Recent Spate of Random BSODs - Error Code 0x0000004a in ntoskrnl.exe

ZaphodB · 04 Oct 2015

7 year-old Sony Vaio VGN-FW21L runnung Windows 7HP (64-bit) SP1

Has 4Gb RAM and 720Gb WD Black HDD (7500BPKT)

Everything has been running smoothly until the last few weeks - basically since 4th Sept this year when I have been getting random BSODs (10 in total since then).

I'm not doing anything processor/memory intensive (like playing games) and i have returned to the PC on several occasions to find the message that the computer has recovered from an unexpected shutdown.

Looking at the minidump logs - they are all IRQL_GT-Zero errors (error codes are all 0x0000004a in ntoskrnl.exe and, with the exception of two earlier BSODs (on 31/May/15 and 05/Aug/15) they all have the same crash address: ntoskrnl.exe+735c0.

Am I looking at a likely RAM problem here?

I thought at first it might be a HDD/pagefile issue.

The laptop vents and fan was cleaned of lint around a year ago when I replaced the power button and the CPU was re-seated and fresh thermal compound applied.

I have a system monitor which is reporting that currently the CPU is running at 48C and the HDD at 40C

Any help/suggestions gratefully appreciated.

Zaph

of-fat-hcouk

**axe0** · 04 Oct 2015

Hi ZaphodB,

Please read BSOD Posting Instructions & How to upload files

ZaphodB · 04 Oct 2015

Here's the output from MGADiag

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-6D6JF
Windows Product Key Hash: t75AQ0eHtc2OWuP13W6S2DcQoc0=
Windows Product ID: 00359-112-4327363-85305
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {044D0D5B-B4F4-4BF8-B609-7797D6104F16}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150722-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{044D0D5B-B4F4-4BF8-B609-7797D6104F16}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6D6JF</PKey><PID>00359-112-4327363-85305</PID><PIDType>5</PIDType><SID>S-1-5-21-3773029520-1852062022-1504755954</SID><SYSTEM><Manufacturer>Sony Corporation</Manufacturer><Model>VGN-FW21L</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>R1100Y0</Version><SMBIOSVersion major="2" minor="4"/><Date>20090827000000.000000+000</Date></BIOS><HWID>87BA3C07018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>Sony</OEMID><OEMTableID>VAIO</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>7480B9502DF0D86</Val><Hash>oYWOW5ayFE3pZ+jvTpuXYsY64JE=</Hash><Pid>89388-707-8722531-65282</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00170-112-432736-00-2057-7601.0000-2712013
Installation ID: 004880105951478731767374809116448156133671470891928172
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 6D6JF
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 04/10/2015 16:19:38

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:19:2015 13:51
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NAAAAAEAAwABAAEAAAACAAAAAwABAAEA6GHEtg5O4l2ArHp/oPc2gPwcGj+ZA5rZuI8qhQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            Sony        VAIO
  FACP            Sony        VAIO
  HPET            Sony        VAIO
  MCFG            Sony        VAIO
  SLIC            Sony        VAIO
  SSDT            Sony        VAIO

I've also attached the machine.zip file.

Is this likely to be a RAM issue or HDD or CPU or cooling?

Hope this helps,

Thanks in anticipation, Zaph

**axe0** · 04 Oct 2015

The only thing I can find that is consistent

Code:

fffff880`07d4b458  fffff880`017563aa NETIO!StreamPermitData+0x13a
fffff880`07d4b488  fffff880`01743d00 NETIO!AttachQoSProvider+0xe0

The Network Input/Output System which usually point to the network drivers

Looking at the date of the drivers, they might need to be updated.
Please check your manufacturer for driver updates.
If there are no driver updates available, or updating them doesn't help, please enable driver verifier.

Code:

0: kd> lmvm yk62x64
start             end                 module name
fffff880`04f54000 fffff880`04fb7000   yk62x64    (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\yk62x64.sys
    Image name: yk62x64.sys
    Timestamp:        Mon Feb 23 16:02:27 2009 (49A2BA83)
    CheckSum:         0006049B
    ImageSize:        00063000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm netw5v64
start             end                 module name
fffff880`04a19000 fffff880`04f54000   netw5v64   (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\netw5v64.sys
    Image name: netw5v64.sys
    Timestamp:        Thu Mar 26 17:21:24 2009 (49CBAB84)
    CheckSum:         00533DE3
    ImageSize:        0053B000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Diagnostic Test

DRIVER VERIFIER

Warning

Please make a backup of your important files and get your rescue media or create one.
Please create a restore point.

Please follow this tutorial to run driver verifier.

Driver verifier stresses your drivers and will crash your pc if any driver fails due to a violation.

Driver verifier should be performed for a max of 48 hours, or when you have a bluescreen, whatever comes first.

If driver verifier has found a violation and you can't get back into windows normally, try to boot into safe mode and reset in safe mode driver verifier, or in the troubleshooting options open command prompt and type verifier /reset.

Note

Your system will act very sluggishly while driver verifier is enabled, this is normal as your drivers will be being subjected to heavy testing in order to make them crash.

ZaphodB · 04 Oct 2015

Ok - I'll look at that. In the meantime, I've downloaded Memtest86+ ver 5.01 from Memtest86+ - Advanced Memory Diagnostic Tool and will also run that to see if it is a memory problem.

Thanks for your help so far.

Will report back later...(possibly MUCH later

)

Zaph

**axe0** · 04 Oct 2015

ZaphodB said:

Ok - I'll look at that. In the meantime, I've downloaded Memtest86+ ver 5.01 from Memtest86+ - Advanced Memory Diagnostic Tool and will also run that to see if it is a memory problem.

Thanks for your help so far.

Will report back later...(possibly MUCH later

)

Zaph

You'll have to run MemTest86+ for at least 8 passes, less isn't worth it as the results are not conclusive

Diagnostic Test

RAM TEST

Run MemTest86+ to analyse your RAM. MemTest86+ - Test RAM - Windows 7 Forums

Note

MemTest86+ needs to be run for at least 8 passes for conclusive results. Set it running before you go to bed and leave it overnight. We're looking for zero errors here. Even a single error will indicate RAM failure.

**axe0** · 04 Oct 2015

Hi ZaphodB,

I have digged through the internet about this error, because I want to know more about it, and I came across a few sites where users are having problems similar to yours.

There is only 1 thing common with the crashes, the process name
It appears to be Bitdefender's main active protection process.
Although I always thought it was a process from Windows.

As a test please uninstall Bitdefender using the uninstall tool you can find here and use Microsoft Security Essentials as alternative

Code:

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 0000000076f2da2a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff8800796eca0, 0

Debugging Details:
------------------


PROCESS_NAME:  vsserv.exe

BUGCHECK_STR:  RAISED_IRQL_FAULT

FAULTING_IP: 
+b018a70000
00000000`76f2da2a ??              ???

CUSTOMER_CRASH_COUNT:  1

ZaphodB · 04 Oct 2015

Thanks axe.

Currently running MemTest86+ Test has been going for over two hours now and hasn't found anything yet but I know it is early days. Will leave it running 'till the test ends and then report back.

Interesting find on the BitDefender scene. I've d/loaded the removal tool for my specific product on another PC and that's ready to go when the RAM test ends.

BitDefender is also causing a problem on a different machine. When that PC boots up, the firewall is ON (enabled) and I can't print to any of my WiFi printers. This is despite turning it off in the last session. If I then turn the firewall off, I can then print to all of my WiFi printers. On a different PC running BitDefender, the firewall is ON and I can print to any of the WiFi printers. Both PCs are running Win 7 Home Premium SP1 64-bit. Strange eh?

Will post updates to this thread as and when I have any.

Kind regards

Zaph

**axe0** · 04 Oct 2015

I had the same thing at my internship.
It was due to a setting in the adapters, the stealth-modus was set to remote and had to change it to off.