Windows has recovered from an unexpected shutdown

Toshiba Satellite
Win_7 Home Premium x32
- external HD as data storage via a mains powered hub

When I awaken the laptop from "Sleep" sometimes a blue screen appears with DOS style message...
"Windows has experienced ... Windows Explorer" ??
... within about 4 seconds the blue-alert is gone and Windows continues to boot (not enough time to read the screen)

When Desktop opens another dialog shows
"Windows has recovered from an unexpected shutdown"
... with a button to "Check for Solutions" ... in the past when I click this button I wait for <2 minutes and then the dialog disappears, and everything is sweet after that.

Today the same again..
Cold boot > laptop goes to sleep in its allotted time without me using the laptop > tap space bar > "Windows Explorer has encountered a problem and must close"
All this without me using the laptop other than to start the laptop.

Copied this from the Windows has recovered from an unexpected shutdown" text box ...

   Note

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 3081

Additional information about the problem:
BCCode: 7f
BCP1: 00000000
BCP2: 00000000
BCP3: 00000000
BCP4: 00000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\102213-13416-01.dmp
C:\Users\Owner\AppData\Local\Temp\WER-56300-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\windows\system32\en-US\erofflps.txt

I cannot open the mini-dump file "Access Denied"
I have started to read How to Run Disk Check in Windows 7 but I dont think I am experiencing BSOD outright.

Would appreciate any help

That BCCode turned up quite a few listing on a search on this forum,
Windows 7 Forums is the largest help and support community, providing friendly help and advice for Microsoft Windows 7 Computers such as Dell, HP, Acer, Asus or a custom build. - Search Results for BCCode: 7f

Thank you ThrashZone for your response, :)

Another Windows has recovered from an unexpected shutdown today

Today's error:
• BCCode: 4a
• BCP1: 901CCC80
• BCP2: 00000002

Previous error:
• BCCode: 7f
• BCP1:00000000
• BCP2: 00000000
-----
I followed your advice to investigate Search Results for BCCode: 7f:

The first 5 results (excluding advertisements) are dead ends. In fact most of the result-threads are dead ends.
Google result #6 "www.sevenforums.com/bsod-help-support/100222-bccode-7f.html" post#2 leads to Using Driver Verifier to identify issues with Drivers which advocates 36 hour non-stop stress test. And warnings of unexpected BSODs.
I do not have access to any other web PCs, only this sick (off colour) Toshiba laptop.

I now suspect my/this thread should have been on BSOD Help and Support forum ... AND having read BSOD - Posting Instructions...I am rather sure of it.

Would it be appropriate to start a new thread in BSOD Help and Support forum and insert a link from this thread to the new BSOD Help and Support forum thread ?

Thank you :)

Hello :),
Please follow the Blue Screen of Death (BSOD) Posting Instructions .

Two BSODs in 3 days

Event #1 (3 days ago)
- cold boot -- beginning of day
- laptop went to sleep (normal behavior)
- woke laptop with space bar
- Windows Explorer has encountered a problem and must close (msgbox)
- rebooted (for safety)
- desktop (OK)
- showed Windows has recovered from an unexpected shutdown (dialog)
- "Check for Solutions" (button) .. windows searched for a solution
- dialog self closed
- Windows opened OK

   Note

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 3081

Additional information about the problem:
BCCode: 7f
BCP1: 00000000
BCP2: 00000000
BCP3: 00000000
BCP4: 00000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\102213-13416-01.dmp
C:\Users\Owner\AppData\Local\Temp\WER-56300-0.sysdata.xml

Event #2 (today)
- opened Bitdefender Safepay.
- Safepay opened for about one second
- showed a BSOD with a long (DOS like) message, auto closed in about 2 seconds (too quick to read)
- rebooted
- desktop setting reverted to a black screen (custom is blue) all desktop icons in tact.
- showed Windows has recovered from an unexpected shutdown dialog.
- copied error text to text reader and saved.
- dismissed Windows has recovered from an unexpected shutdown (dialog)
- desktop colour still black
- rebooted
- Windows opened OK

   Note

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 3081

Additional information about the problem:
BCCode: 4a
BCP1: 901CCC80
BCP2: 00000002
BCP3: 00000000
BCP4: 00000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\102513-48672-01.dmp
C:\Users\Owner\AppData\Local\Temp\WER-70543-0.sysdata.xml

ZIPPED ATTACHMENT:
Attachment 291085

I would appreciate any support. (This is my first bluescreen experience ... help!!)
Thank you :)
-----
Toshiba Satellite C665
Win-7 Home Premium x32 (factory installed)

Thanks :) .

Your laptop actually experienced five bugchecks where four of which are due to an old GPU driver (0x7F)
or possibly overheating (since it's a laptop it's more prone to dust accumulation), the odd one of the bunch
is a one when you used Bitdefender (0x4A).

Code:

BugCheck 7F, {0, 0, 0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+4d2236 )

Code:

00 9192ea68 88f3c868 nvlddmkm+0x4d2236
01 9192eb64 9261f966 0x88f3c868
02 9192ebfc 926ebeea nvlddmkm+0x409966
03 9192ec60 925136ef nvlddmkm+0x4d5eea
04 9192ec80 9251e653 nvlddmkm+0x2fd6ef
05 9192ec9c 9251e715 nvlddmkm+0x308653
06 9192ecac 923c7d49 nvlddmkm+0x308715
07 9192ecc8 923c6fb5 nvlddmkm+0x1b1d49
08 9192ecf8 923c745c nvlddmkm+0x1b0fb5
09 9192ed44 923c749a nvlddmkm+0x1b145c
0a 9192ed68 923722a6 nvlddmkm+0x1b149a
0b 9192edf8 922f6553 nvlddmkm+0x15c2a6
0c 9192ee14 922f78fa nvlddmkm+0xe0553
0d 9192ee4c 92299270 nvlddmkm+0xe18fa
0e 9192eea0 922a3d7e nvlddmkm+0x83270
0f 9192efc0 923309c4 nvlddmkm+0x8dd7e
10 9192f020 923339af nvlddmkm+0x11a9c4
11 9192f038 923362e5 nvlddmkm+0x11d9af
12 9192f174 92328a29 nvlddmkm+0x1202e5
13 9192f30c 927f15b7 nvlddmkm+0x112a29
14 9192f324 927f39b7 nvlddmkm+0x5db5b7
15 9192f514 92c975ff nvlddmkm+0x5dd9b7
16 9192f53c 92c9832d dxgkrnl!DXGADAPTER::DdiCommitVidPn+0x49
17 9192f5e0 92ca6dd7 dxgkrnl!DmmCommitVidPn+0x64e
18 9192f93c 92c7b446 dxgkrnl!VIDPN_MGR::RestorePresentPathToActiveVidPn+0x55f
19 9192f984 92c7b678 dxgkrnl!VIDPN_MGR::_MonitorEventHandler+0x2e7
1a 9192f9b8 92ca82b6 dxgkrnl!MONITOR_MGR::_IssueMonitorEvent+0xa4
1b 9192f9b8 00000000 dxgkrnl!MONITOR_MGR::_EnableDisableMonitor+0x24f

The "last" (which are actually the first as stacks grow from the bottom) entries
on the stack is inline with what you described about the PC changing power states
the bugcheck most probably occurred when the PC was transitioning from S3 to S0
(or sleep > normal operating mode).

Using the lmvm command we get more info about the driver, most importantly
the digital signature time stamp.

Code:

lmvm nvlddmkm
start    end        module name
92216000 92c267c0   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        Tue Mar 01 19:44:02 2011

• Driver Reference Table - nvlddmkm.sys

The driver is very old!
Please follow this detailed quote and update the driver.

Arc said:

Install the 314.22 WHQL only.

• Uninstall All nvidia items in Control Panel > Programs and features
  
  • 3D Vision Control Driver
  • 3D Vision Driver
  • Graphics Driver
  • HD Audio Driver
  • PhysX
  • nvidia Update
  
  (Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
• Now follow Drivers - Clean Left over Files after Uninstalling
• Boot normally now. Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:
  
  

---

The other bugcheck as I mentioned before was due to Bitdefender, I can't tell you what happened
because the stack is lacking, to say the least.
But the bugcheck code gives us hints as to what generally happened.

Code:

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 901ccc80, Address of system function (system call routine)
Arg2: 00000002, Current IRQL
Arg3: 00000000, 0
Arg4: 00000000, 0

Code:

9c23bc08  ????????
9c23bc0c  ????????
9c23bc10  ????????
9c23bc14  ????????
9c23bc18  0000004a
9c23bc1c  901ccc80 bdselfpr+0x8c80
9c23bc20  00000002
9c23bc24  00000000
9c23bc28  00000000
9c23bc2c  9c23bc34
9c23bc30  00000002

Please remove Bitdefender.

• Uninstall Bitdefender
• How to uninstall Bitdefender

I suggest you use Microsoft Security Essentials as an alternative.
Keep us posted :) .

Thank you YoYo155 for your feedback :)
Just opened your post at 23:20 hrs. Very late for me.
I wanted to make this quick response and thank you for your prompt and thorough feedback
I am so grateful.

At a glance and maybe I am getting ahead of my self the only NVIDIA items at CP > Programs and features are ...
Attachment 291102

Regards :)

GrayGhost2 said:

Thank you YoYo155 for your feedback :)
Just opened your post at 23:20 hrs. Very late for me.
I wanted to make this quick response and thank you for your prompt and thorough feedback
I am so grateful.

At a glance and maybe I am getting ahead of my self the only NVIDIA items at CP > Programs and features are ...
Attachment 291102

Regards :)

My pleasure :) .
It's OK follow the quoted on the three of them, the quote was originally targeted at a desktop
graphics card so some functionality may be missing on a mobile variant but the principles are the same.

x BlueRobot said:

YoYo, all User-Mode programs run at IRQL level 0 or Passive Level, the Bitdefender driver has returned to User-Mode while the IRQL Level was at level 2 or Dispatch Level.

That explains it!
Thanks .