on Windows 7. I am open to suggestions for checking and repairing Windows 7 System Files.

    You also wrote:

    "Frankly there are so many issues I would consider clean installing win 7"

    Thank you. I have just spent the past week reconfiguring my smart phone after "clean installing" an Android update onto it. Wiping my laptop completely?  Please.

    I know, I know. "It's easy-peasy. All you have to do is ..."  A quick web search turned up half a dozen articles that promised to walk me through it. Beginning with, "back up everything on your computer."

    In my experience, any advice that begins, "All you have to do is ..." is usable only by an expert. Usually, that expert. Usually, after about the time that the expert predicted, times pi. At best, since "stuff [always] happens."

    If I must clean install Windows 7, I will probably follow these three steps:

    1. "Back up everything on my computer,"

    2. Drop the laptop from my balcony, and

    3. Buy a new laptop.

    Now, having done all this I left the laptop running overnight. This morning (14 Nov 2015), I saw a BSOD (Blue Screen Of Death). I photographed it with my phone, in case it helps you guys. I am still struggling to find its memory dump file. I will address this search in a response to a different reply.

    Truly, thank you for your help. If you see any "attitude" in any part of this response, it comes from my continued frustration with the situation.

    Saturday, November 14, 2015 6:02 PM
  • Thanks for your reply. I apologize for the delay in my response.

    As I just noted in a response to another person's reply, yesterday I took some steps to clean up my laptop (replaced a video driver, expunged some files that had not been removed by "remove program" in Control Panel) and left the laptop running overnight.

    This morning, I found a BSOD (Blue Screen Of Death) on the laptop.

    In a minute, I will post a URL to a photo I took of that laptop screen. Here though I want to address my search for its dump file.

    In your reply here, you gave this advice for finding a dump file:

    "In addition to that, we suggest you upload your dump file to us so that we can help you better. For you said that “The most recent file in C:\Windows\Minidump was created in April 2015,” it is strange due to every time your system crash, the system will create a dump file for it. I suggest you right click “This Computer” in desktop, then click “Advanced system settings” > “Advanced” > “Startup and Recovery”. The you will see the location which the dump file saved."

    Last time, I found a dump file in C:\Windows. I have just looked in the same location. Now, it has no such file. A search for "C:\" and subordinate folders for "*.dmp" did not show this new dump file.

    Regarding your suggestion, I have nothing on my Windows 7 desktop that says "This Computer." I have a shortcut named "Computer," but this simply opens Windows Explorer at the "Computer" level. Right clicking the shortcut simply gives me the usual options for Windows Explorer.

    I have checked Control Panel; I found nothing that seems to correspond to "Startup and Recovery."

    Is there somewhere else that I can look?

    Again, thanks for your reply.

    Saturday, November 14, 2015 6:25 PM
  • Here is the public Dropbox link to the "BSOD" that I found this morning (14 November 2015):

    https://dl.dropboxusercontent.com/u/44771144/Screen%20shot%20BSOD%2020151114_092559.jpg

    Thanks for looking at this.

    Saturday, November 14, 2015 6:28 PM
  • We need the actual DMP file not a picture of it.  Please upload it as you did before

    Wanikiya and Dyami--Team Zigzag Windows IT-PRO (MS-MVP)

    Sunday, November 15, 2015 11:26 AM
  • As I wrote yesterday,

    This morning, I found a BSOD (Blue Screen Of Death) on the laptop.

    In a minute, I will post a URL to a photo I took of that laptop screen. Here though I want to address my search for its dump file.

    In your reply here, you gave this advice for finding a dump file:

    "In addition to that, we suggest you upload your dump file to us so that we can help you better. For you said that “The most recent file in C:\Windows\Minidump was created in April 2015,” it is strange due to every time your system crash, the system will create a dump file for it. I suggest you right click “This Computer” in desktop, then click “Advanced system settings” > “Advanced” > “Startup and Recovery”. The you will see the location which the dump file saved."

    Last time, I found a dump file in C:\Windows. I have just looked in the same location. Now, it has no such file. A search for "C:\" and subordinate folders for "*.dmp" did not show this new dump file.

    Regarding your suggestion, I have nothing on my Windows 7 desktop that says "This Computer." I have a shortcut named "Computer," but this simply opens Windows Explorer at the "Computer" level. Right clicking the shortcut simply gives me the usual options for Windows Explorer.

    I have checked Control Panel; I found nothing that seems to correspond to "Startup and Recovery."

    Is there somewhere else that I can look?

    Again, thanks for your reply.

    Sunday, November 15, 2015 9:05 PM