Various BSOD after windows update on Acer Aspire M3802

RollTheBeats · 04 Dec 2012

For the past several months I have been getting regular BSODs on my Acer Aspire M3802 desktop PC.

They started after a Windows update was applied a few months ago. The BSODs rapidly got worse to the point where they were constant and the only way I could use the PC was to use System Restore to roll back to a point before the update. As soon as the update(s) were applied, however, usually on the next boot-up, the BSODs would immediately return.

The BSOD messages are not consistent, they include (but are not limited to) BAD_POOL_HEADER, INTERRUPT_EXCEPTION_NOT_HANDLED and IRQL_NOT_LESS_OR_EQUAL.

So I did the following none of which solved the problem -

I updated all my drivers and BIOS and removed all USB peripherals.
I then used the Acer system recovery disk to reinstall Windows 7 Home Premium which did fix the problem but only UNTIL windows updates were applied whereupon the BSODs started again.

I have now clean installed a new copy of Win 7 Pro and updated my drivers (all USB peripherals still disconnected) and applied all Windows Updates. It's early days but I have had a couple of BSODs (diagnostic zip file attached) so clearly there is still an issue. I just completed 9 passes of memtest86+ without error.

Any ideas?

btw - I have installed a second internal hard drive and I thought that perhaps my 300w PSU might be struggling under the increased load but the hard drive was installed at least a year before the BSODs began and so far as I can tell the BSODs seem to be related to a Windows update.

Arc · 04 Dec 2012

Welcome aboard.

It is crashed by AVG IDS Application Activity Monitor Driver.

Code:

fffff880`02c6b888  fffff880`03185fe6Unable to load image \SystemRoot\system32\DRIVERS\avgidsdrivera.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgidsdrivera.sys
*** ERROR: Module load completed but symbols could not be loaded for avgidsdrivera.sys
 avgidsdrivera+0xffe6

Description here: Driver Reference Table - avgidsdrivera.sys

I would suggest you to uninstall AVG.Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download and install those, and then run full system scans with both of them, one by one.

Some Ntfs errors are also there.

Code:

fffff880`02c6b8b8  fffff880`014bbebd Ntfs!TxfAccessCheck+0x32d
fffff880`02c6b868  fffff880`014b8aa7 Ntfs!NtfsFindInFileRecord+0x1e7
fffff880`02c6b838  fffff880`014b96b0 Ntfs!NtfsReadMftRecord+0x4ec
fffff880`02c6b7c8  fffff880`014bbebd Ntfs!TxfAccessCheck+0x32d

Update your SSD's Firmware (Skip it, if it not a SSD)
Re-seat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Also, it is claiming to be a memory corruption.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002cdf284, fffff88002c6bd30, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cdf284, Address of the instruction which caused the bugcheck
Arg3: fffff88002c6bd30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!SwapContext_PatchXRstor+0
fffff800`02cdf284 0fae29          xrstor  [rcx]

CONTEXT:  fffff88002c6bd30 -- (.cxr 0xfffff88002c6bd30)
rax=0000000000000001 rbx=fffff88003364180 rcx=fffff88002c6cdc0
rdx=0000000000000000 rsi=fffffa8009640640 rdi=fffff8800336efc0
rip=fffff80002cdf284 rsp=fffff88002c6c710 rbp=fffff88002c6cd70
 r8=fffffa8008c92bb8  r9=0000000000000000 r10=fffffffffffffffb
r11=00000000000f0000 r12=0000000000000000 r13=0000000000000000
r14=fffffa8008c92b30 r15=fffff88003368f40
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!SwapContext_PatchXRstor:
fffff800`02cdf284 0fae29          xrstor  [rcx]
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002cdf284

STACK_TEXT:  
fffff880`02c6c710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SwapContext_PatchXRstor


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002cdf1a2 - nt!SwapContext_PatchXSave+2
    [ 01:21 ]
    fffff80002cdf286 - nt!SwapContext_PatchXRstor+2 (+0xe4)
    [ 09:29 ]
    fffff80002cdf442 - nt!EnlightenedSwapContext_PatchXSave+2 (+0x1bc)
    [ 01:21 ]
    fffff80002cdf528 - nt!EnlightenedSwapContext_PatchXRstor+2 (+0xe6)
    [ 09:29 ]
4 errors : !nt (fffff80002cdf1a2-fffff80002cdf528)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT_LARGE

STACK_COMMAND:  .cxr 0xfffff88002c6bd30 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE

Followup: memory_corruption
---------

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

As you have stated, the capacity of your PSU should be insufficient. Plan to have a higher one.

Let us know the results.

RollTheBeats · 04 Dec 2012

Many thanks for your helpful post Arc. I have now uninstalled AVG and installed Microsoft Security Essentials and I'm currently running disk check. Will follow the other steps and report back.

Could you expand on 're-seat sata and power' or point me in right direction - how would I do that?

I ran memtest86+ overnight last night and completed 9 passes without error. Is that sufficient or do I need to specifically configure it to test per ram slot?

Arc · 05 Dec 2012

Unplug the sata and power cable from the HDDs end, clean those and plug them back.

Let us know if any further crashes occur there.

RollTheBeats · 26 Dec 2012

Hi,

Following my last post I completed the steps below as per your advice and found no problems or issues. I have not yet upgraded the PSU but I have a new higher capacity PSU on order which I will install when it arrives.

Re-seat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.
Test your RAM modules for possible errors with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

Since then I have only had one BSOD until today (26 Dec) when I had multiple BSODs on starting the PC, on a couple of occasions not even making it to the Windows login screen before BSOD kicked in. After several reboots (2 in safe mode) I managed to get into Windows long enough to run SF Diagnostic Tool - results attached.

The prime suspect is a USB device (Serato Sratch Live) that I installed the last time I used the PC a few days ago. Windows is reporting that a USB device has malfunctioned and I should try re-attaching it. Serato Scratch is the only USB device that I had connected so it must be that. This error message, however, could be because I have disconnected the USB device in the hope that it would stop the BSODs.

Arc · 27 Dec 2012

Do you use MD8475 Abstraction Layer by Anritsu Corporation?

Code:

fffff880`04369408  fffff800`03208552Unable to load image xal.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for xal.dll
*** ERROR: Module load completed but symbols could not be loaded for xal.dll
 xal+0x13552

Uninstall it.

Intel rapid storage.

Code:

fffff880`0436a538  fffff880`012cd023Unable to load image iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
 iaStor+0x56023

Get rid of intel rapid storage.

Right click on "my computer" icon and click "manage" on the context menu.
It will open the "computer management" window.
Select "Device Manager" in the left pane, It will list all the existing devices up.
Expand "Disc Drives" by clicking on the triangle in front of it.
Select one item under it, right click, uninstall.
Continue the process for all items under "Disc Drives"
Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

Let us know the results.

RollTheBeats · 29 Dec 2012

Thanks for the advice.

I started my PC today to check this page and had another BSOD a few minutes after boot-up and then a lock-up (screen froze and no response to mouse or keyboard). I have run SF Diagnostic Tool again - results attached but I can't see a minidump for 29 December. I booted straight back into windows normally each time and it now seems to be stable. This is not the first time I have seen this pattern i.e. I will get BSOD(s) then after x number of BSODs it becomes stable and even if I reboot and I won't get any problems until the following day. I'm wondering if this is significant because you last post mentions timestamps.

I could not find xal.dll or any reference to MD8475 Abstraction Layer by Anritsu Corporation on my C drive. It's not something that I installed (knowingly) and Googling doesn't throw up many clues as to the origin other than a referece to xalevent.exe - but again I couldn't find that on my C Drive.

I am now going to follow your advice re: Get rid of intel rapid storage - and will report back any further issues.

RollTheBeats · 29 Dec 2012

Followed instructions re: Get rid of intel rapid storage and system was ok for a few hours then four BSODs in rapid succession (in windows for no more than 1 minute before crashing) the last of which was in Safe Mode. Have now booted in to safe mode again to post this message. Updated SF Diagnostic Tool results attached.

Any help would be appreciated, as the PC now seems to be very unstable. Don't understand why this PC keeps getting BSODs even after two re-installs of windows the last of which was an upgrade to Win Pro, but only after updates are applied. BSOD messages seem to be inconsistent (last two were Interrupt_Service_Exception and Bad_Pool_Header) but I can't seem to find any hardware faults.

Arc · 30 Dec 2012

The problem, as far as I am seeing, is with your Driver CD.

Intel(R) 82567V-2 Gigabit Network Connection driver fails.

Code:

fffff880`033fc9f8  fffff880`053b6e05Unable to load image e1y62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for e1y62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1y62x64.sys
 e1y62x64+0x3e05

And it is very old.

Code:

lmvm e1y62x64
start             end                 module name
fffff880`053b3000 fffff880`053fc000   e1y62x64 T (no symbols)           
    Loaded symbol image file: e1y62x64.sys
    Image path: e1y62x64.sys
    Image name: e1y62x64.sys
    Timestamp:        Sat Jun 13 06:46:42 2009 (4A32FDFA)
    CheckSum:         00049736
    ImageSize:        00049000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from Intel® 82567 Gigabit Ethernet Controller — Support for Intel® 82567 LM / LF / V Gigabit Network Connections

A lot of USB related issues are present there. For the port, first, uninstall and reinstall the USB ports drivers.

Right click on Computer icon > manage. It will open the computer management window.
Click on "Device Manager" in the left pane, it will list all installed devices up.
Expand "USB Serial Bus Controllers" by clicking on the triangle in front of it.
Click on one item to select, then right click and uninstall.
Do the same for all.
Restart the computer.
At restart, windows will auto configure the appropriate drivers.

And, Disable USB Selective Suspense too.
USB Selective Suspend - Turn On or Off

For the devices, first, detach all the USB devices other than the keyboard and mouse.
Then, Update the drivers for them all, including the keyboard and mouse, if any third party drivers are installed for them.

You have installed Intel rapid storage again, and it is failing, again.

Code:

fffff880`033fd808  fffff880`012dd49aUnable to load image iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
 iaStor+0x4b49a

Uninstall it.

The display driver is very old, too.

Code:

lmvm atikmdag
start             end                 module name
fffff880`04c3e000 fffff880`05255000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Thu Jul 02 23:15:07 2009 (4A4CF223)
    CheckSum:         005C2509
    ImageSize:        00617000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update your ATI/AMD display driver.
You can get it from the link in our forum, Latest AMD Catalyst Video Driver for Windows 7, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Have a look :

Code:

BiosVendor = American Megatrends Inc.
BiosVersion = P01-A1
BiosReleaseDate = 08/31/2009
SystemManufacturer = Acer
SystemProductName = Aspire M3802
SystemFamily = Acer Desktop

Try to update the BIOS.

Let us know the results.

RollTheBeats · 31 Dec 2012

Many Thanks Arc.

Had a couple more BSODs on start-up today (this was before I read your most recent post) and had to use start-up repair to get into windows. Updated SF Diagnostic Tool results attached.

When I got into Windows I read your post and followed your advice -

1. Updated driver for Intel(R) 82567V-2 Gigabit Network Connection
2. Updated driver for ATI/AMD display
3. Uninstalled and reinstalled the USB ports drivers
4. Disabled USB Selective Suspense

The BIOS does look quite old but it's the most recent version available on the Acer website for my PC Model. Do you think there would be a more recent version available elsewhere or is the BIOS specific to my make/model of PC?

I'm not sure what happened with Intel Rapid Storage. I followed your advice to remove it and have not (knowingly) re-installed it. I have followed the steps again - i.e. uninstall all disk drives in device manager and reboot. Perhaps I've misunderstood but none of disk drives in device manager seem to be using the driver iaStor.sys. However, in Device Manager under 'Storage Controllers' there is 'Intel(R) ICH8R/ICH9R/ICH10R/DO/PCH SATA RAID Controller' - which does use iaStor.sys. Should I also uninstall this to get rid of Intel Rapid Storage?