Windows 7: BSODs at random BCCode: 1e Windows 7 x64

kerberotte · 25 Nov 2013

I keep getting Blue screens at random times when Im on the internet and sometimes it also bluescreens several times while the computer restarts. This is the most recent error message that ive gotten from the last blue screen:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC000001D
BCP2: FFFFFA800CC92083
BCP3: 0000000000000002
BCP4: 0000000000000200
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\112513-21387-01.dmp
C:\Windows\Temp\WER-26660-0.sysdata.xml

CPU - Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Motherboard - ASRock Z77 Pro4-M
BIOS Date: 07/11/13 20:21:30 Ver: 04.06.05
GPU - (1) Intel(R) HD Graphics 4000 (2) AMD Radeon HD 7850
RAM - Gskill 8GB Part Number F3-12800CL10-8GBXL
HDD - WDC WD5000AAKX-00U6AA0 (500GB)

I have also uploaded the Diagnostic Tool results. Thank you for your help.

koolkat77 · 25 Nov 2013

Welcome to the Forum.

Please remove Norton Internet Security for the time being and use MSE.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Make scans with the following:

Kaspersky TDSSKiller

Anti-rootkit utility TDSSKiller

ESET online scanner

Free Online Virus Scanner | ESET

Disk Check on your hard disk for file system errors and bad sectors on it:

Disk Check

Please remove the software below with revo:

Code:

AsrAppCharger.sys Tue May 10 14:28:46 2011

ASRock App Charger Likely BSOD cause
Driver Reference Table - AsrAppCharger.sys

Revo Uninstaller "Free"Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling. This allows you to remove leftover registry entries of the software.

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Update this driver:

FNETURPX.SYS Sat Oct 4 08:27:02 2008 (48E6D476)
FNet Turbo HDD USB Driver - Also part of AsRock XFastUSB package
Driver Reference Table - FNETURPX.SYS

To perform a clean install of a driver, follow this tutorial:

How to Clean Left Over Driver Files with Driver Sweeper

Check for heating issues using Speccy or HWmonitor

Upload a screen shot: Screenshots and Files - Upload and Post in Seven Forums
Bugcheck:

Code:

BugCheck 1E, {ffffffffc000001d, fffffa800cc92083, 2, 200}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+487ed )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck D1, {ffffd4004ce290b6, 2, 0, fffff88001c47456}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck D1, {0, 2, 1, fffff88001c9b1b3}
Probably caused by : ndis.sys ( ndis!ndisAcquireReadWriteLockX+103 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 1A, {41284, 23686001, 146ba, fffff70001080000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ad3 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 109, {a3a039d8a2de28d9, b3b7465ef55af83f, fffff80003100810, 1}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 24, {1904fb, fffff88003785578, fffff88003784dd0, fffff80002e61998}
Probably caused by : ntkrnlmp.exe ( nt!DeleteNodeFromTree+128 )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 109, {a3a039d8a27bdac2, b3b7465ef4f8aa28, fffff80002e98970, 1}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {fffff8800d3e60d8, 0, fffff80003166ea0, 2}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 24, {1904fb, fffff8800b3a5f08, fffff8800b3a5760, fffff88001878a2c}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 50, {fffff8800a944c68, 1, fffff80003144a30, 0}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 109, {a3a039d8a3e215a7, b3b7465ef65ff371, fffff88001ac88f0, 1}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 109, {a3a039d8a1a0353a, b3b7465ef41d0490, fffff80002e1141c, 1}
Probably caused by : memory_corruption
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
BugCheck 109, {a3a039d8a2b02609, b3b7465ef52e0393, fffff80003411000, 0}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

kerberotte · 26 Nov 2013

Ok I got rid of Norton, did the all the scans and they didnt find anything, got rid of ASRock App Charger revo using Revo, updated FNet Turbo HDD USB Driver by getting it from the asrock site and used Display Driver Uninstaller to sweep up the left over driver files.

It seemed to be what my computer needed as it worked fine all day yesterday but today it Bluescreen again. This the error message:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: 24
BCP1: 00000000001904FB
BCP2: FFFFF8800279EC08
BCP3: FFFFF8800279E460
BCP4: FFFFF800030D4AC5
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\112613-20046-01.dmp
C:\Users\Mack\AppData\Local\Temp\WER-31621-0.sysdata.xml

I uploaded the Diagnostic Tool from today. Thanks again

koolkat77 · 26 Nov 2013

Post screenshot(s) of your Hard Drive(s) using Crystal Disk Info Software:

Run a Hard Drive test:

Hard Drive Diagnostic Procedure

kerberotte · 27 Nov 2013

CrystalDiskInfo screenshot
Attachment 295207

Diagnostics Test
Attachment 295208

koolkat77 · 27 Nov 2013

Okay have you performed a clean boot?

Troubleshoot Application Conflicts by Performing a Clean Startup

kerberotte · 29 Nov 2013

Sorry for the late response.

Ive done a clean reboot as of right now.

koolkat77 · 30 Nov 2013

Okay..monitor for further bsods.

kerberotte · 30 Nov 2013

Well I had another one. Im thinking its probably something to do with the memory hardware at this point.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: 50
BCP1: FFFFDB47FC7F862C
BCP2: 0000000000000001
BCP3: FFFFF800030DCA24
BCP4: 0000000000000007
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\113013-15537-01.dmp
C:\Users\Mack\AppData\Local\Temp\WER-42479-0.sysdata.xml

koolkat77 · 30 Nov 2013

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffdb47fc7f862c, 1, fffff800030dca24, 7}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffdb47fc7f862c, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800030dca24, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fa100
GetUlongFromAddress: unable to read from fffff800032fa1c0
 ffffdb47fc7f862c Nonpaged pool

FAULTING_IP: 
nt!SepMandatoryIntegrityCheck+14
fffff800`030dca24 4889442038      mov     qword ptr [rax+38h],rax

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x50

PROCESS_NAME:  driverscanner.

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008f2e260 -- (.trap 0xfffff88008f2e260)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffdb47fc7f85f4 rbx=0000000000000000 rcx=fffff800033b6b50
rdx=fffff8a00021898c rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030dca24 rsp=fffff88008f2e3f0 rbp=0000000000000001
 r8=fffffa8007326b00  r9=fffff8a0019eb430 r10=fffff88007ab6728
r11=fffff88008f2e458 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!SepMandatoryIntegrityCheck+0x14:
fffff800`030dca24 4889442038      mov     qword ptr [rax+38h],rax ds:ffffdb47`fc7f862c=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000313f53b to fffff800030c2bc0

STACK_TEXT:  
fffff880`08f2e0f8 fffff800`0313f53b : 00000000`00000050 ffffdb47`fc7f862c 00000000`00000001 fffff880`08f2e260 : nt!KeBugCheckEx
fffff880`08f2e100 fffff800`030c0cee : 00000000`00000001 ffffdb47`fc7f862c 00000000`00000000 00000000`00100000 : nt! ?? ::FNODOBFM::`string'+0x43781
fffff880`08f2e260 fffff800`030dca24 : fffff8a0`019eb430 00000000`00000000 00000000`00000000 ffffdb47`00000008 : nt!KiPageFault+0x16e
fffff880`08f2e3f0 fffff800`030d473b : 00000000`00000000 00000000`00000001 fffff8a0`019eb430 00000000`00000000 : nt!SepMandatoryIntegrityCheck+0x14
fffff880`08f2e460 fffff880`016b0a13 : fffffa80`09e2d180 fffff8a0`0021898c 00000000`00000000 00000000`00000000 : nt!SeAccessCheckWithHint+0x3fb
fffff880`08f2e560 fffff880`016abf97 : fffffa80`07326b10 00000000`00000000 fffff8a0`0021ea90 00000000`00100000 : Ntfs!TxfAccessCheck+0x123
fffff880`08f2e6d0 fffff880`01699b93 : fffffa80`0704fc60 fffff880`07ab6390 fffff8a0`0021ea90 00000000`00000000 : Ntfs!NtfsAccessCheck+0x1b7
fffff880`08f2e8b0 fffff880`01699de3 : fffff880`07ab6390 fffff8a0`0021ea90 00000000`00000002 fffff8a0`0021ee01 : Ntfs!NtfsCheckExistingFile+0xc3
fffff880`08f2e940 fffff880`01695c6f : fffff880`07ab6390 00000000`c0000022 fffff880`07ab6390 00000000`00000000 : Ntfs!NtfsOpenExistingAttr+0x73
fffff880`08f2ea00 fffff880`01698f6f : fffffa80`0704fc60 fffffa80`071cfc10 fffff8a0`0021eed0 fffff880`00000000 : Ntfs!NtfsOpenAttributeInExistingFile+0x50f
fffff880`08f2eb90 fffff880`016a8f56 : fffffa80`0704fc60 fffffa80`071cfc10 fffff8a0`0021eed0 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`08f2ec80 fffff880`016a6701 : fffffa80`0704fc60 fffffa80`071cfc10 fffff880`08f2ee50 fffff880`08f2eea0 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`08f2ed50 fffff880`0161040d : fffffa80`0704fc60 fffffa80`071cfc10 fffff880`07ab6390 fffffa80`0bf1e000 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`08f2ef30 fffff800`030ba6b7 : fffff880`07ab6300 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08f2ef60 fffff800`030ba678 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`07ab61d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff800030dca27 - nt!SepMandatoryIntegrityCheck+17
	[ 24:20 ]
1 error : !nt (fffff800030dca27)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Quote:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.