BSOD, after signin into user.

[a77wolves]

Okay, I had this problem for a couple of weeks now. My computer is under a year. for 6 months I had been fine using it, no problems there. but then one day my computer did an automatic update. after that it started to crash and give me a bsod. I restore it to a time before the update and it worked fine but then, it automatic updated while I was asleep and I got the Bsod again. I restored it to factory default. and I'm using my laptop and I get a Bsod. then I started to get one every other time my comp starts. then everytime. It does run in safemode though. certain the cause of this was because of some faulty download I restored it to factory default again. Now im enjoying my laptop again for three days. and then randomly The annoying BSOD comes back. It has been the first time since I restored it again. but I fear it will take the same pattern it has in the past. Any suggestions? my computer is a 64 bit, hp dv6 pavilion. 64 bit windows 7 home premium. 6 gigs of ram, amd quad core. using amd radon graphics. I have not made any changes to the hardware as it has suggested I did.

 

[JMH]

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[a77wolves]

This is a laptop, no overclocking done here. no changes have been made to the hardware of the laptop. Heres the minidump. One more thing I dont know if this will help at all. but during my second factory default restore, I lost the ability to go into hibernation mode. which I used all the time. when I tried it turns off my computer and when I turn it back on it says computer has crashed. it crashing my computer instead of using hibernation. This carried over even after I factory defaul restore it.

 

[JMH]

* Please keep in mind > It is much easier to find patterns, etc, when there are more than one crash.

We prefer you wait until you have at least two so that if one is corrupt the other probably wont be.


* Your crash was probably caused by Norton.
Symantec is a frequent cause of BSOD's.
I would remove and replace it with Microsoft Security Essentials AT LEAST TO TEST

http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

Microsoft Security Essentials - Free Antivirus for Windows

 

[a77wolves]

It has only crashed once since I restored it the third time. but before that It would crash a lot. you really think norton is the cause of it? I havent found a Good AV to replace norton with that has the same efficiency (or better) except malware bytes. but ill remove it and give it a try. Just have to find a good Anti virus

 

[JMH]

You asked for advice.
We responded.
Up to you to take it... or not!

 

[a77wolves]

Not sure how the qoute applied, but thanks ^^; wasn't sure on MSE because I havn't heard of it till then, but after I did some research it looks pretty good. hopefully better then norton. I'll report back with more mini dump if the problem continues. Just one last problem. What could be the cause of my hibernation mode not working, even after factory reset?

 

[JMH]

What could be the cause of my hibernation mode not working, even after factory reset?

Lets do one step at a time.
They may indeed be entwined.
Yet to be determined.
Time will tell.

 

[zigzag3143]

It has only crashed once since I restored it the third time. but before that It would crash a lot. you really think norton is the cause of it? I havent found a Good AV to replace norton with that has the same efficiency (or better) except malware bytes. but ill remove it and give it a try. Just have to find a good Anti virus

IMO Norton is far from efficient. Almost any of the top malware applications can do the trick

From the BSOD perspective (and this thread is about bsod's) Microsoft Security Essentials cause the fewest problems.

The hibernation issue may be related but lets fix the crash first.

 

[a77wolves]

Thanks for that input. I have installed MSE

 

[JMH]

Keep us posted please.

 

[a77wolves]

Its happen more now.

 

[writhziden]

Possible out of date drivers:

VMNetSrv	fffff880`0582a000	fffff880`0583f000	Wed Jan 24 05:05:46 2007 (45b74b9a)	0001712b		VMNetSrv.sys
vmm	fffff880`04398000	fffff880`043e5000	Sun Feb 18 01:11:21 2007 (45d80a29)	0004b4b7		vmm.sys

If you fill in your system specs by following http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html, we can help you find those drivers. For now, the best we can do is:
VMNetSrv.sys
vmm.sys
The http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html may also help.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\a77wolves\033012-38282-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`02c67000 PsLoadedModuleList = 0xfffff800`02eace90
Debug session time: Fri Mar 30 14:29:51.210 2012 (UTC - 6:00)
System Uptime: 0 days 0:02:59.739
Loading Kernel Symbols
...............................................................
................................................................
......................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41287, 6c6c, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46585 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000006c6c
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TERA-Launcher.

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800bb64900 -- (.trap 0xfffff8800bb64900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000006c6c rbx=0000000000000000 rcx=0000000000000002
rdx=0720000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d06478 rsp=fffff8800bb64a90 rbp=fffff8800bb64b40
 r8=fffff8800bb64b98  r9=fffff6fb40001d90 r10=fffff680003b2398
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiCheckVirtualAddress+0xc8:
fffff800`02d06478 488b08          mov     rcx,qword ptr [rax] ds:4af0:00000000`00006c6c=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c7a62e to fffff80002ce7640

STACK_TEXT:  
fffff880`0bb64798 fffff800`02c7a62e : 00000000`0000001a 00000000`00041287 00000000`00006c6c 00000000`00000000 : nt!KeBugCheckEx
fffff880`0bb647a0 fffff800`02ce576e : 00000000`00000000 00000000`00006c6c fffffa80`08847a00 fffffa80`06a1a230 : nt! ?? ::FNODOBFM::`string'+0x46585
fffff880`0bb64900 fffff800`02d06478 : fffffa80`082dcaa0 ffffffff`ffffffff 00000000`00000000 fffff880`0bb64b40 : nt!KiPageFault+0x16e
fffff880`0bb64a90 fffff800`02cf4869 : 00000000`00000000 00000000`00000000 fffff880`0bb64c20 fffff680`00006180 : nt!MiCheckVirtualAddress+0xc8
fffff880`0bb64ac0 fffff800`02ce576e : 00000000`00000008 00000000`76473529 00000000`001de201 00000000`00000000 : nt!MmAccessFault+0x249
fffff880`0bb64c20 00000000`76473529 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0018ee70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76473529


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+46585
fffff800`02c7a62e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+46585

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7951a

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46585

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+46585

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...

• If you are overclocking any hardware, please stop.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. In Windows 7:

  • Click the Start Menu
  • Type verifier in Search programs and files (do not hit enter)
  • Right click verifier and click Run as administrator
  • Put a tick in Create custom settings (for code developers) and click next
  • Put a tick in Select individual settings from a full list and click next
  • Set up the individual settings as in the image and click next
    View attachment 205148
  • Put a tick in Select driver names from a list
  • Put a tick next to all non-Microsoft drivers.
  • Click Finish.
  • Restart your computer.

  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

 

[a77wolves]

I have posted my specs

 

[writhziden]

Thank you, that will make it easier to provide help as we go along. Proceed with the memory testing and Verifier steps and post back any new crash reports once you've experienced a few crashes.