Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: occasional random BSOBs recently.

01 Nov 2012   #1
dipde1985

Windows 7 Pro x64
 
 
occasional random BSOBs recently.

over the last month i have been getting occasional BSOB that i know nothing about.
please help find the source. I basically have never got BOSD on a regular basis before, and try to keep the pc in ship shape.

i think i followed the dmp upload instructions properly. but let me know if otherwise.


i put together my pc a couple of years ago and there has not been any hardware changes in and last few months. nor can i recall any software changes in this time frame. I manually update via windows update most of my drivers.

the issue is occurring sometimes when i am away from the pc and something completely randomly when browsing the web. (Firefox with several tabs is always on my pc).

each time a mini memory dmp has been created as attached.


details:

-I have norton 360 runing and always updated.
-There are seemingly no temerature issue with this pc as both CPU and GPU temp hardly go above 65 deg. I don't game. Mainly just firefox, Office, and VLC.
-i dont knw how, and hence don't overclock
-system restore is off on this pc. Not sure when that happened, maybe after i set up the SSD a few months a go.


thanks in advance.


My System SpecsSystem Spec
.
01 Nov 2012   #2
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

Welcome to SevenForums

Let us first take a look at your most recent .dmps bugchecks and usual causes.
Code:
STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Usual causes: None listed
BugCheck 1000007E, {ffffffffc0000005, fffff80004ec369b, fffff880039167c8, fffff88003916020}
Probably caused by : ntkrnlmp.exe ( nt!ExpScanGeneralLookasideList+a0 )
-----------------------------------------------------------
STOP 0x00000019: BAD_POOL_HEADER 
Usual causes:  Device driver
BugCheck 19, {22, fffff8a00d65c000, 1, 0}
GetPointerFromAddress: unable to read from fffff80005100100
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 )
-----------------------------------------------------------
STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
BugCheck 1E, {0, 0, 0, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
-----------------------------------------------------------
STOP 0x00000019: BAD_POOL_HEADER 
Usual causes:  Device driver
BugCheck 19, {20, fffffa800bef3ae0, fffffa800bef3da0, 42c4108}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
-----------------------------------------------------------
STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
BugCheck 1E, {ffffffffc0000005, fffff80000b98ce0, 0, 0}
Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : IDSvia64.sys ( IDSvia64+3389b )
Norton is often responsible for stuff like this:
Code:
fffff800`00b9b0c8  fffff880`01f34843 tcpip!TcpInspectReceive+0xd3
fffff800`00b9b0d0  fffffa80`10ecb620
fffff800`00b9b0d8  fffff880`01e702e6 tcpip!TcpTcbAcceptDatagram+0x46
fffff800`00b9b0e0  fffffa80`10ecb780
fffff800`00b9b0e8  00000000`edecd1c3
fffff800`00b9b0f0  fffffa80`0ff68c40
fffff800`00b9b0f8  fffff880`01c881a7 ndis!NdisFreeNetBufferList+0x87
fffff800`00b9b100  fffff800`00b9b2b0
fffff800`00b9b108  fffff880`01f10771 tcpip!TcpDelayOrScheduleAck+0x51
fffff800`00b9b110  fffff880`07867848 nwifi!Dot11AllocateRecvMdlAndMemForNdis6
fffff800`00b9b118  00000000`00000000
fffff800`00b9b120  fffff800`04ec6bb0 nt!KiKernelCalloutExceptionHandler
fffff800`00b9b128  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b130  fffff800`04ec6eca nt!KiIdleLoop+0x5a
fffff800`00b9b138  00000000`00000000
fffff800`00b9b140  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b148  00000000`00000000
fffff800`00b9b150  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b158  fffff800`04ecf2db nt!KeBugCheckEx+0x11b
fffff800`00b9b160  fffffa80`0e2a3800
fffff800`00b9b168  fffff880`078a1300 nwifi!Dot11Mem+0x180
fffff800`00b9b170  fffff880`078a1300 nwifi!Dot11Mem+0x180
fffff800`00b9b178  fffffa80`0d7c57f0
fffff800`00b9b180  00000000`00000000
fffff800`00b9b188  00000000`00000000
fffff800`00b9b190  00000000`00000286
fffff800`00b9b198  fffff800`04ecf199 nt!KiBugCheckReturn+0x5
fffff800`00b9b1a0  00000000`0000001e
fffff800`00b9b1a8  fffff800`00b9cc40
fffff800`00b9b1b0  fffff800`00b9b940
fffff800`00b9b1b8  fffff800`00b9b2c0
fffff800`00b9b1c0  fffff800`00b9c0e8
fffff800`00b9b1c8  fffff800`04ec6bbe nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b1d0  00000000`00000000
fffff800`00b9b1d8  fffff800`04efa320 nt!_C_specific_handler
fffff800`00b9b1e0  fffff800`050d595c nt!BBTBuffer <PERF> (nt+0x28595c)
fffff800`00b9b1e8  fffff800`04eddb0c nt!IopTimerDispatch+0x12f
fffff800`00b9b1f0  00000000`00000000
fffff800`00b9b1f8  fffff800`04ef9e2d nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b200  fffff800`050d5770 nt!BBTBuffer <PERF> (nt+0x285770)
fffff800`00b9b208  fffff800`050122f0 nt!_imp_NtOpenSymbolicLinkObject+0x4de8
fffff800`00b9b210  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b218  fffff800`00b9c0e8
fffff800`00b9b220  fffff800`00b9b2c0
fffff800`00b9b228  fffff800`04ef8c05 nt!RtlDispatchException+0x415
fffff800`00b9b230  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b238  fffff800`00b9b278
fffff800`00b9b240  fffff800`00b9c0e8
fffff800`00b9b248  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b250  ffff0080`014f2f57
fffff800`00b9b258  fffffa80`0bc851a0
fffff800`00b9b260  00000000`00000000
fffff800`00b9b268  00000000`00000000
fffff800`00b9b270  fffff800`00b9cc40
fffff800`00b9b278  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b280  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b288  fffff800`00b9b7e0
fffff800`00b9b290  00000000`00000000
fffff800`00b9b298  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b2a0  fffff800`00b9d000
fffff800`00b9b2a8  fffff800`00b97000
fffff800`00b9b2b0  00000000`00000000
fffff800`00b9b2b8  fffffa80`0ff68c40
fffff800`00b9b2c0  fffff800`04ec6eca nt!KiIdleLoop+0x5a
fffff800`00b9b2c8  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b2d0  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b2d8  fffff800`00b9cc40
fffff800`00b9b2e0  00000000`00000000
fffff800`00b9b2e8  fffff800`00b9b310
fffff800`00b9b2f0  fffff800`04ec6bb0 nt!KiKernelCalloutExceptionHandler
fffff800`00b9b2f8  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b300  fffff800`00b9b7e0
fffff800`00b9b308  fffffa80`00000000
fffff800`00b9b310  fffffa80`0a378800
fffff800`00b9b318  fffff880`01d7a872 NETIO!NetioDereferenceNetBufferListChain+0x132
fffff800`00b9b320  fffffa80`0a249a60
fffff800`00b9b378  fffff880`01e53c60 tcpip!FlpReturnNetBufferListChain
fffff800`00b9b380  fffffa80`0a39c490
fffff800`00b9b388  fffff880`01e57544 tcpip!IppReceiveHeadersHelper+0x454
fffff800`00b9b658  fffff880`01e5774a tcpip!IppProcessDeliverList+0x5a
fffff800`00b9b660  00000000`00000000
fffff800`00b9b668  fffff880`01f6e9a0 tcpip!Ipv4Global
fffff800`00b9bbe8  fffff880`01e53c12 tcpip!FlReceiveNetBufferListChain+0xb2
fffff800`00b9bbf0  fffff880`01e53470 tcpip!FlReceiveNetBufferListChainCalloutRoutine
fffff800`00b9bbf8  fffff880`01d4d395 ndis!ethFilterDprIndicateReceivePacket+0x385
fffff800`00b9bc00  00000000`00000002
fffff800`00b9bc18  fffff880`01e5b902 tcpip!IpSecTlPacketsOutProcessing+0x2
Code:
fffff800`00b9c538  fffff880`041c3ee0Unable to load image \SystemRoot\System32\Drivers\N360x64\0604000.009\SYMNETS.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
 SYMNETS+0x55ee0
-----------------------------------------------------------
fffff800`00b9c388  fffff880`0ce0b2a1Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121006.001\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
 IDSvia64+0xb2a1
One dump which shows what was causing BSOD exactly:
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80000b98ce0, 0, 0}

Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : IDSvia64.sys ( IDSvia64+3389b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80000b98ce0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+6a182faf0317de30
fffff800`00b98ce0 089cb90000f8ff  or      byte ptr [rcx+rdi*4-80000h],bl

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000510f100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff80000b99c08 -- (.exr 0xfffff80000b99c08)
ExceptionAddress: fffff8000500b617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff80000b99cb0 -- (.trap 0xfffff80000b99cb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000b163d6c604830 rbx=0000000000000000 rcx=fffffa800bd700a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000500b617 rsp=fffff80000b99e40 rbp=0000000000001000
 r8=0000000000000000  r9=fffff80005068620 r10=fffff80005067588
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`0500b617 48895808        mov     qword ptr [rax+8],rbx ds:000b163d`6c604838=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80004f6883b to fffff80004ee01c0

STACK_TEXT:  
fffff800`00b98c28 fffff800`04f6883b : 00000000`0000001e ffffffff`c0000005 fffff800`00b98ce0 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b98c30 fffff800`04f331e4 : fffff800`00b98e78 fffff880`00000078 fffffa80`0c211308 fffff880`04f08b3f : nt!KipFatalFilter+0x1b
fffff800`00b98c70 fffff800`04f0b3ac : fffff800`00b98ce0 fffff880`04f08c08 00000000`00000001 fffffa80`0ad91040 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff800`00b98cb0 fffff800`04f0ae2d : fffff800`05023c48 fffff800`00b9bb10 00000000`00000000 fffff800`04e61000 : nt!_C_specific_handler+0x8c
fffff800`00b98d20 fffff800`04f09c05 : fffff800`05023c48 fffff800`00b98d98 fffff800`00b99c08 fffff800`04e61000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b98d50 fffff800`04f1ab81 : fffff800`00b99c08 fffff800`00b99460 fffff800`00000000 00000000`00000005 : nt!RtlDispatchException+0x415
fffff800`00b99430 fffff800`04edf842 : fffff800`00b99c08 fffff800`05068620 fffff800`00b99cb0 00000000`000000f7 : nt!KiDispatchException+0x135
fffff800`00b99ad0 fffff800`04ede14a : fffffa80`141be660 fffffa80`141be6c0 fffffa80`0bcce100 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`00b99cb0 fffff800`0500b617 : 00000000`00080000 fffff800`00000000 fffffa80`0b9b8e10 fffffa80`0b9b8550 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b99e40 fffff880`0ce5889b : 00000000`00000000 00000000`00000f5c 00000000`00000000 fffff800`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff800`00b99f30 00000000`00000000 : 00000000`00000f5c 00000000`00000000 fffff800`00000000 00000000`00000000 : IDSvia64+0x3389b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
IDSvia64+3389b
fffff880`0ce5889b ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  IDSvia64+3389b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IDSvia64

IMAGE_NAME:  IDSvia64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  503d8308

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+3389b

BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+3389b

Followup: MachineOwner
---------

0: kd> lmvm IDSvia64
start             end                 module name
fffff880`0ce25000 fffff880`0cea7000   IDSvia64 T (no symbols)           
    Loaded symbol image file: IDSvia64.sys
    Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys
    Image name: IDSvia64.sys
    Timestamp:        Wed Aug 29 08:48:40 2012 (503D8308)
    CheckSum:         00081FFB
    ImageSize:        00082000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
SYMNETS.SYS = Symantec/ Norton NIS/ N360 driver Driver Reference Table
IDSvia64.sys = Norton Internet Security Driver Reference Table

I'd suggest you to uninstall Norton Internet Security, for some reason it's known to cause BSODs. Uninstall using the Norton Removal Tool

Recommended antivirus program for Windows 7 based on stability compared to others:- Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Update your graphic card drivers to their latest:
Code:
0: kd> lmvm atikmdag
start             end                 module name
fffff880`04e51000 fffff880`0590f000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Wed Feb 15 08:51:52 2012 (4F3B1DC8)
    CheckSum:         00A5DE83
    ImageSize:        00ABE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
Click on the Start ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to ATI then delete remnants of its drivers using Driver Fusion - Driver Sweeper

Install the latest drivers, get them from the AMD website or from here

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:Run Disk Check on your hard disk for file system errors and bad sectors on it:Let us know the results and further BSODs if any
My System SpecsSystem Spec
02 Nov 2012   #3
dipde1985

Windows 7 Pro x64
 
 

Cheers. I am happy that it is a software thing at least. though i must say that i am a bit surprised (and disheartened) that it is Norton as i have been using it for about 12 years without an issue.

I did all of your other suggestions and there no issues found.

anyway i was going to upgrade to windows 8 in the next few weeks anyway so i guess i'l just do it sooner rather than later and start with a fresh format.

will update if there are further related issues.

thank you very much
My System SpecsSystem Spec
.

02 Nov 2012   #4
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

You're welcome, keep us posted either way.
My System SpecsSystem Spec
15 Nov 2012   #5
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

You can mark the thread as solved if there were no more BSOD-s.

Let us know if there are any other issues
My System SpecsSystem Spec
16 Dec 2012   #6
koolkat77

Microsoft Community Contributor Award Recipient

Windows 10 Home 64Bit
 
 

  • If your problem is solved please use the Mark this thread as solved link at the top of your thread or down on the left corner
My System SpecsSystem Spec
Reply

 occasional random BSOBs recently.




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Random Occasional BSODs While Doing Anything
Hello, I have not been able to find the source of this major issue with my PC. I am getting indecisive error codes and have gotten help from a professional friend, but the problem still remains no matter what we've tried. We've ran many programs from the Ultimate Boot CD, such as CPU...
BSOD Help and Support
Random restarts and occasional BSOD's
My pc keeps restarting on its own, most of the time the screen just blurs with vertical lines going across the screen but there are 1 off BSOD's. It is a custom built PC with specs on my profile or below. Please help :cry:
BSOD Help and Support
Occasional random shutdown leads to crash
My fairly new laptop (<3 months old) will occasionally shut down while the lid is closed. When I open my laptop when this happens it's already at the boot menu for "windows did not shut down properly." It has so far only happened while the lid is closed and I haven't actually seen a BSOD.
BSOD Help and Support
Mysterious occasional BSOD, seemingly random.
My first post. Please be gentle... I just refurbed a used machine off of Ebay, Cloned my W7U64 install from a similar unit that had physical damage into a bigger HDD. Same CPU and mobo so I am lost why I'm getting BSOD. Before the physical damage, that install ran great for months without...
BSOD Help and Support
Random occasional BSODs on new W7 64-bit build
This is my first post so I hope I've done it correctly. I bought a retail W7 64-bit in September and installed it on my 8 month old PC which previously had run Windows XP Pro SP3 without a glitch. Almost immediately I started getting random BSODs but persevered for 10 days or so but, knowing...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 13:42.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App