Apparently Random BSOD (BCCode:f4 BCP1: 0000000000000003)

carlossierra · 30 Nov 2012

Hi Dave76. Thanks for your reply, first of all. Below you'll find the results of Memtest86+. And the RST Driver version is 11.5.0.1207. I'll start right now with the driver verifier test.

Attachment 243798

carlossierra · 30 Nov 2012

Here's the first BSOD I got after starting driver verifier.

Dave76 · 01 Dec 2012

Good news on the memtest86+ results.

Check which Intel RST driver version you have installed and post it here.

Go to Device Manager > IDE ATA/ATAPI controllers > Intel ... Series AHCI Controller > right click on this, select Properties > Driver tab
This is one of the possibilities that was blamed for your last crash.

Your last crash:

Code:

STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR
Usual causes:  Memory, Paging file corruption, File system, Hard drive, Cabling, Virus infection, Improperly seated cards, BIOS, Bad motherboard, Missing Service Pack
Probably caused by : memory_corruption
The requested page of kernel data could not be read in.  Typically caused by a bad block in the paging file or disk controller error.
If the error status is 0xC000000E, it means the disk subsystem has experienced a failure.
Arg2: ffffffffc000000e, error status (normally i/o status code)
ERROR_CODE: (NTSTATUS) 0xc000000e - A device which does not exist was specified.
DISK_HARDWARE_ERROR: There was error with disk hardware
DEFAULT_BUCKET_ID:  CODE_CORRUPTION
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096

This is blaming the disk controller, probably the Intel RST driver.
Other possibilities are bad block on HDD, RAM failure. Just because these have passed tests doesn't mean they aren't still to blame. Just the way electronics are, let's update or change the Intel RST driver first.

The Vostro 3460 Dell Support site lists the Intel RST driver version 11.5.0.1207, there were reports of some issues with some of the RST drivers around this version number.
The Intel RST site no longer lists this version, which indicates it is one that had an issue.

Down load and install the latest Intel RST driver:
Intel® Rapid Storage Technology Version: 11.6.0.1030

If you are still having the same crashes we can try the next older Intel RST driver:
Intel® Rapid Storage Technology Version: 11.2.0.1006

Before installing the RST driver, disable Driver Verifier.
After installing the RST v11.6.0.1030 driver, try to re-create the crash scenario.

carlossierra · 01 Dec 2012

Thanks Dave76. I just downloaded and installed Intel® Rapid Storage Technology 11.6.0.1030. I will try to recreate the situation. Should I activate driver verifier again?

I am also posting a couple more BSOD dumps I got since my last post (the one from today happened after disabling driver verifier and restarting the system).

Dave76 · 02 Dec 2012

Leave driver verifier disabled for now, so we can see if the RST driver is helping stability.

Last two crashes are the same:

Code:

STOP 0x000000F4: CRITICAL_OBJECT_TERMINATION 
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no
longer function.
MODULE_NAME: wininit
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
FAILURE_BUCKET_ID:  X64_0xF4_c0000005_VRF_IMAGE_wininit.exe
2: kd> !process fffffa800a013b30 3
GetPointerFromAddress: unable to read from fffff80002ec7000
PROCESS fffffa800a013b30
    SessionId: none  Cid: 0284    Peb: 7fffffd6000  ParentCid: 01cc
    DirBase: 169122000  ObjectTable: fffff8a00ade5850  HandleCount: <Data Not Accessible>
    Image: wininit.exe
    VadRoot fffffa800ab86f70 Vads 75 Clone 0 Private 760. Modified 890. Locked 2.
    DeviceMap fffff8a000007c70
    Token                             fffff8a00ade5920
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         105296
    QuotaPoolUsage[NonPagedPool]      28176
    Working Set Sizes (now,min,max)  (1689, 50, 345) (6756KB, 200KB, 1380KB)
    PeakWorkingSetSize                1689
    VirtualSize                       52 Mb
    PeakVirtualSize                   54 Mb
    PageFaultCount                    1936
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      901

The wininit.exe file is a safe Microsoft Windows system process, called "Windows Start-Up Application".

Post the crash files, if you get them.

carlossierra · 03 Dec 2012

Hi Dave76. Here's another crash file from a crash that just happened.

Dave76 · 03 Dec 2012

This is the same crash you have had before, indicating that RST driver hasn't helped.

This crash:

Code:

STOP 0x0000007A: KERNEL_DATA_INPAGE_ERROR
Usual causes:  Memory, Paging file corruption, File system, Hard drive, Cabling, Virus infection, Improperly seated cards, BIOS, Bad motherboard, Missing Service Pack
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
FAILURE_BUCKET_ID:  X64_0x7a_c0000185_nt!_??_::FNODOBFM::_string_+36bea

First, open laptop and remove, then inspect for any damage on connectors/components and clean if necessary, then re-install:
RAM
Internal hard drive
DVD/CD drive

Be sure these are firmly connected/attached when re-installing.

If that doesn't stop the crashes then download and install RST driver v:11.2.0.1006.
Intel® Rapid Storage Technology File name:iata_enu.exe Version:11.2.0.1006

The most common cause of this crash is bad blocks on hard drive, if the above steps don't stop the crashes then you need to test the laptop with a different or new hard drive.

In the Blue Screen of Death (BSOD) Posting Instructions generated files, open 'EventSys' file, search the file by Ctrl+F, enter 'error' in spanish. Search the document from the last week, translate findings and post here.

carlossierra · 05 Dec 2012

Hi Dave76. I just downgraded the Intel Drivers to the version 11.2.0.1006. Regarding the translated error messages from EventSys, the file is very long (127.288 lines) and contains a lot of blocks with the word Error in the Level and Description. Do you need the whole list of blocks containing the word error translated? Can you be more specific maybe?

Dave76 · 06 Dec 2012

Did you re-seat the RAM, hard drive and DVD?

The event Logs are very helpful in finding the issues, especially if the 'usual' fixes don't work.
For now, just give the error messages from the last week or the last 10, to get started.

carlossierra · 06 Dec 2012

Hi Dave76. Again, thanks for your time, and sorry for not getting back earlier to you on your last post (it's been a busy week). I haven't come around to the hardware suggestions yet, but I will get to it next. In the meantime, here are the last messages that contain the "error" word on EventSys.txt. Some of them clearly don't look like errors, but I preferred to send them to you in case they are relevant. I hope the translation is good enough:

Event[6563]:
Log Name: System
Source: Service Control Manager
Date: 2012-11-15T12:37:16.706
Event ID: 7036
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The windows error log service went into "stopped" state.

Event[6589]:
Log Name: System
Source: Disk
Date: 2012-11-15T14:18:20.573
Event ID: 11
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The driver detected a driver error on \Device\Harddisk1\DR1.

Event[6590]:
Log Name: System
Source: Disk
Date: 2012-11-15T14:18:21.088
Event ID: 11
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The driver detected a driver error on \Device\Harddisk1\DR1.

Event[6806]:
Log Name: System
Source: volsnap
Date: 2012-11-16T15:31:00.233
Event ID: 29
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The volume instances were nullified during detección for C:

Event[6807]:
Log Name: System
Source: EventLog
Date: 2012-11-16T15:31:22.000
Event ID: 6008
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The previous system shutdown was unexpected 02:26:39 p.m. on ?15/?11/?2012.

Event[6811]:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 2012-11-16T15:31:01.746
Event ID: 41
Task: N/A
Level: Critical
Opcode: Information
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: PCAC
Description:
The system was restarted without a clean shutdown first. This error can be generated because the system stopped responding, it freezed or the power supply was suddently interrupted.

Event[6923]:
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 2012-11-16T15:33:44.000
Event ID: 10005
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
DCOM error "1053" when trying to start WSearch with arguments "" to start the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Event[6963]:
Log Name: System
Source: Microsoft Antimalware
Date: 2012-11-16T15:43:51.000
Event ID: 2001
Task: N/A
Level: Error
Opcode: Information
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:

Microsoft Antimalware encountered an error while trying to update the signatures.
New signature version:
Old signature version: 1.139.2168.0
Source: Microsoft Update Server
Stage: Installation
Path: Microsoft Home Page | Devices and Services
Signature type: Antivirus
Update type: complete
User: NT AUTHORITY\SYSTEM
Current engine version:
Previous engine version: 1.1.8904.0
Error code: 0x80070643
Error description: unrecoverable error during installation.

Event[6965]:
Log Name: System
Source: Microsoft-Windows-WindowsUpdateClient
Date: 2012-11-16T15:43:56.016
Event ID: 20
Task: Agente de Windows Update
Level: Error
Opcode: Instalación
Keyword: Instalación,Error
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: PCAC
Description:
Instalation error: windows error when trying to install the following upgrade: error 0x80070643: Microsoft Security Essentials definition upgrade – KB2310138 (definition 1.139.2242.0).

Event[6969]:
Log Name: System
Source: Microsoft-Windows-DistributedCOM
Date: 2012-11-16T15:46:13.000
Event ID: 10010
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The server {16D99191-6280-4B33-A2F5-04805A0FC582} didn't register with DCOM in the required time.

Event[7133]:
Log Name: System
Source: Microsoft Antimalware
Date: 2012-11-16T15:48:52.000
Event ID: 3007
Task: N/A
Level: Information
Opcode: Information
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The Microsoft Antimalware real time protection has reset a feature. It's advised to execute a whole system detection to detect the elements that could have been omitted while the agent was inactive.
Feature: network inspection system
Reasson: the real time protection has recovered from an unknown error. A quick detection scan is recommended

Event[7192]:
Log Name: System
Source: Service Control Manager
Date: 2012-11-16T16:42:36.789
Event ID: 7036
Task: N/A
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The windows error log service went into "execution" state.

Event[7349]:
Log Name: System
Source: Microsoft Antimalware
Date: 2012-11-16T16:44:43.000
Event ID: 3007
Task: N/A
Level: Information
Opcode: Information
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The Microsoft Antimalware real time protection has reset a feature. It's advised to execute a whole system detection to detect the elements that could have been omitted while the agent was inactive.
Feature: network inspection system
Reasson: the real time protection has recovered from an unknown error. A quick detection scan is recommended

Event[7635]:
Log Name: System
Source: Microsoft Antimalware
Date: 2012-11-19T19:14:20.000
Event ID: 3007
Task: N/A
Level: Information
Opcode: Information
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The Microsoft Antimalware real time protection has reset a feature. It's advised to execute a whole system detection to detect the elements that could have been omitted while the agent was inactive.
Feature: network inspection system
Reasson: the real time protection has recovered from an unknown error. A quick detection scan is recommended

Event[7877]:
Log Name: System
Source: Microsoft Antimalware
Date: 2012-11-23T10:47:50.000
Event ID: 3007
Task: N/A
Level: Information
Opcode: Information
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The Microsoft Antimalware real time protection has reset a feature. It's advised to execute a whole system detection to detect the elements that could have been omitted while the agent was inactive.
Feature: network inspection system
Reasson: the real time protection has recovered from an unknown error. A quick detection scan is recommended

Event[8004]:
Log Name: System
Source: EventLog
Date: 2012-11-27T12:41:49.000
Event ID: 6008
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The previous system shutdown at 03:14:08 p.m. on ?26/?11/?2012 was unexpected.

Event[8008]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 2012-11-27T12:41:50.000
Event ID: 1001
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: PCAC
Description:
The machine was restarted after an error check. The error check was 0x000000f4 (0x0000000000000003, 0xfffffa800aca1b30, 0xfffffa800aca1e10, 0xfffff80002f8e460). A dump was saved to: C:\Windows\MEMORY.DMP. Report Id.: 112712-21543-01.

Event[8009]:
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 2012-11-27T12:41:22.758
Event ID: 41
Task: N/A
Level: Critical
Opcode: Information
Keyword: N/A
User: S-1-5-18
User Name: NT AUTHORITY\SYSTEM
Computer: PCAC
Description:
The system was restarted without a clean shutdown first. This error can be generated because the system stopped responding, it freezed or the power supply was suddently interrupted.