BSOD shortly after start up, Bugcheck code: 0x1E (0xFFFFFFFFC0000005,

[webcrawlur]

Hello, I have a Toshiba laptop that started with the BSOD right after a virus that was removed, not sure if related. Here is my who crashed copied and pasted. Not sure how to do a zip file of my minidump.

System Information (local)
</B>
computer name: OD-PC
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\windows
CPU: AuthenticAMD AMD C-50 Processor AMD586, level: 20
2 logical processors, active mask: 3
RAM: 8160927744 total
VM: 2147352576, free: 1970311168



[FONT=Segoe UI, Arial]
Crash Dump Analysis
</B>[/FONT]
[FONT=Segoe UI, Arial]Crash dump directory: C:\windows\Minidump[/FONT]
[FONT=Segoe UI, Arial][/FONT]
[FONT=Segoe UI, Arial]Crash dumps are enabled on your computer.
[/FONT]
[FONT=Segoe UI, Arial]On Sun 6/30/2013 12:31:50 AM GMT your computer crashed
crash dump file: C:\windows\Minidump\062913-54101-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x75C00)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003DD6BBA, 0x1, 0x18)
Error: [FONT=Segoe UI, Arial]KMODE_EXCEPTION_NOT_HANDLED[/FONT]
file path: C:\windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


[/FONT]
[FONT=Segoe UI, Arial]On Sun 6/30/2013 12:31:50 AM GMT your computer crashed
crash dump file: C:\windows\memory.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntkrnlmp.exe[/FONT] (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003DD6BBA, 0x1, 0x18)
Error: [FONT=Segoe UI, Arial]KMODE_EXCEPTION_NOT_HANDLED[/FONT]
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


[/FONT]
[FONT=Segoe UI, Arial]On Sat 6/29/2013 4:24:00 PM GMT your computer crashed
crash dump file: C:\windows\Minidump\062913-35973-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x75C00)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFFA800775C610, 0x0, 0x7FFFFFA8000)
Error: [FONT=Segoe UI, Arial]KMODE_EXCEPTION_NOT_HANDLED[/FONT]
file path: C:\windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


[/FONT]
[FONT=Segoe UI, Arial]On Sat 6/29/2013 4:18:40 PM GMT your computer crashed
crash dump file: C:\windows\Minidump\062913-54569-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x75C00)
Bugcheck code: 0xA (0x0, 0x2, 0x0, 0xFFFFF80003ACB315)
Error: [FONT=Segoe UI, Arial]IRQL_NOT_LESS_OR_EQUAL[/FONT]
file path: C:\windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


[/FONT]
[FONT=Segoe UI, Arial]On Sat 6/29/2013 3:19:27 AM GMT your computer crashed
crash dump file: C:\windows\Minidump\062813-37268-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]unknown_module_00000000_00000001.sys[/FONT] (Unknown_Module_00000000_00000001+0x0)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80003D84BBA, 0x1, 0x18)
Error: [FONT=Segoe UI, Arial]KMODE_EXCEPTION_NOT_HANDLED[/FONT]
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: unknown_module_00000000_00000001.sys .
Google query: [FONT=Segoe UI, Arial]unknown_module_00000000_00000001.sys KMODE_EXCEPTION_NOT_HANDLED[/FONT]

[/FONT]

 

[Dsprague]

Please follow the http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[webcrawlur]

Please follow the http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

Where will I find the zip file? I did download and run the sf software.

 

[Dsprague]

Did you run the program from your desktop? or did you run it from where ever you downloaded it to?

 

[webcrawlur]

Where I downloaded it to. I double clicked the file in the download folder to open it.

 

[Dsprague]

look in the folder where you downloaded the program the program generates a folder called Desktop when you run it where ever you run it.

 

[webcrawlur]

Ok, I think I found it, how do I zip it? Thanks so much for your help so far.


ETA: Found how to zip it, will post it in a few.

 

[Dsprague]

Right click the folder select send to from the context menu, then from the menu that opens after selecting send to select Compressed(Zipped) folder

 

[webcrawlur]

Thanks, I attached it in the post above yours.

 

[Dsprague]

OK a couple of things:

Update your graphics driver it is very old and is causing problems:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 116, {fffffa80067d84e0, fffff8800414e2dc, 0, 2}

Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
[COLOR="Red"]*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys [/COLOR]( atikmpag+72dc )

Followup: MachineOwner
---------

Driver Reference Table - atikmpag.sys

kd> lmvm atikmpag
start             end                 module name
fffff880`04147000 fffff880`04194000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    [COLOR="red"]Timestamp:        Thu Feb 10 12:15:07 2011[/COLOR] (4D541D1B)
    CheckSum:         0004D36C
    ImageSize:        0004D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Also update your SATA driverit seems to be causing problems and is again very old:

fffff880`0954b938  fffff880`00de6670Unable to load image \SystemRoot\system32\DRIVERS\amd_sata.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for amd_sata.sys
*** ERROR: Module load completed but symbols could not be loaded for amd_sata.sys
 amd_sata+0x1670

Driver Reference Table - amd_sata.sys

kd> lmvm amd_sata
start             end                 module name
fffff880`00de5000 fffff880`00dfb000   amd_sata T (no symbols)           
    Loaded symbol image file: amd_sata.sys
    Image path: \SystemRoot\system32\DRIVERS\amd_sata.sys
    Image name: amd_sata.sys
    [COLOR="red"]Timestamp:        Thu Nov 04 19:52:21 2010[/COLOR] (4CD34735)
    CheckSum:         00019FF4
    ImageSize:        00016000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Both drivers can be updated from here: Support & Drivers


your wireless driver seems to be failing as well:

fffff880`031d9688  fffff880`03eb0b01Unable to load image \SystemRoot\system32\DRIVERS\rtl8192Ce.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for rtl8192Ce.sys
*** ERROR: Module load completed but symbols could not be loaded for rtl8192Ce.sys
 rtl8192Ce+0x72b01

Driver Reference Table - rtl8192Ce.sys

Again it is very old:

kd> lmvm rtl8192Ce
start             end                 module name
fffff880`03e3e000 fffff880`03fab000   rtl8192Ce T (no symbols)           
    Loaded symbol image file: rtl8192Ce.sys
    Image path: \SystemRoot\system32\DRIVERS\rtl8192Ce.sys
    Image name: rtl8192Ce.sys
    [COLOR="red"]Timestamp:        Tue Jan 04 11:50:10 2011[/COLOR] (4D234FC2)
    CheckSum:         0011554E
    ImageSize:        0016D000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Updates can be found here: Realtek

 

[webcrawlur]

Hi, thanks again for your help, it appears the BSOD is stopped for now, I am not able to update the driver for the sata drive, not sure what is up with that. There are no options in the link you posted that I can see.

 

[Dsprague]

That's alright, for now observe and if you do not get another BSOD with in a week please mark the thread as solved.

 

[webcrawlur]

Good morning, it happened again:shock:, just a few minutes ago. Here is the zip file, thanks.

 

[koolkat77]

Security App

Start Menu\Programs\Norton Internet Security	Public:Start Menu\Programs\Norton Internet Security	Public

Remove Norton and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software. Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.

Microsoft Security Essentials, Free antivirus for windows and Malwarebytes Anti-Malware Free

   Information

• :warn: Do not start the free trial of MalwareBytes, unselect that option when prompted.
  
  
  
  
  
• :tip: Update and make full scans with both separately.

Virus check
Scan your system with the following:

Kaspersky TDSSKiller - How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)

ESET online scanner - One-time virus scanner free with ESET online scanner

Start up
Keep less stuff at the start-up. Only anti-virus, this helps avoid driver conflicts and improves time to log in to windows.
Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista
How to Change, Add, or Remove Startup Programs in Windows 7

SFC /scannow to check windows for corruption:

How to Repair Windows 7 System Files with System File Checker
1. Click Start

2. In the search box, type Command Prompt
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type

sfc /scannow

and hit enter.

Disk Check
For errors on your Hard drive(s): How to Run Disk Check in Windows 7

Memtest86+
Run Memtest86+ for at least 8-10 passes. It may take up to 20 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold. How to Test and Diagnose RAM Issues with Memtest86+

   Note

Pay close attention to part 3 of the tutorial in order to rule the faulty RAM stick out.

   Tip

Do this test overnight.

 

[webcrawlur]

Security App

Start Menu\Programs\Norton Internet Security    Public:Start Menu\Programs\Norton Internet Security    Public

Remove Norton and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software. Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.

Microsoft Security Essentials, Free antivirus for windows and Malwarebytes Anti-Malware Free

   Information

• :warn: Do not start the free trial of MalwareBytes, unselect that option when prompted.
  
  
  
  
  
• :tip: Update and make full scans with both separately.

Virus check
Scan your system with the following:

Kaspersky TDSSKiller - How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)

ESET online scanner - One-time virus scanner free with ESET online scanner

Start up
Keep less stuff at the start-up. Only anti-virus, this helps avoid driver conflicts and improves time to log in to windows.
Troubleshoot a Problem by Performing a Clean Startup in Windows 7 or Vista
How to Change, Add, or Remove Startup Programs in Windows 7

SFC /scannow to check windows for corruption:

How to Repair Windows 7 System Files with System File Checker
1. Click Start

2. In the search box, type Command Prompt
3. In the list that appears, right-click on cmd.exe and choose Run as administrator
4. In the command window that opens, type

sfc /scannow

and hit enter.

Disk Check
For errors on your Hard drive(s): How to Run Disk Check in Windows 7

Memtest86+
Run Memtest86+ for at least 8-10 passes. It may take up to 20 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold. How to Test and Diagnose RAM Issues with Memtest86+

   Note

Pay close attention to part 3 of the tutorial in order to rule the faulty RAM stick out.

   Tip

Do this test overnight.

Thanks for your help, the TDSSkiller seems to have done the trick, found a virus and deleted it, no more BSOD, almost two weeks now. Will keep you all updated.

 

[koolkat77]

Thanks for your help, the TDSSkiller seems to have done the trick, found a virus and deleted it, no more BSOD, almost two weeks now. Will keep you all updated.

Good to hear. Thanks for the update.