Windows 7 - BSOD almost everytime I boot

bsodsucks · 02-11-2012

Hi, I'll get straight to the point, I'm getting the BSOD almost everytime I boot my pc.

specs:

Windows 7 Home Premium
32bit system
Full Retail
I bought the pc about 10 months ago, that's when it was installed and I never had it re-installed

Documents.rar is the files as requested by the BSOD tutorial.

Thanks in advance

zigzag3143 · 02-12-2012

Quote: Originally Posted by bsodsucks

Hi, I'll get straight to the point, I'm getting the BSOD almost everytime I boot my pc.

specs:

Windows 7 Home Premium
32bit system
Full Retail
I bought the pc about 10 months ago, that's when it was installed and I never had it re-installed

Documents.rar is the files as requested by the BSOD tutorial.

Thanks in advance

Couple of obvious issues

Avast can be a contributing cause of BSOD'S . Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows

Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

Using MagicISO to create ISO image files

bsodsucks · 03-10-2012

Thanks guys, I deleted Daemon and avast and everything was working for a decent amount of time but it' back again. Exactly like last time, I see the windows loading screen and that's when it pops up, after a few dozen tries I can get through to my pc.

Here's a new dump

writhziden · 03-11-2012

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\bsodsucks\Windows_NT6_BSOD_jcgriff2\031012-25178-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82e4d000 PsLoadedModuleList = 0x82f964d0
Debug session time: Sat Mar 10 08:16:39.894 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:08.252
Loading Kernel Symbols
...............................................................
................
Loading User Symbols
Loading unloaded module list
.
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e9b8c2ee, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8624a161, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'netbt' and 'aswSnx.SYS' overlap

READ_ADDRESS: GetPointerFromAddress: unable to read from 82fb6848
Unable to read MiSystemVaType memory at 82f95e20
 e9b8c2ee 

FAULTING_IP: 
+3631323461663138
8624a161 8b7250          mov     esi,dword ptr [edx+50h]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  80786b74 -- (.trap 0xffffffff80786b74)
ErrCode = 00000000
eax=00000000 ebx=8624a279 ecx=00002000 edx=e9b8c29e esi=866a0000 edi=80786bf8
eip=8624a161 esp=80786be8 ebp=80786c4c iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
8624a161 8b7250          mov     esi,dword ptr [edx+50h] ds:0023:e9b8c2ee=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e8e408 to 82edb40f

STACK_TEXT:  
80786b5c 82e8e408 00000000 e9b8c2ee 00000000 nt!MmAccessFault+0x106
80786b5c 8624a161 00000000 e9b8c2ee 00000000 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
80786c4c 808119b0 8080aff0 80786d48 80786c70 0x8624a161
80786c60 82e894f5 00000008 00000001 832021de 0x808119b0
80786d50 83055fda 8080aff0 b29c0f21 00000000 nt!ZwNotifyChangeKey+0x11
00000000 00000000 00000000 00000000 00000000 nt!PspSystemThreadStartup+0x9e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTrap0E+dc
82e8e408 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiTrap0E+dc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

FAILURE_BUCKET_ID:  0x50_nt!KiTrap0E+dc

BUCKET_ID:  0x50_nt!KiTrap0E+dc

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\bsodsucks\Windows_NT6_BSOD_jcgriff2\022212-26504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x82e1b000 PsLoadedModuleList = 0x82f644d0
Debug session time: Tue Feb 21 14:38:28.048 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:09.406
Loading Kernel Symbols
...............................................................
...............
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8624d161, 80786b20, 80786700}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8624d161, The address that the exception occurred at
Arg3: 80786b20, Exception Record Address
Arg4: 80786700, Context Record Address

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'tdx' and 'aswSnx.SYS' overlap

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+19
8624d161 8b7250          mov     esi,dword ptr [edx+50h]

EXCEPTION_RECORD:  80786b20 -- (.exr 0xffffffff80786b20)
ExceptionAddress: 8624d161
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 7e68d476
Attempt to read from address 7e68d476

CONTEXT:  80786700 -- (.cxr 0xffffffff80786700)
eax=00000000 ebx=8624d279 ecx=00002000 edx=7e68d426 esi=866bc000 edi=80786bf8
eip=8624d161 esp=80786be8 ebp=80786c4c iopl=0         ov up ei pl nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a03
8624d161 8b7250          mov     esi,dword ptr [edx+50h] ds:0023:7e68d476=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  7e68d476

READ_ADDRESS: GetPointerFromAddress: unable to read from 82f84848
Unable to read MiSystemVaType memory at 82f63e20
 7e68d476 

FOLLOWUP_IP: 
+19
8624d161 8b7250          mov     esi,dword ptr [edx+50h]

FAILED_INSTRUCTION_ADDRESS: 
+19
8624d161 8b7250          mov     esi,dword ptr [edx+50h]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 80811b70 to 8624d161

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
80786c4c 80811b70 8080b180 80786d48 80786c70 0x8624d161
80786c60 82e574f5 00000008 00000001 831d01de 0x80811b70
80786d50 83023fda 8080b180 b2c7ea08 00000000 nt!ZwNotifyChangeKey+0x11
00000000 00000000 00000000 00000000 00000000 nt!PspSystemThreadStartup+0x9e


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  0x7E_BAD_IP_ANALYSIS_INCONCLUSIVE

BUCKET_ID:  0x7E_BAD_IP_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers...
Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

If you are overclocking any hardware, please stop.
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
Use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
Due to the unknown module crashes, I would suggest scanning for viruses with your antivirus software and with Malwarebytes. Do not start the free trial of Malwarebytes; use the standalone full scan feature of Malwarebytes.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

Windows 7 - BSOD almost everytime I boot

BSOD almost everytime I boot problems?