locked
Random BSOD Windows 7 64-bit RRS feed

  • Question

  • Hello Ive been having too many BSOD and cannot find anything that might be the cause of the issue.  Ive use debugging tools that did not help me much. The troubleshoooting steps ive done was reinstall windows 7, update windows 7 with latests patches and SP 1, updated all my drivers and research on the manufacturer of the system board to find if there is any related issue to this BSOD with the hardware or if there is any patch that could help me fix this issue but nothing has been found.

    I have the minidumps so if are needed, let me know where i can upload it.


    http://img641.imageshack.us/i/bsodi.jpg/
    Monday, March 28, 2011 1:43 AM

Answers

  • Andre,

     

    Last night i left my system on and the BSOD appeared again a couple of minutes later. Once restarted and on the login screen, the system restarted again since i was AFK so after that restart the system worked fine.  I have now changed the memory timing to T2.  Until now everything seems to be normal.

     

    Will let you know if something happens.


    Thanks.
    • Marked as answer by Miya Yao Monday, April 4, 2011 9:30 AM
    Thursday, March 31, 2011 3:02 PM

All replies

  • Hi,

    Since some of those are 0A check for rootkits.

    TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN
    it will show any infections in the report after running - if it will not run change the name from
    tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not
    check with the other methods below.
    http://support.kaspersky.com/viruses/solutions?qid=208280684

    If any Rootkits are found use this thread and other suggestions. (Run UnHackMe)

    http://social.answers.microsoft.com/Forums/en-US/InternetExplorer/thread/a8f665f0-c793-441a-a5b9-54b7e1e7a5a4/

    =================================================================

    Other than the above the issues just about have to be hardware. Remove ALL power and reseat
    the cards, memory, and cables (on both ends when possible) - actually remove and replace
    - do not just snug.

    Check with a real computer shop (not leeks and peeks at a Best Buy or other Big Box Stores).

    Hope this helps.


    Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle - Mark Twain said it right.
    Monday, March 28, 2011 2:27 AM
  • A bugcheck (BSOD) is a mechanism to protect your PC from damage.

    You get several ctashes from this type:

    Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL - This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

    Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA - This indicates that invalid system memory has been referenced.

    To see the cause I have to take a look at the dumps with the Debugging Tools for Windows.

    Please start the Windows Explorer and go to the folder C:\Windows\Minidump. Next, copy the dmp files to your desktop, zip all dmp into 1 zip file and upload the zip file to your public Skydrive [1] folder and post a link here.

    if you can't see dmp files, make sure your Windows is configured correctly [2][3] to generate dumps.

    André

    [1] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    [2] http://support.microsoft.com/kb/254649
    [3] http://blog.nirsoft.net/2010/07/27/how-to-configure-windows-to-create-minidump-files-on-bsod/


    "A programmer is just a tool which converts caffeine into code"

    Want to install RSAT on Windows 7 Sp1? Check my HowTo: http://www.msfn.org/board/index.php?showtopic=150221
    Monday, March 28, 2011 11:56 AM
  • Thanks for the reply Andre.  Here is the skydrive link for the minidumps file. I have also added the msinfo32 file so you can verify my system configuration.  I have already updated the BIOS.

     

    https://cid-cd5fdcc0dcd341d8.skydrive.live.com/redir.aspx?resid=CD5FDCC0DCD341D8!115&authkey=PDXkFp!ED3Y%24

     

     


    Monday, March 28, 2011 11:50 PM
  • Bug Check 0x4E: PFN_LIST_CORRUPT

    This indicates that the page frame number (PFN) list is corrupted.

    http://msdn.microsoft.com/en-us/library/ff559014%28VS.85%29.aspx

    Child-SP          RetAddr           Call Site
    fffff880`02b8b0c8 fffff800`02d55f5c nt!KeBugCheckEx
    fffff880`02b8b0d0 fffff800`02c77f89 nt!MiBadShareCount+0x4c
    fffff880`02b8b110 fffff800`02ca0e23 nt! ?? ::FNODOBFM::`string'+0x333c1
    fffff880`02b8b1a0 fffff800`02ca1f16 nt!MiDeleteAddressesInWorkingSet+0x307
    fffff880`02b8ba50 fffff800`02fa609a nt!MmCleanProcessAddressSpace+0x96
    fffff880`02b8baa0 fffff800`02f896dc nt!PspExitThread+0x56a
    fffff880`02b8bba0 fffff800`02ccf8d3 nt!NtTerminateProcess+0x138
    fffff880`02b8bc20 00000000`771a15da nt!KiSystemServiceCopyEnd+0x13
    00000000`001bfb18 00000000`00000000 0x771a15da

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

    Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED

    This indicates that a kernel-mode program generated an exception which the error handler did not catch.

    http://msdn.microsoft.com/en-us/library/ff557408%28VS.85%29.aspx

    fffff880`089a9ee8 fffff800`02b2b028 nt!KeBugCheckEx
    fffff880`089a9ef0 fffff800`02adecc2 nt! ?? ::FNODOBFM::`string'+0x4987d
    fffff880`089aa590 fffff800`02add5ca nt!KiExceptionDispatch+0xc2
    fffff880`089aa770 fffff880`082d9912 nt!KiGeneralProtectionFault+0x10a
    fffff880`089aa908 fffff880`089aa9b8 cpudrv64+0x1912

        Image path: \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys
        Image name: cpudrv64.sys
        Timestamp:        Tue Aug 11 18:39:13 2009


    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.

    fffff880`035164a8 fffff800`02a9bbe9 nt!KeBugCheckEx
    fffff880`035164b0 fffff800`02a9a860 nt!KiBugCheckDispatch+0x69
    fffff880`035165f0 fffff800`02abbe49 nt!KiPageFault+0x260
    fffff880`03516780 fffff800`02aac1c4 nt!KiIpiSendRequest+0x1d9
    fffff880`03516840 fffff800`02aa2302 nt!KiIpiSendRequestEx+0x84
    fffff880`03516880 fffff800`02a86e05 nt!KeFlushMultipleRangeTb+0x362
    fffff880`03516950 fffff800`02b15685 nt!MiAgeWorkingSet+0x37b
    fffff880`03516b00 fffff800`02a87206 nt! ?? ::FNODOBFM::`string'+0x4d886
    fffff880`03516b80 fffff800`02a876c3 nt!MmWorkingSetManager+0x6e
    fffff880`03516bd0 fffff800`02d39cce nt!KeBalanceSetManager+0x1c3
    fffff880`03516d40 fffff800`02a8dfe6 nt!PspSystemThreadStartup+0x5a
    fffff880`03516d80 00000000`00000000 nt!KxStartSystemThread+0x16

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.

    Child-SP          RetAddr           Call Site
    fffff880`0720d3b8 fffff800`02a86be9 nt!KeBugCheckEx
    fffff880`0720d3c0 fffff800`02a85860 nt!KiBugCheckDispatch+0x69
    fffff880`0720d500 fffff800`02ab8e12 nt!KiPageFault+0x260
    fffff880`0720d690 fffff800`02a76a28 nt!KxWaitForLockOwnerShip+0x12
    fffff880`0720d6c0 fffff800`02d85706 nt!IopCheckVpbMounted+0x158
    fffff880`0720d730 fffff800`02d81d38 nt!IopParseDevice+0x816
    fffff880`0720d8c0 fffff800`02d82f56 nt!ObpLookupObjectName+0x588
    fffff880`0720d9b0 fffff800`02d8485c nt!ObOpenObjectByName+0x306
    fffff880`0720da80 fffff800`02d70134 nt!IopCreateFile+0x2bc
    fffff880`0720db20 fffff800`02a868d3 nt!NtOpenFile+0x58
    fffff880`0720dbb0 00000000`775f164a nt!KiSystemServiceCopyEnd+0x13

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.

    fffff880`08221ec8 fffff800`02ad8be9 nt!KeBugCheckEx
    fffff880`08221ed0 fffff800`02ad7860 nt!KiBugCheckDispatch+0x69
    fffff880`08222010 fffff800`02b0ae12 nt!KiPageFault+0x260
    fffff880`082221a0 fffff800`02ae9ccd nt!KxWaitForLockOwnerShip+0x12
    fffff880`082221d0 fffff800`02aa74db nt!MiInsertPageInFreeOrZeroedList+0x55d
    fffff880`082222e0 fffff800`02aa7e42 nt!MmPurgeSection+0x4db
    fffff880`082223d0 fffff880`0147d9ef nt!CcPurgeCacheSection+0x172
    fffff880`08222440 fffff880`014ab84e Ntfs!NtfsFlushAndPurgeScb+0x1bd
    fffff880`082224d0 fffff880`01499fe5 Ntfs!NtfsOpenAttribute+0x80e
    fffff880`082225e0 fffff880`01495e3b Ntfs!NtfsOpenExistingAttr+0x145
    fffff880`082226a0 fffff880`0149909f Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
    fffff880`08222830 fffff880`014a9166 Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
    fffff880`08222920 fffff880`014a6911 Ntfs!NtfsFindStartingNode+0x5e6
    fffff880`082229f0 fffff880`01404945 Ntfs!NtfsCommonCreate+0x3e1
    fffff880`08222bd0 fffff800`02ae3a21 Ntfs!NtfsFspDispatch+0x26d
    fffff880`08222cb0 fffff800`02d76cce nt!ExpWorkerThread+0x111
    fffff880`08222d40 fffff800`02acafe6 nt!PspSystemThreadStartup+0x5a
    fffff880`08222d80 00000000`00000000 nt!KxStartSystemThread+0x16


    So first update the SystemRequirementsLab driver. Next run chkdsk C: /r /f to check the HDD for NTFS issues because you had several crashes related to Opening files.

    If this is all done and you have still issues, download memtest86+ [1], burn a new bootable CD (use a CD-RW if possible) from the ISO (download and use ImgBurn [2][3] to do this or make double click on the ISO in Windows 7), reboot your PC and scan your RAM 4-5hours for errors. If memtest86+ detects errors, test each module its own and replace the faulty RAM.

    If the memtest tells no error, please download CPU-Z [4], look in the memory and SPD tab and verify that the current RAM Speed and the Timings match to the values that you see in the SPD tab. If your RAM run at CR (Command Rate) 1T, change the value into 2T in the BIOS. This should fix the crashes.

    André

    [1] http://www.memtest.org/download/4.20/memtest86+-4.20.iso.zip
    [2] http://www.imgburn.com/index.php?act=download
    [3] http://forum.imgburn.com/index.php?showtopic=61
    [4] http://www.cpuid.com/softwares/cpu-z.html


    "A programmer is just a tool which converts caffeine into code"

    Want to install RSAT on Windows 7 Sp1? Check my HowTo: http://www.msfn.org/board/index.php?showtopic=150221
    • Proposed as answer by Andre.Ziegler Wednesday, March 30, 2011 12:52 PM
    Tuesday, March 29, 2011 12:38 PM
  • Th

     

    Thanks for the reply Andre.  I will be testing the system with the steps you have recommended and will keep you updated, if resolved I will let you know too.  I really appreciate your help.

    By the way where I can get the System Requirement Labs driver?

    Tuesday, March 29, 2011 2:19 PM
  • I have no idea what this cpudrv64.sys driver is. Look at the file properties to see what is the manufacture.

    "A programmer is just a tool which converts caffeine into code"

    Want to install RSAT on Windows 7 Sp1? Check my HowTo: http://www.msfn.org/board/index.php?showtopic=150221
    Tuesday, March 29, 2011 7:49 PM
  • I have already updated 2 days ago all the drivers using driveragent since there was no support from ASUS with up to date drivers.  All their drivers were from 2009 so i just updated the drivers using a 3rd party application that could help me identify what drivers needed to be updated.

     

    Well, I will proceed with the checkdisk and then with the memory diagnostics and will keep you updated.

     

     

    Tuesday, March 29, 2011 8:53 PM
  • Hi,

    Did you check for malware? As I indicated above the 0A is very often caused by malware.
    Memory is also another suspect. If you solve the 0A you probably have solved the others
    or will have a better idea of the CAUSE of them.

    cpudrv64.sys is likely from System Requirements Lab - however it has also been associated
    with malware. See if its location or Right Click on it - Properties - Details - does that tell you
    anything?
    http://www.systemrequirementslab.com/marketing/Home.html

    Since you did a clean install it has to be from something you installed.

    ==================================================================

    If you haven't I would do an extremely thorough check for malware.

    If you need to check for malware here are my recommendations - these will allow you to do
    a thorough check and removal without ending up with a load of spyware programs running
    resident which can cause as many issues as the malware and maybe harder to detect as the
    cause.

    No one program can be relied upon to detect and remove all malware. Added that often easy
    to detect malware is often accompanied by a much harder to detect and remove payload. So
    its better to be overly thorough now than to pay the high price later. Check with these to an
    extreme overkill point and then run the cleanup only when you are very sure the system is clean.

    These can be done in Safe Mode - repeatedly tap F8 as you boot however you should also run 
    them in regular Windows when you can.

    TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN
    it will show any infections in the report after running - if it will not run change the name from
    tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not
    check with the other methods below.
    http://support.kaspersky.com/viruses/solutions?qid=208280684

    Download malwarebytes and scan with it, run MRT, and add Prevx to be sure it is gone.
    (If Rootkits run UnHackMe)

    Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

    Malwarebytes - free
    http://www.malwarebytes.org/

    Run the Microsoft Malicious Removal Tool

    Start - type in Search box -> MRT  find at top of list - Right Click on it - RUN AS ADMIN.

    You should be getting this tool and its updates via Windows Updates - if needed you can
    download it here.

    Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN
    (Then run MRT as above.)

    Microsoft Malicious Removal Tool - 32 bit
    http://www.microsoft.com/downloads/details.aspx?FamilyID=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

    Microsoft Malicious Removal Tool - 64 bit
    http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

    also install Prevx to be sure it is all gone.

    Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

    Prevx - Home - Free - small, fast, exceptional CLOUD protection, works with other
    security programs. This is a scanner only, VERY EFFECTIVE, if it finds something come back
    here or use Google to see how to remove. 
    http://www.prevx.com/   <-- information
    http://info.prevx.com/downloadcsi.asp  <-- download

    PCmag - Prevx - Editor's Choice
    http://www.pcmag.com/article2/0,2817,2346862,00.asp

    Try the trial version of Hitman Pro :

    Hitman Pro is a second opinion scanner, designed to rescue your computer from malware
    (viruses, trojans, rootkits, etc.) that have infected your computer despite all the security
    measures you have taken (such as anti virus software, firewalls, etc.).
    http://www.surfright.nl/en/hitmanpro

    --------------------------------------------------------

    If needed here are some online free scanners to help

    http://www.eset.com/onlinescan/

    New Vista and Windows 7 version
    http://onecare.live.com/site/en-us/center/whatsnew.htm

    Original version
    http://onecare.live.com/site/en-us/default.htm

    http://www.kaspersky.com/virusscanner

    Other Free online scans
    http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

    --------------------------------------------------------

    After removing any malware :

    Also do these to cleanup general corruption and repair/replace damaged/missing
    system files.


    Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  -  RUN AS ADMIN

    Enter this at the prompt - sfc /scannow

    How to Repair Windows 7 System Files with System File Checker
    http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

    How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program
    generates in Windows Vista cbs.log
    http://support.microsoft.com/kb/928228


    Also run CheckDisk so we can rule out corruption as much as possible.

    How to Run Disk Check in Windows 7
    http://www.sevenforums.com/tutorials/433-disk-check.html

    -----------------------------------------------------------------------

    If any Rootkits are found use this thread and other suggestions. (Run UnHackMe)

    http://social.answers.microsoft.com/Forums/en-US/InternetExplorer/thread/a8f665f0-c793-441a-a5b9-54b7e1e7a5a4/

    Hope this helps.


    Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle - Mark Twain said it right.
    Tuesday, March 29, 2011 9:46 PM
  • Thanks for the reply SpiritX, I've scan with many tools but do far no malware has been found on my system so I'll be doing the steps suggested by Andre.
    Wednesday, March 30, 2011 2:26 AM
  • Hi,

    If you have scanned thoroughly for malware, especially rootkits, then the problem
    virtually has to be BIOS, low level chipset or other drivrs, and most likely hardware.
    There is also the chance your system is not SP1 compatible.

    Since you have re-installed Windows 7 that rules out all the other causes.



    Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle - Mark Twain said it right.
    Wednesday, March 30, 2011 2:49 AM
  • SpiritX,

     

    Here is the chkdsk results:

     

    Checking file system on C:
    The type of the file system is NTFS.

    A disk check has been scheduled.
    Windows will now check the disk.                        

    CHKDSK is verifying files (stage 1 of 5)...
      150272 file records processed.                                        

    File verification completed.
      183 large file records processed.                                  

      0 bad file records processed.                                    

      2 EA records processed.                                          

      57 reparse records processed.                                     

    CHKDSK is verifying indexes (stage 2 of 5)...
      203806 index entries processed.                                       

    Index verification completed.
      0 unindexed files scanned.                                       

      0 unindexed files recovered.                                     

    CHKDSK is verifying security descriptors (stage 3 of 5)...
      150272 file SDs/SIDs processed.                                       

    Cleaning up 1117 unused index entries from index $SII of file 0x9.
    Cleaning up 1117 unused index entries from index $SDH of file 0x9.
    Cleaning up 1117 unused security descriptors.
    Security descriptor verification completed.
      26768 data files processed.                                          

    CHKDSK is verifying Usn Journal...
      37594560 USN bytes processed.                                           

    Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
      150256 files processed.                                               

    File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
      51085670 free clusters processed.                                       

    Free space verification is complete.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.

     242430975 KB total disk space.
      37766752 KB in 88570 files.
         59840 KB in 26769 indexes.
             0 KB in bad sectors.
        261699 KB in use by the system.
         65536 KB occupied by the log file.
     204342684 KB available on disk.

          4096 bytes in each allocation unit.
      60607743 total allocation units on disk.
      51085671 allocation units available on disk.

    Internal Info:
    00 4b 02 00 96 c2 01 00 13 81 03 00 00 00 00 00  .K..............
    75 01 00 00 39 00 00 00 00 00 00 00 00 00 00 00  u...9...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

    Windows has finished checking your disk.
    Please wait while your computer restarts.

    Wednesday, March 30, 2011 3:58 AM
  • Hi,

    Checkdisk found nothing.

    Try using minimum memory. There could be something like a timing issue between
    the sticks which can happen even when the sticks are identical from the same production'
    run.

    Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle - Mark Twain said it right.
    Wednesday, March 30, 2011 4:07 AM

  • Free space verification is complete.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.

    Windows fixed file sytem issues. it should be fixed now.




    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    Wednesday, March 30, 2011 12:51 PM
  • Ive been working with the system without issues so far since 3 days ago, but I will continue testing the system by running the memory diagnostics and see if there is something wrong with the memories. Will be updating if issue reappears within a week and if not, then I will be giving votes.

     

    Thanks for all your help.

    Wednesday, March 30, 2011 1:23 PM
  • the chkdsk fixed the issue. The RAM should be ok, otherwise you get more crashes.

    André


    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    Wednesday, March 30, 2011 1:30 PM
  • Andre,

     

    Last night i left my system on and the BSOD appeared again a couple of minutes later. Once restarted and on the login screen, the system restarted again since i was AFK so after that restart the system worked fine.  I have now changed the memory timing to T2.  Until now everything seems to be normal.

     

    Will let you know if something happens.


    Thanks.
    • Marked as answer by Miya Yao Monday, April 4, 2011 9:30 AM
    Thursday, March 31, 2011 3:02 PM
  • I have now changed the memory timing to T2.  Until now everything seems to be normal.
    ok.

    "A programmer is just a tool which converts caffeine into code"

    I'm going to leave the forum on 31th March 2011 if I don't get a Feedback about the SPAM of 2 MVPs. So if you want an answer, be fast so that I can help you before I leave the Technet forum.
    Thursday, March 31, 2011 9:35 PM
  • Andre,

     

    Thanks for keeping up with me on trying to solve the issue as well as Spirit. Both of you guys are very wise. I can say that the issue has been solved and everything works fine.

     

    Thanks again.

    Sunday, April 3, 2011 3:02 AM
  • SystemRequirementsLab\cpudrv64.syswas installed when I tried to use the Intel Driver Update Utility. I found it caused a blue-screen with the error DRIVER_VERIFIER_DETECTED_VIOLATION (I set up Windows' Verifier.exe to troubleshoot other crashes).

    Wednesday, February 22, 2012 5:46 PM