Windows 7: Random BSOD, error 0x0000001a and 0x0000001e

aandrade158 · 28 Mar 2012

Hey I recently got an ASUS X54H laptop and it has windows 7 ultimate x64. I randomly get the BSOD error 0x0000001a and 0x0000001e and I've tried updating the drivers and still no luck it could be running great for a week or so and then give me the BSOD. I've attached the .zip made from the performance monitor. Any help would be great.

Thanks,
Adrian

writhziden · 28 Mar 2012

Security Software:

Code:

avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1456	8	200	1380	3/28/2012 9:13 AM	6.0.1367.0	43.72 KB (44,768 bytes)	2/15/2012 5:51 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	2536	8	200	1380	3/28/2012 9:14 AM	6.0.1367.0	3.57 MB (3,744,552 bytes)	2/15/2012 5:51 PM

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\aandrade158\Windows_NT6_BSOD_jcgriff2\032812-17534-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16917.amd64fre.win7_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e52e70
Debug session time: Tue Mar 27 22:57:31.892 2012 (UTC - 6:00)
System Uptime: 0 days 0:15:50.218
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {411, fffff68000011258, 38a000004531e8c6, cffff68000011259}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+5fe1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000411, The subtype of the bugcheck.
Arg2: fffff68000011258
Arg3: 38a000004531e8c6
Arg4: cffff68000011259

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_411

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c4d69e to fffff80002c86540

STACK_TEXT:  
fffff880`06242888 fffff800`02c4d69e : 00000000`0000001a 00000000`00000411 fffff680`00011258 38a00000`4531e8c6 : nt!KeBugCheckEx
fffff880`06242890 fffff800`02cb807d : 00000000`0224bd25 fffff680`00011258 0000007f`fffffff8 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x5fe1
fffff880`062428e0 fffff800`02ca2976 : 00000000`00000000 00000000`0223b869 fffff683`ff78b070 fffffa80`040a0aa8 : nt!MiResolveTransitionFault+0x38d
fffff880`06242970 fffff800`02ca0393 : ffffffff`ffffffff 00000000`00000000 fffff800`02dffe80 fffff780`00000320 : nt!MiDispatchFault+0x946
fffff880`06242a80 fffff800`02c8462e : 00000000`00000000 00000000`00000002 00000000`00000001 000007fe`f1220000 : nt!MmAccessFault+0x343
fffff880`06242be0 000007fe`f1247d5b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`02cbc7a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`f1247d5b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+5fe1
fffff800`02c4d69e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+5fe1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec7a284

FAILURE_BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+5fe1

BUCKET_ID:  X64_0x1a_411_nt!_??_::FNODOBFM::_string_+5fe1

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...

If you are overclocking any hardware, please stop.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. In Windows 7:
- Click the Start Menu
- Type verifier in Search programs and files (do not hit enter)
- Right click verifier and click Run as administrator
- Put a tick in Create custom settings (for code developers) and click next
- Put a tick in Select individual settings from a full list and click next
- Set up the individual settings as in the image and click next
  Attachment 204941
- Put a tick in Select driver names from a list
- Put a tick next to all non-Microsoft drivers.
- Click Finish.
- Restart your computer.
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

aandrade158 · 29 Mar 2012

ok i ran the driver verifier and restarted my computer and it wouldnt let me get passed the Windows loading screen. I got "STOP ERROR 0x000000C9" . I've attached the minidump file that was created.

writhziden · 29 Mar 2012

Please remove Daemon Tools, as it uses a driver called dtsoftbus01.sys that is known to cause BSODs.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.

Also, see my first post for the correct settings for running Verifier. Sorry, I forgot to include the image. Reset Verifier with the following before doing the steps in my first post: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type this command followed by the Enter key:

verifier /reset

-> Restart your computer.

aandrade158 · 01 Apr 2012

ok after resetting the driver verifier and restarting my computer, I ran the driver verifier with the correct settings and today I got BSOD.

writhziden · 02 Apr 2012

Alright, it is blaming your processor driver for the crashes. This could mean faulty hardware. Disable Verifier for the time being: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type this command followed by the Enter key:

verifier /reset

-> Restart your computer.

Check your hardware:

If you are overclocking any hardware, please stop.
Monitor temperatures during the following tests.
Use the following programs to monitor the temperatures.
- Real Temp is a good CPU temperature monitor.
- Speccy - System Information - Free Download will monitor all hardware temperatures.
- HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
- Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Let it run until the GPU temperatures even out or until the GPU temperatures reach a dangerous level (you can find the max temperature for your card on either the nVidia or AMD sites; if you are not sure, ask us). Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
- Run Hardware - Stress Test With Prime95 to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.
- Follow the steps for doing a CPU stress test using IntelBurnTest
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.

aandrade158 · 03 Apr 2012

hey i got the BSOD yesterday but i have not ran the stress test yet. i attached the minidump file.

writhziden · 03 Apr 2012

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\aandrade158\040212-21824-01\040212-21824-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?fffff800`00b9c4c0?
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`030a0650
Debug session time: Mon Apr  2 00:49:12.174 2012 (UTC - 6:00)
System Uptime: 0 days 3:18:09.376
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800779e060, fffff80000b9c4d8, fffff98029644c60}

Probably caused by : usbhub.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800779e060, Physical Device Object of the stack
Arg3: fffff80000b9c4d8, Functional Device Object of the stack
Arg4: fffff98029644c60, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

DRIVER_OBJECT: fffffa8007de5560

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d8c0c15

MODULE_NAME: usbhub

FAULTING_MODULE: fffff88003e69000 usbhub

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

STACK_TEXT:  
fffff800`00b9c488 fffff800`02f46192 : 00000000`0000009f 00000000`00000003 fffffa80`0779e060 fffff800`00b9c4d8 : nt!KeBugCheckEx
fffff800`00b9c490 fffff800`02ee3a6c : fffff800`00b9c5c0 fffff800`00b9c5c0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x34040
fffff800`00b9c530 fffff800`02ee3906 : fffffa80`08ce9168 fffffa80`08ce9168 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5a0 fffff800`02ee37ee : 0000001b`ae9edf2a fffff800`00b9cc18 00000000`000ba116 fffff800`03050548 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cbf0 fffff800`02ee35d7 : 00000005`aa146cc2 00000005`000ba116 00000005`aa146cb0 00000000`00000016 : nt!KiTimerExpiration+0x1be
fffff800`00b9cc90 fffff800`02ed0a6a : fffff800`0304de80 fffff800`0305bcc0 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd00 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_VRF_3_IMAGE_usbhub.sys

BUCKET_ID:  X64_0x9F_VRF_3_IMAGE_usbhub.sys

Followup: MachineOwner
---------

This was a new crash and points to a USB device, or possibly the USB ports being in a power state that protects the system from power surges.

Start with USB Driver - General Fix for Problems to resolve the USB issues. Also, USB ports can sometimes enter a safe power state to protect the system from power surges due to USB devices. To reset the USB ports to a nominal power state:
1. Shut down and turn off the computer.
2. Unplug the computer from the wall or surge protector (then remove the battery if it is a laptop).
3. Hold down the power button for 30 seconds. This closes the circuit and ensures all
  power from components is drained to clear the software connections between the BIOS
  and hardware and clear any corruption in the temporary memory.
4. (If it is a laptop, plug the battery back into the laptop and then) Plug the computer back into the wall.
5. Turn it on to reinitialize the software connections between the BIOS and hardware

aandrade158 · 10 Apr 2012

hi i havent had a BSOD for a while and today it happened i attached the minidump. thank you

writhziden · 11 Apr 2012

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\aandrade158\041012-21715-01\041012-21715-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03048650
Debug session time: Tue Apr 10 20:13:02.917 2012 (UTC - 6:00)
System Uptime: 3 days 4:31:08.449
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d897be2871, b3b7465eea3c3b2f, fffff88000c3be98, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d897be2871, Reserved
Arg2: b3b7465eea3c3b2f, Reserved
Arg3: fffff88000c3be98, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002e80d40

SYMBOL_ON_RAW_STACK:  1

STACK_ADDR_RAW_STACK_SYMBOL: fffff880031d35c0

STACK_COMMAND:  dds FFFFF880031D35C0-0x20 ; kb

STACK_TEXT:  
fffff880`031d35a0  00000109
fffff880`031d35a4  00000000
fffff880`031d35a8  97be2871
fffff880`031d35ac  a3a039d8
fffff880`031d35b0  ea3c3b2f
fffff880`031d35b4  b3b7465e
fffff880`031d35b8  00c3be98
fffff880`031d35bc  fffff880
fffff880`031d35c0  00000001
fffff880`031d35c4  00000000
fffff880`031d35c8  00000000
fffff880`031d35cc  00000000
fffff880`031d35d0  00000000
fffff880`031d35d4  00000000
fffff880`031d35d8  00000000
fffff880`031d35dc  00000000
fffff880`031d35e0  00000000
fffff880`031d35e4  00000000
fffff880`031d35e8  00000000
fffff880`031d35ec  00000000
fffff880`031d35f0  00000000
fffff880`031d35f4  00000000
fffff880`031d35f8  00000000
fffff880`031d35fc  00000000
fffff880`031d3600  00000000
fffff880`031d3604  00000000
fffff880`031d3608  00000000
fffff880`031d360c  00000000
fffff880`031d3610  00000000
fffff880`031d3614  00000000
fffff880`031d3618  00000000
fffff880`031d361c  00000000


CHKIMG_EXTENSION: !chkimg -lo 50 -db !CI
6 errors : !CI (fffff88000c3b01f-fffff88000c3bf0f)
fffff88000c3b010  7c  09  49  23  c9  45  3b  ea  49  89  8e  78  01  00  00 *09 |.I#.E;.I..x....
...
fffff88000c3b250  40  79  e3  6d  48  8b  7c *04  10  41  8b  c8  48  33  c1  8b @y.mH.|..A..H3..
...
fffff88000c3b290  7c  24  18  48  8b  d9  48 *0b  f2  8b  c2  c1  e0  04  48  8b |$.H..H.......H.
...
fffff88000c3b360  cc  cc  cc  cc  48  89  5c *04  08  48  89  74  24  10  48  89 ....H.\..H.t$.H.
...
fffff88000c3ba30  cc  cc  cc  cc  cc  cc  cc *8c  8b  c2  4c  8b  c2  4c  8b  d1 ..........L..L..
...
fffff88000c3bf00  d6  83  c2  94  48  23  d0  8b  c6  c1  e8  08  0f  b7  c8 *01 ....H#..........

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

Your latest crash points to your memory still. Have you had a chance to run Memtest86+? Don't swap any RAM modules in your laptop as it could void the warranty. Just run Memtest86+ and see if any errors show up.

The timestamp for win32k.sys could not be verified. This is a system file, so this may indicate Windows corruption.

Run Disk Check with with Automatically fix file system errors checked. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

Also, since this is a new laptop, you may consider contacting the manufacturer regarding your warranty.

Windows 7: Random BSOD, error 0x0000001a and 0x0000001e

Random BSOD, error 0x0000001a and 0x0000001e problems?