Random BSODs and applications crashes on a fresh Win7 install

writhziden said:

Glad to see no errors in Memtest86+. Best wishes with the Windows Memory Diagnostic tool. :)

Windows Memory Diagnostic tool without errors, although in event viewer results appear with two different codes, but the same time stamp codes are 1101 and 1201, neither of them reported errors.

Today however, I had a BSOD again, when I wasn't even using the computer. Upon reboot Win would complain about avira AV being turned off, while the process was running in the task manager and the tray icon was active.

Skype crashed as well after the reboot, I had to reboot again to get it work.

I attach the bsod report from jcgriff tool.

In the event viewer I see a following entry reported, reappearing constantly as an error:

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

but I suppose it's attached in the dumps file as well.

I ran chkdisk on C: which reported 1001 code and no problems detected.

Until today's BSOD all had been running flawlessly.

Thanks for looking at the files and enjoy your weekend.

R4ndom said:

writhziden said:

Glad to see no errors in Memtest86+. Best wishes with the Windows Memory Diagnostic tool. :)

Windows Memory Diagnostic tool without errors, although in event viewer results appear with two different codes, but the same time stamp codes are 1101 and 1201, neither of them reported errors.

Today however, I had a BSOD again, when I wasn't even using the computer. Upon reboot Win would complain about avira AV being turned off, while the process was running in the task manager and the tray icon was active.

Skype crashed as well after the reboot, I had to reboot again to get it work.

I attach the bsod report from jcgriff tool.

In the event viewer I see a following entry reported, reappearing constantly as an error:

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

but I suppose it's attached in the dumps file as well.

I ran chkdisk on C: which reported 1001 code and no problems detected.

Until today's BSOD all had been running flawlessly.

Thanks for looking at the files and enjoy your weekend.

To fix your event viewer error, see Event ID 10 is logged in the Application log after you install Service Pack 1 for Windows 7 or Windows Server 2008 R2

Code:

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\011412-16676-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`030a7670
Debug session time: Sat Jan 14 07:05:32.619 2012 (UTC - 7:00)
System Uptime: 0 days 1:11:58.149
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {8884, fffffa80008c1390, fffffa80008c17e0, 502}

Probably caused by : memory_corruption ( nt!MiRelinkStandbyPage+c6 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000008884, The subtype of the bugcheck.
Arg2: fffffa80008c1390
Arg3: fffffa80008c17e0
Arg4: 0000000000000502

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_8884

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f86496 to fffff80002edec40

STACK_TEXT:  
fffff880`08012778 fffff800`02f86496 : 00000000`0000001a 00000000`00008884 fffffa80`008c1390 fffffa80`008c17e0 : nt!KeBugCheckEx
fffff880`08012780 fffff800`02fe66e5 : fffffa80`04783498 fffffa80`049be000 00000000`00000000 00000000`00000020 : nt!MiRelinkStandbyPage+0xc6
fffff880`080127f0 fffff800`032ef754 : fffffa80`04782000 fffff880`08012b60 fffff880`080128c8 00000000`00ecbc01 : nt!MmSetPfnListPriorities+0x175
fffff880`08012840 fffff800`033511ca : 00000000`00000020 00000000`00000000 fffffa80`04782000 00000000`00000001 : nt!PfpPfnPrioRequest+0x84
fffff880`08012890 fffff800`03355a0a : 00000000`00000000 00000000`0000004f 00000000`00000000 fffffa80`03a6f201 : nt!PfSetSuperfetchInformation+0x199
fffff880`08012970 fffff800`02edded3 : fffffa80`058d9b60 00000000`01920690 00000000`02be9290 00000000`019214f0 : nt!NtSetSystemInformation+0xc8d
fffff880`08012ae0 00000000`77762a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00ecbb98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77762a0a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiRelinkStandbyPage+c6
fffff800`02f86496 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiRelinkStandbyPage+c6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1a_8884_nt!MiRelinkStandbyPage+c6

BUCKET_ID:  X64_0x1a_8884_nt!MiRelinkStandbyPage+c6

Followup: MachineOwner
---------

MEMORY_MANAGEMENT (1a) crash; likely due to an underlying device driver since your memory passed. It could also be your hard disk again, so you may want to run through the steps for doing the disk check again as you did before.

Update the following driver or re-install League of Legends.

Code:

tmpD844	fffff880`087c8000	fffff880`087cf000	Sat Jul 26 07:29:37 2008 (488b26c1)	00011908		tmpD844.tmp

Uninstall Avira using add/remove programs and then http://www.avira.com/en/support-down...egistrycleaner and replace with http://windows.microsoft.com/en-US/w...ity-essentials to run with Windows Firewall, at least for testing.

Thanks for answering,

I applied the fix proposed by MS for the ID 10 error, so far can't see it in the log viewer :)

I re-scanned C: for a 2nd time today with chkdisk, which found no problems, just as the 1st time.

I don't have League of Legends installed, never had actually. And the tmp file isn't on my disk (search wouldn't find it). might be a temporary internet file?

Avira uninstalled, their registry cleaner failed to launch after I unistalled Avira and rebooted the pc. It reported some problems, but after searching registry for "avira" I didn't find any entries referring to it, so I hope it's gone.

Thanks for help :)

R4ndom said:

Thanks for answering,

I applied the fix proposed by MS for the ID 10 error, so far can't see it in the log viewer :)

I re-scanned C: for a 2nd time today with chkdisk, which found no problems, just as the 1st time.

I don't have League of Legends installed, never had actually. And the tmp file isn't on my disk (search wouldn't find it). might be a temporary internet file?

Avira uninstalled, their registry cleaner failed to launch after I unistalled Avira and rebooted the pc. It reported some problems, but after searching registry for "avira" I didn't find any entries referring to it, so I hope it's gone.

Thanks for help :)

No problem. Post back if you have any more crashes or if you have any questions, comments, or concerns.

Hi,
After a few days without a BSOD, today another one. The blue screen after windows crashed reported MEMORY_MANAGEMENT error... interesting, but I don't understand anymore. One thing for sure, I won't migrate any data I had backed up from the old one into the new system... JCgriff files attached. Thanks for looking.

PS Firefox just crashed when opening a new tab, thing that was already happening before.

Code:

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\R4ndom\Windows_NT6_BSOD_jcgriff2\012212-16348-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4d000 PsLoadedModuleList = 0xfffff800`03092670
Debug session time: Sun Jan 22 06:36:48.200 2012 (UTC - 7:00)
System Uptime: 0 days 0:04:28.371
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {31, fffffa80042311e0, fffff880025fc000, fffff8a007aeae43}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000031, The subtype of the bugcheck.
Arg2: fffffa80042311e0
Arg3: fffff880025fc000
Arg4: fffff8a007aeae43

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_31

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  foobar2000.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003126b25 to fffff80002ec9c40

STACK_TEXT:  
fffff880`0a6fe2a8 fffff800`03126b25 : 00000000`0000001a 00000000`00000031 fffffa80`042311e0 fffff880`025fc000 : nt!KeBugCheckEx
fffff880`0a6fe2b0 fffff800`031a1c37 : fffffa80`00000000 fffffa80`06383a70 00000000`0000004b fffff8a0`07ae9000 : nt! ?? ::NNGAKEGL::`string'+0x7271
fffff880`0a6fe310 fffff800`02ef96eb : ffffffff`ffffffff fffff880`0a6fe480 00000000`0000ec00 00000000`00000000 : nt!MiRelocateImagePfn+0xf7
fffff880`0a6fe370 fffff800`02e64b64 : fffffa80`040bf820 00000000`00000000 00000000`00000000 00000000`00000042 : nt!MiWaitForInPageComplete+0x7ef
fffff880`0a6fe450 fffff800`03123e7a : 00000000`00000000 fffffa80`041b44a8 00000000`00000044 fffffa80`041b42b0 : nt!MiPfCompletePrefetchIos+0x54
fffff880`0a6fe480 fffff800`03325bfc : 00000000`00000010 00000000`0000002c fffffa80`041b42b0 00000000`0000002c : nt!MmPrefetchPages+0x13a
fffff880`0a6fe4e0 fffff800`03325e37 : fffff880`0a6fe600 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PfSnPrefetchSections+0x43c
fffff880`0a6fe5d0 fffff800`0332625f : 0000021e`4d5092ff fffffa80`040d7b30 fffff8a0`07aaf000 00000000`00000000 : nt!PfSnPrefetchScenario+0x187
fffff880`0a6fe840 fffff800`032252df : 00000000`00000000 00000000`615aa999 fffffa80`03d02b80 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`0a6fe910 fffff800`031b7fb8 : fffffa80`06383a70 fffffa80`03d02b80 00000000`14050a00 00000000`fffde000 : nt! ?? ::NNGAKEGL::`string'+0x513d0
fffff880`0a6fe940 fffff800`02ebb715 : fffff800`0303fe80 00000000`00000000 fffff800`031b7e70 fffffa80`06383a70 : nt!PspUserThreadStartup+0x148
fffff880`0a6fe9a0 fffff800`02ebb697 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`0a6feae0 00000000`76d3c500 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`000cfa18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d3c500


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+7271
fffff800`03126b25 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+7271

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

Followup: MachineOwner
---------

foobar2000.exe media player is the likely culprit for the latest crash.

Hi and thanks for both your answers.

Dave76 said:

You need to run the Avira RegistryCleaner again to be sure all the traces of Avira are removed.
Did you install MSE?

I did run the Avira RegistryCleaner after uninstalling Avira. As I mentioned previously (post n#23 on 3rd page), their utility won't even start, crashing immediately when trying to execute the file - both the zip version and exe from their site. I did install MSE as soon as was advised to do so. As I mentioned in the same post, I cannot find any residues of Avira in the registry, although I searched only by "avira" keyword. Anyway, crashes happened already before installing Avira, with MSE as well.

Dave76 said:

As writhziden mentioned, uninstall foobar2000 for testing.

The strange thing is that BSODs appear to happen while the computer is @ idle and not under stress, and often happen when I close and not launch programmes. PC crashes when I do NOTHING, like the last 2 BSODs (27.01 and 28.01) which took place when I left the computer without any programmes running, came back after 2-3 hours and found that it had rebooted with BSOD in the meantime - the latest 2 dump files are the case. I did uninstall foobar though I think the reason lies somewhere deeper.

Dave76 said:

We need to get some additional information on your RAM and settings.
D/L CPUZ and post a snip of the CPU, Mainboard, Memory, and SPD tabs.
For posting the information , enter 'Snipping tool' in the Start button > Search box, hit enter. Select the area you want to post and save to a convenient place.
How to Post a Screenshot in Seven Forums

The system isn't overclocked, in BIOS everything is set to default - voltages, RAM timings, CPU speed, NB, etc. I placed RAMs in different slots than they were originally located, no change. I attach the screenshot of the 4 cpu-z tables - computer @ idle. Do you also need the same tables under load?

Attachment 195477

Dave76 said:

Have you been checking your temperatures?
Use Core Temp , to check the CPU temps when at idle, under load and/or testing.
Let us know the minimum and maximum temps you get.

Go to your BIOS and tell us what the CPU, RAM and the CPU integrated memory controller voltages are.

I've been checking my temps since the first BSODs started. At idle CPU temp is 33 celsius (91F) and 55C (131F) under load (playing SCII, MW). The quite big difference comes probably from the fact that I use a 92mm fan on the CPU heatsink @ 1500RPM to avoid noise. I've been using Open Hardware Monitor as Core Temp was giving weird results. I only have CPU temp, as I believe my MB doesn't measure individual cores (no sensors?).

Thanks in advance for any ideas, as I don't understand anything anymore: PC won't BSOD while under load, but at idle, doing nothing, various apps crashing randomly and without any visible pattern, corrupted system file while HDD has no errors. Seems like there's always a few days' gap between BSODs occuring, then 1, 2 or 3 BSODs, again back to normal for 3-4 days, before crashing again.

HWiNFO64 Download can be run in sensor-only mode to determine if the individual cores have sensors. May be worth checking. Have you run SFC /SCANNOW Command - System File Checker to check for corrupted Windows files? You may need to run up to three times to resolve all corrupted files. If you get no integrity violations after the first run, let us know. Also, if you get errors after a fourth run, upload the CBS.log or the sfcdetails.txt file (see OPTION THREE of the SFC /SCANNOW tutorial) to your next post.

Dave76 may have further helpful steps, as well. :)