BSOD at random times

solkrem · 01 Nov 2012

I get bluescreens at random times of the day. These last few times, it has happened while I was afk. It also got worse after the newest Windows updates.

This is the message I get when Windows starts after reset:

OS-version: 6.1.7600.2.0.0.768.3
BCCode: 7a
BCP1: FFFFF6FC400084D0
BCP2: FFFFFFFFC0000185
BCP3: 0000000072C0F860
BCP4: FFFFF8800109A008
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

I also uploaded the dump files. I hope someone can help me, since I have no clue what to do. I'm not too good with computers :)

Arc · 01 Nov 2012

Welcome aboard.
STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR

Usual causes: Memory, Paging file corruption, File system, Hard drive, Cabling, Virus infection, Improperly seated cards, BIOS, Bad motherboard, Missing Service Pack (source: Carrona.org)
What I am getting from your crash dump is

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc400088f8, ffffffffc0000185, 8329e860, fffff8800111f008}

GetPointerFromAddress: unable to read from fffff800030c8278
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: fffff6fc400088f8, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc0000185, error status (normally i/o status code)
Arg3: 000000008329e860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff8800111f008, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880033a8a90 -- (.trap 0xfffff880033a8a90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa80040cb1a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800111f008 rsp=fffff880033a8c28 rbp=fffff80003036201
 r8=fffffa8007992010  r9=fffffa80036d1948 r10=0000000000000000
r11=fffff880033a8bc0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
ataport!IdePortScanChannel:
fffff880`0111f008 0000            add     byte ptr [rax],al ds:00000000`00000001=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f06552 to fffff80002e98fc0

STACK_TEXT:  
fffff880`033a8778 fffff800`02f06552 : 00000000`0000007a fffff6fc`400088f8 ffffffff`c0000185 00000000`8329e860 : nt!KeBugCheckEx
fffff880`033a8780 fffff800`02ebfcbf : fffffa80`06cbc7d0 fffff880`033a88f0 fffff800`030cb540 fffffa80`06cbc7d0 : nt! ?? ::FNODOBFM::`string'+0x36bea
fffff880`033a8860 fffff800`02ea6589 : 00000000`00000000 00000000`00000008 ffffffff`ffffffff fffffa80`05a306b0 : nt!MiIssueHardFault+0x28b
fffff880`033a8930 fffff800`02e970ee : 00000000`00000008 fffff880`0111f008 00000000`00000000 00000000`00000004 : nt!MmAccessFault+0x1399
fffff880`033a8a90 fffff880`0111f008 : fffff880`01124ea4 00000000`00000004 fffff800`03036200 fffffa80`040cb1a0 : nt!KiPageFault+0x16e
fffff880`033a8c28 fffff880`01124ea4 : 00000000`00000004 fffff800`03036200 fffffa80`040cb1a0 00000000`00000000 : ataport!IdePortScanChannel
fffff880`033a8c30 fffff800`0318b583 : 00000000`00000001 00000000`00000004 fffff800`030350b0 fffff880`033a8c90 : ataport!ChannelQueryBusRelation+0xa0
fffff880`033a8c80 fffff800`02ea2641 : fffff800`02e8e100 fffff800`0318b501 fffffa80`03700b00 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`033a8cb0 fffff800`0312fe5a : 00000000`00000000 fffffa80`03700b50 00000000`00000080 fffffa80`036d1740 : nt!ExpWorkerThread+0x111
fffff880`033a8d40 fffff800`02e89d26 : fffff880`03163180 fffffa80`03700b50 fffff880`0316dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`033a8d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !ataport
    fffff8800111f008-fffff8800111f01a  19 bytes - ataport!IdePortScanChannel
    [ 4c 8b dc 49 89 5b 18 49:00 00 00 00 00 00 00 00 ]
    fffff8800111f01e-fffff8800111f027  10 bytes - ataport!IdePortScanChannel+16 (+0x16)
    [ 33 ed 48 8b f9 4c 8d 05:00 00 00 00 00 00 00 00 ]
    fffff8800111f02a-fffff8800111f041  24 bytes - ataport!IdePortScanChannel+22 (+0x0c)
    [ 48 21 6c 24 30 48 21 6c:00 00 00 00 00 00 00 00 ]
    fffff8800111f044-fffff8800111f048  5 bytes - ataport!IdePortScanChannel+3c (+0x1a)
    [ 48 8d 0d d5 9a:00 00 00 00 00 ]
    fffff8800111f04b-fffff8800111f059  15 bytes - ataport!IdePortScanChannel+43 (+0x07)
    [ 48 89 4c 24 40 48 89 4c:00 00 00 00 00 00 00 00 ]
    fffff8800111f05c-fffff8800111f060  5 bytes - ataport!IdePortScanChannel+54 (+0x11)
    [ 48 8d 05 7d 9a:00 00 00 00 00 ]
    fffff8800111f063-fffff8800111f070  14 bytes - ataport!IdePortScanChannel+5b (+0x07)
    [ 4d 8d 4b 10 48 89 44 24:00 00 00 00 00 00 00 00 ]
    fffff8800111f073-fffff8800111f094  34 bytes - ataport!IdePortScanChannel+6b (+0x10)
    [ 48 89 44 24 58 49 21 6b:00 00 00 00 00 00 00 00 ]
    fffff8800111f097-fffff8800111f0a7  17 bytes - ataport!IdePortScanChannel+8f (+0x24)
    [ 49 89 53 80 49 89 43 90:00 00 00 00 00 00 00 00 ]
    fffff8800111f0aa-fffff8800111f0bb  18 bytes - ataport!IdePortScanChannel+a2 (+0x13)
    [ 49 89 4b 98 4d 89 43 a0:00 00 00 00 00 00 00 00 ]
    fffff8800111f0bd - ataport!IdePortScanChannel+b5 (+0x13)
    [ 02:00 ]
    fffff8800111f0bf-fffff8800111f0d4  22 bytes - ataport!IdePortScanChannel+b7 (+0x02)
    [ 48 8b cb 49 89 43 b0 ff:00 00 00 00 00 00 00 00 ]
    fffff8800111f0d8-fffff8800111f0e5  14 bytes - ataport!IdePortScanChannel+d0 (+0x19)
    [ 48 8d 54 24 30 44 8b c0:00 00 00 00 00 00 00 00 ]
    fffff8800111f0e8 - ataport!IdePortScanChannel+e0 (+0x10)
    [ be:00 ]
    fffff8800111f0ea - ataport!IdePortScanChannel+e2 (+0x02)
    [ 10:00 ]
    fffff8800111f0ed-fffff8800111f117  43 bytes - ataport!IdePortScanChannel+e5 (+0x03)
    [ 41 b8 49 64 65 50 33 c9:00 00 00 00 00 00 00 00 ]
    fffff8800111f11a-fffff8800111f121  8 bytes - ataport!IdePortScanChannel+112 (+0x2d)
    [ 44 88 5b 02 8a 8f 30 12:00 00 00 00 00 00 00 00 ]
    fffff8800111f124-fffff8800111f129  6 bytes - ataport!IdePortScanChannel+11c (+0x0a)
    [ 88 0b ff 87 a0 01:00 00 00 00 00 00 ]
    fffff8800111f12c-fffff8800111f130  5 bytes - ataport!IdePortScanChannel+124 (+0x08)
    [ 48 89 9f 90 01:00 00 00 00 00 ]
    fffff8800111f133-fffff8800111f139  7 bytes - ataport!IdePortScanChannel+12b (+0x07)
    [ 48 85 db 0f 84 aa 02:00 00 00 00 00 00 00 ]
    fffff8800111f13c-fffff8800111f13f  4 bytes - ataport!IdePortScanChannel+134 (+0x09)
    [ 21 ac 24 f0:00 00 00 00 ]
    fffff8800111f143-fffff8800111f147  5 bytes - ataport!IdePortScanChannel+13b (+0x07)
    [ 4c 8d 8c 24 f0:00 00 00 00 00 ]
    fffff8800111f14b-fffff8800111f159  15 bytes - ataport!IdePortScanChannel+143 (+0x08)
    [ 4c 8d 05 be a5 ff ff b2:00 00 00 00 00 00 00 00 ]
    fffff8800111f15c-fffff8800111f15f  4 bytes - ataport!IdePortScanChannel+154 (+0x11)
    [ 8a 84 24 f0:00 00 00 00 ]
    fffff8800111f163-fffff8800111f165  3 bytes - ataport!IdePortScanChannel+15b (+0x07)
    [ 49 bf 08:00 00 00 ]
    fffff8800111f169-fffff8800111f1ab  67 bytes - ataport!IdePortScanChannel+161 (+0x06)
    [ 80 f7 ff ff 88 43 03 48:00 00 00 00 00 00 00 00 ]
    fffff8800111f1ae-fffff8800111f1b3  6 bytes - ataport!IdePortScanChannel+1a6 (+0x45)
    [ 44 0f b6 8f 38 12:00 00 00 00 00 00 ]
    fffff8800111f1b6-fffff8800111f1c2  13 bytes - ataport!IdePortScanChannel+1ae (+0x08)
    [ 48 8b 49 18 4c 8d 05 f7:00 00 00 00 00 00 00 00 ]
    fffff8800111f1c6-fffff8800111f222  93 bytes - ataport!IdePortScanChannel+1be (+0x10)
    [ 89 44 24 20 e8 99 90 fe:00 00 00 00 00 00 00 00 ]
    fffff8800111f225-fffff8800111f239  21 bytes - ataport!IdePortScanChannel+21d (+0x5f)
    [ 48 8b 49 18 49 8b c0 48:00 00 00 00 00 00 00 00 ]
    fffff8800111f23c-fffff8800111f240  5 bytes - ataport!IdePortScanChannel+234 (+0x17)
    [ 4c 8b c2 ba 0b:00 00 00 00 00 ]
    fffff8800111f244-fffff8800111f2a9  102 bytes - ataport!IdePortScanChannel+23c (+0x08)
    [ 49 c1 e8 0b 4c 89 44 24:00 00 00 00 00 00 00 00 ]
    fffff8800111f2ac-fffff8800111f2c7  28 bytes - ataport!IdePortScanChannel+2a4 (+0x68)
    [ 48 8b 49 18 48 8b d6 48:00 00 00 00 00 00 00 00 ]
    fffff8800111f2ca-fffff8800111f2ce  5 bytes - ataport!IdePortScanChannel+2c2 (+0x1e)
    [ 4c 8b c2 ba 0c:00 00 00 00 00 ]
    fffff8800111f2d2-fffff8800111f2f6  37 bytes - ataport!IdePortScanChannel+2ca (+0x08)
    [ 49 c1 e8 0b 4c 89 44 24:00 00 00 00 00 00 00 00 ]
    fffff8800111f2f9-fffff8800111f337  63 bytes - ataport!IdePortScanChannel+2f1 (+0x27)
    [ 4c 8b 1d 28 ce ff ff 41:00 00 00 00 00 00 00 00 ]
    fffff8800111f33a-fffff8800111f359  32 bytes - ataport!IdePortScanChannel+332 (+0x41)
    [ 48 8b 49 18 48 2b d5 48:00 00 00 00 00 00 00 00 ]
    fffff8800111f35c-fffff8800111f360  5 bytes - ataport!IdePortScanChannel+354 (+0x22)
    [ 4c 8b d2 ba 0d:00 00 00 00 00 ]
    fffff8800111f364-fffff8800111f37e  27 bytes - ataport!IdePortScanChannel+35c (+0x08)
    [ 49 c1 ea 0b 4c 89 54 24:00 00 00 00 00 00 00 00 ]
    fffff8800111f382-fffff8800111f39a  25 bytes - ataport!IdePortScanChannel+37a (+0x1e)
    [ eb 08 44 0f b6 4b 03 41:00 00 00 00 00 00 00 00 ]
    fffff8800111f39d-fffff8800111f3a9  13 bytes - ataport!IdePortScanChannel+395 (+0x1b)
    [ 40 32 ff 40 0f b6 c7 48:00 00 00 00 00 00 00 00 ]
    fffff8800111f3ad-fffff8800111f3b7  11 bytes - ataport!IdePortScanChannel+3a5 (+0x10)
    [ 74 0b 40 8a d7 48 8b cb:00 00 00 00 00 00 00 00 ]
    fffff8800111f3ba-fffff8800111f3d7  30 bytes - ataport!IdePortScanChannel+3b2 (+0x0d)
    [ 40 fe c7 40 3a 7b 02 76:00 00 00 00 00 00 00 00 ]
    fffff8800111f3d9-fffff8800111f3e9  17 bytes - ataport!IdePortScanChannel+3d1 (+0x1f)
    [ 33 d2 48 8b cb ff 15 64:00 00 00 00 00 00 00 00 ]
    fffff8800111f3ec-fffff8800111f3f0  5 bytes - ataport!IdePortScanChannel+3e4 (+0x13)
    [ 01 83 8f 9c 01:00 00 00 00 00 ]
    fffff8800111f3f3-fffff8800111f3f8  6 bytes - ataport!IdePortScanChannel+3eb (+0x07)
    [ 01 4c 8d 9c 24 d0:00 00 00 00 00 00 ]
    fffff8800111f3fc-fffff8800111f42a  47 bytes - ataport!IdePortScanChannel+3f4 (+0x09)
    [ 49 8b 5b 30 49 8b 6b 38:00 00 00 00 00 00 00 00 ]
    fffff8800111f42c-fffff8800111f437  12 bytes - ataport!IdeEnumerateLuns+18 (+0x30)
    [ 48 8b ea 48 8b f9 75 10:00 00 00 00 00 00 00 00 ]
    fffff8800111f43a-fffff8800111f43e  5 bytes - ataport!IdeEnumerateLuns+26 (+0x0e)
    [ 20 83 89 9c 01:00 00 00 00 00 ]
    fffff8800111f441-fffff8800111f450  16 bytes - ataport!IdeEnumerateLuns+2d (+0x07)
    [ 20 eb 4a 40 32 f6 40 0f:00 00 00 00 00 00 00 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
3555 errors : !ataport (fffff8800111f008-fffff8800111ffff)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

Do the following things at first.

A full scan with Windows Defender Offline
Scan with Anti-rootkit utility TDSSKiller

Depending on its result, we will go to the next steps. So many ataport error makes me think of any virus or rootkit.

Uninstall Avg using AVG Removal Tool. It is not any worthy as an antivirus, and at the same time it is unhealthy for the system.

Uninstall Daemon Tools, too. That is also too bad for any system, and the most wall known BSOD causer.

Let us know the results.

solkrem · 13 Nov 2012

I uninstalled Daemon tools and AVG, and haven't had a bluescreen after that. It's amazing if this actually solves the problem.

Thank you very much for your help, I will post again if the problem returns.

Arc · 14 Nov 2012

Let us know how the system is running.

I think you should have run the virus scans too.

solkrem · 19 Feb 2013

I used the Windows Defender Offline and found no problems there. The problem returned for a while after the new Windows updates, but it seems to be working fine now.

My only problem is that I feel unprotected now that I don't have AVG anymore. What kind of protection against virus and trojans should I use to avoid more BSODs?

Dsprague · 19 Feb 2013

Most of the BSOD team will tell you use a combination of MSE and Mbam. Tip: when installing Mbam be sure to uncheck the box that offers to start a free trial.