BSOD Randomly Occurring, New Lenovo W520

AfraidOfDecaf · 23 Mar 2012

System was manufactured this March. Computer was received 6 days ago.

Restored operating system to factory settings multiple times. It was restored 6 hours before this latest crash.

I was watching a youtube video while installing Visual Studio when this latest crash occurred.

Windows Ultimate 64-bit. Upgraded from Windows Home Premium. Full Retail.
Lenovo ThinkPad W520
Intel Core i7-2860QM
16GB
NVidia Quadro 2000M
Intel 160GB X25 SSD (2 in RAID 0)

Output from the system file collection app and the system health report is attached as zip.

Thanks in advance for any assistance.

Update 3/24: No errors from Memtest.

writhziden · 23 Mar 2012

Problem Devices:

Code:

Cisco Systems VPN Adapter for 64-bit Windows	ROOT\NET\0000	This device is disabled.

Security Software:

Code:

vipappservice.exe	c:\program files (x86)\symantec\vip access client\vipappservice.exe	8356	8	200	1380	3/23/2012 9:40 PM	2.0.2.140	80.61 KB (82,544 bytes)	6/30/2011 1:07 AM
vipuimanager.exe	c:\program files (x86)\symantec\vip access client\vipuimanager.exe	6196	8	200	1380	3/23/2012 9:46 PM	2.0.2.140	2.08 MB (2,185,832 bytes)	6/30/2011 1:07 AM
avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	2096	8	200	1380	3/23/2012 9:38 PM	7.0.1426.0	43.72 KB (44,768 bytes)	3/23/2012 7:13 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	1744	8	200	1380	3/23/2012 9:38 PM	7.0.1426.0	4.05 MB (4,241,512 bytes)	3/23/2012 7:13 PM

Possible out of date drivers:

Code:

dne64x	fffff880`04c60000	fffff880`04c8c000	Mon Nov 10 18:01:24 2008 (4918d964)	000359da		dne64x.sys
LenovoRd	fffff880`027cb000	fffff880`027e7d00	Mon May 11 03:33:56 2009 (4a07f104)	000271d2		LenovoRd.sys

dne64x.sys
LenovoRd.sys

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\AfraidOfDecaf\Windows_NT6_BSOD_jcgriff2\032312-13166-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e5a000 PsLoadedModuleList = 0xfffff800`0309e650
Debug session time: Fri Mar 23 19:35:25.355 2012 (UTC - 6:00)
System Uptime: 0 days 0:28:46.214
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88007e661c0, fffff880247456c0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceHandler+7c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88007e661c0, Address of the instruction which caused the bugcheck
Arg3: fffff880247456c0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+0
fffff880`07e661c0 0000            add     byte ptr [rax],al

CONTEXT:  fffff880247456c0 -- (.cxr 0xfffff880247456c0)
rax=0000000000000000 rbx=0000000000000000 rcx=0000f88003e841ba
rdx=fffffa8014b664a1 rsi=0000000000000008 rdi=0000000000000000
rip=fffff88007e661c0 rsp=fffff880247460a8 rbp=fffff88024746b60
 r8=fffffa8014b664a0  r9=0000000000000010 r10=fffffa800cd6c980
r11=fffff880247460a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
fffff880`07e661c0 0000            add     byte ptr [rax],al ds:002b:00000000`00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88007e661c0

STACK_TEXT:  
fffff880`24744df8 fffff800`02ed62e9 : 00000000`0000003b 00000000`c0000005 fffff880`07e661c0 fffff880`247456c0 : nt!KeBugCheckEx
fffff880`24744e00 fffff800`02ed5c3c : fffff880`24745e68 fffff880`247456c0 00000000`00000000 fffff800`02f01f60 : nt!KiBugCheckDispatch+0x69
fffff880`24744f40 fffff800`02f01a6d : fffff800`030f4764 fffff800`030197a8 fffff800`02e5a000 fffff880`24745e68 : nt!KiSystemServiceHandler+0x7c
fffff880`24744f80 fffff800`02f00845 : fffff800`03020638 fffff880`24744ff8 fffff880`24745e68 fffff800`02e5a000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`24744fb0 fffff800`02f117c1 : fffff880`24745e68 fffff880`247456c0 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
fffff880`24745690 fffff800`02ed63c2 : fffff880`24745e68 00000000`00000000 fffff880`24745f10 00000000`00000008 : nt!KiDispatchException+0x135
fffff880`24745d30 fffff800`02ed4f3a : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`24745f10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceHandler+7c
fffff800`02ed5c3c b801000000      mov     eax,1

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceHandler+7c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiSystemServiceHandler+7c

BUCKET_ID:  X64_0x3B_nt!KiSystemServiceHandler+7c

Followup: MachineOwner
---------

It is easier to find patterns with multiple dmp files, so we may have to wait for you to crash a few more times to determine the cause. Possible causes of the above crash are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...

Start with the following steps:

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. In Windows 7:
- Click the Start Menu
- Type verifier in Search programs and files (do not hit enter)
- Right click verifier and click Run as administrator
- Put a tick in Create custom settings (for code developers) and click next
- Put a tick in Select individual settings from a full list and click next
- Set up the individual settings as in the image and click next
  Attachment 204113
- Put a tick in Select driver names from a list
- Put a tick next to all non-Microsoft drivers.
- Click Finish.
- Restart your computer.
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.