Blue screen problem

[Keertus]

I know this post is two years old but I'm having a very similar problem - http://www.sevenforums.com/crashes-debugging/116222-blue-screen-crash-please-help.html

I've tried to update the four drivers listed above but haven't found anything newer than what I have. I have also removed McAfee and replaced it with Microsoft Security Essentials. I just experienced another BSOD.

I attached the diagnostic tool zip file but I haven't yet run the bootable diagnostics yet. I've run memtest and others in the past with no problems so I don't expect there to be anything this time, but I'm going to do it anyway. Is there any chance this has been solved sometime over the past two years?

 

[koolkat77]

Hi & welcome to sevenforums.

Dump files show possible memory errors. Test RAM again, in the following manner:

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

:info: Errors are sometimes found after 8 passes.
:tip: Do this test overnight, before going to bed.

How old is this computer? Its hardware? When did you last install windows on it?

Run the System File Checker. It allows the user to scan for and restore corruptions in Windows system files.

• 
  1. Click on the rb:
  2. Type CMD on Search
  3. Left click and Run as Administrator
  4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Free up the start-up, nothing except the antivirus is usually needed.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Upload a screenshot of your hard disk using crystal disk info and summary tab using speccy:

• CrystalDiskInfo - Software - Crystal Dew World
• Speccy - System Information - Free Download
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Post back results.

 

[Keertus]

Thanks for the suggestions. I did run disk check, HD diagnostic scan, and the memtest (for three passes on both sticks) earlier today and everything checked out. I'll start running memtest overnight as suggested and work my way down the list in the morning. Obviously it's going to take some time but I'll post back when I've finished the tests.

 

[Keertus]

Oh, sorry. You also asked about the computer. It's about four years old, give or take. Toshiba Satellite L355D with standard hardware:

AMD Turion X2
ATI Radeon X1250
3GB RAM

I'm not sure what other hardware info you might be interested in.

It has been a few months since I last installed Windows but the last time was, at least, the second reinstall. I updated to Windows 7 about a year ago and immediately started having problems. I've been powering through, trying the occasional thing here and there (hence the previous memtest runs) and I know I've reinstalled Windows at least twice now.

 

[koolkat77]

Thanks. Take your time.
Will be waiting for the snips.

 

[Keertus]

Okay, here it is:
Ran memtest 8x on each individual stick in each slot with no errors
System File checker didn't catch any problems
Ran disk check and everything passed
Currently running on a clean boot going on one whole hour without any terminal crashes
Screenshots of Crystal Disk Info and Speccy are attached.

 

[Keertus]

Obviously I don't know much about what I'm looking at in those snapshots but I certainly appreciate your help getting this issue finally situated if possible.

 

[koolkat77]

How many sticks of RAM do you have? Test how your computer works on running one/each individually. If there is any dust accumulated inside of the case, clear them.

With driver verifier enabled the crashes seemed to blame very old drivers for your video card.

lmvm atikmdag
start             end                 module name
fffff880`0484e000 fffff880`04dbe000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Fri May 22 10:10:27 2009 (4A1625B3)
    CheckSum:         005261B1
    ImageSize:        00570000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You should update them.

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; ATI and restart the system. Delete remnants of its drivers/older drivers using Driver Fusion/Sweeper Link to update from here: AMD Driver Autodetect

:info: *Does the computer BSOD in safe mode?

Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

Download the free version of malware bytes and make a full scan:

• Malwarebytes - Free
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

 

[Keertus]

There are two sticks of RAM. I'll do test running the computer on each stick individually but I have a hard time believing that is the problem. The computer worked fine right up until I upgraded to 7.

I'm far more willing to believe it's an issue with the drivers but I can't seem to get any more up-to-date drivers. I followed your directions but it reinstalled the same driver.

Kaspersky and ESET couldn't find anything. Neither did Malwarebytes.

I did have another BSOD between this round of tests and the previous. I zipped the dump file and have attached it.

I'm trying to learn how to read these things as we go along but I'm not having much success in decoding things for myself. So if there are any tutorials in reading minidump files I'd be interested in that too.

Thanks again.

 

[koolkat77]

Did you run the windows upgrade advisor before doing so? : Windows 7 Upgrade Advisor - Download - Microsoft Windows

Driver Verifier

Use verifier for 36 hours. Then send us the BSOD reports

Driver Verifier
I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because [/B]Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
Driver Verifier - Enable and Disable

 

[Keertus]

Yeah, I ran the upgrade advisor. I don't recall exactly what the outcome was but it must have been some kind of green light or I wouldn't have gone ahead with the upgrade. I do remember running it though.

I've started the verifier. I expected it to crash out immediately as it has in the past but so far it hasn't. I'm a little surprised actually. I'll post the crash reports when it finally does break down.

 

[Keertus]

Guess I should have waited two more seconds before posting. Honestly, I don't think I've ever had a problem with peerblock before. I'll keep running verifier but stay away from PB this time.

 

[Keertus]

Okay, I've had a couple of other issues happen since this last BSOD.

I found that I was unable to send documents to my printer so I restarted the computer while verifier was still running. Windows was unable to start so I had to go into repair mode. After getting windows started up I looked for a dump file but there wasn't one. I guess windows crashed too soon for one to be created.

At any rate, I restarted verifier and immediately after restarting I got another BSOD. I've attached the dump file. It looks as though it's pointing to the video driver again but I simply cannot find a more up to date one. Suggestions?

 

[koolkat77]

Update your ATI drivers.

METHOD

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; ATI & restart the system. Delete remnants of its drivers/older drivers using Driver Fusion/Sweeper

Link: AMD Driver Autodetect

 

[Keertus]

Okay. I'll do it again but it just reinstalls the same driver.

 

[Vir Gnarus]

The solitary DV crash has indeed identified Peerblock as the cause. While I understand your delay for dealing with it, it should be taken care of before we can continue. At the very least update it, since it's dated Nov 2010, and then run Driver Verifier afterwards to confirm any change. Otherwise, it has to be removed. And yes, I personally have had to deal with numerous PC instabilities caused by Peerblock.

 

[Keertus]

The saga continues.

I ran verifier for about 48 hours without Peerblock and recevied no BSODs. Then, a day or two after turning off verifier, I received a BSOD that produced the attached dump. I ran verifier again, as suggested by the dump itself, for another 36 hours and couldn't get another crash.

At this point should I just be running verifier constantly? Or giving up on this laptop? It is four years old, after all.

 

[Vir Gnarus]

Uh oh. This is one of those uncommon instances where Driver Verifier alters the OS environment just enough that it's actually preventing a crash from occurring, rather than causing one. This can make analysis very difficult.

I may be able to get the info I need from the kernel dump of this particular crash, as the mini dump just doesn't have enough. Archive the MEMORY.DMP file from your Windows directory and upload to a 3rd party site like Mirrorcreator.com.

So far the current minidump showed involvement with the NSI proxy driver for Windows, which is the driver used to interface with client-to-server relationships for network applications. Make sure your network drivers are up-to-date and ensure that you only have one antivirus software running (no firewall software), as those can cause conflicts. I can only speculate on this as this driver may not be the culprit but just triggering the crash. Again, I might be able to learn more from a kernel dump.

 

[Keertus]

Okay, I think I got it here. It looks like it's pointing at that damn ATI driver again, but you all would know better than me.

BayFiles

 

[Vir Gnarus]

Whoa, I can kinda see why. The driver is pre-Windows 7 RTM, dated back from May 22, 2009. I'm not sure why you have a driver so old on this system for your graphics (did you install from a cd?) but it should be updated pronto.

The problem specifically is that the ATI driver was handling an event object incorrectly. The object name is Overdrive, which no doubt refers to ATI's Overdrive software that is used to overclock a system. I advise against using ATI Overdrive, since all overclocking should start and hopefully end inside the system's BIOS. Software overclocking can be very unstable, especially if it's with a driver and application this old. If you must monitor your GPU for temp/voltage/load, use a 3rd party application like HwInfo. If you must OC your GPU, do so through the BIOS if possible.

Analysts:

The crash for this kernel dump was quite clear in that a driver (atikmdag.sys; ATI driver) tried to reference a user handle as Kernel mode. Details on this check and why it's important as well as some fundamentals behind kernel/user objects and proper handling is explained in this powerpoint. I can clarify to the best of my ability upon request, but the general idea is that references to an object is done differently depending on the object, and if something references an object as a kernel object when it's actually a user object, it opens a can of worms (security hole, data integrity compromise, etc.).

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2:[COLOR=Sienna] 00000000000004b8[/COLOR], Handle value being referenced.
Arg3: fffffa8005a844b0, Address of the current process.
Arg4: fffff8800487fc29, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

BUGCHECK_STR:  0xc4_f6

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  CCC.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035613dc to fffff800030dafc0

STACK_TEXT:  
fffff880`0759e268 fffff800`035613dc : 00000000`000000c4 00000000`000000f6 00000000`000004b8 fffffa80`05a844b0 : nt!KeBugCheckEx
fffff880`0759e270 fffff800`03576ae4 : 00000000`000004b8 fffffa80`05a844b0 00000000`00000002 fffffa80`04443b50 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0759e2b0 fffff800`0332e000 : 00000000`80000000 fffff880`0759e4e0 00000000`00000000 00000000`00000000 : nt!VfCheckUserHandle+0x1b4
fffff880`0759e390 fffff800`033b0ed5 : fffffa80`04443b00 000007fe`000f001f 00000000`00000000 0053002b`002b0000 : nt! ?? ::NNGAKEGL::`string'+0x212de
fffff880`0759e460 fffff800`03576878 : 00000202`0018002b fffff880`07596001 fffff980`0139ece0 fffff980`14b9eee0 : nt!ObReferenceObjectByHandle+0x25
fffff880`0759e4b0 fffff880`0487fc29 : fffff880`0759ea54 fffffa80`04445000 00000000`00000000 00000000`1cfdb510 : nt!VerifierObReferenceObjectByHandle+0x48
fffff880`0759e500 fffff880`048685a7 : fffff980`0164aea0 00000000`00000000 fffff880`0759e770 00000000`00000000 : atikmdag+0x31c29
fffff880`0759e540 fffff880`04860e98 : 00000000`00000000 00000000`00000000 fffff980`01610f80 fffff880`0759ea40 : atikmdag+0x1a5a7
fffff880`0759e730 fffff880`048613f3 : fffff880`0759e950 fffff880`044860d1 00000000`00000001 fffff880`0759e9c0 : atikmdag+0x12e98
fffff880`0759e7f0 fffff880`044b9f50 : 00000000`00000000 00000000`00000000 fffff880`0759e950 fffff8a0`0005d000 : atikmdag+0x133f3
fffff880`0759e840 fffff880`044ad093 : 00000000`00000000 00000000`00000000 fffff880`0759eca0 00000000`00000003 : dxgkrnl!DXGADAPTER::DdiEscape+0x50
fffff880`0759e870 fffff960`001a0ad2 : fffff8a0`00022000 fffffa80`04443b50 00000000`1cfdb510 00000000`00000020 : dxgkrnl!DxgkEscape+0x7af
fffff880`0759ebf0 fffff800`030da253 : 00000000`1cd05e10 fffff880`0759eca0 000007fe`ff490000 00000000`000000c0 : win32k!NtGdiDdDDIEscape+0x12
fffff880`0759ec20 000007fe`ff4913ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1b7acd38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ff4913ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+31c29
fffff880`0487fc29 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  atikmdag+31c29

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a1625b3

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_atikmdag+31c29

BUCKET_ID:  X64_0xc4_f6_VRF_atikmdag+31c29

Followup: MachineOwner
---------

0: kd>[COLOR=Blue] lmvm[/COLOR] atikmdag
start             end                 module name
fffff880`0484e000 fffff880`04dbe000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR=Red]Fri May 22 00:10:27 2009[/COLOR] (4A1625B3)
    CheckSum:         005261B1
    ImageSize:        00570000
    File version:     8.1.1.882
    Product version:  8.1.1.882
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      ATI Technologies Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.882
    FileVersion:      8.01.01.882
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2006 ATI Technologies Inc.
0: kd> [COLOR=Blue]!handle [/COLOR][COLOR=Sienna]4b8[/COLOR]

PROCESS fffffa8005a844b0
    SessionId: 1  Cid: 1044    Peb: 7fffffda000  ParentCid: 0e1c
    DirBase: a15a3000  ObjectTable: fffff8a003399d00  HandleCount: 317.
    Image: CCC.exe

Handle table at fffff8a003399d00 with 317 entries in use

04b8: Object: fffffa8003848300  GrantedAccess: 001f0003 Entry: fffff8a0036782e0
Object: fffffa8003848300  Type: (fffffa8002365a40) [COLOR=Green]Event[/COLOR]
    ObjectHeader: fffffa80038482d0 (new version)
        HandleCount: 1  PointerCount: 3
        Directory Object: fffff8a0011e3490  Name: [COLOR=Green]Overdrive[/COLOR]

​