BSOD during idle, error code 1E

dakoslug · Mar 7, 2015

I'm getting a BSOD when I leave my computer for like half an hour.

What should I do?

Note: Some of the LOGS may refer to another BSOD that I had earlier this month which I have recently fixed. The most recent BSOD was today (3/7/2015)

Thanks in advance!

Arc · Mar 7, 2015

Hi dakoslug.

Dont use a BETA display driver.

Uninstall the installed display driver using DDU. Then install the CCC 14.4 WHQL only.

Let us know for any further BSOD after doing it. Because, some more steps may be needed depending on the resulting situation.
___________________________________________

Code:

BugCheck 7F, {8, 80050033, 406f8, fffff8800f13ee78}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : atikmdag.sys ( atikmdag+81e78 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000406f8
Arg4: fffff8800f13ee78

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  a

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800032d2469 to fffff800032d2ec0

STACK_TEXT:  
fffff800`00ba4d28 fffff800`032d2469 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 : nt!KeBugCheckEx
fffff800`00ba4d30 fffff800`032d0932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba4e70 fffff880`0f13ee78 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0933bff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x81e78


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+81e78
fffff880`0f13ee78 e8ebfbffff      call    atikmdag+0x81a68 (fffff880`0f13ea68)

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  atikmdag+81e78

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  546ea3c3

FAILURE_BUCKET_ID:  X64_0x7f_8_atikmdag+81e78

BUCKET_ID:  X64_0x7f_8_atikmdag+81e78

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x7f_8_atikmdag+81e78

FAILURE_ID_HASH:  {93242815-fadd-5c51-751c-058b875fd641}

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`0f0bd000 fffff880`10341000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Fri Nov 21 08:00:27 2014 (546EA3C3)
    CheckSum:         0121F198
    ImageSize:        01284000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

dakoslug · Mar 7, 2015

Arc said:

Hi dakoslug.

Dont use a BETA display driver.

Uninstall the installed display driver using DDU. Then install the CCC 14.4 WHQL only.

Let us know for any further BSOD after doing it. Because, some more steps may be needed depending on the resulting situation.
___________________________________________

Code:

BugCheck 7F, {8, 80050033, 406f8, fffff8800f13ee78}

*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : atikmdag.sys ( atikmdag+81e78 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000406f8
Arg4: fffff8800f13ee78

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  a

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800032d2469 to fffff800032d2ec0

STACK_TEXT:  
fffff800`00ba4d28 fffff800`032d2469 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000406f8 : nt!KeBugCheckEx
fffff800`00ba4d30 fffff800`032d0932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba4e70 fffff880`0f13ee78 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
fffff880`0933bff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x81e78


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atikmdag+81e78
fffff880`0f13ee78 e8ebfbffff      call    atikmdag+0x81a68 (fffff880`0f13ea68)

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  atikmdag+81e78

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  546ea3c3

FAILURE_BUCKET_ID:  X64_0x7f_8_atikmdag+81e78

BUCKET_ID:  X64_0x7f_8_atikmdag+81e78

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x7f_8_atikmdag+81e78

FAILURE_ID_HASH:  {93242815-fadd-5c51-751c-058b875fd641}

Followup: MachineOwner
---------

0: kd> lmvm atikmdag
start             end                 module name
fffff880`0f0bd000 fffff880`10341000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Fri Nov 21 08:00:27 2014 (546EA3C3)
    CheckSum:         0121F198
    ImageSize:        01284000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Hi, thanks for the reply! I believe this is the bsod that was caused by atimdag was it not? I've already resolved that specific BSOD (i took out the GPU, currently using integrated right now). I'm trying to troubleshoot another bsod that is caused by 1E.

Could you look over the recent minidump (March 7th) and tell me what the cause is?
Unless you believe that the ATI drivers are still causing it?

Arc · Mar 8, 2015

If there are BSODs even after removing the ATI card, uninstall ESET.

Code:

fffff800`0482ef48  fffff880`014668abUnable to load image \SystemRoot\system32\DRIVERS\epfw.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for epfw.sys
*** ERROR: Module load completed but symbols could not be loaded for epfw.sys[/COLOR]
 epfw+0x208ab

Driver Reference Table - epfw.sys

Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Also, there is failure from the part of intel HD graphics.

Code:

fffff800`0482db38  fffff880`048e01a8Unable to load image \SystemRoot\system32\DRIVERS\igdkmd64.sys, Win32 error 0n2
[COLOR=Red]*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys[/COLOR]
 igdkmd64+0xbc1a8

As random things are crashing, it would be better to Test your RAM modules for possible errors.

How to Test and Diagnose RAM Issues with Memtest86+

Run memtest86+ for at least 8 consecutive passes.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If memtest86+ is free from errors, we will try to concentrate on the intel graphics failure.

dakoslug · Mar 8, 2015

Before I decide to uninstall ESET, I'm also having some sound issues that might be related to the BSOD.

When I first start up, there are some random sound poppings and sound distortions. Then it disappears and then again later on in the day it starts up.

Could this be related to a ram issue or is it possible that it's part of ESET? I did install ESET recently but I don't think it started causing BSOD right away.

Arc · Mar 8, 2015

OK, test the RAM first.

The sound during startup comes from the HDDs sometimes, when the start spinning.

dakoslug · Mar 10, 2015

Sorry for the late reply. I have some time today so I'll be running the memtest right now.

Edit: 3 pass, 0 errors.

dakoslug · Mar 10, 2015

Ok I let it run through 4 passes, and still no error. I know you told me to wait atleast until 8 so I will do it again overnight but it ran for almost 5 hours and no errors.

Do you still suspect that it might be a ram issue? Or should I continue with your other advice?

Arc · Mar 11, 2015

How are you testing the RAM? Are you typing those from another computer?

dakoslug · Mar 11, 2015

I'm posting on my phone. Anyways I've left MemTest on overnight, 8 pass 0 errors

Total Runtime: 10 hours and 20 mins

Arc · Mar 11, 2015

Good to know that the RAM is free from errors.

Go to https://downloadcenter.intel.com/ ... take the Intel® Driver Update Utility and see if it suggest any newer version of the display driver. If it does, apply the driver.

Also, you need to uninstall ESET at this stage. At least on a test basis. Yes, I know that it is a real good antivirus, but as it is contributing to the BSODs, we need to see the situation with ESET out. When the RAM is not failing, we have nowhere to go without uninstalling the reported crasher.
Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.

Let us know fro any further BSOD.

dakoslug · Mar 11, 2015

Ever since i ran that memtest yesterday I haven't been experiencing Sound Distortions..nor BSODs for that matter(however I never left it to idle. But I did experience a BSOD yesterday (before I ran the memtest) which encouraged me to actually run the memtest.

Basically I was watching a video, and the sound got really distorted, stuttered and then BSOD.

Here is the minidump.

Let me know if you need any more info. Thanks for all the help btw

Arc · Mar 11, 2015

Disable Driver Verifier.

You should not have enabled it when it was not suggested.

dakoslug · Mar 11, 2015

I have never seen that in my life. I remembering reading about it but I never enabled it. I did what the page you sent asked and it said "No settings changed" after deleting all settings. So that means it wasn't enabled I believe right?

Arc · Mar 11, 2015

Are you sure? Let us know.

Because your uploaded dump says something else.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[COLOR=Red][B]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/B][/COLOR]
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff8000344fcc0
Arg4: 0000000000000000

Also follow post #11 .

dakoslug · Mar 11, 2015

I'm 100% sure, if it was enabled it wasn't by my control. And doing what that wiki post suggested (deleting existing settings) the program alerted me that no settings were changed. Which seems to imply that it wasn't enabled to begin with.

I'm starting to lean towards malware here...though fairly unlikely considering I regularly scan with Malware-bytes and Nod32.

dakoslug · Mar 11, 2015

Alright I'll check for updated drivers. As for NOD32, I'll idle the computer tonight and see if there any issues then delete it. Sorry I know I'm being indecisive.

Arc · Mar 11, 2015

I see. Then it has an alternative explanation. Some driver is behaving is such a way that they are being verified.

Follow post #11 ... it may do some changes there. Also update VirtualBox Guest addition.

dakoslug · Mar 11, 2015

Okay my Intel HD Graphics card driver is several versions outdated. And as I don't need Oracle VM is it not just safe to uninstall it?

Arc · Mar 11, 2015

If you dont use VM, feel free to uninstall it.

BSOD during idle, error code 1E

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer