BSOD various error codes occuring

scarborough · 02 Mar 2012

Hi there. Starting since about a week ago my system has been constantly getting BSODs ranging from codes (driver)IRQL not less or equal, page fault in non paged area, to KMODE exception not handled, among a couple of others.

I would really appreciate it if I can get help and finally be able to fix these. I've sifted through a lot of suggestions through other sites such as scanning the system through cmd and using different diagnostic tools that I've read in other forums, but they oddly come out negative (hardware/memory). I'm at my wit's end troubleshooting, and would gladly accept advice after finally deciding to join this forum.

My system specs are:
Windows 7 Home Premium
x64-based PC

My system is about less than 2 years old, a Toshiba Qosmio X505-Q887.

Attached are my dump & system file collection and performance report as per the BSOD posting guideline sticky.

JMH · 03 Mar 2012

1. I note you have AVG.
AVG can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows

2. Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads http://duplexsecure.com/faq

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

http://www.magiciso.com/download.htm

zigzag3143 · 03 Mar 2012

There are far to many probable causes to be certain ATM. The most recent ones have uptimes of around 15 mins and from that I would think a driver rather than hardware.

I would run several tests to be certain.

Lets start with a system file check.

SFC /SCANNOW Command - System File Checker

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

If it passes that we can run driver verifier to check what driver is misbehaving.

scarborough · 04 Mar 2012

Wish I could've replied sooner. Had work all day.

@JMH

I will try and do that, though AVG has been my antivirus software for a while now and I'd be really surprised if it turns out to be one of the reasons for my BSOD.

And to do as much as even giving a replacement Virtual CD/DVD-ROM! I'm grateful for the tip, thanks.

*Daemon tool removed

@zigzag3143

Just did the scan as you suggested. Got "Windows Resource Protection did not find any integrity
violations."

Also, I've already tried Driver Verifier before, if that counts. I saw it in one of the other forums, checked all non-Windows related drivers, then restarted the system. But then I ended up with a stop code 0x000000C9, saying "The IO manager has detected a violation by a driver that is being verified." Had a bit of trouble getting the system to reboot properly, then resetting the Verifier settings after successfully doing so.

scarborough · 04 Mar 2012

Also, I ran a Disk Check and the scan found no errors whatsoever. Just wanted to add this in case it helps.

[EDIT] I was able to use my system smoothly for a good hours straight. I turned it off and turned it on again after a few hours, and got a BSOD in the middle of an online match, stating another IRQL not or less equal error caused by ntoskrnl.exe (26ee0). Hope this helps.

writhziden · 05 Mar 2012

Please upload the latest full crash reports using the instructions as before so we may analyze them.

scarborough · 05 Mar 2012

Thanks for replying. I attached the crash report which I've finished just now.

writhziden · 05 Mar 2012

Antivirus Software:

Code:

avgcsrva.exe	c:\program files (x86)\avg\avg2012\avgcsrva.exe	3040	8	200	1380	2012/03/05 12:41	12.0.0.1786	507.34 KB (519,520 bytes)	2011/08/15 6:21
avgemca.exe	c:\program files (x86)\avg\avg2012\avgemca.exe	2416	8	200	1380	2012/03/05 12:41	12.0.0.1854	1.52 MB (1,593,696 bytes)	2011/09/21 19:53
avgidsagent.exe	c:\program files (x86)\avg\avg2012\avgidsagent.exe	2588	8	200	1380	2012/03/05 12:41	12.0.0.1855	4.23 MB (4,433,248 bytes)	2011/10/12 6:25
avgnsa.exe	c:\program files (x86)\avg\avg2012\avgnsa.exe	2408	8	200	1380	2012/03/05 12:41	12.0.0.1883	1.90 MB (1,987,424 bytes)	2011/09/13 10:33
avgrsa.exe	c:\program files (x86)\avg\avg2012\avgrsa.exe	3020	8	200	1380	2012/03/05 12:41	12.0.0.1806	1.31 MB (1,370,464 bytes)	2011/09/08 20:53
avgtray.exe	c:\program files (x86)\avg\avg2012\avgtray.exe	4796	8	200	1380	2012/03/05 12:42	12.0.0.1912	2.30 MB (2,416,480 bytes)	2012/01/24 17:24
avgwdsvc.exe	c:\program files (x86)\avg\avg2012\avgwdsvc.exe	1836	8	200	1380	2012/03/05 12:41	12.0.0.1773	188.26 KB (192,776 bytes)	2011/08/02 6:09
ccsvchst.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\ccsvchst.exe	1968	8	200	1380	2012/03/05 12:41	109.0.0.107	123.43 KB (126,392 bytes)	2011/12/09 18:59
ccsvchst.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\ccsvchst.exe	3920	8	200	1380	2012/03/05 12:42	109.0.0.107	123.43 KB (126,392 bytes)	2011/12/09 18:59
symcpcculaunchsvc.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\symcpcculaunchsvc.exe	5944	8	200	1380	2012/03/05 12:44	1.0.0.13	132.43 KB (135,608 bytes)	2011/12/09 18:59

I would recommend removing Norton PC Checkup. I do not see the benefit of the software, and it may cause conflicts on the system.

Possible out of date drivers

Code:

regi	fffff880`052d9000	fffff880`052e1000	Mon Apr 16 09:19:10 2007 (462393ee)	000082b5		regi.sys
GEARAspiWDM	fffff880`041ea000	fffff880`041f7000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
tosrfec	fffff880`0303a000	fffff880`03043000	Mon Jun 01 00:58:53 2009 (4a237c2d)	00014970		tosrfec.sys
QIOMem	fffff880`101eb000	fffff880`101f5000	Sun Jun 14 23:58:48 2009 (4a35e318)	0000ab35		QIOMem.sys
tosporte	fffff880`05593000	fffff880`055a4000	Tue Jun 16 04:48:47 2009 (4a37788f)	00010ea3		tosporte.sys
TVALZFL	fffff880`0404d000	fffff880`04054000	Fri Jun 19 04:05:44 2009 (4a3b62f8)	00010921		TVALZFL.sys
pgeffect	fffff880`0545c000	fffff880`05462e80	Mon Jun 22 03:00:11 2009 (4a3f481b)	00017d48		pgeffect.sys
tos_sps64	fffff880`01cfd000	fffff880`01d77000	Tue Jun 23 23:31:09 2009 (4a41ba1d)	0007eb46		tos_sps64.sys
thpdrv	fffff880`01d79000	fffff880`01d85000	Sun Jun 28 20:02:56 2009 (4a4820d0)	000138cc		thpdrv.sys
Thpevm	fffff880`01d77000	fffff880`01d78f80	Mon Jun 29 02:15:37 2009 (4a487829)	000124b8		Thpevm.SYS

regi.sys
QIOMem.sys
tosporte.sys
TVALZFL.sys
pgeffect.sys
tos_sps64.sys
thpdrv.sys
Thpevm.SYS

None of the above raise red flags, but if there are any updates available through the Toshiba support site, I would recommend downloading and installing them.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\scarborough\Windows_NT6_BSOD_jcgriff2\030412-15007-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03859000 PsLoadedModuleList = 0xfffff800`03a9e670
Debug session time: Sun Mar  4 21:51:45.166 2012 (UTC - 7:00)
System Uptime: 0 days 0:23:08.259
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8047a4f830, 2, 1, fffff800038dafaa}

Probably caused by : ntkrnlmp.exe ( nt!KiCommitThreadWait+24a )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8047a4f830, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800038dafaa, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003b08100
 fffffa8047a4f830 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiCommitThreadWait+24a
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  plugin-contain

TRAP_FRAME:  fffff88009ca98f0 -- (.trap 0xfffff88009ca98f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000fff7d000 rbx=0000000000000000 rcx=fffff88009ca9a40
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038dafaa rsp=fffff88009ca9a80 rbp=0000000000000000
 r8=fffffa8002c9a6f8  r9=0000000000000000 r10=fffffffffffffff7
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KiCommitThreadWait+0x24a:
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7 ds:00bd:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800038d51e9 to fffff800038d5c40

STACK_TEXT:  
fffff880`09ca97a8 fffff800`038d51e9 : 00000000`0000000a fffffa80`47a4f830 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09ca97b0 fffff800`038d3e60 : 00000000`00000000 fffff800`038d88a4 00000000`00000003 fffffa80`07a4f770 : nt!KiBugCheckDispatch+0x69
fffff880`09ca98f0 fffff800`038dafaa : fffffa80`07a4f770 fffffa80`07a4f770 00000000`00000000 fffffa80`00000003 : nt!KiPageFault+0x260
fffff880`09ca9a80 fffff800`038dd74f : 00000000`00000378 fffffa80`07a4f770 fffffa80`0000009e fffff800`038d823f : nt!KiCommitThreadWait+0x24a
fffff880`09ca9b10 fffff800`03bcc44e : 00000000`064bb000 fffff880`00000006 00000000`00000001 fffff800`03bc0000 : nt!KeWaitForSingleObject+0x19f
fffff880`09ca9bb0 fffff800`038d4ed3 : fffffa80`07a4f770 00000000`00000378 fffff880`09ca9bf8 fffffa80`053a9ae0 : nt!NtWaitForSingleObject+0xde
fffff880`09ca9c20 00000000`726d2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0441edd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x726d2e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiCommitThreadWait+24a
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiCommitThreadWait+24a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiCommitThreadWait+24a

BUCKET_ID:  X64_0xA_nt!KiCommitThreadWait+24a

Followup: MachineOwner
---------

In addition to the above, I see a number of memory_corruption crashes. Also, there were a couple network related crashes that may have been related to AVG...

Start with the possible memory problems:

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.

Another concern is all the corrupted .dmp files. This could indicate hard drive problems. Since the Windows hard disk check came up clean, I would recommend a more intensive check with the Drive Fitness Test

scarborough · 05 Mar 2012

Removed/Deleted the Norton PC Check-up (it was not appearing in the installed programs list, so I deleted the folders.) And will update the drivers you mentioned.

For the Memtest, I will run it later tonight before going to sleep, I really appreciate the detailed information you gave, thanks. Will get back to you once I'm done with the testing.

[EDIT] Apparently that Norton PC Check-up was the Toshiba Laptop Checkup, only under that name. Successfully uninstalled.

writhziden · 05 Mar 2012

No problem. Look forward to finding out how the tests go. Best of luck!

BSOD various error codes occuring

BSOD various error codes occurring