BSOD random: Using Chrome, Excel and Word. I have Intel Anti Theft .

Yopes · 18 Jul 2013

Hello,
I'm having this issue and I would be glad if you can help.
It is happening every 2 hours, and I'm using this laptop to work.

Best Regards,
Yopes

Arc · 18 Jul 2013

Hello Yopes.

You have multiple antivirus programs installed. Avast free, and Microsoft Security Essentials.
Using multiple real time protection programs are not a good practice, it will in turn cause your PC more vulnerable to threats than it is even without a single AV.

I would suggest you to Uninstall Avast using Avast Uninstall Utility. Use MSE too. Then Download a fresh copy of MSE and install it. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results.

Finding something even odd here, but will think about that part after seeing the situation with MSE only state.
______________________________________________________________________________________
BSOD ANALYSIS:

Code:

........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 0, fffffa80218c2350, 0}

*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
Probably caused by : MpFilter.sys ( MpFilter+11d8d )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa80218c2350
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  EXCEL.EXE

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f1d4ea to fffff80002ec6c00

STACK_TEXT:  
fffff880`22cf8318 fffff800`02f1d4ea : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`218c2350 : nt!KeBugCheckEx
fffff880`22cf8320 fffff800`02ebb565 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000801 : nt! ?? ::FNODOBFM::`string'+0x4884
fffff880`22cf8360 fffff880`01165d8d : fffff880`22cf84b8 fffff800`02ffa30d 00000000`00000000 fffff880`22cf8510 : nt!IoGetStackLimits+0x15
fffff880`22cf8390 fffff880`22cf84b8 : fffff800`02ffa30d 00000000`00000000 fffff880`22cf8510 00000000`00000080 : MpFilter+0x11d8d
fffff880`22cf8398 fffff800`02ffa30d : 00000000`00000000 fffff880`22cf8510 00000000`00000080 00000000`000007ff : 0xfffff880`22cf84b8
fffff880`22cf83a0 fffff880`22cf84b8 : fffff880`22cf8490 00000000`01000064 ffffacb5`64536553 e56c6946`00000090 : nt!ExFreePoolWithTag+0x22d
fffff880`22cf8450 fffff880`22cf8490 : 00000000`01000064 ffffacb5`64536553 e56c6946`00000090 00000000`00000000 : 0xfffff880`22cf84b8
fffff880`22cf8458 00000000`01000064 : ffffacb5`64536553 e56c6946`00000090 00000000`00000000 fffffa80`196ff010 : 0xfffff880`22cf8490
fffff880`22cf8460 ffffacb5`64536553 : e56c6946`00000090 00000000`00000000 fffffa80`196ff010 00000001`00000000 : 0x1000064
fffff880`22cf8468 e56c6946`00000090 : 00000000`00000000 fffffa80`196ff010 00000001`00000000 fffffa80`00000016 : 0xffffacb5`64536553
fffff880`22cf8470 00000000`00000000 : fffffa80`196ff010 00000001`00000000 fffffa80`00000016 00000000`00000000 : 0xe56c6946`00000090


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MpFilter+11d8d
fffff880`01165d8d ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  MpFilter+11d8d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MpFilter

IMAGE_NAME:  MpFilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51b26637

FAILURE_BUCKET_ID:  X64_0xc4_91_MpFilter+11d8d

BUCKET_ID:  X64_0xc4_91_MpFilter+11d8d

Followup: MachineOwner
---------

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa805f636358, 2, 0, fffff8800170e354}

*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
Probably caused by : tdx.sys ( tdx!TdxSendConnection+252 )

Followup: MachineOwner
---------

Corrupt Driver ... verifier misbehave, arg 1 =91

Yopes · 18 Jul 2013

Hi Arc,
I followed your suggestions and now all seems fine.
Tell me if you think I shall mark the thread as solved.

Regards,
Yopes

Arc · 18 Jul 2013

Hello Yopes. :)

Good to know that all is going well till now. But, I think you should give the computer a bit more time, at least two more days. If there is no more issue within tow more days, all may be treated as OK.

But if not, and there are more BSODs within this time, you need to post the SF Diag tool output again.

So, let us know the situation after two days (or earlier if needed) ? :)

Yopes · 18 Jul 2013

Here we go again!

Arc, you were absolutely right.
No dumps for 5 hours and then 2 in 5 minutes. The only change was the installation of a printer driver...

Thanks,

Yopes

Arc · 18 Jul 2013

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight. But if it starts showing error (red lines) stop testing and report back.

Code:

.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {1, d, 1, fffff80002e7156b}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 000000000000000d, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e7156b, address which referenced memory

Debugging Details:
------------------


WORKER_ROUTINE: 
+0
00000000`00000001 ??              ???

WORK_ITEM:  fffff80002e7156b

CURRENT_IRQL:  d

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TAG_NOT_DEFINED_c000000f:  FFFFF80000BA2FB0

TRAP_FRAME:  0000000000000001 -- (.trap 0x1)
Unable to read trap frame at 00000000`00000001

EXCEPTION_RECORD:  fffff8000300fe80 -- (.exr 0xfffff8000300fe80)
ExceptionAddress: 0000000000000000
   ExceptionCode: 00001f80
  ExceptionFlags: 01000000
NumberParameters: 50453696
   Parameter[0]: 0000000000000001
   Parameter[1]: fffff80000b9cc70
   Parameter[2]: 0000000000000000
   Parameter[3]: 0000000000000000
   Parameter[4]: 0000000080050033
   Parameter[5]: 0000000000000001
   Parameter[6]: 0000000000187000
   Parameter[7]: 00000000000406f8
   Parameter[8]: 0000000000000000
   Parameter[9]: 0000000000000000
   Parameter[10]: 0000000000000000
   Parameter[11]: 0000000000000000
   Parameter[12]: 00000000fffe0ff0
   Parameter[13]: 0000000000000400
   Parameter[14]: 007f000000000000

LAST_CONTROL_TRANSFER:  from fffff80002e941a9 to fffff80002e94c00

STACK_TEXT:  
fffff800`00b9c6a8 fffff800`02e941a9 : 00000000`0000000a 00000000`00000001 00000000`0000000d 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c6b0 fffff800`02e92e20 : fffffa80`1d55fc28 fffffa80`1b015ba8 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c7f0 fffff800`02e7156b : fffffa80`1b32d402 fffffa80`1b015410 fffffa80`1b32d410 fffff880`061b2e34 : nt!KiPageFault+0x260
fffff800`00b9c980 fffff800`0340f895 : fffff800`03435460 fffff800`00b9cb30 fffff800`03435460 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x6a35
fffff800`00b9ca80 fffff800`02e91153 : fffffa80`1a367480 fffffa80`1d6d2901 fffff800`0300fe80 fffff800`00b96080 : hal!HalpHpetClockInterrupt+0x8d
fffff800`00b9cab0 fffff800`02e8c8e2 : fffff800`0300fe80 fffff800`00000001 00000000`00000001 fffff880`00000000 : nt!KiInterruptDispatchNoLock+0x163
fffff800`00b9cc40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x32


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002e7156c - nt! ?? ::FNODOBFM::`string'+6a36
    [ 8b:ab ]
1 error : !nt (fffff80002e7156c)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Yopes · 20 Jul 2013

Hello Arc,
I ran 8.7 passes with no errors. has been running for 36 hours.

I'm attaching the last dump, includes two dumps from Friday.

Regards,
Yopes

Arc · 21 Jul 2013

Killer Wireless-N 1100 Series LAN device driver is failing here.

Code:

*** WARNING: Unable to verify timestamp for Ak27x64.sys
*** ERROR: Module load completed but symbols could not be loaded for Ak27x64.sys
 Ak27x64+0x2bc13a

And it is failing despite of being a very latest driver.

Code:

fffff880`06406000 fffff880`067ed000   Ak27x64  T (no symbols)           
    Loaded symbol image file: Ak27x64.sys
    Image path: Ak27x64.sys
    Image name: Ak27x64.sys
    Timestamp:        Fri May 31 02:01:39 2013 (51A7B72B)
    CheckSum:         003C310F
    ImageSize:        003E7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Why? There must be something that is blocking the network operations. And there is something for sure. See below .....

Bigfoot Networks Bandwidth Control Wireless NDIS Light Weight Filter driver is also failing.

Code:

fffff800`00b9bda8  fffff880`04470064Unable to load image bflwfx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for bflwfx64.sys
*** ERROR: Module load completed but symbols could not be loaded for bflwfx64.sys
 bflwfx64+0x4064

Bigfoot Networks Bandwidth Control is a very well known network blocker. I would suggest you to uninstall it.

At the same time, you have McAfee installed.

Code:

c:\program files\mcafee\endpoint encryption for files and folders\mfeffcore.exe

McAfee is also a network blocker. Moreover, using multiple antivirus programs is a bad idea. It makes your PC even more unsecured in turn.

Uninstall McAfee Using McAfee Removal Tool. Use Microsoft Security Essentials as your antivirus (which you already have) with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

The display driver is also failing.

Code:

fffff800`00b990c8  fffff880`05729dadUnable to load image nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
 nvlddmkm+0xb4dad

Which is not the latest.

Code:

fffff880`05675000 fffff880`06121000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Thu Feb 14 12:53:44 2013 (511C9100)
    CheckSum:         00A9665F
    ImageSize:        00AAC000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Apply the latest WHQL version of nVidia display driver (WHQL 320.49).
You may download it directly, from our forum link Latest NVIDIA ForceWare Video Drivers Windows 7; or you may opt for the Option 2 of Drivers- Download NVIDIA Drivers for “Automatically find drivers for my NVIDIA products” (it requires java installed).

Is the computer hot? Report us the heat of the computer after a couple of hours of your normal usage. Upload a screenshot of the summery tab of Speccy.

Stress test the Graphics Card using Furmark.
Video Card - Stress Test with Furmark

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus and the touchpad driver, SynTPEnh.
Apply > OK
Accept then restart.

Make it sure that your INTEL SSD SC2CW480A3 is running with the up-to-date firmware.

Let us know the results.

Yopes · 21 Jul 2013

Hi Arc,
Bigfoot Networks Bandwidth Control is part of the Killer Wireless, I cannot uninstall it.
The Mcaffee installed is not an antivirus. Is just an encryption tool part of the Intel Anti Theft, I disabled it because with the tool that you said cannot be uninstalled.
I updated the driver of the graphic card. But the situation is not happening when I'm playing. It is happening in normal office work. So it should be the intel integrated card the one working.
SSD has latest firmmware.

CPU Temp is 49. I cannot feel the laptop hot at all. I'm sending you a new file with a new BSOD.

Now the question, what will you do with something like this. Will you return the laptop? It is new.

Best Regards,
Yopes

Arc · 21 Jul 2013

A wide range of things are failing there.

Make it sure that it is not a virus infection. Scan the system for possible virus infection with the following programs.

Failing RAM also can cause such a mess. Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

A corrupt windows installation also may do it. I'd recommend you ta Clean Reinstall - Factory OEM Windows 7 to see if it changes the situation.

If all is good, but still it is the same level of issue, we may think it as a failing motherboard and RMA the computer.