BSOD Cold Boot

[MDDI]

Just upgraded from XP x64 to 7 Home Premium x64. System was stable with XP x64; no hardware/software changes have been made.

System will BOOT/Restart when warm "no" BSOD; has to sit several hours, will BSOD when started and display:

*Windows Has Recovered From An Unexpected Shutdown*

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1a
BCP1: 0000000000041790
BCP2: FFFFFA8004423980
BCP3: 000000000000FFFF
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\041514-18328-01.dmp
C:\Users\Mark\AppData\Local\Temp\WER-29906-0.sysdata.xml

Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

I ran Seagate Seatools long test twice, no errors. I ran Memtest V5 overnight (8+) hours, no errors.

Have attached debug report.

Sure could use some help,

Thanks in advance.

 

[koolkat77]

Welcome to the forum MDDI,

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Usra\Downloads\MARK-PC-Tue_04_15_2014__82754_98\041514-18328-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c67000 PsLoadedModuleList = 0xfffff800`02eaa6d0
Debug session time: Tue Apr 15 17:11:48.570 2014 (UTC + 6:00)
System Uptime: 0 days 0:01:01.992
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8004423980, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Usra\Downloads\MARK-PC-Tue_04_15_2014__82754_98\041514-17406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c59000 PsLoadedModuleList = 0xfffff800`02e9c6d0
Debug session time: Mon Apr 14 23:44:37.902 2014 (UTC + 6:00)
System Uptime: 0 days 0:01:06.308
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80043cd580, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Usra\Downloads\MARK-PC-Tue_04_15_2014__82754_98\041414-20390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02ea86d0
Debug session time: Mon Apr 14 17:16:09.842 2014 (UTC + 6:00)
System Uptime: 0 days 0:00:54.249
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8004407180, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

Start by testing RAM.
Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

 

[MDDI]

Koolkat,

Thank you for your reply and help. As I said in my opening post my system was stable with XP and "no" hardware changes were made before doing a clean install of Windows 7.

When my issue started I did suspect RAM and ran Memtest overnight; "no errors". I have 8GB RAM so it took awhile to complete a pass. I believe it did complete at lest 8 passes overnight.

I did have an issue with my video card and XP. My screen saver is text; my system would BSOD if 3D rendering was enabled in screen saver. Disabling 3D rendering I had no issue. I did disable 3D rendering in Windows 7.

Windows 7 installed the NVidia drivers during install/update; including the 3D drivers. I checked the NVidia site and the drivers were the latest release.

Because I had a similar problem with XP I suspected the NVidia drivers. Yesterday afternoon I downloaded the current drivers from NVidia, uninstalled the Windows installed and reinstalled the downloaded. I did not install the 3D drivers. I shut the system down for the evening.

This AM, for the first time in 5 days, my system booted and did not BSOD! Go figure?

Obviously you saw something in the debug report that made you suspect RAM? Do you think I still have a RAM problem?

I know RAM is a major source of system issues. Even if my system continues to be stable do you believe I should perform the extended RAM test you suggested in your reply?

Again, thank you for your assistance,
MDDI

 

[koolkat77]

Windows 7 uses a bit more system resources than XP did.

Will wait for a response after RAM test.

 

[MDDI]

OK, thanks. I have 4 RAM sticks; that test will take some time. May have to wait until this weekend.

 

[MDDI]

BSOD Resolved

KoolKat,

My system did BSOD again so it was not the Nvidia 3D drivers.

I ran the RAM tests you requested, there were no defective DIMM's, however, when I started to test with one stick, my system would not POST.

The BIOS RAM voltage setting was 1.5V. I had to step up the voltage to 1.7V to POST with a single DIMM.

I have had no BSOD's after about a 1/2 dozen cold BOOT's; go figure? You said Windows 7 uses more resources than Win XP. Guess Win 7 needed the extra .2V?

Thanks for the help; will all the "error dump file" delete using "Disk Cleanup"?

MDDI

 

[MDDI]

Still random crash

Some improvement but still having random crash. Now only when browsing; sometimes freeze and sometimes BSOD. IE and Outlook are open

I have rolled back from IE11 to IE10.
I have changed AV from Avast to Bitdefender.
I have made power settings in the BIOS recommended on another forum.
RAM has been extended tested many times.

I'm starting to believe I could have some hardware getting long in the tooth?

PSU = 8 years old (Corsair HX620)
MOBO = 5 years old (Gigabyte EP45T-UD3P)
CPU = 6 years old (Intel E8400)
Video = 6 years old (NVidia 8800GT)
HDD = 60 days (WD Black)
RAM = 60 days (Mushkin PC3-10660)

Dump file attached.

 

[Thedoctor44]

Given that you've ran memtest86 already this looks like a driver issue.

0: kd> [COLOR="Green"]dt nt!_mmpfn fffffa8004423980[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40000120 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`40000120 Void
   +0x010 Lock             : 0n1073742112
   +0x010 PteLong          : 0xfffff6fb`40000120
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR="Red"]0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

The Page Table Entries have fallen below zero which is generally a driver calling the MmUnlockPages function more than once in a linked list.

Your latest bugcheck is similar.

BugCheck 1A, {[COLOR="red"]41284[/COLOR], fffff98017200001, 0, fffff780c0000000}

This also indicates Page Table Entries have been corrupted.

With all this said I suggest enabling Driver Verifier.

Enable driver verifier but only enable the options: Standard settings and IRP logging step 3.
Don't enable Force Pending I/O Requests

Enable Driver Verifier to monitor the drivers.
Driver Verifier -Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

We use Driver Verifier as it puts a stress on the drivers, and so it makes the unstable drivers crash. This should flag the driver responsible in the dump file.
It

Driver Verifier will make the system laggy, this is normal so don't worry.

Before enabling DV, make sure that you have earlier System restore points made in your computer.

If there are no points, make a System Restore Point Manually

Post back the results.

 

[MDDI]

Thanks Doctor,

I set Driver Verifier with following settings:

Select a task:
Create custom code settings for code developers (should it be create standard settings?)

Create custom settings;
Standard settings & IRP Logging

Select what drivers to verify;
Automatically select all drivers installed on this computer

I have used my machine on & off all day, no crash. This is not abnormal, sometimes it may go for days before an instance.

I appreciate the help, this has been like chasing a ghost.

Mark

 

[MDDI]

Doctor,

I trust I had the verifier settings correct on the previous reply?

Crash this AM; files attached.

Thank you again for your help.

Mark

 

[MDDI]

Files

I guess the files did not attach?

 

[Thedoctor44]

No, you need to select drivers manually from a list, then choose all 3rd party drivers, none from the following.

Unknown, Microsoft Cooperation, Macrovision and Microvision.

1: kd> [COLOR="Green"]dt nt!_mmpfn fffffa80014d9180[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`400010d8 _MMPTE
   +0x010 VolatilePteAddress : 0xfffff6fb`400010d8 Void
   +0x010 Lock             : 0n1073746136
   +0x010 PteLong          : 0xfffff6fb`400010d8
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR="Red"]0xffff[/COLOR]
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

Still looks driver related to me, I suggest enabling driver verifier by using my instructions at the start then following the rest from the link.

 

[MDDI]

Doctor,

I reset Driver Verifier last night, it has been 24 hours and no crash. There have been two events that may have a bearing on my issue. Monday evening my system froze while on the net. I waited and the mouse started to respond to cursor movement but would not close/change any program.

I reset then shutdown. Windows & has never seemed to like my keyboard/mouse; Microsoft Intellitype/Intellipoint (has the USB orb looking receiver). Both are several years old.

I had a new extra receiver; I installed it. When I booted and was in Windows it went through a whole new device install along withy some other extra features I did not install. I have the current Intellitype/Intellipoint driver/software installed.

I checked Windows Update after the system was running. There was a new update I had not seen before; KB911895, I installed. Up to now there have been no crashes.

I'm not believing this yet, I will wait another few days before committing.

Another observation; when selecting drivers in Driver Verifier I noticed Brother Industries Ltd. I do not have a Brother device; my printer/scanner/fax is Canon (no Canon drivers present). Is Canon/Brother same entity?

MDDI

 

[MDDI]

Took awhile

Doctor,

Sorry it took this long. I enabled Verifier again Sunday the 15th, after three days I did not have a crash so I disabled Verifier. Friday the 2oth I had a crash with Verifier disabled, I enabled Verifier.

Last night while I was away from the computer I returned with the Windows Recovered message, dump attached. I hope the information you are looking for is present.

Thanks,
Mark

 

[MDDI]

Update

TheDoctor44,

Not sure if you found an issue or had time to analyze the last dump file. If it matters I have a few more crashes.

All were while Internet Explorer was open and all displayed "Internet Explorer Has Stopped Working". When trying to close IE the system will BSOD.

Typically the system will only crash once per day and not every day; will not crash again the same day 95% of the time.

Thanks,

MDDI