Solved Blue screens

[Ninebreaker]

Hi

I am currently having trouble with blue screens constantly plaging my pc these blue screens are Mostly Memory_Mangement based blue screens but also include a blue screen in windows safe mode cuased by Bad_pool_header i have run the windows memory diagnostic tool and found no errors


Can any one offer any insight to the cuase of these blue screens

attached are the minidumps created by the blue screens

System

windows 7 home premium 64 bit
ATI Radeon HD 5850
AMD Phenom ll x6 1090T Black edition
Asus M4A89GTD PRO USB3 motherboard
Asus PCE-N13 wiFi adapter
G.skill 8GB DDR3 Ram (2x4)

 

[americancritic2]

Bsod

Hello and welcome to the forum.

Please follow the posting instructions so we can better help you.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

A BSOD expert will get back to you.

 

[Ninebreaker]

Here is the report and contents of the folder

 

[FredeGail]

Hello Nikebreaker & Welcome to SevenForums!

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Frederik\AppData\Local\Temp\Rar$DI09.186\052511-25818-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c15000 PsLoadedModuleList = 0xfffff800`02e52e50
Debug session time: Wed May 25 10:56:37.070 2011 (UTC + 2:00)
System Uptime: 0 days 0:31:58.350
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4A, {749e2dd9, 2, 0, fffff88006e48ca0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 00000000749e2dd9, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff88006e48ca0, 0

Debugging Details:
------------------


PROCESS_NAME:  vsmon.exe

BUGCHECK_STR:  RAISED_IRQL_FAULT

FAULTING_IP: 
+5d5e2faf0254dd70
00000000`749e2dd9 c3              ret

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c86469 to fffff80002c86f00

STACK_TEXT:  
fffff880`06e48a68 fffff800`02c86469 : 00000000`0000004a 00000000`749e2dd9 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`06e48a70 fffff800`02c863a0 : fffff880`06e48ca0 fffffa80`09c25d40 fffff880`06e48bf8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`06e48bb0 00000000`749e2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`0410eea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x749e2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`02c863a0 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

[B][COLOR="Red"]IMAGE_NAME:  ntkrnlmp.exe[/COLOR][/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsmon.exe_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsmon.exe_nt!KiSystemServiceExit+245

Followup: MachineOwner
---------

Let's start out simple doing a SFC /SCANNOW

Two of your .dmp follows this ntkrnlmp.exe. Ntkrnlmp.exe is one of the most important files of the whole OS. You could be infected. What kind of Anti-Virus do you run? A full scan with Malwarebytes would be great.

Also make sure your drivers are up-to-date.

Best Regards,
FredeGail

 

[Ninebreaker]

Hi FredeGail

I currently only have avast antivirus and malware bytes installed i attempted to perform the scannow action and run a scan for a virus with malware bytes but sufferd a blue screen in the process i am now in safe mode and will perform the scannow function again and will then attempt to scan for a virus after woulds.

is it possable that a virus can inteligently identify a anti virus attempting to search for it and cuase a blue screen to stop itself from being discoverd. ?

 

[FredeGail]

Hi FredeGail

I currently only have avast antivirus and malware bytes installed i attempted to perform the scannow action and run a scan for a virus with malware bytes but sufferd a blue screen in the process i am now in safe mode and will perform the scannow function again and will then attempt to scan for a virus after woulds.

is it possable that a virus can inteligently identify a anti virus attempting to search for it and cuase a blue screen to stop itself from being discoverd. ?

If possible, post the .txt Malwarebytes generates after the scan if possible. I was more like asking for your AV, if you didn't have one etc.

Everything is possible

Best Regards,
FredeGail

 

[Ninebreaker]

Here is the log generated by the scannow function it states that it found corrupt files but could not repair them

 

[FredeGail]

From here it looks like some things got repaired. Go out of safe-mode and browse around as you do, and see if any BSOD will appear. If there's one appearing, upload the .dmp file

Best Regards,
FredeGail

 

[Ninebreaker]

This apears to have fixed the problems for the moment it may be to early to completly rule out any more problems.

Thank you for your assistance

 

[FredeGail]

This apears to have fixed the problems for the moment it may be to early to completly rule out any more problems.

Thank you for your assistance

Sounds great. Keep on having your computer open, and upload .dmp files if a BSOD appears.

Best Regards,
FredeGail

 

[Ninebreaker]

Hi

sorry to bother again but they persisted most the day without a incident then trying to install froma disc cuased steam to stop workign and a blue screen. and again when trying to upload mini dumps onto this site

 

[FredeGail]

That sucks,

Try testing your memory sticks by using http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Frederik\AppData\Local\Temp\Rar$DI00.759\071011-30248-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`03087e50
Debug session time: Sun Jul 10 21:32:11.004 2011 (UTC + 2:00)
System Uptime: 0 days 5:32:25.315
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80048b30d0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+338c6 )

Followup: MachineOwner
---------

Best Regards,
FredeGail

 

[Ninebreaker]

I am unable to get this tool to work i have followed the USB instuctions to the letter and have tried to change the boot bevice proroty this has had no effect windows will boot normally.

 

[FredeGail]

I am unable to get this tool to work i have followed the USB instuctions to the letter and have tried to change the boot bevice proroty this has had no effect windows will boot normally.

Try F8, F5 to bring up the boot manager, it depends on which motherboard you have.

Or go to BIOS and set the boot priority to show your USB as number 1.

Best Regards,
FredeGail

 

[Ninebreaker]

I did this but it had no effect on the boot

1 Removable device
2 Hardrive
3 cd/dvd rom

 

[FredeGail]

I did this but it had no effect on the boot

1 Removable device
2 Hardrive
3 cd/dvd rom

Try putting your "cd/dvd rom" as the first!

Best Regards,
FredeGail

 

[Ninebreaker]

ok i have begun testing it may take a while i will post the resualts tommorow or the day after

 

[FredeGail]

ok i have begun testing it may take a while i will post the resualts tommorow or the day after

Glad it worked.
Take your time..

Best Regards,
FredeGail

 

[Ninebreaker]

Hi

I ran the test for the seven passes it suggested no logs or anythign were generated but i did notice while it was scanning it found errors i will now follow the rest of the instruction in the previous link to test each stick individually and post the out comes

 

[Ninebreaker]

HI

okay tested each RAM individually in the motehrboard slots and found that one of them is completly usless errors on every line it tested the otehr one is flawless. and the blue screens are now gone thank you FredeGail for your assistance.