Answered by:
Win 7 home edition Blue Screen Error - Please help

Question
-
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.2
Locale ID: 16393
Additional information about the problem:
BCCode: 4a
BCP1: 00000000771C138A
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF8800AF86CA0
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1
Files that help describe the problem:
C:\Windows\Minidump\010713-22386-01.dmp
C:\Users\Mano\AppData\Local\Temp\WER-68468-0.sysdata.xml
Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409
If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
-------------------
Windows 7 Blue Screen - appearing randomly.
Got the required data
Uploaded SKYDrive Short link
http://sdrv.ms/118FMGj
Thanks in advance.
Its a 6 months laptop
It happen randomly. Couldn't identify what is causing it
Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
Monday, January 7, 2013 5:56 PM
Answers
-
Hi,
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 00000000771c138a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff8800af86ca0, 0Debugging Details:
------------------
PROCESS_NAME: vsserv.exeBUGCHECK_STR: RAISED_IRQL_FAULT
FAULTING_IP:
+6632376464633665
00000000`771c138a ?? ???DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003492569 to fffff80003492fc0
STACK_TEXT:
fffff880`0af86a68 fffff800`03492569 : 00000000`0000004a 00000000`771c138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0af86a70 fffff800`034924a0 : 00000000`00000b1c fffff880`0af86ca0 00000000`00000000 fffff800`03778be3 : nt!KiBugCheckDispatch+0x69
fffff880`0af86bb0 00000000`771c138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`1b19fcc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771c138a
STACK_COMMAND: kbFOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`034924a0 4883ec50 sub rsp,50hSYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
FAILURE_BUCKET_ID: X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245
BUCKET_ID: X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------1: kd> lmvm nt
start end module name
fffff800`03414000 fffff800`039fc000 nt (pdb symbols) C:\ProgramData\dbg\sym\ntkrnlmp.pdb\B2DA40502FA744C18B9022FD187ADB592\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\dbg\sym\ntoskrnl.exe\503F82BE5e8000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Thu Aug 30 23:11:58 2012 (503F82BE)
CheckSum: 00554126
ImageSize: 005E8000
File version: 6.1.7601.17944
Product version: 6.1.7601.17944
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17944
FileVersion: 6.1.7601.17944 (win7sp1_gdr.120830-0333)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.One of the processes that crashed was the vsserv.exe, which is a BitDefender process.
I would suggest to uninstall BitDefender and see if it helps.Also, ntoskrnl.exe is quite common not that hard to fix. The file basically deals with your computers memory which includes, Hard Drive and RAM. You can also try the following methods:
Check your computer for hard disk and memory errors:
Some errors can be caused by problems with your computer's hard disk or random access memory (RAM), rather than problems with Windows or other software running on your computer.Windows 7 includes tools that can help identify and fix certain hardware-related errors. Serious errors might require you to contact the hardware manufacturer for support. For more information, see Check a drive for errors and Diagnosing memory problems on your computer.
To check for hard disk errors
-
Open Computer by clicking the Start button
, and then clicking Computer.
-
Right-click the drive that you want to check, and then click Properties.
-
Click the Tools tab, and then, under Error-checking, click Check now.
If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.
To perform a thorough check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the drive itself, and it can take much longer to complete.
To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors. -
Click Start.
To check for memory problems
-
Open Memory Diagnostics Tool by clicking the Start button
, and then clicking Control Panel. In the search box, type Memory, and then click Diagnose your computer's memory problems.
If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
-
Choose when to run the tool. If you choose to restart your computer and run the tool immediately, make sure that you save your work and close all of your running programs. The Memory Diagnostics Tool will run automatically when you restart Windows.
Some useful information please refer to Bug Check 0x4A:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559001(v=vs.85).aspx
Spencer
TechNet Community Support- Marked as answer by Spencer Xi Friday, February 1, 2013 5:28 AM
Wednesday, January 9, 2013 4:22 AM -
All replies
-
Try the following:
- Run Windows Update and install all available updates.
- Update your drivers.
- Run a virus scan
- Run a chkdsk.
Monday, January 7, 2013 10:13 PM -
Test your RAM, for example by using this:
http://www.memtest.org/
Tuesday, January 8, 2013 2:15 AM -
Hi Schloicka,
In 4 tasks.
only i missed out CHKDSK,
have ran it . it fixed couple of things.. will monitor is for a day are so and update you on the same.
thank for the reply both of you.!
Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
Tuesday, January 8, 2013 10:38 AM -
memtest was having full x86 things. Mine is 64 bit. is that ok ?
Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
Tuesday, January 8, 2013 10:38 AM -
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 08-01-2013 10:39:56
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: MANO-HP
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004a (0x0000000076ec138a, 0x0000000000000002, 0x0000000000000000, 0xfffff8800a6d3ca0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 010813-26800-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-01-08T05:09:56.000000000Z" />
<EventRecordID>119327</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>MANO-HP</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x0000004a (0x0000000076ec138a, 0x0000000000000002, 0x0000000000000000, 0xfffff8800a6d3ca0)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">010813-26800-01</Data>
</EventData>
</Event>Again the Same Error..any thoughts ?
Satheshwaran Manoharan | Exchange 2003/2007/2010/2013 | Blog:http://www.careexchange.in | Please mark it as an answer if it really helps you ------------- I do not represent the organisation I work for, all the opinions expressed here are my own. This posting is provided "AS IS" with no warranties or guarantees and confers no rights.
Tuesday, January 8, 2013 2:43 PM -
Yes you can use that memtest.
Tuesday, January 8, 2013 4:09 PM -
Hi,
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 00000000771c138a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff8800af86ca0, 0Debugging Details:
------------------
PROCESS_NAME: vsserv.exeBUGCHECK_STR: RAISED_IRQL_FAULT
FAULTING_IP:
+6632376464633665
00000000`771c138a ?? ???DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80003492569 to fffff80003492fc0
STACK_TEXT:
fffff880`0af86a68 fffff800`03492569 : 00000000`0000004a 00000000`771c138a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0af86a70 fffff800`034924a0 : 00000000`00000b1c fffff880`0af86ca0 00000000`00000000 fffff800`03778be3 : nt!KiBugCheckDispatch+0x69
fffff880`0af86bb0 00000000`771c138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`1b19fcc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771c138a
STACK_COMMAND: kbFOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`034924a0 4883ec50 sub rsp,50hSYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
FAILURE_BUCKET_ID: X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245
BUCKET_ID: X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------1: kd> lmvm nt
start end module name
fffff800`03414000 fffff800`039fc000 nt (pdb symbols) C:\ProgramData\dbg\sym\ntkrnlmp.pdb\B2DA40502FA744C18B9022FD187ADB592\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\ProgramData\dbg\sym\ntoskrnl.exe\503F82BE5e8000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Thu Aug 30 23:11:58 2012 (503F82BE)
CheckSum: 00554126
ImageSize: 005E8000
File version: 6.1.7601.17944
Product version: 6.1.7601.17944
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7601.17944
FileVersion: 6.1.7601.17944 (win7sp1_gdr.120830-0333)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.One of the processes that crashed was the vsserv.exe, which is a BitDefender process.
I would suggest to uninstall BitDefender and see if it helps.Also, ntoskrnl.exe is quite common not that hard to fix. The file basically deals with your computers memory which includes, Hard Drive and RAM. You can also try the following methods:
Check your computer for hard disk and memory errors:
Some errors can be caused by problems with your computer's hard disk or random access memory (RAM), rather than problems with Windows or other software running on your computer.Windows 7 includes tools that can help identify and fix certain hardware-related errors. Serious errors might require you to contact the hardware manufacturer for support. For more information, see Check a drive for errors and Diagnosing memory problems on your computer.
To check for hard disk errors
-
Open Computer by clicking the Start button
, and then clicking Computer.
-
Right-click the drive that you want to check, and then click Properties.
-
Click the Tools tab, and then, under Error-checking, click Check now.
If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
To automatically repair problems with files and folders that the scan detects, select Automatically fix file system errors. Otherwise, the disk check will report problems but not fix them.
To perform a thorough check, select Scan for and attempt recovery of bad sectors. This scan attempts to find and repair physical errors on the drive itself, and it can take much longer to complete.
To check for both file errors and physical errors, select both Automatically fix file system errors and Scan for and attempt recovery of bad sectors. -
Click Start.
To check for memory problems
-
Open Memory Diagnostics Tool by clicking the Start button
, and then clicking Control Panel. In the search box, type Memory, and then click Diagnose your computer's memory problems.
If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
-
Choose when to run the tool. If you choose to restart your computer and run the tool immediately, make sure that you save your work and close all of your running programs. The Memory Diagnostics Tool will run automatically when you restart Windows.
Some useful information please refer to Bug Check 0x4A:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559001(v=vs.85).aspx
Spencer
TechNet Community Support- Marked as answer by Spencer Xi Friday, February 1, 2013 5:28 AM
Wednesday, January 9, 2013 4:22 AM -