locked
Blue Screen On Win7 64-Bit RRS feed

  • Question

  • here is the event log:


    Log Name:      System
    Source:        Microsoft-Windows-WER-SystemErrorReporting
    Date:          09/10/25 3:23:04 AM
    Event ID:      1001
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      AlwaysMe-PC
    Description:
    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000004a (0x0000000074d22dd9, 0x0000000000000002, 0x0000000000000000, 0xfffff8800617cca0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102509-24398-01.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
        <EventID Qualifiers="16384">1001</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-10-25T03:23:04.000000000Z" />
        <EventRecordID>4514</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>AlwaysMe-PC</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">0x0000004a (0x0000000074d22dd9, 0x0000000000000002, 0x0000000000000000, 0xfffff8800617cca0)</Data>
        <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
        <Data Name="param3">102509-24398-01</Data>
      </EventData>
    </Event>




    ___________


    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000004a (0x0000000074d22dd9, 0x0000000000000002, 0x0000000000000000, 0xfffff8800617cca0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 102509-24398-01.



    ___


    - System
    - Provider
    [ Name ] Microsoft-Windows-WER-SystemErrorReporting
    [ Guid ] {ABCE23E7-DE45-4366-8631-84FA6C525952}
    [ EventSourceName ] BugCheck
    - EventID 1001
    [ Qualifiers ] 16384
    Version 0
    Level 2
    Task 0
    Opcode 0
    Keywords 0x80000000000000
    - TimeCreated
    [ SystemTime ] 2009-10-25T03:23:04.000000000Z
    EventRecordID 4514
    Correlation
    - Execution
    [ ProcessID ] 0
    [ ThreadID ] 0
    Channel System
    Computer AlwaysMe-PC
    Security
    - EventData
    param1 0x0000004a (0x0000000074d22dd9, 0x0000000000000002, 0x0000000000000000, 0xfffff8800617cca0)
    param2 C:\Windows\MEMORY.DMP
    param3 102509-24398-01


    Whats going on with my machine ?

    Is it the OS or the hardwares ?

    Please Help...
    Sunday, October 25, 2009 3:54 AM

Answers

  • From the minidump file the Stop Error was a IRQL_GT_ZERO_AT_SYSTEM_SERVICE (BugCheck 4A) probably caused by the ntkrnlmp.exe.

    Although a system file is listed as causing the crash there is a good chance the problem is actually caused by a third party driver. However the problem could be also be hardware.

    It is interesting to note that the process that crashed was the vsmon.exe which is a ZoneAlarm service.

    I would suggest, if the BSODs continue, to uninstall ZoneAlarm and see if the BSODs resolve.

    Sunday, October 25, 2009 9:01 PM

All replies

  • Can you zip up the minidump files in the C:\Windows\Minidump folder and make available via Windows Live Skydrive or similar site?
    Sunday, October 25, 2009 4:11 AM
  • Can you zip up the minidump files in the C:\Windows\Minidump folder and make available via Windows Live Skydrive or similar site?
    Thanks for replying

    There is only 1 dump file and I've uploaded it and here is the link:

    http://cid-6f785907e059b112.skydrive.live.com/self.aspx/.Public/102509-24398-01.zip

    Thanks You
    Sunday, October 25, 2009 1:16 PM
  • From the minidump file the Stop Error was a IRQL_GT_ZERO_AT_SYSTEM_SERVICE (BugCheck 4A) probably caused by the ntkrnlmp.exe.

    Although a system file is listed as causing the crash there is a good chance the problem is actually caused by a third party driver. However the problem could be also be hardware.

    It is interesting to note that the process that crashed was the vsmon.exe which is a ZoneAlarm service.

    I would suggest, if the BSODs continue, to uninstall ZoneAlarm and see if the BSODs resolve.

    Sunday, October 25, 2009 9:01 PM
  • I actually  have no idea how the BSOD apeeraed last night :|
    All I know is I downloaded the browser Firefox 3.7 for Win7 64-Bit; Its an unstable version of Firefox which was created for Win7 64-Bit recently, and when I tried to install the adobe flash player for the browser my machine crashed.
    Yes Zonealarm does a check on every new process starts, but after rebooting I tried the same , i.e Installing adobe flash player for Firefox, and no ERROR occured :|
    After realizing that there is no adobe flash player supported for win 64-Bit browsers I un-installed it and downloaded the previous version ,i.e 3.5 for Win 32-Bit, and installed the adobe flash player with no problem.
    I left my machine working last night with the Firefox opened and the BSOD didn't appear.
    Dunno if the problem still unsolved or it was a one-time-experience.

    Thanks for your assistance and I'll update you if the BSOD appeared again.

    Sunday, October 25, 2009 10:44 PM
  • Hi
    The BSOD appeared again and my system crashed

    here is the system log info:

    - System
       
    - Provider
          [ Name ] Microsoft-Windows-WER-SystemErrorReporting
          [ Guid ] {ABCE23E7-DE45-4366-8631-84FA6C525952}
          [ EventSourceName ] BugCheck
       
    - EventID 1001
          [ Qualifiers ] 16384
       
      Version 0
       
      Level 2
       
      Task 0
       
      Opcode 0
       
      Keywords 0x80000000000000
       
    - TimeCreated
          [ SystemTime ] 2009-10-26T20:38:56.000000000Z
       
      EventRecordID 5879
       
      Correlation
       
    - Execution
          [ ProcessID ] 0
          [ ThreadID ] 0
       
      Channel System
       
      Computer ALWAYSME-PC
       
      Security
    - EventData
        param1 0x0000004a (0x0000000075032dd9, 0x0000000000000002, 0x0000000000000000, 0xfffff88006529ca0)
        param2 C:\Windows\MEMORY.DMP
        param3 102609-19687-01


    and here is the dump file on the following link:

    http://cid-6f785907e059b112.skydrive.live.com/self.aspx/.Public/Desktop.zip

    N.B the zip file contains dump files for this nights BSOD and the previous BSOD from 2 nights ago.

    Thanks
    Monday, October 26, 2009 8:50 PM
  • Remove Zonealarm, and you be happy.

    The built-in firewall is always enough.

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [D:\zahni\Downloads\x\102509-24398-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
    Machine Name:
    Kernel base = 0xfffff800`02816000 PsLoadedModuleList = 0xfffff800`02a53e50
    Debug session time: Sun Oct 25 04:21:47.813 2009 (GMT+1)
    System Uptime: 0 days 2:20:27.013
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 4A, {74d22dd9, 2, 0, fffff8800617cca0}
    
    Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
    Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
    Arguments:
    Arg1: 0000000074d22dd9, Address of system function (system call routine)
    Arg2: 0000000000000002, Current IRQL
    Arg3: 0000000000000000, 0
    Arg4: fffff8800617cca0, 0
    
    Debugging Details:
    ------------------
    
    
    PROCESS_NAME:  vsmon.exe
    
    BUGCHECK_STR:  RAISED_IRQL_FAULT
    
    FAULTING_IP: 
    +6895952f03b4dd18
    00000000`74d22dd9 ??              ???
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    CURRENT_IRQL:  2
    
    LAST_CONTROL_TRANSFER:  from fffff80002887469 to fffff80002887f00
    
    STACK_TEXT:  
    fffff880`0617ca68 fffff800`02887469 : 00000000`0000004a 00000000`74d22dd9 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0617ca70 fffff800`028873a0 : fffff880`0617cca0 fffffa80`05df8a90 fffff880`0617cbf8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`0617cbb0 00000000`74d22dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
    00000000`0358e948 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74d22dd9
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!KiSystemServiceExit+245
    fffff800`028873a0 4883ec50        sub     rsp,50h
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  nt!KiSystemServiceExit+245
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME:  ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600
    
    FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsmon.exe_nt!KiSystemServiceExit+245
    
    BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsmon.exe_nt!KiSystemServiceExit+245
    
    Followup: MachineOwner
    ---------
    
    
    Monday, October 26, 2009 9:42 PM