locked
I have had several different BSODs at random times over the years and they are getting annoying enough to ask for help. RRS feed

  • Question

  • My OS is Windows 7 Ultimate SP1 64-bit.  Below are all of the BugCheck errors from my System log for all of 2013.  I am providing these to show how random and infrequent these errors are.  Sometimes these BSODs happen when I'm using my PC and other times I'm not even in the room and the screen is locked so I don't have a pattern.  I am having a problem with my sound (I have no sound in Windows and I believe it is driver related [for which I have installed the latest versions] because my Ubuntu on this PC has sound) that I have come to live with because I can't risk having to reload my PC.  I tried to look at the MEMORY.DMP file but can not get anywhere with it.  I don't know if this is related but for I don't know how long (quite a while) in Control Panel > System, for Processor:, Installed memory (RAM):, Status, and Product ID: all say "Not Available" but I assure you I installed Windows with a legally purchased new OEM license and these fields used to display the correct information.  The current MEMORY.DMP file is 958 MB, how should I go about posting it so that somebody here could please give me a hand with this ongoing issue?

    Please let me know if I can provide more helpful information and thank you in advance for your help.

    Error    7/19/2013 11:34:32 AM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff88003b535c8, 0xfffff88003b52e20, 0xfffff80003a6374a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071913-51059-01.

    Error    6/26/2013 11:50:20 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff8800e8460c8, 0xfffff8800e845920, 0xfffff80003a90770). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062613-45505-01.

    Error    6/26/2013 12:24:25 AM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff8800f1760e8, 0xfffff8800f175940, 0xfffff88001c33d4d). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 062613-46004-01.

    Error    6/19/2013 7:10:00 AM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 061913-145626-01.

    Error    6/1/2013 5:47:52 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff88003b52ce8, 0xfffff88003b52540, 0xfffff80003a5d74a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060113-47049-01.

    Error    5/25/2013 6:39:14 AM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff8800d623578, 0xfffff8800d622dd0, 0xfffff88001ccd649). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052513-65255-01.

    Error    5/24/2013 5:39:15 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff80003a88615, 0xfffff88006d86110, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052413-57470-01.

    Error    5/17/2013 10:03:22 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff8800e161cd8, 0xfffff8800e161530, 0xfffff80003d82742). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051713-71167-01.

    Error    5/12/2013 10:56:25 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000000a (0x00000000000000f4, 0x0000000000000002, 0x0000000000000001, 0xfffff80003aec364). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051213-48500-01.

    Error    4/23/2013 6:23:08 AM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 042313-49233-01.

    Error    4/6/2013 1:00:35 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 040613-65192-01.

    Error    2/2/2013 3:08:15 PM    BugCheck    1001    None

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000024 (0x00000000001904fb, 0xfffff88003b45718, 0xfffff88003b44f70, 0xfffff80003d38379). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 020213-46753-01.


    • Edited by ZigZag3143x Saturday, July 20, 2013 2:58 AM edit title
    • Changed type tracycai Thursday, July 25, 2013 1:19 AM
    • Changed type ZigZag3143x Wednesday, September 25, 2013 5:29 PM It is a question
    Saturday, July 20, 2013 2:55 AM

Answers

  • MSH

    This one directly blamed on Kaspersky.  I would remove it and replace with MSE

    Kaspersky is a frequent cause of BSOD's.  

    I would remove and replace it with Microsoft Security Essentials AT LEAST TO TEST.

    http://support.kaspersky.com/downloads/utils/kavremover10.zip

    http://www.microsoft.com/security_essentials

    BugCheck 3B, {c0000005, fffff9600017cd81, fffff8800d9df880, 0}
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+7bed4 )






    Wanikiya & Dyami--Team Zigzag

    • Marked as answer by ZigZag3143x Wednesday, September 25, 2013 5:30 PM
    Thursday, August 15, 2013 6:42 PM

All replies

  • We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  

    WE NEED AT LEAST TWO DMP FILES TO SPOT TRENDS AND CONFIRM THE DIAGNOSIS.
    You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.
    If you are overclocking stop.  (chances are if you dont know if you are, you are not)a
    To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.  We need at least 2 DMP FILES to diagnose and confirm
    The procedure:
    * Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
    * Zip up the copy.
    * Attach the ZIP archive to your post using the "paperclip" (file attachments) button. (if available on  your site, MS doesnt have this)
     *Please upload them to a file sharing service like Skydrive or"Rapidshare" and put a link to them in your reply.
    Link for how to  upload below.
    To ensure minidumps are enabled:
    * Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    * Under the Advanced tab, click on the Startup and Recovery Settings... button.
    * Ensure that Automatically restart is unchecked.
    * Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
    * Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
    * OK your way out.
    * Reboot if changes have been made.
    Please also run MSinfo32 and upload the output as well.
    To run MSinfo32 please go to start>run>MSinfo32
    Go to "file" "save" and upload the saved file with the DMPS
    System specs are extremely useful so please include whatever you know.

    Blue Screen View & Who Crashed are often wrong and should only be used in an emergency

    Wanikiya & Dyami--Team Zigzag

    Saturday, July 20, 2013 2:57 AM
  • Thank you for getting back to me.

    Minidump.zip  http://sdrv.ms/16Rg7QE  (all Minidumps that were in the folder are included totaling 48 back to January 2012)

    System Information.zip  http://sdrv.ms/1b2ySIz

    I am not now nor have I ever overclocked my computer (aside from a very brief experiment when I had just built my system).  On my Startup and Recovery settings I changed the settings to what you requested, but it was set to Kernel memory dump and it was already saving Minidump files as well as the most recent MEMORY.DMP (which I can provide a link to if needed).

    Looking through the System Information it seems to have a great deal of information about my PC so I'm not sure what I could tell you that would not be redundant.  If there are types of information about my computer that would be left out of the System Information then let me know what those would be because since I built my PC I could waste a lot of time providing unnecessary information.

    Saturday, July 20, 2013 10:20 PM
  • MS_Hater

    Before we can investigate the underlying problem which you have had for over 18 months you need to update the below drivers from as far back as 2006

    NCREMOTEPCI.SYS    9/11/2006 4:47:50 PM  
    ElbyCDFL.sys    12/14/2006 5:22:27 PM  
    btusbflt.sys    8/27/2008 9:12:08 PM  
    CW100.sys    10/29/2008 10:31:27 PM   
    ElbyCDIO.sys    2/17/2009 1:11:23 PM   
    Rt64win7.sys    2/26/2009 5:04:13 AM 
    ahcix64s.sys    3/17/2009 2:38:19 AM  
    amdsbs.sys    3/20/2009 2:36:03 PM  
    usbfilter.sys    4/3/2009 7:39:51 AM  
    btwl2cap.sys    4/3/2009 8:28:45 PM  
    amdxata.sys    4/28/2009 7:33:27 PM   
    AtiPcie.sys    5/5/2009 11:00:22 AM   

    How To Find Drivers:

    Search
     Google for the name of the driver
    Compare the Google results with what's installed on your system to figure out which device/program it belongs to
    Visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
    If there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program

    The most common drivers are listed on these pages: 
    http://www.carrona.org/dvrref.php
    http://sysnative.com/drivers/

    Driver manufacturer links are on this page: http://www.carrona.org


    Wanikiya & Dyami--Team Zigzag

    Sunday, July 21, 2013 12:47 AM
  • Thank you for that.  I will do it when I get home today.

    This morning I had another BSOD, here is the minidump for it.

    http://sdrv.ms/12LfuqS

    I am just providing it for the sake of completeness at this point since those drivers aren't updated yet.

    Thanks again

    Wednesday, July 24, 2013 12:12 PM
  • MS_Hater

    Same issue.  I found a driver for the NCREMOTEPCI.SYS

    http://www.technisat.com/index149b.html?nav=Software_Drivers,en,33


    Wanikiya & Dyami--Team Zigzag

    Thursday, July 25, 2013 8:06 AM
  • I installed every update for the drivers I could find but many of the files have dates that have not changed much.  I'm looking for files in the Windows folder since when I look in the System Information I can't see a date when I am even able to find the file listed.

    NcRemotePci.SYS  12/5/2008 12:51 AM

    ElbyCDFL.sys  2/15/2007 7:57 PM

    btusbflt.sys  8/28/2008 1:12 AM

    CW100.sys  10/30/2008 11:31 AM

    ElbyCDIO.sys  2/17/2009 12:11 PM

    Rt64win7.sys  7/24/2013 7:55 PM

    ahcix64s.sys  7/14/2009 2:35 PM

    amdsbs.sys  7/13/2009 9:52 PM

    usbfilter.sys  8/28/2012 8:27 AM

    btwl2cap.sys  7/24/2013 7:03 PM

    amdxata.sys  6/17/2011 11:06 PM

    AtiPcie.sys  5/4/2009 12:30 PM

    I don't know where you got the dates and times for the driver files but I copied everything here from Windows Explorer.  Is this good enough?

    Friday, July 26, 2013 8:12 PM
  • MSH

    1-NcremotePci.sys, if you are not using it rename it to *.bak, or un-install it

    2-Elby is from slysoft and there is a newer driver.  If you dont use it un-install it.

    3-btusbflt.sys is an XP blue tooth driver update or remove

    4-CW100.sys is a casio USB driver update or remove.

    The rest are new enough that they are probably ok.

    If you continue to crash after the drivers upload the DMPS


    Wanikiya & Dyami--Team Zigzag

    Friday, July 26, 2013 8:24 PM
  • I uninstalled the SlySoft software (I did update it before my previous message), uninstalled the Bluetooth software, renamed NcRemotePci.SYS as NcRemotePci.SYS.bak in 'C:\Windows\System32\drivers' but Windows would not allow me to rename the copy of it in the 'C:\Windows\System32\DriverStore\FileRepository\aticaw76.inf_amd64_neutral_7d9279b411cf1dfc' folder (probably because Windows needs that file for something so renaming it would be dangerous).  Since renaming the file seems to be risky, what program can I uninstall to remove this driver?  As far as the Casio printer goes, I installed the latest version of its driver before my previous message and I do still use the printer.  Can I please let it remain on my computer?
    Friday, July 26, 2013 11:44 PM
  • I feel like I should restore the name of the file NcRemotePci.SYS.bak back to NcRemotePci.SYS since it is being used by Windows, but I'll hold off on changing it back and not reboot my PC until you advise me on how to handle this file.
    Friday, July 26, 2013 11:48 PM
  • MSH

    It is not a windows file.  The reason it wont let you rename it in driver store is because of permissions.  You can leave that copy and I dont think it will be installed on reboot

    If you have not been getting crashes then one of your changes is the reason.


    Wanikiya & Dyami--Team Zigzag

    Saturday, July 27, 2013 12:14 AM
  • I have gone a month or more without getting a crash so I wouldn't be so quick to say its fixed.

    I am still having my no sound issue as well as others but one thing at a time I guess.

    Rebooting.

    Saturday, July 27, 2013 5:06 AM
  • After rebooting I ran a search for NcRemotePci.SYS and it is still in the File Repository and in the drivers folder the NcRemotePci.SYS which I renamed as NcRemotePci.SYS.bak is still there.  Since renaming the driver did not remove its copy from the File Repository I must assume that the driver is still being used.  How shall I proceed?
    Saturday, July 27, 2013 1:53 PM
  • MSH

    If you continue to crash upload the DMPS and I can tell if it is being loaded.  It should not be.  The copy in the file repository is a copy that would be used if you ran a system file check to repair the current copy.


    Wanikiya & Dyami--Team Zigzag

    Saturday, July 27, 2013 2:40 PM
  • Oh, okay.

    How long will this case remain open?

    If it is closed (marked solved) and I have another BSOD can I mark it unsolved and post to it again?

    I suppose I would need to start more threads to address my other problems, correct?

    Saturday, July 27, 2013 3:12 PM
  • MSH

    This thread should remain open until you or a moderator marks it as solved.  You can either start a new thread or upload the link to the DMPS in this one.  I will stay subscribed for another week.

    Re new issues.  You are better off starting new threads for them as people have different areas of expertise and will reply to different issues.  Frankly this appears to be a consumer issue and as such it should be re-posted here

    If you do re-post leave a link to it here as I can point some help towards it as I am also a moderator there.

    In either case we seem to be stalled on updating the drivers and I am unsure what your status is atm.

    There are more aggressive tests we can be running but it would still be best if you finish updating the drivers unless you cant for some reason.


    Wanikiya & Dyami--Team Zigzag

    Saturday, July 27, 2013 4:07 PM
  • I had another crash but this time there was no minidump file saved, the BSOD I saw was not in the event log, and I can not find a MEMORY.DMP file... oh I remember now, I was told to change the setting from saving the memory to only saving a minidump file (which were being saved before already so I don't understand the logic there).  I did not take a picture of it with my phone as I usually do because I was expecting the minidump to be saved.  I believe the stop code was 0x0000001e (or something very similar) and in the parenthesis I believe that everything was all zeros (which I thought was odd when I saw it).  When I rebooted I had no keyboard or mouse so I couldn't login and forced a restart.  In the system log there are entries about the USB device / driver having problems.  I don't recall for sure if I updated the USB drivers.  Can I send you my error log (since that is all I have at this point)?

    Edit 1: I found a system error in the log that says "The previous system shutdown at 11:35:30 AM on ‎7/‎31/‎2013 was unexpected.", so that's when the latest one happened.


    Edit 2: By the way, of the files you wanted me to update before, I looked for many hours for the latest I could get but if I missed the correct drivers for my hardware then I obviously need help with finding them.

    Edit 3: I saved the system log for the last 24 hours.      http://sdrv.ms/13ww6Th
    • Edited by MS_Hater Wednesday, July 31, 2013 11:11 PM added saved log link
    Wednesday, July 31, 2013 10:49 PM
  • MSH

    Did you start the thread on the other site?

    Did you change the setting in control panel?

    We need the DMP files the Event viewer logs wont tell us much, if anything.


    Wanikiya & Dyami--Team Zigzag

    Thursday, August 1, 2013 2:16 AM
  • My settings in Control Panel are exactly as you told me to set them back in the first response to my question.

         [X] Write an event to the system log

         [  ] Automatically restart

         Small memory dump (256 KB)

         %SystemRoot%\Minidump

    I was confused about starting the other thread (I recall you said I should move this thread to the other site, but don't know how) so I have not done that yet.

    If there was a new dump file I would have given it to you but there was not one created.  The logs are ALL I have from this incident.

    Thursday, August 1, 2013 11:22 AM
  • Hi,

    Based on your description, this what i understood and found

    High Priority:

    The bugcheck was: 0x00000024 -  (Appeared 7 Times)
    http://msdn.microsoft.com/en-us/library/ff557433(VS.85).aspx

    Medium Priority:

    BSOD "The bugcheck was: 0x0000001e" - (Appeared 3 Times)
    http://msdn.microsoft.com/en-us/library/ff557408(v=vs.85).aspx

    Low Priority:

    BSOD "The bugcheck was: 0x0000000a" - (Appeared 1 Times)
    http://msdn.microsoft.com/en-us/library/ff560129(v=vs.85).aspx

    BSOD "The bugcheck was: 0x0000003b" (Appeared 1 Times)
    http://msdn.microsoft.com/en-us/library/ff558949(v=vs.85).aspx

    Go to the respective article to understand the possible causes for the BSOD and try fixing the same.

    Hope that helps :)


    Vikky | "If my reply rendered as answer to you question,kindly click on "Mark as Answer"

    Thursday, August 1, 2013 11:54 AM
  • I apologize for not responding sooner but I have not had a chance to do more with my Windows issue(s), although there is at least nothing new to report.
    I expect to get back to this later in the week.
    I greatly appreciate all the help so far.
    Tuesday, August 6, 2013 12:03 PM
  • Let us know if you need help

    Wanikiya & Dyami--Team Zigzag

    Thursday, August 8, 2013 4:27 AM
  • I just had another BSOD this morning when I attempted to open KeyPass (ironically so I could login to here).

    Here is the Minidump file     http://sdrv.ms/1a49f9o

    After I rebooted I had no problems when I ran KeyPass and the BSOD this time showed SYSTEM_SERVICE_EXCEPTION     STOP: 0x0000003b (0x00000000c0000005, 0xfffff9600017cd81, 0xfffff8800d9df880, 0x0000000000000000)     win32k.sys - Address FFFFF9600017CD81 base at FFFFF960000B0000, DateStamp 51aeb1a7

    This is the first BSOD I have had since July 31st and I have not had the time to find or run any more updates on this things drivers.

    I have to get to work (I'm late as it is).

    Thank you again for the continued help.

    Wednesday, August 14, 2013 12:12 PM
  • MSH

    This one directly blamed on Kaspersky.  I would remove it and replace with MSE

    Kaspersky is a frequent cause of BSOD's.  

    I would remove and replace it with Microsoft Security Essentials AT LEAST TO TEST.

    http://support.kaspersky.com/downloads/utils/kavremover10.zip

    http://www.microsoft.com/security_essentials

    BugCheck 3B, {c0000005, fffff9600017cd81, fffff8800d9df880, 0}
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+7bed4 )






    Wanikiya & Dyami--Team Zigzag

    • Marked as answer by ZigZag3143x Wednesday, September 25, 2013 5:30 PM
    Thursday, August 15, 2013 6:42 PM