Windows 7 - Several BSOD a day, The bugcheck was: 0x0000001e

Lauren17 · 02-11-2012

Hi all,
This has been an ongoing battle for about 2 weeks. I have reformatted and re-installed windows at least 4 times. re-flashed my BIOS. At first it was freezing while attempting to go into sleep mode...I believe that is fixed... Now it freezes even while in games. I have even run check disk on the HDD a few times as well. I am this close to chalking this to a bad HDD and buying a new one...Could someone please take a look and confirm? I also am aware I have several hosts file errors too...but I don't know if that's part of it or something else entirety. I would be so grateful for any incite.

x86 (32-bit) or x64 ?
- the original installed OS on the system? Windows 7 professional 64 bit
- an OEM or full retail version? OEM
- What is the age of system (hardware)? a little over a year
- What is the age of OS installation (have you re-installed the OS?) yes and about a week

Thank You,
Lauren

zigzag3143 · 02-12-2012

If you think it is a HD run chkdsk

A- CHKDSK /R /F:

Quote:

Run CHKDSK /R /F from an elevated (Run as administrator) Command Prompt.

Do this for each hard drive on your system.

When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter.

Then reboot and let the test run.

It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors.

See "CHKDSK LogFile" below in order to check the results of the test.

B- Elevated Command Prompt:

Quote:

Go to Start and type in "cmd.exe" (without the quotes)

At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

C-CHKDSK LogFile:

Quote:

Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter

Expand the Windows logs heading, then select the Application log file entry.

Double click on the Source column header.

Scroll down the list until you find the Chkdsk entry (wininit for Windows 7) (winlogon for XP).

Copy/paste the results into your next post.

Just to be sure I would also download malwarebytes and run a scan.

Please download the free version of Malwarebytes.
Update it immediately.
Do a full system scan
Let us know the results at the end.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

These crashes were caused by memory corruption/exception (probably a driver).
Please run these two tests to verify your memory and find which driver is causing the problem.

* If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

* If you have raid update its Driver.

Memtest.

Quote:

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

RAM - Test with Memtest86+

Driver verifier

Quote:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Lauren17 · 02-12-2012

Hi,
Here is the result of the check disk I ran 2 days ago. When I boot into windows I now receive several pop ups "Log.iniis" Attached is an example of that. Also I have downloaded and ran Malwarebytes and it only found 1 object which is my PDF creator. I don't think that is the issue but i removed it anyways. Attached is that file as well. Also yesterday I decided to uninstall my display drivers and re-install them just to see if that might be the issue.

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
163584 file records processed. File verification completed.
572 large file records processed. 0 bad file records processed. 2 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
217486 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
163584 file SDs/SIDs processed. Cleaning up 198 unused index entries from index $SII of file 0x9.
Cleaning up 198 unused index entries from index $SDH of file 0x9.
Cleaning up 198 unused security descriptors.
Security descriptor verification completed.
26952 data files processed. CHKDSK is verifying Usn Journal...
35061712 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x3c0fd2000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3c0fd9000 for 0x1000 bytes.
Read failure with status 0xc000009c at offset 0x3c101a000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3c1027000 for 0x1000 bytes.
Windows replaced bad clusters in file 104926
of name \Windows\System32\DRIVER~1\FILERE~1\NV_DIS~3.INF\nvoglv32.dll.
163568 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
145305142 free clusters processed. Free space verification is complete.
Adding 2 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

976657407 KB total disk space.
395079044 KB in 91569 files.
63288 KB in 26953 indexes.
8 KB in bad sectors.
294495 KB in use by the system.
65536 KB occupied by the log file.
581220572 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
145305143 allocation units available on disk.

Internal Info:
00 7f 02 00 05 cf 01 00 2e 69 03 00 00 00 00 00 .........i......
02 13 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

zigzag3143 · 02-12-2012

OK so there were errors in the file system and they were repaired. Are you still crashing?

Lauren17 · 02-12-2012

Hi,
Sadly I left my game running and walked away from the computer when I came back maybe 15 min later is was frozen on the MB logo screen. I have attached a new DMP file.

zigzag3143 · 02-12-2012

Quote: Originally Posted by Lauren17

Hi,
Sadly I left my game running and walked away from the computer when I came back maybe 15 min later is was frozen on the MB logo screen. I have attached a new DMP file.

No dmp files included in upload

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

Quote:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

Quote:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

Lauren17 · 02-18-2012

Ok, sorry for the delay. I actually ran Western Digital diags on my HDD and it failed the extended test. I returned the HDD under warenty and got a new one. Now 3 days with the replacement...I am BSOD constantly when I run SWTOR. I cant even stay in the game 10min. attached is a new mini dump with the health report.

Thanks !

Lauren17 · 02-19-2012

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
163072 file records processed. File verification completed.
515 large file records processed. 0 bad file records processed. 2 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
221018 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
163072 file SDs/SIDs processed. Cleaning up 535 unused index entries from index $SII of file 0x9.
Cleaning up 535 unused index entries from index $SDH of file 0x9.
Cleaning up 535 unused security descriptors.
Security descriptor verification completed.
28974 data files processed. CHKDSK is verifying Usn Journal...
37324264 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
163056 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
226981279 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

976657407 KB total disk space.
68341724 KB in 123951 files.
94112 KB in 28975 indexes.
0 KB in bad sectors.
296451 KB in use by the system.
65536 KB occupied by the log file.
907925120 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
226981280 allocation units available on disk.

Internal Info:
00 7d 02 00 69 55 02 00 72 7d 04 00 00 00 00 00 .}..iU..r}......
ff 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

writhziden · 02-19-2012

Code:


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\Kingston\BSODDmpFiles\Lauren17\Windows_NT6_BSOD_jcgriff2\021812-16926-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e0d000 PsLoadedModuleList = 0xfffff800`0304ae70
Debug session time: Sat Feb 18 19:44:18.986 2012 (GMT-7)
System Uptime: 0 days 0:14:08.749
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffff010e6, 1, fffff80002e2fa16, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CcPerformReadAhead+26e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffff010e6, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e2fa16, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b50e0
 fffffffffff010e6 

FAULTING_IP: 
nt!CcPerformReadAhead+26e
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002f9a940 -- (.trap 0xfffff88002f9a940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000023df000 rbx=0000000000000000 rcx=0000000000001000
rdx=fffffa80070e3a40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e2fa16 rsp=fffff88002f9aad0 rbp=fffff800030225a0
 r8=fffffa80070e3bb0  r9=0000000000800000 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
nt!CcPerformReadAhead+0x26e:
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002efddf4 to fffff80002e7d5c0

STACK_TEXT:  
fffff880`02f9a7d8 fffff800`02efddf4 : 00000000`00000050 ffffffff`fff010e6 00000000`00000001 fffff880`02f9a940 : nt!KeBugCheckEx
fffff880`02f9a7e0 fffff800`02e7b6ae : 00000000`00000001 00000000`023de000 00000000`00000000 fffff800`02e5fa64 : nt! ?? ::FNODOBFM::`string'+0x426f7
fffff880`02f9a940 fffff800`02e2fa16 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`02f9aad0 fffff800`02e71442 : fffffa80`06e89c60 fffffa80`06a3b000 fffff880`00000000 fffff880`03f77734 : nt!CcPerformReadAhead+0x26e
fffff880`02f9ac00 fffff800`02e8a7e1 : fffffa80`06a41ab0 fffff800`02e71224 fffff800`03084170 fffffa80`00000000 : nt!CcWorkerThread+0x21e
fffff880`02f9acb0 fffff800`0311d6fa : 00000000`00000000 fffffa80`06a3b040 00000000`00000080 fffffa80`069ab840 : nt!ExpWorkerThread+0x111
fffff880`02f9ad40 fffff800`02e5bb46 : fffff880`02d64180 fffffa80`06a3b040 fffff880`02d6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02f9ad80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CcPerformReadAhead+26e
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CcPerformReadAhead+26e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0x50_nt!CcPerformReadAhead+26e

BUCKET_ID:  X64_0x50_nt!CcPerformReadAhead+26e

Followup: MachineOwner
---------

Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers... Antivirus Software... Faulty System Service...

Thanks to Dave76 for help understanding possible causes.

Do the following steps.

If you are overclocking any hardware, please stop.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
Use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Await further instructions after posting your results before proceeding to the next steps.
Update to Service Pack 1 (SP1)
Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 (KB947821) [August 2011]

Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [August 2011]

Steps to follow before you install Windows 7 Service Pack 1 from the Microsoft Download Center

Service Pack 1 Download site

Links to Service Pack 1 (SP1) and preparation for SP1 courtesy of JMH
Troubleshoot Application Conflicts by Performing a Clean Startup

Lauren17 · 02-20-2012

Hi,

1) ran memtest86+ overnight for about 10+hours, no errors
and windows memory diag tool for one pass
2) I was not overclocking
3) I ran the |MG| Video Memory Stress Test 1.7.116 Download for about 3 hours, no errors
4) ran sfc /scannow once, no errors
5) did a clean start up in windows 7
6) did an 'upgrade' on windows 7 from the cd
7) reseated all power connectors and cables on the mother board

I just got another blue screen this morning and I got one last night. Please see attached minidumps.

Thank you

Windows 7 - Several BSOD a day, The bugcheck was: 0x0000001e

Several BSOD a day, The bugcheck was: 0x0000001e problems?