BSOD at random times.

sta · 02 Jan 2013

Hi I'm getting random BSODs. The only way I can run is on Safe Mode. I've attached the necessary files.

**Pauly** · 02 Jan 2013

Hello sta, Welcome to SF

Have a read through these links and i will have a good look at your dumps and post later

First off if your OCing in anyway stop, return everything to stock settings for the purposes of testing

If you havent already, fill in your system specs so we know what we are dealing with
System Info - See Your System Specs

Make sure you have read the guide on asking for help with BSOD so you know what we need
https://www.sevenforums.com/crashes-d...tructions.html
And if necessary set your machine to create minidumps (Method 2 Step 2 is easiest IMO)
Dump Files - Configure Windows to Create on BSOD

Run some scans to check against virus or infection
http://support.kaspersky.com/5350
Windows Defender Offline

sta · 03 Jan 2013

Hi. Thanks for your response. I've filled in the system specs on my profile.

OS
Microsoft Windows 7 Professional 32-bit 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz
Motherboard
Intel Corporation DH55TC
Memory
2.00 GB
Graphics Card(s)
ATI Radeon HD 4300/4500 Series
Sound Card
(1) ATI HDMI Audio (2) Realtek High Definition Audio
Hard Drives
Hitachi HDS721050CLA362 ATA Device

I did the virus scan. Nothing showed up.

sta · 03 Jan 2013

I've attached the files again, but this time the computer was running normally (no safe mode).

**Pauly** · 03 Jan 2013

Sorry mate this thread got away from me

Right have had a look at dumps you got
two error code 0xA BSOD Index
one error code 0x1A BSOD Index

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {a0cd4e8f, 2, 0, 832a248a}
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+723b6 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: a0cd4e8f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 832a248a, address which referenced memory
Debugging Details:
------------------
 
READ_ADDRESS: GetPointerFromAddress: unable to read from 8337f848
Unable to read MiSystemVaType memory at 8335ee20
 a0cd4e8f 
CURRENT_IRQL:  2
FAULTING_IP: 
nt!MiUnlinkPageFromLockedList+d8
832a248a 0fb6500f        movzx   edx,byte ptr [eax+0Fh]
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
TRAP_FRAME:  884ada1c -- (.trap 0xffffffff884ada1c)
ErrCode = 00000000
eax=ae6e2fe0 ebx=8ae2d368 ecx=00000002 edx=00010022 esi=ae6e2fe0 edi=8ae2d37c
eip=832c9aca esp=884ada90 ebp=884ada90 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!RtlLengthSid+0x8:
832c9aca 0fb64001        movzx   eax,byte ptr [eax+1]       ds:0023:ae6e2fe1=??
Resetting default scope
LAST_CONTROL_TRANSFER:  from 832a248a to 83255cdb
STACK_TEXT:  
884ad814 832a248a badb0d00 833803f6 ffffffff nt!KiTrap0E+0x2cf
884ad8ac 832b911d 00000000 00000000 ae6e2fe1 nt!MiUnlinkPageFromLockedList+0xd8
884ad8fc 832a6480 00000000 ae6e2fe1 c0573710 nt!MiResolveTransitionFault+0x550
884ad980 832a3f0c ae6e2fe1 00000000 83380280 nt!MiDispatchFault+0x61f
884ada04 83255ae8 00000000 ae6e2fe1 00000000 nt!MmAccessFault+0x14d4
884ada04 832c9aca 00000000 ae6e2fe1 00000000 nt!KiTrap0E+0xdc
884ada90 857223b6 ae6e2fe0 859c3022 8571c062 nt!RtlLengthSid+0x8
WARNING: Stack unwind information not available. Following frames may be wrong.
884adab0 8599e5f4 8ae2d368 00000010 00000000 klif+0x723b6
884adacc 8599e7c0 8ae2d338 8ae2d338 884adaf0 fltmgr!DoFreeContext+0x66
884adadc 859af722 8ae2d338 8bad6300 00000000 fltmgr!DoReleaseContext+0x42
884adaf0 859afac8 a229bde0 a229bdd8 a3f86968 fltmgr!FltpDeleteContextList+0x15c
884adb08 859a4eac a3f86968 a229bdb0 884adb84 fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+0x1a
884adb18 8599dcd8 8b1c3828 a3f86968 a229bdb0 fltmgr!FltpCleanupStreamListCtrlForFileObjectCloseWithStreamListCtrl+0x10
884adb84 859a09f0 884adbd8 a9b52e00 a9b52fd8 fltmgr!FltpPerformPreCallbacks+0x53a
884adb9c 859a0f01 884adbd8 00000000 8b1c3d68 fltmgr!FltpPassThroughInternal+0x40
884adbc0 859a13ba 024adbd8 a9b52e00 8b1c3d68 fltmgr!FltpPassThrough+0x203
884adbf0 835476c3 8b1c3d68 a9b52e00 a9b52e00 fltmgr!FltpDispatch+0xb4
884adc14 8324bbe0 00000000 8b1c8024 8b1c3d68 nt!IovCallDriver+0x258
884adc28 83447aff 853ec110 a3f86950 00000000 nt!IofCallDriver+0x1b
884adc6c 834386f9 a3f86968 a3f86968 a3f86950 nt!IopDeleteFile+0x10c
884adc84 8328d4c0 00000000 000c0000 00000000 nt!ObpRemoveObjectRoutine+0x59
884adc98 8328d430 a3f86968 8343e0d9 a8bec0c0 nt!ObfDereferenceObjectWithTag+0x88
884adca0 8343e0d9 a8bec0c0 a8bec0e8 833819c0 nt!ObfDereferenceObject+0xd
884adccc 83276664 a8bec0c0 00000000 00000000 nt!MiSegmentDelete+0x191
884add28 83276985 853f3020 00000000 00000000 nt!MiProcessDereferenceList+0xdb
884add50 8341f07a 00000000 ada5fb68 00000000 nt!MiDereferenceSegmentThread+0xc5
884add90 832c5819 832768be 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
klif+723b6
857223b6 ??              ???
SYMBOL_STACK_INDEX:  7
SYMBOL_NAME:  klif+723b6
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: klif
IMAGE_NAME:  klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  5093b116
FAILURE_BUCKET_ID:  0xA_VRF_klif+723b6
BUCKET_ID:  0xA_VRF_klif+723b6
Followup: MachineOwner
---------

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {28, 2, 1, 832e348e}
Probably caused by : memory_corruption ( nt!MiIdentifyPfn+1ed )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000028, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 832e348e, address which referenced memory
Debugging Details:
------------------
 
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 833ab848
Unable to read MiSystemVaType memory at 8338ae20
 00000028 
CURRENT_IRQL:  2
FAULTING_IP: 
nt!MiIdentifyPfn+1ed
832e348e f00fba281f      lock bts dword ptr [eax],1Fh
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0xA
PROCESS_NAME:  svchost.exe
TRAP_FRAME:  a12ec6f4 -- (.trap 0xffffffffa12ec6f4)
ErrCode = 00000002
eax=00000028 ebx=9599e420 ecx=00000000 edx=080225e6 esi=8336cd20 edi=00000000
eip=832e348e esp=a12ec768 ebp=a12ec7a0 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!MiIdentifyPfn+0x1ed:
832e348e f00fba281f      lock bts dword ptr [eax],1Fh ds:0023:00000028=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from 832e348e to 83281cdb
STACK_TEXT:  
a12ec6f4 832e348e badb0d00 080225e6 00000002 nt!KiTrap0E+0x2cf
a12ec7a0 83272bfc 9599e420 9599e000 a12ec844 nt!MiIdentifyPfn+0x1ed
a12ec7c8 834c214f 0099e060 84f78cbc a12ec858 nt!MmQueryPfnList+0xa6
a12ec810 83477a85 00000001 84f78c3c 00000000 nt!PfpPfnPrioRequest+0xde
a12ec890 83463767 00000000 00000001 a12eccd0 nt!PfQuerySuperfetchInformation+0xea
a12ecd00 83472ed4 0000004f 00000000 00000000 nt!ExpQuerySystemInformation+0x2477
a12ecd1c 8327e8fa 0000004f 00b4eeb0 00000014 nt!NtQuerySystemInformation+0x76
a12ecd1c 77167094 0000004f 00b4eeb0 00000014 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b4cd70 00000000 00000000 00000000 00000000 0x77167094
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MiIdentifyPfn+1ed
832e348e f00fba281f      lock bts dword ptr [eax],1Fh
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt!MiIdentifyPfn+1ed
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  503f7f43
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  0xA_VRF_nt!MiIdentifyPfn+1ed
BUCKET_ID:  0xA_VRF_nt!MiIdentifyPfn+1ed
Followup: MachineOwner
---------

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {411, c04bb558, 204f68c2, c14bb559}
Probably caused by : memory_corruption ( nt!MiLockTransitionLeafPage+115 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00000411, The subtype of the bugcheck.
Arg2: c04bb558
Arg3: 204f68c2
Arg4: c14bb559
Debugging Details:
------------------
 
BUGCHECK_STR:  0x1a_411
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  CCC.exe
CURRENT_IRQL:  2
TRAP_FRAME:  a3ca0874 -- (.trap 0xffffffffa3ca0874)
ErrCode = 00000002
eax=976abea8 ebx=83379da0 ecx=a6270cc8 edx=00000000 esi=a1dbbd48 edi=83379dc0
eip=834964d1 esp=a3ca08e8 ebp=a3ca0908 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!CmpAllocateKeyControlBlock+0x152:
834964d1 897804          mov     dword ptr [eax+4],edi ds:0023:976abeac=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from 832bacca to 832efe98
STACK_TEXT:  
a3ca06c4 832bacca 0000001a 00000411 c04bb558 nt!KeBugCheckEx+0x1e
a3ca0704 832b4bec a3ca076c 00000000 976abeac nt!MiLockTransitionLeafPage+0x115
a3ca0754 832a2480 00000001 976abeac c04bb558 nt!MiResolveTransitionFault+0x20
a3ca07d8 8329ff0c 976abeac 00000000 8337c280 nt!MiDispatchFault+0x61f
a3ca085c 83251ae8 00000001 976abeac 00000000 nt!MmAccessFault+0x14d4
a3ca085c 834964d1 00000001 976abeac 00000000 nt!KiTrap0E+0xdc
a3ca0908 834966da a3ca0a00 a3ca0a04 a3ca0c54 nt!CmpAllocateKeyControlBlock+0x152
a3ca0938 8343c34e 972de9c8 00052788 87c8bb48 nt!CmpCreateKeyControlBlock+0xbe
a3ca0980 83440c60 972de9c8 00052788 9734778c nt!CmpDoOpen+0x469
a3ca0b48 83437c4e a41637e8 853f77f0 a5284008 nt!CmpParseKey+0xd88
a3ca0bc4 83448060 00000048 a3ca0c18 00000040 nt!ObpLookupObjectName+0x4fa
a3ca0c20 83445f91 0846e88c 853f77f0 00000001 nt!ObOpenObjectByName+0x165
a3ca0d00 83422c11 0846e970 0002001f 0846e88c nt!CmOpenKey+0x1f4
a3ca0d1c 8324e8fa 0846e970 0002001f 0846e88c nt!NtOpenKeyEx+0x18
a3ca0d1c 76e87094 0846e970 0002001f 0846e88c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0846e8cc 00000000 00000000 00000000 00000000 0x76e87094
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MiLockTransitionLeafPage+115
832bacca cc              int     3
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt!MiLockTransitionLeafPage+115
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  503f7f43
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  0x1a_411_VRF_nt!MiLockTransitionLeafPage+115
BUCKET_ID:  0x1a_411_VRF_nt!MiLockTransitionLeafPage+115
Followup: MachineOwner
---------

2 of the dumps are blaming memory management so i think we need to run some tests on RAM
RAM - Test with Memtest86+
other blames driver klif.sys which is part of kaspersky AV could try uninstalling and running with MS security essentials

sta · 06 Jan 2013

Is it possible to remove the RAM from one slot and insert it into another slot?

**Pauly** · 06 Jan 2013

Did you run memtest, if so how many passes
Yes you can remove RAM i assume your asking because it has failed if so remove bad stick and then test again if pass then move good stick to other slot and test again, then bad stick in good slot and test again etc etc
If RAM checks out ok then i would run Hard Drive Diagnostic Procedure
If hardware checks out then would move on to stress tests and then drivers

sta · 09 Jan 2013

Hi. Sorry for the late. I did 8 passes and no errors were found.

**Pauly** · 09 Jan 2013

Hi mate sorry should have posted this with RAM check originally but memory problems (if thats what it is) can originate from RAM, HDD or GFX memory so recommend some more hardware tests
Hard Drive Diagnostic Procedure
Hardware - Stress Test With Prime95
Video Card - Stress Test with Furmark
see how you get on with these are you noticing any pattern with when the BSODs are occuring ?
Seeing as safemode works it may not be hardware but first is to prove its all good, also a clean boot may assist you getting to normal desktop, check this out
Troubleshoot Application Conflicts by Performing a Clean Startup