locked
Win 7 home edition Blue Screen Error - Please help RRS feed

  • Question

  • Problem signature:
      Problem Event Name: BlueScreen
      OS Version: 6.1.7601.2.1.0.768.2
      Locale ID: 16393

    Additional information about the problem:
      BCCode: 4a
      BCP1: 00000000771C138A
      BCP2: 0000000000000002
      BCP3: 0000000000000000
      BCP4: FFFFF8800AF86CA0
      OS Version: 6_1_7601
      Service Pack: 1_0
      Product: 768_1

    Files that help describe the problem:
      C:\Windows\Minidump\010713-22386-01.dmp
      C:\Users\Mano\AppData\Local\Temp\WER-68468-0.sysdata.xml

    Read our privacy statement online:
      http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

    If the online privacy statement is not available, please read our privacy statement offline:
      C:\Windows\system32\en-US\erofflps.txt

    -------------------

    Windows 7 Blue Screen - appearing randomly.

    Got the required data

    Uploaded SKYDrive Short link

    http://sdrv.ms/118FMGj

    Thanks in advance.

    Its a 6 months laptop

    It happen randomly. Couldn't identify what is causing it


    Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    Monday, January 7, 2013 5:56 PM

Answers

  • Hi,

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
    Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
    Arguments:
    Arg1: 00000000771c138a, Address of system function (system call routine)
    Arg2: 0000000000000002, Current IRQL
    Arg3: 0000000000000000, 0
    Arg4: fffff8800af86ca0, 0

    Debugging Details:
    ------------------


    PROCESS_NAME:  vsserv.exe

    BUGCHECK_STR:  RAISED_IRQL_FAULT

    FAULTING_IP:
    +6632376464633665
    00000000`771c138a ??              ???

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff80003492569 to fffff80003492fc0

    STACK_TEXT: 
    fffff880`0af86a68 fffff800`03492569 : 00000000`0000004a 00000000`771c138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0af86a70 fffff800`034924a0 : 00000000`00000b1c fffff880`0af86ca0 00000000`00000000 fffff800`03778be3 : nt!KiBugCheckDispatch+0x69
    fffff880`0af86bb0 00000000`771c138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
    00000000`1b19fcc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771c138a


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiSystemServiceExit+245
    fffff800`034924a0 4883ec50        sub     rsp,50h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiSystemServiceExit+245

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

    FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

    BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

    Followup: MachineOwner
    ---------

    1: kd> lmvm nt
    start             end                 module name
    fffff800`03414000 fffff800`039fc000   nt         (pdb symbols)          C:\ProgramData\dbg\sym\ntkrnlmp.pdb\B2DA40502FA744C18B9022FD187ADB592\ntkrnlmp.pdb
        Loaded symbol image file: ntkrnlmp.exe
        Mapped memory image file: C:\ProgramData\dbg\sym\ntoskrnl.exe\503F82BE5e8000\ntoskrnl.exe
        Image path: ntkrnlmp.exe
        Image name: ntkrnlmp.exe
        Timestamp:        Thu Aug 30 23:11:58 2012 (503F82BE)
        CheckSum:         00554126
        ImageSize:        005E8000
        File version:     6.1.7601.17944
        Product version:  6.1.7601.17944
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        1.0 App
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntkrnlmp.exe
        OriginalFilename: ntkrnlmp.exe
        ProductVersion:   6.1.7601.17944
        FileVersion:      6.1.7601.17944 (win7sp1_gdr.120830-0333)
        FileDescription:  NT Kernel & System
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    One of the processes that crashed was the vsserv.exe, which is a BitDefender process.
    I would suggest to uninstall BitDefender and see if it helps.

    Also, ntoskrnl.exe is quite common not that hard to fix. The file basically deals with your computers memory which includes, Hard Drive and RAM. You can also try the following methods:

    Check your computer for hard disk and memory errors:

    Some errors can be caused by problems with your computer's hard disk or random access memory (RAM), rather than problems with Windows or other software running on your computer.           

    Windows 7 includes tools that can help identify and fix certain hardware-related errors. Serious errors might require you to contact the hardware manufacturer for support. For more information, see Check a drive for errors and Diagnosing memory problems on your computer.           

    To check for hard disk errors

    1. Open Computer by clicking the Start button Picture of the Start button, and then clicking Computer.

    2. Right-click the drive that you want to check, and then click Properties.               

    3. Click the Tools tab, and then, under Error-checking, click Check now. Administrator permission requiredIf you're prompted for an administrator password or confirmation, type the password or provide confirmation. 


      To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.


      To perform a thorough check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the drive itself, and it can take much longer to complete.


      To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors.

       

    4.  Click Start.               

    To check for memory problems

    1. Open Memory Diagnostics Tool by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type Memory, and then click Diagnose your computer's memory problems.Administrator permission requiredIf you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    2. Choose when to run the tool. If you choose to restart your computer and run the tool immediately, make sure that you save your work and close all of your running programs. The Memory Diagnostics Tool will run automatically when you restart Windows.

    Some useful information please refer to Bug Check 0x4A:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559001(v=vs.85).aspx

    Regards.


    Spencer
    TechNet Community Support

    • Marked as answer by Spencer Xi Friday, February 1, 2013 5:28 AM
    Wednesday, January 9, 2013 4:22 AM

All replies

  • Try the following:

    1. Run Windows Update and install all available updates.
    2. Update your drivers.
    3. Run a virus scan
    4. Run a chkdsk.
    Monday, January 7, 2013 10:13 PM
  • Test your RAM, for example by using this:

    http://www.memtest.org/

    Tuesday, January 8, 2013 2:15 AM
  • Hi Schloicka,

    In 4 tasks.

    only i missed out CHKDSK,

    have ran it  . it fixed couple of things.. will monitor is for a day are so and update you on the same.

    thank for  the reply both of you.! 



    Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    Tuesday, January 8, 2013 10:38 AM
  • memtest was having full x86 things. Mine is 64 bit. is that ok ?

    Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    Tuesday, January 8, 2013 10:38 AM
  • Log Name:      System
    Source:        Microsoft-Windows-WER-SystemErrorReporting
    Date:          08-01-2013 10:39:56
    Event ID:      1001
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      MANO-HP
    Description:
    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000004a (0x0000000076ec138a, 0x0000000000000002, 0x0000000000000000, 0xfffff8800a6d3ca0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 010813-26800-01.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
        <EventID Qualifiers="16384">1001</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-01-08T05:09:56.000000000Z" />
        <EventRecordID>119327</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>MANO-HP</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">0x0000004a (0x0000000076ec138a, 0x0000000000000002, 0x0000000000000000, 0xfffff8800a6d3ca0)</Data>
        <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
        <Data Name="param3">010813-26800-01</Data>
      </EventData>
    </Event>

    Again the Same Error..any thoughts ?


    Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    Tuesday, January 8, 2013 2:43 PM
  • Yes you can use that memtest.

    Tuesday, January 8, 2013 4:09 PM
  • Hi,

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
    Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
    Arguments:
    Arg1: 00000000771c138a, Address of system function (system call routine)
    Arg2: 0000000000000002, Current IRQL
    Arg3: 0000000000000000, 0
    Arg4: fffff8800af86ca0, 0

    Debugging Details:
    ------------------


    PROCESS_NAME:  vsserv.exe

    BUGCHECK_STR:  RAISED_IRQL_FAULT

    FAULTING_IP:
    +6632376464633665
    00000000`771c138a ??              ???

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff80003492569 to fffff80003492fc0

    STACK_TEXT: 
    fffff880`0af86a68 fffff800`03492569 : 00000000`0000004a 00000000`771c138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0af86a70 fffff800`034924a0 : 00000000`00000b1c fffff880`0af86ca0 00000000`00000000 fffff800`03778be3 : nt!KiBugCheckDispatch+0x69
    fffff880`0af86bb0 00000000`771c138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
    00000000`1b19fcc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771c138a


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiSystemServiceExit+245
    fffff800`034924a0 4883ec50        sub     rsp,50h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiSystemServiceExit+245

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

    FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

    BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

    Followup: MachineOwner
    ---------

    1: kd> lmvm nt
    start             end                 module name
    fffff800`03414000 fffff800`039fc000   nt         (pdb symbols)          C:\ProgramData\dbg\sym\ntkrnlmp.pdb\B2DA40502FA744C18B9022FD187ADB592\ntkrnlmp.pdb
        Loaded symbol image file: ntkrnlmp.exe
        Mapped memory image file: C:\ProgramData\dbg\sym\ntoskrnl.exe\503F82BE5e8000\ntoskrnl.exe
        Image path: ntkrnlmp.exe
        Image name: ntkrnlmp.exe
        Timestamp:        Thu Aug 30 23:11:58 2012 (503F82BE)
        CheckSum:         00554126
        ImageSize:        005E8000
        File version:     6.1.7601.17944
        Product version:  6.1.7601.17944
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        1.0 App
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     ntkrnlmp.exe
        OriginalFilename: ntkrnlmp.exe
        ProductVersion:   6.1.7601.17944
        FileVersion:      6.1.7601.17944 (win7sp1_gdr.120830-0333)
        FileDescription:  NT Kernel & System
        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    One of the processes that crashed was the vsserv.exe, which is a BitDefender process.
    I would suggest to uninstall BitDefender and see if it helps.

    Also, ntoskrnl.exe is quite common not that hard to fix. The file basically deals with your computers memory which includes, Hard Drive and RAM. You can also try the following methods:

    Check your computer for hard disk and memory errors:

    Some errors can be caused by problems with your computer's hard disk or random access memory (RAM), rather than problems with Windows or other software running on your computer.           

    Windows 7 includes tools that can help identify and fix certain hardware-related errors. Serious errors might require you to contact the hardware manufacturer for support. For more information, see Check a drive for errors and Diagnosing memory problems on your computer.           

    To check for hard disk errors

    1. Open Computer by clicking the Start button Picture of the Start button, and then clicking Computer.

    2. Right-click the drive that you want to check, and then click Properties.               

    3. Click the Tools tab, and then, under Error-checking, click Check now. Administrator permission requiredIf you're prompted for an administrator password or confirmation, type the password or provide confirmation. 


      To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.


      To perform a thorough check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the drive itself, and it can take much longer to complete.


      To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors.

       

    4.  Click Start.               

    To check for memory problems

    1. Open Memory Diagnostics Tool by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type Memory, and then click Diagnose your computer's memory problems.Administrator permission requiredIf you're prompted for an administrator password or confirmation, type the password or provide confirmation.

    2. Choose when to run the tool. If you choose to restart your computer and run the tool immediately, make sure that you save your work and close all of your running programs. The Memory Diagnostics Tool will run automatically when you restart Windows.

    Some useful information please refer to Bug Check 0x4A:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559001(v=vs.85).aspx

    Regards.


    Spencer
    TechNet Community Support

    • Marked as answer by Spencer Xi Friday, February 1, 2013 5:28 AM
    Wednesday, January 9, 2013 4:22 AM