BSOD occurs frequently on start up & Lappy needs restart

ritadesai · Dec 30, 2012

Hi,

Quick description of BSOD. Whenever I start my laptop, I get Blue Screen and I had to again restart my lappy. Whenever I restart, i get the message of starting with "System Restore" or "Start Window Normally". Thrice I clicked on System Restore, however I come across same thing whenever I start my lappy again.

Therefore, Please find attached actual dump generated from SF_Daignostic_Tool.

Looking forward for the reply.

Thanks & Regards,
Hemant

Pauly · Dec 30, 2012

Hello ritadesai, Welcome to SF

First off if your OCing in anyway stop, return everything to stock settings for the purposes of testing

If you havent already, fill in your system specs so we know what we are dealing with
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

Make sure you have read the guide on asking for help with BSOD so you know what we need
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Run some scans to check against virus or infection
Anti-rootkit utility TDSSKiller
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

OK so i ran the four dumps you uploaded and they are all identical
error code 0x50 page fault in non paged area BSOD Index and all dumps blame the driver ntoskrnl.exe which is not a driver but the kernel on which a driver has crashed so not much use to us

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffffffd0, 1, fffff80002e9712c, 0}
 
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!xxxCreateDesktopEx+8e2 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e9712c, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
 
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd100
GetUlongFromAddress: unable to read from fffff800030bd1c0
 ffffffffffffffd0 
FAULTING_IP: 
nt!ObfDereferenceObject+2c
fffff800`02e9712c f0480fc11f      lock xadd qword ptr [rdi],rbx
MM_INTERNAL_CODE:  0
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  winlogon.exe
CURRENT_IRQL:  0
TRAP_FRAME:  fffff88002cfe2b0 -- (.trap 0xfffff88002cfe2b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c01f2010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e9712c rsp=fffff88002cfe440 rbp=fffff880073c8ca0
 r8=fffff80002e0f000  r9=0000000000000000 r10=0000000000000001
r11=fffffa8003b0ca12 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ObfDereferenceObject+0x2c:
fffff800`02e9712c f0480fc11f      lock xadd qword ptr [rdi],rbx ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80002e35eec to fffff80002e8dfc0
STACK_TEXT:  
fffff880`02cfe148 fffff800`02e35eec : 00000000`00000050 ffffffff`ffffffd0 00000000`00000001 fffff880`02cfe2b0 : nt!KeBugCheckEx
fffff880`02cfe150 fffff800`02e8c0ee : 00000000`00000001 ffffffff`ffffffd0 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4514f
fffff880`02cfe2b0 fffff800`02e9712c : fffffa80`03b71f60 00000000`00000000 fffff900`c01f2010 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`02cfe440 fffff960`0011a042 : fffff880`073c8ca0 00000000`00000000 fffffa80`07acaf20 fffffa80`07f32c58 : nt!ObfDereferenceObject+0x2c
fffff880`02cfe4a0 fffff960`001341a3 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : win32k!xxxCreateDesktopEx+0x8e2
fffff880`02cfe640 fffff960`0013269c : 00000000`00000000 fffff880`073c8ca0 fffff900`c01f2010 00000000`00000000 : win32k!xxxResolveDesktop+0xa47
fffff880`02cfe9f0 fffff960`0015e99f : 00000000`77b7a020 00000000`00000000 00000000`00000001 fffffa80`07ee6b30 : win32k!xxxCreateThreadInfo+0x648
fffff880`02cfeb60 fffff960`00135c00 : fffff900`c01f2010 fffffa80`07f6db50 fffffa80`07f6db50 fffffa80`07ee6b30 : win32k!UserThreadCallout+0xcf
fffff880`02cfeb90 fffff800`0312d0a5 : fffffa80`07f6db50 fffffa80`07ee6b30 fffff6fc`40039e10 fffff6fc`40039e40 : win32k!W32pThreadCallout+0x78
fffff880`02cfebc0 fffff800`02e858ba : fffffa80`07f6db50 ffffffff`ffff0000 00000000`00000020 000007fe`fe880000 : nt!PsConvertToGuiThread+0xe9
fffff880`02cfebf0 fffff800`02e8d41f : 00000000`000000bb 00000000`00dff138 000007fe`fe880000 00000000`00dff158 : nt!KiConvertToGuiThread+0xa
fffff880`02cfec20 00000000`7781d45a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x1c4
00000000`00dff100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7781d45a
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
win32k!xxxCreateDesktopEx+8e2
fffff960`0011a042 49895d38        mov     qword ptr [r13+38h],rbx
SYMBOL_STACK_INDEX:  4
SYMBOL_NAME:  win32k!xxxCreateDesktopEx+8e2
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: win32k
IMAGE_NAME:  win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  50ad9b54
FAILURE_BUCKET_ID:  X64_0x50_win32k!xxxCreateDesktopEx+8e2
BUCKET_ID:  X64_0x50_win32k!xxxCreateDesktopEx+8e2
Followup: MachineOwner
---------

At this point i would suggest running some hardware tests to check for any problems so we can start to narrow it down
RAM http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
HDD Hard Drive Diagnostic Procedure
General http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html MAKE SURE YOU MONITOR TEMPS WHILE DOING THIS

If these come out ok then we need to start looking at drivers, looking at your loaded drivers list i can see you have a few old drivers in there that could do with updating (in order of importance/age)
CtClsFlt.sys 15/06/2009 Creative Camera Class Upper Filter Driver
HECIx64.sys 17/09/2009 Intel Management Engine ? Chipset
SynTP.sys 23/12/2009 Synaptics Touchpad Driver
Rt64win7.sys 12/01/2010 Realtek PCI-E Gigabit Ethernet
NETw5s64.sys 18/03/2010 Intel 5100 wifi

The top two in particular predate windows 7

If all else fails we can look at running driver verifier to track down an offending driver but i dont think we should go there just yet as it can be a pain in the arse http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

ritadesai · Jan 1, 2013

Hi Pauly,

Please find the results of the test as follows

RAM RAM - Test with Memtest86+

- 10 Passes and there were 0 errors

HDD Hard Drive Diagnostic Procedure

- Bad sector was detected however it was said that bad sector was repairable. Tried to repair it but couldnt do it.

General Hardware - Stress Test With Prime95

- Ran for 3 hours and it passed.

Please let me know your thoughts.

Thanks,
Rita.

Pauly · Jan 1, 2013

Thats good if you are not aware the process for BSOD debugging is not always clear cut as in this case so its a bit trial and error and attempting to narrow down possibilities and variables, so we can be reasonably confident of the hardware so far, next i would move on to replacing/updating the list of drivers i gave you especially the top two.
Also run the virus and rootkit scans i linked to above in my first post that rules out some more possibilities

As we go along if you get any more BSOD please keep uploading the dump files for analysis the more we got the easier it is to pinpoint stuff

ritadesai · Jan 2, 2013

Thanks Pauly,

I will update drivers and virus scan my system.

fingers crossed

Will update you the results

Regards,
Rita

ritadesai · Jan 2, 2013

HI Pauly,

Received few more BSOD.

Attached dump.

I have run the antivirus scan and no issues detected.

I was unable to download below drivers as it was difficult to find.
CtClsFlt.sys 15/06/2009 Creative Camera Class Upper Filter Driver
HECIx64.sys 17/09/2009 Intel Management Engine ? Chipset

Pauly · Jan 2, 2013

Can you please fill in your system details
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html
will see if i can find any drivers for you should hopefully be able to get updated chipset drivers
If we cant update other driver we can always temp remove it for testing purposes

Latest dump (theres only one) is error 0xf4 and theres nothing useful in there im afraid didnt even want to load properly!

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck F4, {3, fffffa8008734910, fffffa8008734bf0, fffff8000319c460}
----- ETW minidump data unavailable-----
Probably caused by : wininit.exe
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8008734910, Terminating object
Arg3: fffffa8008734bf0, Process image file name
Arg4: fffff8000319c460, Explanatory message (ascii)
Debugging Details:
------------------
----- ETW minidump data unavailable-----
PROCESS_OBJECT: fffffa8008734910
IMAGE_NAME:  wininit.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  0
MODULE_NAME: wininit
FAULTING_MODULE: 0000000000000000 
PROCESS_NAME:  wininit.exe
EXCEPTION_CODE: (Win32) 0x5 (5) - Access is denied.
BUGCHECK_STR:  0xF4_5
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
CURRENT_IRQL:  0
STACK_TEXT:  
fffff880`07bc6b08 fffff800`03224822 : 00000000`000000f4 00000000`00000003 fffffa80`08734910 fffffa80`08734bf0 : nt!KeBugCheckEx
fffff880`07bc6b10 fffff800`031d0e0b : 00000000`00000001 fffffa80`08709b50 fffffa80`08734910 fffffa80`08753920 : nt!PspCatchCriticalBreak+0x92
fffff880`07bc6b50 fffff800`0314ff04 : 00000000`00000001 00000000`00000001 fffffa80`08734910 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x176e6
fffff880`07bc6ba0 fffff800`02e9c253 : fffffa80`08709b50 fffff880`00000005 fffffa80`08709b50 00000000`00000000 : nt!NtTerminateProcess+0xf4
fffff880`07bc6c20 00000000`77c715da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0027f788 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c715da
 
STACK_COMMAND:  kb
FOLLOWUP_NAME:  MachineOwner
FAILURE_BUCKET_ID:  X64_0xF4_5_IMAGE_wininit.exe
BUCKET_ID:  X64_0xF4_5_IMAGE_wininit.exe
Followup: MachineOwner
---------

We have been through most of the basic steps like hardware tests, virus tests and obvious drivers, i think we should deal with last two drivers from before then if no joy we should try driver verifier to see if we can stress the drivers into revealing a faulty one, heres the link
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html but please dont rush into it sometimes when enabling driver verifier it can bring out a faulty driver (which is what we want) but can make your system unstable/unbootable and to turn it off again you go to safe mode or worse case system restore etc so please read up first and make sure you have recovery options in place and a bootable recovery disc and/or install disk/usb to boot from if the worst happens. 9 times out of 10 it works fine but occasionally its a pain, if your not sure please ask

ritadesai · Jan 2, 2013

Hi,

I have update the system spec.

I tried today as weel but unable to find the drives.

Do let me know..

I am frequently geting BSOD on start up not sure why.

Pauly · Jan 2, 2013

While i have a look for you seeing as its mainly to do with startup you could always try http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html to see if it helps, nothing you do here is permanent and can be changed back easily

Also i need the actual model number of the machine should be stamped on it or on label underneath

ritadesai · Jan 7, 2013

HI Pauly,

Cleanup was completed successfully.

System worked fine for few days.

Today again received BSOD on start up

Attached Dump.

Regards,
Hemant

Pauly · Jan 7, 2013

How about that model number for your machine and also go back and check startup some programs automatically put themselves back in seeing as it worked for a while may be worth checking the offending program didnt reinsert itself

Having a look back through thread and looking at your dump i would go back and focus of your disk run some more tests and see if your still getting errors if you do they need to be fixed ie bad sectors written out or its gonna throw everytime that bad sector attempts to be written to or read from

BSOD occurs frequently on start up & Lappy needs restart

New member

My Computer My Computer

At a glance

An error has occured

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

An error has occured

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

An error has occured

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

An error has occured

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

An error has occured

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer