Windows 7: Blue Screen Appears from time to time

Bling · 13 Jul 2009

Hi,
I have a problem appearing from time to time on my laptop amilo pi 2512.
I get the blue screen , windows dumps some memory into a file and I get the following error report after it restarts:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.2.2.0.768.2
Locale ID: 1026
Additional information about the problem:
BCCode: d1
BCP1: 1E004D70
BCP2: 00000002
BCP3: 00000000
BCP4: 9BE431A5
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1
Files that help describe the problem:
C:\Windows\Minidump\Mini071309-01.dmp
C:\Users\Ivaylo\AppData\Local\Temp\WER-35958-0.sysdata.xml
C:\Users\Ivaylo\AppData\Local\Temp\WERBC0D.tmp.version.txt

Please don't delete my thread.I am new here and if I have done something wrong, tell me and I will correct it according to your forum rules.

Lebon14 · 13 Jul 2009

Don't panic, you are in the right place. You did nothing wrong. (Btw, Welcome to SevenForums

)

We will start by the beginning.
1. What are your system specs? Are those the specs of the laptop?
2. Is the blue screen always happening when doing the same task or is it random?
3. Since when does this problem happens?
4. Please, post the minidump here. Some people here knows how to read it here and can help to pinpoint the problem you have.

Also, gives us all information you have no matter how small. It can help.

Lebon

Bling · 13 Jul 2009

Quote: Originally Posted by Lebon14

Don't panic, you are in the right place. You did nothing wrong. (Btw, Welcome to SevenForums

)

We will start by the beginning.
1. What are your system specs? Are those the specs of the laptop?
2. Is the blue screen always happening when doing the same task or is it random?
3. Since when does this problem happens?
4. Please, post the minidump here. Some people here knows how to read it here and can help to pinpoint the problem you have.

Also, gives us all information you have no matter how small. It can help.

Lebon

Thank you for the warm welcome and the quick reply

1.Yes , those are the specs.
2. I believe it is random though I am not sure...

3. It happened ever since I got Vista. I have changed couple of OS's. At first I was with XP. When the laptop ran with XP , it wasn't blue screen, the system just froze, mouse and everything else was not responding. The only solution was to restart it. Then I got Vista. Now it doesn't freeze but but I have this bluescreen thing.
4.I have attached the minidump file here.

Accuser · 13 Jul 2009

I had the same problem.
After some research I realized that it had to do something with my videocard drivers from ATI together with Battlefield Heroes... I had to reinstall to solve the problem.

Here's some information for you and everyone who needs it how to analyse a dumpfile and determine the cause of your problems:

1. Download
http://msdl.microsoft.com/download/s...86_6.4.7.2.exe
and install it.
2. Start WinDbg
3. In the menu of WinDbg goto "File>Symbol File Path" and type in the following:
SRV*C:\Symbols*Symbol information
WinDbg will now only download the necessary Smybol Files and not the whole load of 170MB.
4. Now it's time to open your dumpfile:
%SystemRoot%\Minidump at File>Open Crash Dump
5. Now there will open 2 windows: Command and Disassembly.
You can close the Disassembly window if you aren't some type of nerd...
6. Bugcheck Analysis shows you an Error Code which you can use with e.g. google to find more information about the problem.
If you wanna have more information about the error code, go to the Command window and type !analyze -v
Now you can see a bunch of information in the window. In the first lines there's a word in capital letters that describes the type of the error.
Also very interesting is the line Probably caused by. Here you can see which file probably caused the error.

After your description that the bluescreen/freeze is there since you're using XP, I would say it has definitely something to do with your hardware.
First of all, update every single driver for your notebook to the latest version. Disable every hardware you do not necessarily need to determine the cause of your problems e.g. printers, soundcard, touchpad (try to use an USB mouse instead) or driver software for your laptop's shortcut key functions.
When the problem occurs again, try analysing your hardware

Try following software to test your RAM:
Memtest86+ - Advanced Memory Diagnostic Tool
Just run the tool and let it test for about 30 minutes up to an hour. When your RAM is Ok, there won't be any error.
You can also test the stability of your system to determine where the problem can be found, google knows everything

I hope I also helped you a little bit without directly analysing your dumpfile, but I'm at work right now. Perhaps later...

Bling · 14 Jul 2009

Hi,
I have installed windows debbuger as you said, but I am having a problem:
it seems the symbol path is not correct. I have uploaded a video to show you what I did ... Can you please provide more information on step 3 ?

Accuser · 14 Jul 2009

Try downloading the whole Symbol File package here:
Download Windows Symbol Packages
be sure to download the correct version for your OS

Bling · 14 Jul 2009

Downloading... This could take a while

9,12 KB transfer rate

Can anyone share Windows Vista SP2 and Windows Server 2008 SP2 x86 retail symbols, all languages on a file hosting site please ?

I have installed also the latest video and wlan drivers... I will see if this helps.

ussj4brolli · 14 Jul 2009

Quote: Originally Posted by Bling

Hi,
I have installed windows debbuger as you said, but I am having a problem:
it seems the symbol path is not correct. I have uploaded a video to show you what I did ... Can you please provide more information on step 3?

Try using driver sweeper.
Uninstall all ati drivers
reboot into safe mode (not necessary, but a good idea)
run driver sweeper, select ATI drivers
Analyze
select all, then clean. then reboot
download newest ati drivers - install

i had issues with BSOD on my laptop too, found out to be ATI related..

Also, does the system overheat?
Can u reproduce the issue at will, or it happends whenever it wants to..
As noted above, try memtest, and maybe even Prime95 and have it run torture test for a little while and see if errors occur. have nothing else running (to eliminate say, IE causing the BSOD)

Accuser · 14 Jul 2009

Ok, I did it for you

Here I post the debug information:

Code:

BugCheck D1, {1e004d70, 2, 0, 9be431a5}

Probably caused by : afd.sys ( afd!AfdCompletePollIrp+51 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 1e004d70, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 9be431a5, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d3f868
Unable to read MiSystemVaType memory at 81d1f420
 1e004d70 

CURRENT_IRQL:  2

FAULTING_IP: 
afd!AfdCompletePollIrp+51
9be431a5 8b4658          mov     eax,dword ptr [esi+58h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  81cfdad4 -- (.trap 0xffffffff81cfdad4)
ErrCode = 00000000
eax=2fea4208 ebx=8472f4e0 ecx=8472f4d0 edx=8472f4e0 esi=1e004d18 edi=8472f498
eip=9be431a5 esp=81cfdb48 ebp=81cfdb54 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
afd!AfdCompletePollIrp+0x51:
9be431a5 8b4658          mov     eax,dword ptr [esi+58h] ds:0023:1e004d70=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 9be431a5 to 81c55fb9

STACK_TEXT:  
81cfdad4 9be431a5 badb0d00 8472f4e0 00000008 nt!KiTrap0E+0x2e1
81cfdb54 9be4328a 8472f498 00000000 81cfdc50 afd!AfdCompletePollIrp+0x51
81cfdb68 81cb22eb 8424d748 8424d738 2b49fc17 afd!AfdTimeoutPoll+0x2e
81cfdc88 81cb1f21 81cfdcd0 00001002 81cfdcd8 nt!KiTimerListExpire+0x367
81cfdce8 81cb2615 00000000 00000000 0002dc33 nt!KiTimerExpiration+0x2a0
81cfdd50 81cb087d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81cfdd54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdCompletePollIrp+51
9be431a5 8b4658          mov     eax,dword ptr [esi+58h]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  afd!AfdCompletePollIrp+51

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49e020c5

FAILURE_BUCKET_ID:  0xD1_afd!AfdCompletePollIrp+51

BUCKET_ID:  0xD1_afd!AfdCompletePollIrp+51

Followup: MachineOwner

As you can see, the file causing the problems is afd.sys

I searched for you and found this article:

Workarounds for Memory Leak in Some Versions of Microsoft Windows afd.sys file

It seems that afd.sys which is part of Microsofts TCP/IP stack contains a memory leak in many versions. Maybe the article will help you solve yur problem.

usasma · 14 Jul 2009

"How To" for generating Minidump analysis': Diagnosing Bsod's (originally posted 02Oct08) - Vox
There's no need to download symbols if you use the Microsoft Symbol Server listed in Item E in the above link

I'd suggest using Driver Verifier according to these instructions. Please read them first as your system can get stuck in a BSOD loop and you may not be able to get into Windows!

Quote:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft (in case it's one of them that causing AFD.SYS to spit out errors)
Then select the AFD.SYS driver
Then click "Next"

- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows, turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

Windows 7: Blue Screen Appears from time to time

Blue Screen Appears from time to time problems?