Random BSOD, not sure where to start

barrish · 14 Mar 2014

Hi folks. I have a custom build PC running Windows 7 Ultimate 64. I'm not sure how much of the backstory will be relevant for troubleshooting, but I'll provide as much as I know. Feel free to jump right to my minidump zip if you don't need any more details...

During the last week, I've had some issues with a BSOD. The first time it happened, my machine would take several minutes to boot up to Windows, and then Windows was mostly not functional. Windows Update, Google Chrome, and Norton 360 all just did not work. Clicking to open the application either did nothing, or would give me an error saying that Windows Explorer had stopped working and was restarting. Finally, I ended up giving up and reinstalling Windows.

While updating my new Windows install, it happened again, only this time, I couldn't get Windows to load at all. After getting to the Windows Loading screen, I would get a Window telling me Windows could not be started and it tried to automatically troubleshoot, but would find nothing. I don't remember the details at this point, but I'm sure somebody out there knows the screen I'm talking about.

So I ended up installing Windows again. This time everything seemed fine for a few days, until just a few minutes ago when I got a blue screen again. This time though, Windows was good enough to let me back in and give me access to the minidump files. I'm no expert at troubleshooting, so I'm hoping there's a tech wizard out there who can help me out.

Here are the details:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: 1e
BCP1: 0000000000000000
BCP2: 0000000000000000
BCP3: 0000000000000000
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\031414-14913-01.dmp
C:\Users\Chris\AppData\Local\Temp\WER-18829-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

...and I have attached the .zip

Arc · 14 Mar 2014

Hi barrish.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
____________________________________________________________

Code:

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
--------------------------------------------------------------
BugCheck 24, {1904fb, fffff88003508178, fffff880035079d0, fffff80002aa00af}

Probably caused by : ntkrnlmp.exe ( nt!ExTryAcquireSpinLockExclusiveAtDpcLevel+2f )

Followup: MachineOwner
---------

barrish · 19 Mar 2014

Thanks for the help so far. I did the memory test. It took almost 36 hours to complete 8 full passes, but it completed without an error. Next I did tried the verifier. A few minutes ago I was listening to some music and moving some files around and I got a BSOD. I couldn't catch any details from the blue screen, but I do know that when it rebooted, it gave me another BSOD and rebooted before Windows ever came up. After a few rounds of that, I booted in safe mode, turned off the verifier, and rebooted in normal mode and used the DM Log Collector to get my last 3 minidumps. They are attached.

Any idea what's causing my problem?

Arc · 20 Mar 2014

The first of the three driver enabled BSOD points to a multifold issue.

It blames the Symantec Real Time Storage Protection which you have very recently installed/updated.

Code:

Unable to load image \SystemRoot\system32\drivers\N360x64\1501010.007\SRTSP64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SRTSP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS
Win32 Start Address SRTSP64 (0xfffff88008bb2e90)

Uninstall Norton360 and all Symentec products using Norton Removal tool.

It also expressed the very old display driver a prima facie cause.

Code:

BugCheck 1E, {0, 0, 0, 0}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys

Probably caused by : atikmdag.sys ( atikmdag+5d74a )

Followup: MachineOwner
---------

It seems to be no updated over almost 3 years.

Code:

fffff880`056af000 fffff880`05fe3000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Wed Apr 20 07:23:29 2011 (4DAE3C99)
    CheckSum:         008E91DD
    ImageSize:        00934000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall your installed latest version of the display driver.

How-To Uninstall AMD Catalyst Drivers From A Windows Based System

Then clean up any possible leftover.

Drivers - Clean Left over Files after Uninstalling

Then install version 13.9 WHQL only.

Previous AMD Catalyst? Display Drivers

But, the rest of the dumps are not providing any more helpful information.

So, apply these changes and let us know how the computer is running.

barrish · 22 Mar 2014

Ok, so I updated my video driver. I haven't messed with Norton yet because I've had tons of issues with doing that in the past. I'm willing to do it if the BSOD continues to point to Norton. I did have another blue screen yesterday while trying to simultaneously unzip a large download, and install another program. So here is another log to look at. Obviously the 3/21 is the one in question.

Arc · 22 Mar 2014

fffff880`08d99e58 fffff880`0498dc09Unable to load image \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\BASHDefs\20140214.001\BHDrvx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for BHDrvx64.sys
*** ERROR: Module load completed but symbols could not be loaded for BHDrvx64.sys
BHDrvx64+0x10ec09

You cannot expect a solution to your BSODs with the crasher present in your system.

Rest is on you.