BSOD Analysis Needed

[Rmont11b]

Hey, title says it all. Was gone for about a week, when I came home, my computer ran for about 2-3 hours and then the blue screens started. Have been getting them upon reboot and within 5-10 min of reboot. Here is my analysis...

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000000600dd, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002efe0c5, address which referenced memory
Debugging Details:
------------------
 
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fd100
 00000000000600dd 
CURRENT_IRQL:  2
FAULTING_IP: 
nt!KeStackAttachProcess+115
fffff800`02efe0c5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
TRAP_FRAME:  fffff88008992770 -- (.trap 0xfffff88008992770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa800c36c0a0
rdx=fffff88008992a58 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002efe0c5 rsp=fffff88008992900 rbp=fffff88008992a58
 r8=fffffa800c36c090  r9=0000000000000130 r10=fffff880033d80c0
r11=fffffa800c36c040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02efe0c5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:3e30:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80002ecd569 to fffff80002ecdfc0
STACK_TEXT:  
fffff880`08992628 fffff800`02ecd569 : 00000000`0000000a 00000000`000600dd 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`08992630 fffff800`02ecc1e0 : fffff880`089927b0 fffff8a0`0cef3e30 00000000`00000039 fffffa80`0c36c040 : nt!KiBugCheckDispatch+0x69
fffff880`08992770 fffff800`02efe0c5 : 00000000`00000000 fffffa80`0c36c040 fffffa80`0c36c040 fffff800`0319c8e3 : nt!KiPageFault+0x260
fffff880`08992900 fffffa80`0a2f49c8 : fffff880`08992a80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`08992980 fffff880`08992a80 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`0a2f49c8
fffff880`08992988 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`08992a80
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!KeStackAttachProcess+115
fffff800`02efe0c5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  nt!KeStackAttachProcess+115
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
IMAGE_NAME:  ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be
FAILURE_BUCKET_ID:  X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID:  X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------

All help is greatly appreciated, in a time pinch! Thanks everyone.

Rob

 

[koolkat77]

Welcome to SevenForums.

You will receive better help if all the files from the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html are submitted.

 

[Rmont11b]

Yeah I read that, don't really have the ability to do much for the computer. Got the dump file and brought it to another computer for that bug report. I am running memtest's now, showing no errors.

 

[koolkat77]

How does the computer work in safe mode?

Try booting into Safe Mode with networking and see if you're able to upload the files from there.

• http://www.sevenforums.com/tutorials/666-advanced-boot-options.html

 

[Rmont11b]

Safe mode seems stable, it's in Memtest86+ pass 2 right now, what does that program from the other forum give that you don't get in the debug report?

 

[koolkat77]

The log files and msinfo file have information of what's installed on your PC and whats going on in the background which can be used to match the situation and how they relate to your BSOD.

Sometimes BSOD-s are caused by problematic programs as well and not just hardware.

 

[Rmont11b]

Alright, I will let the Memtest go overnight, I read RAM is a common problem, and tomorrow I will try that guide to making posts. Was just hoping it was something obvious by some fortunate chance. Got to do some coding for a CSE project due Tuesday... Thanks for your help thus far.

 

[koolkat77]

Take your time, good luck.,

 

[Rmont11b]

Added the Zip files from the Diagnostic Tool, hope you are still around to help!

 

[koolkat77]

Yes I am.

What were the results from memtest? Do you use a antivirus?

I see none.

 

[Rmont11b]

Memtest ran all night, no problems. And no anti-virus.

 

[koolkat77]

First thing I would suggest is, scan for virus.

Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

Use MSE and Free version of MBAM. They're light on resources.

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Will continue troubleshooting after the results.

 

[Rmont11b]

TDSSKiller says it found one threat, \Device\Harddisk0\DR0 (Rootkit.Boot.Pihar.c), running the other one now.

 

[koolkat77]

Good luck.

 

[Rmont11b]

Well blue screens have kept hitting me during the other test, I got an anti virus and ran an entire computer scan in safemode, it found a couple things, got rid of them and now I'm on my laptop because it is blue screening within a minute or two of logging in.

 

[koolkat77]

Upload the new logs from safe mode with networking if possible

Perform a clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[Rmont11b]

Did the clean boot, and didn't get a bsod right away, will start a little binary sort of the processes and see if it narrows down to something.

 

[koolkat77]

OkeyDokey

 

[Rmont11b]

Eh BSOD are too inconsistent... when you boot up clean without the non-microsoft processes, that means they won't start up, but does that also mean they will not ever start up if you let your computer sit?

 

[koolkat77]

You can start them manually from the rb: > All programs list.

Does the computer BSOD in safe mode?

Upload a screenshot of your hard disk using crystal disk info:

• CrystalDiskInfo - Software - Crystal Dew World
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Test your hard drive:

• Hard Drive Diagnostic Procedure