BSOD various error codes occuring

[scarborough]

BSOD various error codes occurring

Hi there. Starting since about a week ago my system has been constantly getting BSODs ranging from codes (driver)IRQL not less or equal, page fault in non paged area, to KMODE exception not handled, among a couple of others.

I would really appreciate it if I can get help and finally be able to fix these. I've sifted through a lot of suggestions through other sites such as scanning the system through cmd and using different diagnostic tools that I've read in other forums, but they oddly come out negative (hardware/memory). I'm at my wit's end troubleshooting, and would gladly accept advice after finally deciding to join this forum.

My system specs are:
Windows 7 Home Premium
x64-based PC

My system is about less than 2 years old, a Toshiba Qosmio X505-Q887.

Attached are my dump & system file collection and performance report as per the BSOD posting guideline sticky.

 

[JMH]

1. I note you have AVG.
AVG can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows



2. Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads http://duplexsecure.com/faq

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

http://www.magiciso.com/download.htm

 

[zigzag3143]

There are far to many probable causes to be certain ATM. The most recent ones have uptimes of around 15 mins and from that I would think a driver rather than hardware.

I would run several tests to be certain.

Lets start with a system file check.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7

If it passes that we can run driver verifier to check what driver is misbehaving.

 

[scarborough]

Wish I could've replied sooner. Had work all day.

@JMH

I will try and do that, though AVG has been my antivirus software for a while now and I'd be really surprised if it turns out to be one of the reasons for my BSOD.

And to do as much as even giving a replacement Virtual CD/DVD-ROM! I'm grateful for the tip, thanks.

*Daemon tool removed

@zigzag3143

Just did the scan as you suggested. Got "Windows Resource Protection did not find any integrity
violations."

Also, I've already tried Driver Verifier before, if that counts. I saw it in one of the other forums, checked all non-Windows related drivers, then restarted the system. But then I ended up with a stop code 0x000000C9, saying "The IO manager has detected a violation by a driver that is being verified." Had a bit of trouble getting the system to reboot properly, then resetting the Verifier settings after successfully doing so.

 

[scarborough]

Also, I ran a Disk Check and the scan found no errors whatsoever. Just wanted to add this in case it helps.

[EDIT] I was able to use my system smoothly for a good hours straight. I turned it off and turned it on again after a few hours, and got a BSOD in the middle of an online match, stating another IRQL not or less equal error caused by ntoskrnl.exe (26ee0). Hope this helps.

 

[writhziden]

Please upload the latest full crash reports using the instructions as before so we may analyze them.

 

[scarborough]

Thanks for replying. I attached the crash report which I've finished just now.

 

[writhziden]

Antivirus Software:

avgcsrva.exe	c:\program files (x86)\avg\avg2012\avgcsrva.exe	3040	8	200	1380	2012/03/05 12:41	12.0.0.1786	507.34 KB (519,520 bytes)	2011/08/15 6:21
avgemca.exe	c:\program files (x86)\avg\avg2012\avgemca.exe	2416	8	200	1380	2012/03/05 12:41	12.0.0.1854	1.52 MB (1,593,696 bytes)	2011/09/21 19:53
avgidsagent.exe	c:\program files (x86)\avg\avg2012\avgidsagent.exe	2588	8	200	1380	2012/03/05 12:41	12.0.0.1855	4.23 MB (4,433,248 bytes)	2011/10/12 6:25
avgnsa.exe	c:\program files (x86)\avg\avg2012\avgnsa.exe	2408	8	200	1380	2012/03/05 12:41	12.0.0.1883	1.90 MB (1,987,424 bytes)	2011/09/13 10:33
avgrsa.exe	c:\program files (x86)\avg\avg2012\avgrsa.exe	3020	8	200	1380	2012/03/05 12:41	12.0.0.1806	1.31 MB (1,370,464 bytes)	2011/09/08 20:53
avgtray.exe	c:\program files (x86)\avg\avg2012\avgtray.exe	4796	8	200	1380	2012/03/05 12:42	12.0.0.1912	2.30 MB (2,416,480 bytes)	2012/01/24 17:24
avgwdsvc.exe	c:\program files (x86)\avg\avg2012\avgwdsvc.exe	1836	8	200	1380	2012/03/05 12:41	12.0.0.1773	188.26 KB (192,776 bytes)	2011/08/02 6:09
ccsvchst.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\ccsvchst.exe	1968	8	200	1380	2012/03/05 12:41	109.0.0.107	123.43 KB (126,392 bytes)	2011/12/09 18:59
ccsvchst.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\ccsvchst.exe	3920	8	200	1380	2012/03/05 12:42	109.0.0.107	123.43 KB (126,392 bytes)	2011/12/09 18:59
symcpcculaunchsvc.exe	c:\program files (x86)\norton pc checkup\engine\2.0.3.198\symcpcculaunchsvc.exe	5944	8	200	1380	2012/03/05 12:44	1.0.0.13	132.43 KB (135,608 bytes)	2011/12/09 18:59

I would recommend removing Norton PC Checkup. I do not see the benefit of the software, and it may cause conflicts on the system.


Possible out of date drivers

regi	fffff880`052d9000	fffff880`052e1000	Mon Apr 16 09:19:10 2007 (462393ee)	000082b5		regi.sys
GEARAspiWDM	fffff880`041ea000	fffff880`041f7000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
tosrfec	fffff880`0303a000	fffff880`03043000	Mon Jun 01 00:58:53 2009 (4a237c2d)	00014970		tosrfec.sys
QIOMem	fffff880`101eb000	fffff880`101f5000	Sun Jun 14 23:58:48 2009 (4a35e318)	0000ab35		QIOMem.sys
tosporte	fffff880`05593000	fffff880`055a4000	Tue Jun 16 04:48:47 2009 (4a37788f)	00010ea3		tosporte.sys
TVALZFL	fffff880`0404d000	fffff880`04054000	Fri Jun 19 04:05:44 2009 (4a3b62f8)	00010921		TVALZFL.sys
pgeffect	fffff880`0545c000	fffff880`05462e80	Mon Jun 22 03:00:11 2009 (4a3f481b)	00017d48		pgeffect.sys
tos_sps64	fffff880`01cfd000	fffff880`01d77000	Tue Jun 23 23:31:09 2009 (4a41ba1d)	0007eb46		tos_sps64.sys
thpdrv	fffff880`01d79000	fffff880`01d85000	Sun Jun 28 20:02:56 2009 (4a4820d0)	000138cc		thpdrv.sys
Thpevm	fffff880`01d77000	fffff880`01d78f80	Mon Jun 29 02:15:37 2009 (4a487829)	000124b8		Thpevm.SYS

regi.sys
QIOMem.sys
tosporte.sys
TVALZFL.sys
pgeffect.sys
tos_sps64.sys
thpdrv.sys
Thpevm.SYS

None of the above raise red flags, but if there are any updates available through the Toshiba support site, I would recommend downloading and installing them.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\scarborough\Windows_NT6_BSOD_jcgriff2\030412-15007-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03859000 PsLoadedModuleList = 0xfffff800`03a9e670
Debug session time: Sun Mar  4 21:51:45.166 2012 (UTC - 7:00)
System Uptime: 0 days 0:23:08.259
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8047a4f830, 2, 1, fffff800038dafaa}

Probably caused by : ntkrnlmp.exe ( nt!KiCommitThreadWait+24a )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8047a4f830, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800038dafaa, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003b08100
 fffffa8047a4f830 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiCommitThreadWait+24a
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  plugin-contain

TRAP_FRAME:  fffff88009ca98f0 -- (.trap 0xfffff88009ca98f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000fff7d000 rbx=0000000000000000 rcx=fffff88009ca9a40
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038dafaa rsp=fffff88009ca9a80 rbp=0000000000000000
 r8=fffffa8002c9a6f8  r9=0000000000000000 r10=fffffffffffffff7
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KiCommitThreadWait+0x24a:
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7 ds:00bd:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800038d51e9 to fffff800038d5c40

STACK_TEXT:  
fffff880`09ca97a8 fffff800`038d51e9 : 00000000`0000000a fffffa80`47a4f830 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09ca97b0 fffff800`038d3e60 : 00000000`00000000 fffff800`038d88a4 00000000`00000003 fffffa80`07a4f770 : nt!KiBugCheckDispatch+0x69
fffff880`09ca98f0 fffff800`038dafaa : fffffa80`07a4f770 fffffa80`07a4f770 00000000`00000000 fffffa80`00000003 : nt!KiPageFault+0x260
fffff880`09ca9a80 fffff800`038dd74f : 00000000`00000378 fffffa80`07a4f770 fffffa80`0000009e fffff800`038d823f : nt!KiCommitThreadWait+0x24a
fffff880`09ca9b10 fffff800`03bcc44e : 00000000`064bb000 fffff880`00000006 00000000`00000001 fffff800`03bc0000 : nt!KeWaitForSingleObject+0x19f
fffff880`09ca9bb0 fffff800`038d4ed3 : fffffa80`07a4f770 00000000`00000378 fffff880`09ca9bf8 fffffa80`053a9ae0 : nt!NtWaitForSingleObject+0xde
fffff880`09ca9c20 00000000`726d2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0441edd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x726d2e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiCommitThreadWait+24a
fffff800`038dafaa f00fba2e07      lock bts dword ptr [rsi],7

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiCommitThreadWait+24a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiCommitThreadWait+24a

BUCKET_ID:  X64_0xA_nt!KiCommitThreadWait+24a

Followup: MachineOwner
---------

In addition to the above, I see a number of memory_corruption crashes. Also, there were a couple network related crashes that may have been related to AVG...

Start with the possible memory problems:

• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

Another concern is all the corrupted .dmp files. This could indicate hard drive problems. Since the Windows hard disk check came up clean, I would recommend a more intensive check with the Drive Fitness Test

 

[scarborough]

Removed/Deleted the Norton PC Check-up (it was not appearing in the installed programs list, so I deleted the folders.) And will update the drivers you mentioned.

For the Memtest, I will run it later tonight before going to sleep, I really appreciate the detailed information you gave, thanks. Will get back to you once I'm done with the testing.

[EDIT] Apparently that Norton PC Check-up was the Toshiba Laptop Checkup, only under that name. Successfully uninstalled.

 

[writhziden]

No problem. Look forward to finding out how the tests go. Best of luck!

 

[zigzag3143]

Would ALSO recommend you remove AVG and replace it Microsoft security Essentials.

I note you have AVG.
AVG can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows


Jan & Ken

 

[scarborough]

Reporting with an update:

I managed to run a Memtest scan using the USB bootable (took me a while to figure out how to prioritize it as the bootable drive since my BIOS was a bit different from the ones I saw online), and managed to run up to 11 passes. This was run through the course of around 11 hours, and no errors were found in the process. In the bottom of the screen it said that the Pass was complete and I can escape anytime so I did.

Proceeding with the extended version of the Windows Diagnostic Tool next.

[EDIT] Also since joining here I have not been getting any blue screens since, BUT my computer has been randomly freezing up still, in case this means anything.

I've removed and re-installed AVG. But since you suggest putting Essentials instead, I will try.

 

[scarborough]

I finished the extended version of the Memory Diagnostic Tool test (took around a good 7 hours or so). I'm not sure where to check for a detailed analysis, but I received a quick pop up from the notification area saying it found no problems, and I checked the System tab of the Event Viewer, and found two entries stating that the Memory test did not find any errors.

This is starting to make me wonder.

I'll now proceed with the Driver Fitness test next, though I'll have to get myself a CD first before I can do this. Will update as soon as I'm done with it.

[EDIT] HOOOkay. I got another IRQL not or less equal BSOD after turning on my laptop from sleep mode. Does that mean anything?

I also uninstalled AVG for MSE. I was reluctant because AVG has proven itself many times by blocking a lot of threats from my pc, and not sure if MSE can do the same. Done anyway.

I now got a whopping 39 pending updates from Windows Update, but mostly from Microsoft Office. As I do not have the product keys for the software anyway, should I still install them?

I apologize for the incessant editing, but I'd rather do this than incur a triple post. I got another IRQL not or less equal BSOD even after installing MSE. This is really starting to test my patience.

 

[zigzag3143]

I finished the extended version of the Memory Diagnostic Tool test (took around a good 7 hours or so). I'm not sure where to check for a detailed analysis, but I received a quick pop up from the notification area saying it found no problems, and I checked the System tab of the Event Viewer, and found two entries stating that the Memory test did not find any errors.

This is starting to make me wonder.

I'll now proceed with the Driver Fitness test next, though I'll have to get myself a CD first before I can do this. Will update as soon as I'm done with it.

[EDIT] HOOOkay. I got another IRQL not or less equal BSOD after turning on my laptop from sleep mode. Does that mean anything?

I also uninstalled AVG for MSE. I was reluctant because AVG has proven itself many times by blocking a lot of threats from my pc, and not sure if MSE can do the same. Done anyway.

I now got a whopping 39 pending updates from Windows Update, but mostly from Microsoft Office. As I do not have the product keys for the software anyway, should I still install them?

I apologize for the incessant editing, but I'd rather do this than incur a triple post. I got another IRQL not or less equal BSOD even after installing MSE. This is really starting to test my patience.

Sorry for the absence. Had a machine meltdown. I would do any critical OS updates (not the office ones yet)

If you keep BSODing upload the DMP files.

 

[scarborough]

Not at all. Thanks for replying. Hope your machine's running fine now.

I ran full scan of MSE (5 hours), and to my surprise, it found a number of threats that even Malwarebytes, AVG, nor TDSS killer wasn't able to detect.

The threat name was Trojan:JS/Hiloti.C, along with Java related files. Before I could manage to remove them though (as I was reading the source and details) I suddenly got that IRQL BSOD so my computer restarted. Went into safe mode, restarted, logged in my user and to my relief the results were still there and allowed me to remove them. Though stubborn as I was I decided to read the details first and yet again, I was faced with IRQL BSOD. Cycled a third time and deleted it without hesitation.

Sorry if that explanation was too long, but I wanted to provide as much information as I could to make sure that it was this trojan that was causing my blue screen/s and errors. I just can't figure out why all the other tools weren't able to detect this. Does this at least explain why my software/device scans all passed the testings?

If it is, I'd appreciate to hear tips to further, thoroughly make sure that this really was the cause of the BSODs.

 

[zigzag3143]

Not at all. Thanks for replying. Hope your machine's running fine now.

I ran full scan of MSE (5 hours), and to my surprise, it found a number of threats that even Malwarebytes, AVG, nor TDSS killer wasn't able to detect.

The threat name was Trojan:JS/Hiloti.C, along with Java related files. Before I could manage to remove them though (as I was reading the source and details) I suddenly got that IRQL BSOD so my computer restarted. Went into safe mode, restarted, logged in my user and to my relief the results were still there and allowed me to remove them. Though stubborn as I was I decided to read the details first and yet again, I was faced with IRQL BSOD. Cycled a third time and deleted it without hesitation.

Sorry if that explanation was too long, but I wanted to provide as much information as I could to make sure that it was this trojan that was causing my blue screen/s and errors. I just can't figure out why all the other tools weren't able to detect this. Does this at least explain why my software/device scans all passed the testings?

If it is, I'd appreciate to hear tips to further, thoroughly make sure that this really was the cause of the BSODs.

No way to be sure but malware often causes bsod's. I would re-run Malwarebytes again just to be sure.

If it were mine I would clean to be certain.

 

[scarborough]

Just finished scanning with Malwarebytes. Scans found 0 errors/infections.

Though my laptop just froze again, and after I restarted, my screen went black. Should I zip up another system report?

[EDIT] Scratch that. Just got another blue screen. I'll be uploading another report in a few.

Attached a system report. Thanks for baring with me, people.

Also in the span of time after doing the report, I had two BSODs, one Page fault and one IRQL not or less equal, both caused by ntoskrnl.exe. Hope that contributes.

 

[scarborough]

Guess it's that hopeless huh? Anyone?

 

[writhziden]

zigzag3143 is one of the busiest members on here, so sometimes threads get missed. Sorry about that. Did you run the drive fitness test yet?

Run the following to test hardware:

• Monitor temperatures during the following tests.
  
  Use the following programs to monitor the temperatures.​
  • Real Temp is a good CPU temperature monitor.
  • Speccy - System Information - Free Download will monitor all hardware temperatures.
  • HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
  • 
    Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
    
    
  • Run http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.

 

[scarborough]

I ran that prime95 program, and I'm not sure if it helped cause the bsod but I got a new one about after 20 minutes later named "A device driver attempting to corrupt the system has been caught." Could this finally be the cause of all my bsods so far?

Attached is the latest report from my system. Again, I appreciate the time you guys take to help.

[EDIT] I read in another site that one of the blue screens I suffered may be caused by a hacker trying to access my system. That's very bothering indeed.