New
#1
BSOD at random times.
Hi I'm getting random BSODs. The only way I can run is on Safe Mode. I've attached the necessary files.
Hi I'm getting random BSODs. The only way I can run is on Safe Mode. I've attached the necessary files.
Hello sta, Welcome to SF
Have a read through these links and i will have a good look at your dumps and post later
First off if your OCing in anyway stop, return everything to stock settings for the purposes of testing
If you havent already, fill in your system specs so we know what we are dealing with
System Info - See Your System Specs
Make sure you have read the guide on asking for help with BSOD so you know what we need
https://www.sevenforums.com/crashes-d...tructions.html
And if necessary set your machine to create minidumps (Method 2 Step 2 is easiest IMO)
Dump Files - Configure Windows to Create on BSOD
Run some scans to check against virus or infection
http://support.kaspersky.com/5350
Windows Defender Offline
Hi. Thanks for your response. I've filled in the system specs on my profile.
OS
Microsoft Windows 7 Professional 32-bit 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz
Motherboard
Intel Corporation DH55TC
Memory
2.00 GB
Graphics Card(s)
ATI Radeon HD 4300/4500 Series
Sound Card
(1) ATI HDMI Audio (2) Realtek High Definition Audio
Hard Drives
Hitachi HDS721050CLA362 ATA Device
I did the virus scan. Nothing showed up.
I've attached the files again, but this time the computer was running normally (no safe mode).
Sorry mate this thread got away from me
Right have had a look at dumps you got
two error code 0xA BSOD Index
one error code 0x1A BSOD Index
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {a0cd4e8f, 2, 0, 832a248a} *** WARNING: Unable to verify timestamp for klif.sys *** ERROR: Module load completed but symbols could not be loaded for klif.sys Probably caused by : klif.sys ( klif+723b6 ) Followup: MachineOwner --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: a0cd4e8f, memory referenced Arg2: 00000002, IRQL Arg3: 00000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: 832a248a, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from 8337f848 Unable to read MiSystemVaType memory at 8335ee20 a0cd4e8f CURRENT_IRQL: 2 FAULTING_IP: nt!MiUnlinkPageFromLockedList+d8 832a248a 0fb6500f movzx edx,byte ptr [eax+0Fh] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: 884ada1c -- (.trap 0xffffffff884ada1c) ErrCode = 00000000 eax=ae6e2fe0 ebx=8ae2d368 ecx=00000002 edx=00010022 esi=ae6e2fe0 edi=8ae2d37c eip=832c9aca esp=884ada90 ebp=884ada90 iopl=0 nv up ei ng nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282 nt!RtlLengthSid+0x8: 832c9aca 0fb64001 movzx eax,byte ptr [eax+1] ds:0023:ae6e2fe1=?? Resetting default scope LAST_CONTROL_TRANSFER: from 832a248a to 83255cdb STACK_TEXT: 884ad814 832a248a badb0d00 833803f6 ffffffff nt!KiTrap0E+0x2cf 884ad8ac 832b911d 00000000 00000000 ae6e2fe1 nt!MiUnlinkPageFromLockedList+0xd8 884ad8fc 832a6480 00000000 ae6e2fe1 c0573710 nt!MiResolveTransitionFault+0x550 884ad980 832a3f0c ae6e2fe1 00000000 83380280 nt!MiDispatchFault+0x61f 884ada04 83255ae8 00000000 ae6e2fe1 00000000 nt!MmAccessFault+0x14d4 884ada04 832c9aca 00000000 ae6e2fe1 00000000 nt!KiTrap0E+0xdc 884ada90 857223b6 ae6e2fe0 859c3022 8571c062 nt!RtlLengthSid+0x8 WARNING: Stack unwind information not available. Following frames may be wrong. 884adab0 8599e5f4 8ae2d368 00000010 00000000 klif+0x723b6 884adacc 8599e7c0 8ae2d338 8ae2d338 884adaf0 fltmgr!DoFreeContext+0x66 884adadc 859af722 8ae2d338 8bad6300 00000000 fltmgr!DoReleaseContext+0x42 884adaf0 859afac8 a229bde0 a229bdd8 a3f86968 fltmgr!FltpDeleteContextList+0x15c 884adb08 859a4eac a3f86968 a229bdb0 884adb84 fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+0x1a 884adb18 8599dcd8 8b1c3828 a3f86968 a229bdb0 fltmgr!FltpCleanupStreamListCtrlForFileObjectCloseWithStreamListCtrl+0x10 884adb84 859a09f0 884adbd8 a9b52e00 a9b52fd8 fltmgr!FltpPerformPreCallbacks+0x53a 884adb9c 859a0f01 884adbd8 00000000 8b1c3d68 fltmgr!FltpPassThroughInternal+0x40 884adbc0 859a13ba 024adbd8 a9b52e00 8b1c3d68 fltmgr!FltpPassThrough+0x203 884adbf0 835476c3 8b1c3d68 a9b52e00 a9b52e00 fltmgr!FltpDispatch+0xb4 884adc14 8324bbe0 00000000 8b1c8024 8b1c3d68 nt!IovCallDriver+0x258 884adc28 83447aff 853ec110 a3f86950 00000000 nt!IofCallDriver+0x1b 884adc6c 834386f9 a3f86968 a3f86968 a3f86950 nt!IopDeleteFile+0x10c 884adc84 8328d4c0 00000000 000c0000 00000000 nt!ObpRemoveObjectRoutine+0x59 884adc98 8328d430 a3f86968 8343e0d9 a8bec0c0 nt!ObfDereferenceObjectWithTag+0x88 884adca0 8343e0d9 a8bec0c0 a8bec0e8 833819c0 nt!ObfDereferenceObject+0xd 884adccc 83276664 a8bec0c0 00000000 00000000 nt!MiSegmentDelete+0x191 884add28 83276985 853f3020 00000000 00000000 nt!MiProcessDereferenceList+0xdb 884add50 8341f07a 00000000 ada5fb68 00000000 nt!MiDereferenceSegmentThread+0xc5 884add90 832c5819 832768be 00000000 00000000 nt!PspSystemThreadStartup+0x9e 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19 STACK_COMMAND: kb FOLLOWUP_IP: klif+723b6 857223b6 ?? ??? SYMBOL_STACK_INDEX: 7 SYMBOL_NAME: klif+723b6 FOLLOWUP_NAME: MachineOwner MODULE_NAME: klif IMAGE_NAME: klif.sys DEBUG_FLR_IMAGE_TIMESTAMP: 5093b116 FAILURE_BUCKET_ID: 0xA_VRF_klif+723b6 BUCKET_ID: 0xA_VRF_klif+723b6 Followup: MachineOwner ---------Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {28, 2, 1, 832e348e} Probably caused by : memory_corruption ( nt!MiIdentifyPfn+1ed ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 00000028, memory referenced Arg2: 00000002, IRQL Arg3: 00000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: 832e348e, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from 833ab848 Unable to read MiSystemVaType memory at 8338ae20 00000028 CURRENT_IRQL: 2 FAULTING_IP: nt!MiIdentifyPfn+1ed 832e348e f00fba281f lock bts dword ptr [eax],1Fh CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0xA PROCESS_NAME: svchost.exe TRAP_FRAME: a12ec6f4 -- (.trap 0xffffffffa12ec6f4) ErrCode = 00000002 eax=00000028 ebx=9599e420 ecx=00000000 edx=080225e6 esi=8336cd20 edi=00000000 eip=832e348e esp=a12ec768 ebp=a12ec7a0 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt!MiIdentifyPfn+0x1ed: 832e348e f00fba281f lock bts dword ptr [eax],1Fh ds:0023:00000028=???????? Resetting default scope LAST_CONTROL_TRANSFER: from 832e348e to 83281cdb STACK_TEXT: a12ec6f4 832e348e badb0d00 080225e6 00000002 nt!KiTrap0E+0x2cf a12ec7a0 83272bfc 9599e420 9599e000 a12ec844 nt!MiIdentifyPfn+0x1ed a12ec7c8 834c214f 0099e060 84f78cbc a12ec858 nt!MmQueryPfnList+0xa6 a12ec810 83477a85 00000001 84f78c3c 00000000 nt!PfpPfnPrioRequest+0xde a12ec890 83463767 00000000 00000001 a12eccd0 nt!PfQuerySuperfetchInformation+0xea a12ecd00 83472ed4 0000004f 00000000 00000000 nt!ExpQuerySystemInformation+0x2477 a12ecd1c 8327e8fa 0000004f 00b4eeb0 00000014 nt!NtQuerySystemInformation+0x76 a12ecd1c 77167094 0000004f 00b4eeb0 00000014 nt!KiFastCallEntry+0x12a WARNING: Frame IP not in any known module. Following frames may be wrong. 00b4cd70 00000000 00000000 00000000 00000000 0x77167094 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiIdentifyPfn+1ed 832e348e f00fba281f lock bts dword ptr [eax],1Fh SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiIdentifyPfn+1ed FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 503f7f43 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: 0xA_VRF_nt!MiIdentifyPfn+1ed BUCKET_ID: 0xA_VRF_nt!MiIdentifyPfn+1ed Followup: MachineOwner ---------2 of the dumps are blaming memory management so i think we need to run some tests on RAMCode:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {411, c04bb558, 204f68c2, c14bb559} Probably caused by : memory_corruption ( nt!MiLockTransitionLeafPage+115 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 00000411, The subtype of the bugcheck. Arg2: c04bb558 Arg3: 204f68c2 Arg4: c14bb559 Debugging Details: ------------------ BUGCHECK_STR: 0x1a_411 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: CCC.exe CURRENT_IRQL: 2 TRAP_FRAME: a3ca0874 -- (.trap 0xffffffffa3ca0874) ErrCode = 00000002 eax=976abea8 ebx=83379da0 ecx=a6270cc8 edx=00000000 esi=a1dbbd48 edi=83379dc0 eip=834964d1 esp=a3ca08e8 ebp=a3ca0908 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt!CmpAllocateKeyControlBlock+0x152: 834964d1 897804 mov dword ptr [eax+4],edi ds:0023:976abeac=???????? Resetting default scope LAST_CONTROL_TRANSFER: from 832bacca to 832efe98 STACK_TEXT: a3ca06c4 832bacca 0000001a 00000411 c04bb558 nt!KeBugCheckEx+0x1e a3ca0704 832b4bec a3ca076c 00000000 976abeac nt!MiLockTransitionLeafPage+0x115 a3ca0754 832a2480 00000001 976abeac c04bb558 nt!MiResolveTransitionFault+0x20 a3ca07d8 8329ff0c 976abeac 00000000 8337c280 nt!MiDispatchFault+0x61f a3ca085c 83251ae8 00000001 976abeac 00000000 nt!MmAccessFault+0x14d4 a3ca085c 834964d1 00000001 976abeac 00000000 nt!KiTrap0E+0xdc a3ca0908 834966da a3ca0a00 a3ca0a04 a3ca0c54 nt!CmpAllocateKeyControlBlock+0x152 a3ca0938 8343c34e 972de9c8 00052788 87c8bb48 nt!CmpCreateKeyControlBlock+0xbe a3ca0980 83440c60 972de9c8 00052788 9734778c nt!CmpDoOpen+0x469 a3ca0b48 83437c4e a41637e8 853f77f0 a5284008 nt!CmpParseKey+0xd88 a3ca0bc4 83448060 00000048 a3ca0c18 00000040 nt!ObpLookupObjectName+0x4fa a3ca0c20 83445f91 0846e88c 853f77f0 00000001 nt!ObOpenObjectByName+0x165 a3ca0d00 83422c11 0846e970 0002001f 0846e88c nt!CmOpenKey+0x1f4 a3ca0d1c 8324e8fa 0846e970 0002001f 0846e88c nt!NtOpenKeyEx+0x18 a3ca0d1c 76e87094 0846e970 0002001f 0846e88c nt!KiFastCallEntry+0x12a WARNING: Frame IP not in any known module. Following frames may be wrong. 0846e8cc 00000000 00000000 00000000 00000000 0x76e87094 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiLockTransitionLeafPage+115 832bacca cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiLockTransitionLeafPage+115 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 503f7f43 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: 0x1a_411_VRF_nt!MiLockTransitionLeafPage+115 BUCKET_ID: 0x1a_411_VRF_nt!MiLockTransitionLeafPage+115 Followup: MachineOwner ---------
RAM - Test with Memtest86+
other blames driver klif.sys which is part of kaspersky AV could try uninstalling and running with MS security essentials
Is it possible to remove the RAM from one slot and insert it into another slot?
Did you run memtest, if so how many passes
Yes you can remove RAM i assume your asking because it has failed if so remove bad stick and then test again if pass then move good stick to other slot and test again, then bad stick in good slot and test again etc etc
If RAM checks out ok then i would run Hard Drive Diagnostic Procedure
If hardware checks out then would move on to stress tests and then drivers
Hi. Sorry for the late. I did 8 passes and no errors were found.
Hi mate sorry should have posted this with RAM check originally but memory problems (if thats what it is) can originate from RAM, HDD or GFX memory so recommend some more hardware tests
Hard Drive Diagnostic Procedure
Hardware - Stress Test With Prime95
Video Card - Stress Test with Furmark
see how you get on with these are you noticing any pattern with when the BSODs are occuring ?
Seeing as safemode works it may not be hardware but first is to prove its all good, also a clean boot may assist you getting to normal desktop, check this out
Troubleshoot Application Conflicts by Performing a Clean Startup