Solved BSOD 768_1 at random times

[david harty]

I get a blue screen every 5 or 10 minutes. It's always 768_1. After 2 attempts, I was able to paste the BSOD message into my post before it crashed. After a few more attempts I got the SF diagnostic tool downloaded so I could build a zip file and attach it. I wasn't sure I would ever get that far so I also attached a zip file of just the mini dump.

I went to "add or remove programs" to see if anything new has been installed lately and I found something. On 8/7/2013 these two programs were installed:

HP FW Update ED02
HP Update

The problem started today (8/10) so I think these are the programs which are causing my problem.

I tried to uninstall these programs, but it always crashes while attempting to create a restore point.
I tried to do a system restore, but it crashes while looking for the restore point.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033
Additional information about the problem:
BCCode: 50
BCP1: FFFFF98121F826A0
BCP2: 0000000000000000
BCP3: FFFFF88001622E60
BCP4: 0000000000000005
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1
Files that help describe the problem:
C:\Windows\Minidump\081013-13041-01.dmp
C:\Users\lynne\AppData\Local\Temp\WER-49296-0.sysdata.xml

file WER-49296-0.sysdata.xml does not exist. I found other WER files, but not this one. I did find the dmp file, but I don't know how to analyze it.

 

[koolkat77]

Start Menu\Programs\McAfee	Public:Start Menu\Programs\McAfee	Public

McAfee is a known cause of BSOD's. Replace with Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:

Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

Help protect your PC with Microsoft Security Essentials

Malwarebytes Free​

• :info: Do not start the trial version of MalwareBytes
  
  

You may also take a look at:

Good & Free System Security Combination​

Reduce items at start up:

Performing a Clean Startup in Windows 7

Add, or Remove Startup Programs in Windows 7
​

Your Antivirus software is basically whats just needed there.

Make scans with -

TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US

Online Virus Scanner Eset​

Upload a screenshot using:

CrystalDiskInfo​

:tip: For how to upload a screenshot or file, read here

Test your Hard Drive by running:

Hard Drive Diagnostic Procedure​

Use the System File Checker tool and Run Disk Check:

Repair Windows 7 System Files with System File Checker

Run Disk Check in Windows 7 for Bad Sectors & Errors​

Monitor hardware temperature with system monitoring software like Speccy or HWMonitor:

Piriform - Speccy

CPUID - HWMonitor​

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff9810a9026a0, 0, fffff8800182be60, 5}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!memcpy+250 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff9810a9026a0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8800182be60, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b9100
GetUlongFromAddress: unable to read from fffff800036b91c0
 fffff9810a9026a0 

FAULTING_IP: 
Ntfs!memcpy+250
fffff880`0182be60 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800358bc60 -- (.trap 0xfffff8800358bc60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=fffff9810a9026d0
rdx=ffffffffffffffd8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800182be60 rsp=fffff8800358bdf8 rbp=fffff9800a902720
 r8=00000000ffffff68  r9=0000000007fffffb r10=0000000000000001
r11=fffff9800a902768 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
Ntfs!memcpy+0x250:
fffff880`0182be60 488b440af8      mov     rax,qword ptr [rdx+rcx-8] ds:fffff981`0a9026a0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034fe5a3 to fffff80003481c00

STACK_TEXT:  
fffff880`0358baf8 fffff800`034fe5a3 : 00000000`00000050 fffff981`0a9026a0 00000000`00000000 fffff880`0358bc60 : nt!KeBugCheckEx
fffff880`0358bb00 fffff800`0347fd2e : 00000000`00000000 fffff981`0a9026a0 00000000`00000000 00000000`00000028 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`0358bc60 fffff880`0182be60 : fffff880`018b7450 00000000`00000028 fffff880`0358be50 fffff8a0`00000400 : nt!KiPageFault+0x16e
fffff880`0358bdf8 fffff880`018b7450 : 00000000`00000028 fffff880`0358be50 fffff8a0`00000400 00000000`00000001 : Ntfs!memcpy+0x250
fffff880`0358be00 fffff880`018b75e8 : fffff8a0`0abe6720 fffff800`03627280 fffff8a0`0abe6720 fffff980`0a902400 : Ntfs!NtfsRestartInsertSimpleRoot+0x50
fffff880`0358be40 fffff880`018db827 : fffffa80`08c62a40 fffffa80`03f23180 fffff880`0358bfd8 fffff880`0358c010 : Ntfs!InsertSimpleRoot+0xb8
fffff880`0358bf10 fffff880`01892d3b : 00000000`00000000 fffff8a0`0abe6720 fffff880`0358bfd8 fffff880`0358c068 : Ntfs!AddToIndex+0xcf
fffff880`0358bf90 fffff880`018aec85 : fffffa80`08c62a40 fffff8a0`0abe6720 fffff8a0`0aa95018 fffffa80`00000000 : Ntfs!NtOfsAddRecords+0x167
fffff880`0358c170 fffff880`018df2fc : fffffa80`08c62a40 fffff8a0`0aa95010 00000000`000924c4 00000000`000924d0 : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x1fd
fffff880`0358c220 fffff880`0188e532 : fffffa80`08c62a40 fffffa80`03f23180 00000000`00000000 fffff980`0a902d00 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xa0
fffff880`0358c270 fffff880`018a65dd : fffffa80`08c62a40 fffffa80`03f23180 fffff800`03627280 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x112d0
fffff880`0358c2f0 fffff880`0183a35c : fffffa80`08c62a40 fffff880`01863a00 fffffa80`08c62a40 fffff8a0`0aaa7010 : Ntfs!NtfsUpdateFcbInfoFromDisk+0x4fe
fffff880`0358c440 fffff880`01903faa : fffffa80`08c62a40 00000000`00000000 00000000`00000000 fffff8a0`0aaa7010 : Ntfs!NtfsInitializeDirectory+0x254
fffff880`0358c550 fffff880`018fe1d6 : fffffa80`08c62a40 fffffa80`03f23180 00000000`00000000 fffffa80`03f23180 : Ntfs!NtfsInitializeExtendDirectory+0x3d6
fffff880`0358c710 fffff880`018997cd : 00000000`00000000 fffffa80`03eedbd0 00000000`00000001 00000000`00000000 : Ntfs!NtfsMountVolume+0x1691
fffff880`0358ca50 fffff880`01821745 : 00000000`00000000 00000000`00000000 fffffa80`08c62a40 fffff800`034891d3 : Ntfs!NtfsCommonFileSystemControl+0x59
fffff880`0358ca90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspDispatch+0x2ad


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!memcpy+250
fffff880`0182be60 488b440af8      mov     rax,qword ptr [rdx+rcx-8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!memcpy+250

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!memcpy+250

BUCKET_ID:  X64_0x50_Ntfs!memcpy+250

Followup: MachineOwner
---------

 

[david harty]

Thanks for the info. I will perform the recommended actions.

 

[david harty]

McAfee is a known cause of BSOD's. Replace with Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately
Response:
Mcaffee removed. Microsoft security essentials & Malwarebytes installed. Did a full scan using both products.
Reduce items at start up. Perform a clean windows 7 startup.
Response: Done

Make scans with TDSSKiller Rootkit Removal Utility
Response: Done

Run online virus Scanner Eset
Response:
I had a lot of trouble with this step. Windows crashed repeatedly while the download and install was in progress. I skipped ahead to other tasks and then came back to this one. Finally, I got it installed.

Use the System File Checker tool and Run Disk Check
Response: Done

Run Disk Check in Windows 7 for Bad Sectors & Errors
Response: Done. See attached log file.

I have not finished all the tasks yet, but windows has been up for over an hour now, so I'm not going to install any more stuff for a few days. Thanks so much for your help.

 

[koolkat77]

Thanks for the update. Good luck!

 

[david harty]

I installed the CPUID HWMONITOR software and ran it. All the temperatures and voltages are in the normal range. I have been working with the Microsoft Help Desk. I gave them permission to take over control of my laptop. I watched as they repeated several of the same steps you advised me to take. They also tried other things that were not on your list such as reloading drivers. Nothing seems to help. My problem has been escalated to level 2. The next step will be to re-install windows 7. The install disk should arrive on Wednesday.

I will keep you posted as the saga continues.

 

[koolkat77]

Clean installs are always good.
Best of luck

 

[david harty]

Clean install of Windows 7 SP1 did the trick. I'm very happy with Microsoft Support. It's the best $99 I ever spent. I was trying to avoid a reload of the OS, but in the final analysis there was now way around it. Thanks for all your help koolkat77.

 

[koolkat77]

Glad you got it sorted. & am always happy to help.
Best of luck!