BSOD. Fixing Remotely. Haven't seen blue screen in person.

[heman22union]

Is Windows 7 . . . -x64 - the original installed OS on the system? yes - an OEM - purchased for personal use - What is the age of system (hardware)? new - i3 2120, 8 GB ram. - What is the age of OS installation- installed around 02/2012

 

[writhziden]

Software Concerns:

Start Menu\Programs\Driver Detective

We do not recommend automated driver update software. It often finds drivers for devices similar to but not exactly the same as the hardware actually on the system. This can lead to conflicts and blue screen crashes. If you need help finding driver updates for a certain device, please start a thread in Drivers - Windows 7 Forums instead of using software. Driver updates are not always necessary and some updates can actually decrease system stability rather than increase it, so it is usually better not to update unless a device or its driver is causing problems with the system. If it ain't broke, don't fix it.​

Analysis:

Crashes point primarily to a memory problem.

• If you are overclocking any hardware, please stop.
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
     Warning

  Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!
  
  For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
• Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

 

[heman22union]

I will do what I can. This is a computer I built for a customer of mine. I was kinda pressed for time when I made the inital post here. I had a hunch it was memory related. While I was over there I tried using a Memtest 86+ disk. It would load the familiar blue memtest screen, would show the std processor specs and a few things on the left hand side, the boxed in area in the upper right wouldnt load nor would it start testing. So I ended up taking the ram home with me. The wmdt would run off of my disk though. At home I am currently running a mem test in my pc here using the memory I took home with me. Definately no overclocking here. We will see what happens, could be mobo, ram, or a bad burn on my test disk. I didnt even know driver dective was on the computer, client never mentioned it. I will check with them and report back.

Thanks for your help

 

[heman22union]

The client confirmed that they didn't install or use driver dective. More than likely it was installed with some other sw that was installed by them. After 2 complete passes there were no errors on their memory. It is in my computer and a different platform, so I'm wondering if the issue is with the compatability with her mobo and ram. I will get with her tomorrow to return the ram and try and test over there again. Since her pc isn't in working order I can't give you the cpuz info. Here is some of her parts though.

Newegg.com - Patriot Gamer 2 Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10666) Desktop Memory Model PGD38G1333ELK

Newegg.com - BIOSTAR TH61 ITX LGA 1155 Intel H61 HDMI USB 3.0 Mini ITX Intel Motherboard with UEFI BIOS

Newegg.com - Intel Core i3-2120 Sandy Bridge 3.3GHz LGA 1155 65W Dual-Core Desktop Processor Intel HD Graphics 2000 BX80623I32120

 

[funtimeerror]

found some interesting info

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff780c0000000
Arg3: 000000000000900d
Arg4: fffff9802c8b2009

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  ccsvchst.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f35d1f to fffff80002ece1c0

STACK_TEXT:  
fffff880`0a11ce88 fffff800`02f35d1f : 00000000`0000001a 00000000`00005003 fffff780`c0000000 00000000`0000900d : nt!KeBugCheckEx
fffff880`0a11ce90 fffff800`02ee39e0 : fffff6fc`c0114b08 00000000`00000001 fffffa80`00000010 fffffa80`05feb3f0 : nt! ?? ::FNODOBFM::`string'+0x2a029
fffff880`0a11d000 fffff800`02ebc4ce : fffff980`22950000 00000000`00011000 00000000`00000000 fffffa80`0d53d3c0 : nt!MmCheckCachedPageStates+0x3c0
fffff880`0a11d1b0 fffff800`031b3a00 : 00000000`00000000 00000000`005d028e fffffa80`0c56c7c0 fffff8a0`01bef000 : nt!CcFetchDataForRead+0x10e
fffff880`0a11d210 fffff880`012d2f08 : fffff880`00000000 00000000`00000005 fffffa80`0002fd72 fffffa80`00010001 : nt!CcCopyRead+0x180
fffff880`0a11d2d0 fffff880`0100a098 : fffffa80`0c56c7c0 fffffa80`0d53d358 00000004`0000000c fffffa80`0c56c801 : Ntfs+0x99f08
fffff880`0a11d4b0 fffff880`0100d8ba : fffff880`0a11d580 fffff8a0`01bef003 fffff8a0`01bef000 fffffa80`0c56c700 : fltmgr!FltpPerformFastIoCall+0x88
fffff880`0a11d510 fffff880`0102b630 : fffffa80`0c56c7c0 00000000`00000000 fffff880`0a11d670 00000000`00010000 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0a11d550 fffff800`031b3539 : fffffa80`0c56c7c0 fffffa80`00000001 fffffa80`06d10080 fffffa80`0c56c7c0 : fltmgr!FltpFastIoRead+0x1d0
fffff880`0a11d5f0 fffff800`02ecd453 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x417
fffff880`0a11d6e0 fffff800`02ec9a10 : fffff880`040046a8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a11d8e8 fffff880`040046a8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`0a11d8f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`0a11d940 : EX64+0x26a8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
EX64+26a8
fffff880`040046a8 ??              ???

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  EX64+26a8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: EX64

IMAGE_NAME:  EX64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4f97c380

FAILURE_BUCKET_ID:  X64_0x1a_5003_EX64+26a8

BUCKET_ID:  X64_0x1a_5003_EX64+26a8

Followup: MachineOwner
---------

3: kd> lmvm EX64
start             end                 module name
fffff880`04002000 fffff880`04200000   EX64     T (no symbols)           
    Loaded symbol image file: EX64.SYS
    Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\VirusDefs\20120703.017\EX64.SYS
    Image name: EX64.SYS
    Timestamp:        Wed Apr 25 04:27:28 2012 (4F97C380)
    CheckSum:         001FDCF5
    ImageSize:        001FE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

looks like this one was caused by Norton. can we completely uninstall norton via the following link (we can reinstall afterwards and verify it was a corrupt Anti-virus) and see if the BSOD's stop?

https://www-secure.symantec.com/nor...t=home&pvid=f-home&version=1&lg=english&ct=us


i would also recommend running a ' SFC /SCANNOW ' from an administrative command line.

 

[heman22union]

found some interesting info

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff780c0000000
Arg3: 000000000000900d
Arg4: fffff9802c8b2009
 
Debugging Details:
------------------
 
 
BUGCHECK_STR:  0x1a_5003
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
 
PROCESS_NAME:  ccsvchst.exe
 
CURRENT_IRQL:  0
 
LAST_CONTROL_TRANSFER:  from fffff80002f35d1f to fffff80002ece1c0
 
STACK_TEXT:  
fffff880`0a11ce88 fffff800`02f35d1f : 00000000`0000001a 00000000`00005003 fffff780`c0000000 00000000`0000900d : nt!KeBugCheckEx
fffff880`0a11ce90 fffff800`02ee39e0 : fffff6fc`c0114b08 00000000`00000001 fffffa80`00000010 fffffa80`05feb3f0 : nt! ?? ::FNODOBFM::`string'+0x2a029
fffff880`0a11d000 fffff800`02ebc4ce : fffff980`22950000 00000000`00011000 00000000`00000000 fffffa80`0d53d3c0 : nt!MmCheckCachedPageStates+0x3c0
fffff880`0a11d1b0 fffff800`031b3a00 : 00000000`00000000 00000000`005d028e fffffa80`0c56c7c0 fffff8a0`01bef000 : nt!CcFetchDataForRead+0x10e
fffff880`0a11d210 fffff880`012d2f08 : fffff880`00000000 00000000`00000005 fffffa80`0002fd72 fffffa80`00010001 : nt!CcCopyRead+0x180
fffff880`0a11d2d0 fffff880`0100a098 : fffffa80`0c56c7c0 fffffa80`0d53d358 00000004`0000000c fffffa80`0c56c801 : Ntfs+0x99f08
fffff880`0a11d4b0 fffff880`0100d8ba : fffff880`0a11d580 fffff8a0`01bef003 fffff8a0`01bef000 fffffa80`0c56c700 : fltmgr!FltpPerformFastIoCall+0x88
fffff880`0a11d510 fffff880`0102b630 : fffffa80`0c56c7c0 00000000`00000000 fffff880`0a11d670 00000000`00010000 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0a11d550 fffff800`031b3539 : fffffa80`0c56c7c0 fffffa80`00000001 fffffa80`06d10080 fffffa80`0c56c7c0 : fltmgr!FltpFastIoRead+0x1d0
fffff880`0a11d5f0 fffff800`02ecd453 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x417
fffff880`0a11d6e0 fffff800`02ec9a10 : fffff880`040046a8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a11d8e8 fffff880`040046a8 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage
fffff880`0a11d8f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`0a11d940 : EX64+0x26a8
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
EX64+26a8
fffff880`040046a8 ??              ???
 
SYMBOL_STACK_INDEX:  c
 
SYMBOL_NAME:  EX64+26a8
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: EX64
 
IMAGE_NAME:  EX64.SYS
 
DEBUG_FLR_IMAGE_TIMESTAMP:  4f97c380
 
FAILURE_BUCKET_ID:  X64_0x1a_5003_EX64+26a8
 
BUCKET_ID:  X64_0x1a_5003_EX64+26a8
 
Followup: MachineOwner
---------
 
3: kd> lmvm EX64
start             end                 module name
fffff880`04002000 fffff880`04200000   EX64     T (no symbols)           
    Loaded symbol image file: EX64.SYS
    Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\VirusDefs\20120703.017\EX64.SYS
    Image name: EX64.SYS
    Timestamp:        Wed Apr 25 04:27:28 2012 (4F97C380)
    CheckSum:         001FDCF5
    ImageSize:        001FE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

looks like this one was caused by Norton. can we completely uninstall norton via the following link (we can reinstall afterwards and verify it was a corrupt Anti-virus) and see if the BSOD's stop?

https://www-secure.symantec.com/nor...t=home&pvid=f-home&version=1&lg=english&ct=us


i would also recommend running a ' SFC /SCANNOW ' from an administrative command line.

Funny you mention Norton. I originally installed Microsoft Security Essentials and told her not to install Norton. Well she wanted her 360 backup and her password saving/sync in IE so she removed MSE and put Norton. Tomorrow I will try and remove Norton. Just curious, is there a way to determine what date/time Norton was installed? Then I can compare it to when she had all those dumps.

 

[writhziden]

First crash occurred 5/26/2012. The crash did not blame Norton directly, but Norton was installed.

It is not likely that Norton is causing these crashes unless it is corrupted. The 2012 versions of Norton have caused very little problems on (most) systems.

Obviously, it would not hurt to remove Norton and replace it with MSE to test. If the user does so, make sure the Norton Removal Tool is used to remove it.

 

[heman22union]

Here are the CPUZ pics

 

[writhziden]

Hardware should be compatible.

Was Norton removed and replaced with MSE? Any results?