BSOD Different Ways, Photographer, Can't Work, Go Back to XP?

[josh99ta]

I'm a photographer and can't get any work done because Windows keeps crashing on the desktop my buddy built for me. It was rock solid on XP but after upgrading to Windows 7 I'm getting all kinds of crazy errors left and right. I get the BSOD from multiple different ways, most notably "IRQL not less or equal" and something about something paged in a non-paged area. It's only up for a brief second before it reboots. I'm about ready to jump ship to XP because I am two weeks behind because of this stupid computer and can't seem to get it working correctly. We've tried everything we know to try including several fresh installs of W7 to no avail, so I'm hoping the experts here can help me before I ditch 7 all together and have to reinstall an OS yet again and reload all my programs again. I'm so behind because of this it's not even funny.

Core 2 Duo 3.0GHz
Gigabyte 775 socket mobo
HIS ATi Radeon HD 4850 graphics
8GB DDR2 Corsair RAM (Dual 2GB paired RAM sticks)
Windows 7 Home Premium 64bit x86

First I had a nVidia 9600GT graphics card crap out on me, then I had a Asus mobo that apparently wasn't Windows 7 compatible and was causing all sorts of issues, so I got a Gigabyte mobo that was Windows 7 compatible, and it was fine for a few days, and now I get the BSOD anytime I'm doing anything intensive again. At first it was showing a RAM problem, made sure all RAM was fully seated, RAM problem went away according to the Windows diagnostics test, and I had smooth sailing for a day, now it's back to crashing every time I try to get any work done with the page on a non-paged error or the IRQL message. Windows Explorer keeps going down in between crashes too. What gives? Should I just jump ship back to XP? Is 7 really this unstable? I have Vista on my laptop and it's been dead reliable, but 7 so far has been a major pain.

My frustration level is at an all time high. This is my job as a wedding photographer and I have a responsibility to my clients to deliver their images in a timely manner. I need this to work or I'm going to have to go back to XP because right now this is all completely unacceptable. I'm working on a fresh install of W7 with only my photo editing programs added back in. I've tried this 3 times now and am still getting problems. I'm not very tech-savvy and this is driving me nuts. I'm at my wit's end. I've attached the SF Diagnostics Tool review and am going to go find memtest and run that as well. I really appreciate any help that I can possibly get. Going to run memtest now and will report back tomorrow with results. Hoping you guys see something easy that jumps out that I can fix and get back to work.

 

[zigzag3143]

I'm a photographer and can't get any work done because Windows keeps crashing on the desktop my buddy built for me. It was rock solid on XP but after upgrading to Windows 7 I'm getting all kinds of crazy errors left and right. I get the BSOD from multiple different ways, most notably "IRQL not less or equal" and something about something paged in a non-paged area. It's only up for a brief second before it reboots. I'm about ready to jump ship to XP because I am two weeks behind because of this stupid computer and can't seem to get it working correctly. We've tried everything we know to try including several fresh installs of W7 to no avail, so I'm hoping the experts here can help me before I ditch 7 all together and have to reinstall an OS yet again and reload all my programs again. I'm so behind because of this it's not even funny.

Core 2 Duo 3.0GHz
Gigabyte 775 socket mobo
HIS ATi Radeon HD 4850 graphics
8GB DDR2 Corsair RAM (Dual 2GB paired RAM sticks)
Windows 7 Home Premium 64bit x86

First I had a nVidia 9600GT graphics card crap out on me, then I had a Asus mobo that apparently wasn't Windows 7 compatible and was causing all sorts of issues, so I got a Gigabyte mobo that was Windows 7 compatible, and it was fine for a few days, and now I get the BSOD anytime I'm doing anything intensive again. At first it was showing a RAM problem, made sure all RAM was fully seated, RAM problem went away according to the Windows diagnostics test, and I had smooth sailing for a day, now it's back to crashing every time I try to get any work done with the page on a non-paged error or the IRQL message. Windows Explorer keeps going down in between crashes too. What gives? Should I just jump ship back to XP? Is 7 really this unstable? I have Vista on my laptop and it's been dead reliable, but 7 so far has been a major pain.

My frustration level is at an all time high. This is my job as a wedding photographer and I have a responsibility to my clients to deliver their images in a timely manner. I need this to work or I'm going to have to go back to XP because right now this is all completely unacceptable. I'm working on a fresh install of W7 with only my photo editing programs added back in. I've tried this 3 times now and am still getting problems. I'm not very tech-savvy and this is driving me nuts. I'm at my wit's end. I've attached the SF Diagnostics Tool review and am going to go find memtest and run that as well. I really appreciate any help that I can possibly get. Going to run memtest now and will report back tomorrow with results. Hoping you guys see something easy that jumps out that I can fix and get back to work.

Hi and welcome

I think we may have an answer. These were almost all caused by your IDSvia64.sys, which is part of your Norton Intrusion app. Norton is a known cause of BSOD's and these look classic.

Remove it to test using their un-install tool

I would also update the old drivers, and run a system file check to verify and repair system files

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

read here for more information http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Let us know the results from the report at the end.

Ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Seven Forums\090910-24772-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0284f000 PsLoadedModuleList = 0xfffff800`02a8ce50
Debug session time: Fri Sep 10 00:32:31.420 2010 (GMT-4)
System Uptime: 0 days 9:31:28.950
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc000001d, fffff80003c75d60, 0, 0}

Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20100908.001\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
Probably caused by : IDSvia64.sys ( IDSvia64+85e3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff80003c75d60, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'EX64' and 'ENG64.SYS' overlap

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
+5999952f039bd9d0
fffff800`03c75d60 886cc703        mov     byte ptr [rdi+rax*8+3],ch

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  lightroom.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff80003c76c88 -- (.exr 0xfffff80003c76c88)
ExceptionAddress: fffff880004c3ae0
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff80003c76d30 -- (.trap 0xfffff80003c76d30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800994a080 rbx=0000000000000000 rcx=fffffa800a088260
rdx=0000000000000014 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880004c3ae0 rsp=fffff80003c76ec8 rbp=0000000000000028
 r8=0000000000000000  r9=0000000000000000 r10=fffff88003b798f0
r11=00000000000000ff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
fffff880`004c3ae0 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002951b2b to fffff800028c0f00

FAILED_INSTRUCTION_ADDRESS: 
+5999952f039bd9d0
fffff800`03c75d60 886cc703        mov     byte ptr [rdi+rax*8+3],ch

STACK_TEXT:  
fffff800`03c75ca8 fffff800`02951b2b : 00000000`0000001e ffffffff`c000001d fffff800`03c75d60 00000000`00000000 : nt!KeBugCheckEx
fffff800`03c75cb0 fffff800`02914390 : 00000000`00000000 fffff800`03c75fc0 fffff800`03c75dd8 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff800`03c75cf0 fffff800`028ef4dc : fffffa80`08743954 fffff800`03c75fc0 fffff800`03c75fc0 fffff800`00000003 : nt! ?? ::FNODOBFM::`string'+0x95d
fffff800`03c75d30 fffff800`028e6bed : fffff800`02a07470 fffff800`03c78450 00000000`00000000 fffff800`0284f000 : nt!_C_specific_handler+0x8c
fffff800`03c75da0 fffff800`028ee250 : fffff800`02a07470 fffff800`03c75e18 fffff800`03c76c88 fffff800`0284f000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`03c75dd0 fffff800`028fb1b5 : fffff800`03c76c88 fffff800`03c764e0 fffff800`00000000 fffffa80`00000005 : nt!RtlDispatchException+0x410
fffff800`03c764b0 fffff800`028c0542 : fffff800`03c76c88 fffff800`03c76f70 fffff800`03c76d30 fffffa80`0a088260 : nt!KiDispatchException+0x135
fffff800`03c76b50 fffff800`028be69f : fffff800`03c76d30 00000000`00000002 00000000`00000000 fffff800`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`03c76d30 fffff880`004c3ae0 : fffff880`03b695e3 00000000`00000028 fffffa80`0a088260 fffffa80`07562910 : nt!KiInvalidOpcodeFault+0x11f
fffff800`03c76ec8 fffff880`03b695e3 : 00000000`00000028 fffffa80`0a088260 fffffa80`07562910 00000000`000001c0 : 0xfffff880`004c3ae0
fffff800`03c76ed0 00000000`00000028 : fffffa80`0a088260 fffffa80`07562910 00000000`000001c0 00000000`00000000 : IDSvia64+0x85e3
fffff800`03c76ed8 fffffa80`0a088260 : fffffa80`07562910 00000000`000001c0 00000000`00000000 0000001c`3dc3e500 : 0x28
fffff800`03c76ee0 fffffa80`07562910 : 00000000`000001c0 00000000`00000000 0000001c`3dc3e500 00000000`00000000 : 0xfffffa80`0a088260
fffff800`03c76ee8 00000000`000001c0 : 00000000`00000000 0000001c`3dc3e500 00000000`00000000 00000000`00000000 : 0xfffffa80`07562910
fffff800`03c76ef0 00000000`00000000 : 0000001c`3dc3e500 00000000`00000000 00000000`00000000 fffffa80`08fae590 : 0x1c0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
IDSvia64+85e3
fffff880`03b695e3 ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  IDSvia64+85e3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IDSvia64

IMAGE_NAME:  IDSvia64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bfe2836

FAILURE_BUCKET_ID:  X64_0x1E_BAD_IP_IDSvia64+85e3

BUCKET_ID:  X64_0x1E_BAD_IP_IDSvia64+85e3

Followup: MachineOwner
---------

Old drivers needing update

GEARAspiWDM.sys        fffff880`043c7000    fffff880`043d0000    0x00009000    0x47fbc46f    4/8/2008 15:15:59                        
Rt64win7.sys        fffff880`011cd000    fffff880`011ff000    0x00032000    0x49a65b0d    2/26/2009 05:04:13                        
[COLOR=Red][B]atikmdag.sys        fffff880`03caf000    fffff880`041d1000    0x00522000    0x49f199cd    4/24/2009 06:51:57[/B][/COLOR]                        
spldr.sys        fffff880`01475000    fffff880`0147d000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
spsys.sys        fffff880`06200000    fffff880`06271000    0x00071000    0x4a085e7a    5/11/2009 13:20:58                        
amdxata.sys        fffff880`00c4d000    fffff880`00c58000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59                        
[COLOR=Red][B]netr28x.sys        fffff880`042ce000    fffff880`04384000    0x000b6000    0x4a3b4496    6/19/2009 03:56:06   [/B][/COLOR]

How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads
[/quote]

 

[josh99ta]

Awesome! I'll give that's a try first thing tomorrow. Away from home right now. I used the uninstall tool found on these forums to remove Norton's as I read about the W7 issues and have since installed AVG. How can I verify all Norton's has been removed? I'll do that and update drivers and report back. I did run memtest before I left and noticed at 50%f o the ea first pass it had already found over 28,400 errors. Does that mean I have some bad RAM too?

 

[josh99ta]

Okay so ran the Norton uninstall tool again. How can I be sure it's removed from the system? I ran it before and it obviously didn't remove all of Norton's, so I want to make sure all traces of Norton's is gone for good.

I also updated the video driver so hopefully that's taken care of.

The other driver you highlighted for me to update points to the wireless driver, but it's saying it is for a RaLink RT2860 Series Wireless LAN Card and I have a Edimax 802.11n wireless card. What gives there? I don't know what I'm supposed to be updating as I don't have that. I also see that netr28x.sys can be tied up to malware. Is that a possibility also?

I'm running the SFC/SCANNOW currently. It looks like this is going to take some time. I'll report back with the results from it ASAP. I'll also post a screenshot I took with my camera of the memtest results after it had ran for 9 hours. Give me one second to load the file to my computer.

 

[zigzag3143]

Okay so ran the Norton uninstall tool again. How can I be sure it's removed from the system? I ran it before and it obviously didn't remove all of Norton's, so I want to make sure all traces of Norton's is gone for good.

I also updated the video driver so hopefully that's taken care of.

The other driver you highlighted for me to update points to the wireless driver, but it's saying it is for a RaLink RT2860 Series Wireless LAN Card and I have a Edimax 802.11n wireless card. What gives there? I don't know what I'm supposed to be updating as I don't have that. I also see that netr28x.sys can be tied up to malware. Is that a possibility also?

I'm running the SFC/SCANNOW currently. It looks like this is going to take some time. I'll report back with the results from it ASAP. I'll also post a screenshot I took with my camera of the memtest results after it had ran for 9 hours. Give me one second to load the file to my computer.

This is the driver that caused the last one (IDSvia64.sys) Just search for it first



ken J

 

[josh99ta]

Thanks for all the help guys. Now I don't feel so hopeless. I really want W7 to work. It's got a great interface if I could just get it running stable.

SCANNOW is finished. It says...

"Beginning system scan. This process will take some time.

Beginning verification phase of scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations."

As for the IDSvia64.sys driver, that seems to be the Norton issue, and I've searched for it on my system as well as the Intrusion app, and neither are showing up except in an EventSys TXT file (I've attached it just in case it holds any pertinent info), so I'm hoping that's gone. With it not showing up in a search is it most likely taken care of?

Here is the memtest screenshot via my camera of what I came home to...

Do I have bad/faulty RAM as well? Windows Diagnostics said I had faulty RAM at first, so I pulled the RAM and reseated it to the mobo just in case I had a loose connection, then I reran Windows Diagnostics and it said my RAM was okay. Now I run memtest and it tells me I have over 28,000 errors. As I said I've got four 2GB sticks of Corsair Dominator DDR2 RAM (two matched pairs). Is there any way from that memtest to tell which is bad just by looking at that screen or by rerunning it and looking for anything specific if I do in fact have bad RAM?

 

[zigzag3143]

Thanks for all the help guys. Now I don't feel so hopeless. I really want W7 to work. It's got a great interface if I could just get it running stable.

SCANNOW is finished. It says...

"Beginning system scan. This process will take some time.

Beginning verification phase of scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations."

As for the IDSvia64.sys driver, that seems to be the Norton issue, and I've searched for it on my system as well as the Intrusion app, and neither are showing up except in an EventSys TXT file (I've attached it just in case it holds any pertinent info), so I'm hoping that's gone. With it not showing up in a search is it most likely taken care of?

Here is the memtest screenshot via my camera of what I came home to...

Do I have bad/faulty RAM as well? Windows Diagnostics said I had faulty RAM at first, so I pulled the RAM and reseated it to the mobo just in case I had a loose connection, then I reran Windows Diagnostics and it said my RAM was okay. Now I run memtest and it tells me I have over 28,000 errors. As I said I've got four 2GB sticks of Corsair Dominator DDR2 RAM (two matched pairs). Is there any way from that memtest to tell which is bad just by looking at that screen or by rerunning it and looking for anything specific if I do in fact have bad RAM?

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot. Test the sticks individually, and if you find a good one, test it in all slots.

ken

 

[josh99ta]

Hmmm, that adds an entirely new twist to the equation. My understanding of memtest is vague to say the least (and like I said I'm not tech-savvy at all). The mobo is brand-spanking new from Gigabyte if that matters.

How would you suggest I test the RAM as I have two pairs? Should I just pull one stick at a time and run memtest until I don't have any errors showing? Should I pull pairs as they're matched? Is there any rhyme or reason as to which I pull, and/or which slots are left open (do I always need RAM in the first slot, and how do I even know which slot is the first slot)?

Thanks so much for your help thus far Ken. I can't thank you enough.

 

[josh99ta]

So I pulled one of the matched pairs of RAM before bed last night and ran memtest again for 7 hours, 0 errors reported this morning. So I guess it's guaranteed I have either bad RAM or a mobo with a bad slot (or two)? I'll test a little further by moving the known good RAM to the other slots and seeing if I pick up any errors.

Also, funny thing, since removing the RAM, Windows has detected that I need to update my video driver (even though I updated it straight from AMD's site). Should I do the update or keep the driver I downloaded?

Also I'm not sure if it's the driver or the fact my RAM is currently cut in half, but everything on my screen lags now. The mouse will jump, it's even hard to type fast because the screen will just miss stuff it seems. Any ideas on that?

 

[josh99ta]

I'm nearing the end of my memtesting. I pulled two sticks and ran memtest, 0 errors.

Transferred the two known good sticks to the other two slots to verify no bad slots, 0 errors.

So now I know all slots are good and at least one of the two sticks I first pulled are bad.

I plugged in one of the sticks, ran memtest, 0 errors.

So now I think I have it isolated to the one stick that is left and that it must be bad. I ran memtest and got 28,416 errors, so it has to be bad, right?

So I plug it in the last slot to run memtest again just to verify that it is indeed bad. It's through 6 passes right now and 0 errors.

How can that be explained? Why would I get over 28,000 errors one time, then get 0 errors with the exact same memory another time?

 

[josh99ta]

Also, what about this driver/issue?

"The other driver you highlighted for me to update points to the wireless driver, but it's saying it is for a RaLink RT2860 Series Wireless LAN Card and I have a Edimax 802.11n wireless card. What gives there? I don't know what I'm supposed to be updating as I don't have that. I also see that netr28x.sys can be tied up to malware. Is that a possibility also"

 

[Keiichi25]

Also, what about this driver/issue?

"The other driver you highlighted for me to update points to the wireless driver, but it's saying it is for a RaLink RT2860 Series Wireless LAN Card and I have a Edimax 802.11n wireless card. What gives there? I don't know what I'm supposed to be updating as I don't have that. I also see that netr28x.sys can be tied up to malware. Is that a possibility also"

Go to the manufacturer's website for your wireless card. In some cases, people who make certain cards will use another group's chipset and tweak it slightly to make their product stand out from the others. The driver you have might be the baseline drivers that Microsoft identified based off the chipset, but it may not be the most optimal for you.