BSOD error 0x0000008e on startup

[LarryB]

very odd BSOD. Numerous BSOD on startup. After about 5 or 6 restarts I can eventually get in. Works perfectly fine in safe mode with networking

I have tried to disable the video, webcam, sound, and even wifi to try and identify the problem device/driver that may be causing the problem. But the bsod still occurs

After 5 or 6 BSOD the laptop finally starts up in normal mode and I can work. To make matters worse the OS is in Spanish so I do not fully understand the errors in event viewer

The dump file is 60Mb zipped. Is there any way I can upload the file? Can you have a look at the dmp file and see if you can see a specific driver or device is causing bsod

UPDATE - Mini dumps from this evenings crashes

Many thanks

Larry B

Nombre de registro:System
Origen: Microsoft-Windows-WER-SystemErrorReporting
Fecha: 10/06/2014 21:01:44
Id. del evento:1001
Categoría de la tarea:Ninguno
Nivel: Error
Palabras clave:Clásico
Usuario: No disponible
Equipo: Davinia-PC
Descripción:
El equipo se reinició después de una comprobación de errores. La comprobación de errores fue: 0x0000008e (0xc0000005, 0x82cf0348, 0x8e8ee800, 0x00000000). Se guardó un volcado en: C:\Windows\MEMORY.DMP. Id. de informe: 061014-36597-01.
XML de evento:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-06-10T20:01:44.000000000Z" />
<EventRecordID>13067</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Davinia-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x0000008e (0xc0000005, 0x82cf0348, 0x8e8ee800, 0x00000000)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">061014-36597-01</Data>
</EventData>
</Event>

 

[koolkat77]

Welcome to the forum LarryB,

[FONT="Lucida Console"]Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\admin\Downloads\mini dump\061014-39421-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.x86fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0x82c54000 PsLoadedModuleList = 0x82d9d5b0
Debug session time: Wed Jun 11 02:16:20.475 2014 (UTC + 6:00)
System Uptime: 0 days 0:01:43.395
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\system32\DRIVERS\avgidsdriverx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgidsdriverx.sys
*** ERROR: Module load completed but symbols could not be loaded for avgidsdriverx.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 9094cdce, 9e962b3f, 0}

Probably caused by : hardware ( avgidsdriverx+19dce )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9094cdce, The address that the exception occurred at
Arg3: 9e962b3f, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
avgidsdriverx+19dce
9094cdce 0000            add     byte ptr [eax],al

TRAP_FRAME:  9e962b3f -- (.trap 0xffffffff9e962b3f)
ErrCode = 00000002
eax=00000042 ebx=82cd6f9f ecx=00000040 edx=9e96b8d0 esi=00000000 edi=9e96ba58
eip=9094cdce esp=9e962bb3 ebp=9e96b8b8 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
avgidsdriverx+0x19dce:
9094cdce 0000            add     byte ptr [eax],al          ds:0023:00000042=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
avgidsdriverx+19dce
9094cdce 0000            add     byte ptr [eax],al

UNALIGNED_STACK_POINTER:  9e962bb3

LAST_CONTROL_TRANSFER:  from 00000000 to 9094cdce

STACK_TEXT:  
9e96b8b8 00000000 0000001a 00000000 82cd6f9f avgidsdriverx+0x19dce


STACK_COMMAND:  kb

FOLLOWUP_IP: 
avgidsdriverx+19dce
9094cdce 0000            add     byte ptr [eax],al

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  avgidsdriverx+19dce

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  IP_MISALIGNED_avgidsdriverx.sys

BUCKET_ID:  IP_MISALIGNED_avgidsdriverx.sys

Followup: MachineOwner
---------

[/FONT]

Looks like the BSOD's were caused by AVG. Uninstall it and replace with Microsoft Security Essentials.

Recommended antivirus software for Windows 7 based on stability compared to others:-

• Microsoft Security Essentials Download | Free Spyware Protection
• Malwarebytes - The Free version
• Good & Free Security Combination

   Warning

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Scan with Kaspersky TDSSKiller:

• Anti-rootkit utility TDSSKiller

ESET online scanner:

• Free Online Virus Scanner | ESET

Reduce items at start-up:

• How to Change, Add, or Remove Startup Programs in Windows 7

Perform a clean boot:

• How to Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• How to Repair Windows 7 System Files with System File Checker

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• How to Run Disk Check in Windows 7

Check for heating issues using Speccy or HWmonitor

Upload a screen shot:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

If this does not provide stability, test RAM.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
​

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
​

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
​

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
​

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
​

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

Post back results.

 

[LarryB]

Thank you KoolKat

I am surprised AVG is showing up. As I have come to rely and recommend this App over the past few years on many OS and devices.

I will work through your list and remove AVG first and install an alternative AV software

Malwerebytes is installed and that option is unchecked.

RAM was reseated and each individual stick and slot tested a number of months back over a period of 2 weeks. slots were cleaned also.

Anyway, AVG will be removed today and I´ll post back if I get through a month of no BSOD

Cheers!

 

[koolkat77]

Good luck

 

[LarryB]

Hi! Many months have passed and removing AVG from my last issue resolved the problem. However BSOD´s have come back. Different error this time

"a driver has overrun a stack buffer. This overrun could potentially be a malicious user trying to gain control of this machine"

Startup into Safe mode with networking works perfectly fine. But into normal mode, it gets further each time. Windows splash screen appears, BSOD. After restart into normal mode, I get passed the windows splash screen, either half the screen appears, the other half black. It continues like that.

I access safe mode and ensure MWBytes - MS Essentials is up do date, and run scans. Nothing shows up. Display drivers were completely removed and I ensured all drivers are up to date. RAM has been tested again successfully- There are only 2 sticks of 2Gb and I tested each one in the both slots and on their own.

It seems only after hours of performing tests, ensuring everything is up to date and free of virus and malware, startup into normal mode is fine. After a couple of days, it works, but then BSOD resumes

I have attached the minidumps from this morning. If you could help me that would be appreciated

Many thanks

Larry