crashes, no bsod

[thetruenorth]

had a lot of crashes, try posted fixes & finally did a total system recovery install 12/8/10( disks provided by manufacturer)
2 hrs into new machine & they started again
Errors in P&R report suggest keyboard & mouse
switch keyboards to manufacture's (cheapie) & mouse is up to date & win7 compliant.
As far as i can tell all drivers seem to be up to date.
starting to loose my hair over this.
any help is more than greatly appreciated

Specs
System Manufacturer/Model Number ACER M5811 OS windows7 Home Premium 64 oem CPU DualCore Intel Core i5 650, 3333 MHz (25 x 133) Motherboard Foxconn H57M01 Memory 6071 MB Graphics Card(s) ATI Radeon HD 4600 Series (1024 MB) Sound Card ATI Radeon HDMI @ ATI RV710/730/740 - High Def Monitor(s) Displays Acer AL1916W [19" LCD] (6290AE094010) Screen Resolution N/A Hard Drives ST31000528AS (1000 GB, 7200 RPM, SATA-II)
WDC WD10EADS-00P8B0 (931 GB, IDE)

 

[thetruenorth]

& 2 more crashes since first posting

 

[thetruenorth]

a little help please

 

[wish]

Go to device manager and see if there is any yellow exclamation, so you need to install the proper driver for its device.

 

[thetruenorth]

Thank you for your reply.
There,s no conflicts in the device manager.
I've attacked a report compiled this morning.
In the system diagnostic report it states the error 'tv_ConfigMgrErr24' & I've searched through Google & can't find anything relevant to this system. ( of course my debugging skills are pretty much non-existent)
According to Driver Genius all my drivers are up to date.
this is happening after a fresh install & with no load at all. Last crash the only thing i was doing was on the web. before I reinstalled & tried various security programs all with no efect.
again thanks for your reply
Cheerz

 

[wish]

Hi,
There is no .dmp files in your attachment, take a look at folder C:\Windows\Minidump\

And make sure your system is set to create dump files.
Set MiniDump

 

[thetruenorth]

set the mini dump as you suggested, I not sure this will help , the system crash just turns itself off, there is no bcod or time for it to write the dump, just a hard crash then a restart asking what mode to start in

 

[thetruenorth]

just had another crash, the only program running was firefox.
& there is no minidump folder under C:\Windows\Minidump\
attached a copy of the error

 

[wish]

Honestly, it's difficult for me to diagnose your problem without dmp file.
Start with uninstall your Eset Antivirus completely and replace it with MSE.
http://www.microsoft.com/security_essentials/

Perform system file checker:
Right click Command Prompt → run as admin → sfc /scannow

Then update/reinstall your Intel Gigabit Network Adapter
http://downloadcenter.intel.com/

 

[thetruenorth]

had another crash while downloading security_essentials/ but we had a BSOD, first one,
here's the minidump
hopefully there's some help in it, I'll continue on with your advice

 

[thetruenorth]

another crash, this time no bsod.
removed eset
installed essentials
according to Intel, using their update utility,drivers are up to date Intel® Driver Update Utility
scannow found no errors
I have run memtest86 a few time, no errors found there
anything else I can do to , Ill try anything, these are getting annoying & I'm getting worried about them harming the hardware
again thanks for your help

 

[wish]

Hi,
Your dmp bugcheck SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e), usual caused by driver.

Enable driver verifier and wait until your windows get BSOD, then attach new file here.
http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002fc191c, fffff880031cb988, fffff880031cb1f0}

Probably caused by : ntkrnlmp.exe ( nt!CmpRemoveKeyHash+4c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002fc191c, The address that the exception occurred at
Arg3: fffff880031cb988, Exception Record Address
Arg4: fffff880031cb1f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
nt!CmpRemoveKeyHash+4c
fffff800`02fc191c 488b01          mov     rax,qword ptr [rcx]

EXCEPTION_RECORD:  fffff880031cb988 -- (.exr 0xfffff880031cb988)
ExceptionAddress: fffff80002fc191c (nt!CmpRemoveKeyHash+0x000000000000004c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880031cb1f0 -- (.cxr 0xfffff880031cb1f0)
rax=ffff00a00ed78708 rbx=fffff8a00e3deb98 rcx=ffff00a00ed78710
rdx=00000000000003a2 rsi=0000000000000004 rdi=fffff880031cbc00
rip=fffff80002fc191c rsp=fffff880031cbbc8 rbp=fffff880031cbc8c
 r8=000000007735940e  r9=000000003b94c536 r10=fffff8a00ea08008
r11=fffff8a00e3deba8 r12=0000000000000003 r13=0000000000000003
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!CmpRemoveKeyHash+0x4c:
fffff800`02fc191c 488b01          mov     rax,qword ptr [rcx] ds:002b:ffff00a0`0ed78710=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!CmpRemoveKeyHash+4c
fffff800`02fc191c 488b01          mov     rax,qword ptr [rcx]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002fc1ae6 to fffff80002fc191c

STACK_TEXT:  
fffff880`031cbbc8 fffff800`02fc1ae6 : fffff8a0`0e3deb98 fffff880`031cbc8c 00000000`00000004 00000000`00000246 : nt!CmpRemoveKeyHash+0x4c
fffff880`031cbbd0 fffff800`02f25aee : fffff8a0`0e3deb98 fffff880`031cbc74 00000000`00000004 00000000`00000002 : nt!CmpCleanUpKcbCacheWithLock+0x52
fffff880`031cbc00 fffff800`02cda961 : fffff800`02f257b4 fffff800`02e725f8 fffffa80`0551ab60 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a
fffff880`031cbcb0 fffff800`02f71c06 : 00000000`00000000 fffffa80`0551ab60 00000000`00000080 fffffa80`0548b840 : nt!ExpWorkerThread+0x111
fffff880`031cbd40 fffff800`02cabc26 : fffff880`02fd3180 fffffa80`0551ab60 fffff880`02fddfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`031cbd80 00000000`00000000 : fffff880`031cc000 fffff880`031c6000 fffff880`031cadc0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!CmpRemoveKeyHash+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff880031cb1f0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!CmpRemoveKeyHash+4c

BUCKET_ID:  X64_0x7E_nt!CmpRemoveKeyHash+4c

Followup: MachineOwner
---------

 

[thetruenorth]

Hi,
thanks for your help.
I've enabled the Enable driver verifier as you asked but with dzs of crashes I've only seen the bsod once.
Not too sure this will work :/

 

[thetruenorth]

And of course we just had a bsod (2nd one)

 

[wish]

Hi,
Driver verifier find violation on KernExplorer64.sys.
It is part of Lavasoft Ad-Aware Antivirus so you must uninstall it completely.

Are you by chance use Avira antivirus? If that true then you must uninstall it and use MSE, because MSE can running better in kernel Windows.
After we finish and the problem gone, then you may go back to your AV.

Just continue the verifier to reveal more driver issue.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {3c, 14c, 0, 0}

Unable to load image KernExplorer64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for KernExplorer64.sys
*** ERROR: Module load completed but symbols could not be loaded for KernExplorer64.sys
Probably caused by : KernExplorer64.sys ( KernExplorer64+1277 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 000000000000003c, ObReferenceObjectByHandle is being called with a bad handle.
Arg2: 000000000000014c, bad handle passed in,
Arg3: 0000000000000000, object type,
Arg4: 0000000000000000, 0.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_3c

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800031603dc to fffff80002cd6740

STACK_TEXT:  
fffff880`082ed858 fffff800`031603dc : 00000000`000000c4 00000000`0000003c 00000000`0000014c 00000000`00000000 : nt!KeBugCheckEx
fffff880`082ed860 fffff800`0317590f : 00000000`000002d4 fffffa80`06849960 fffff880`082ed930 fffff880`06f9db7a : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`082ed8a0 fffff880`06f9d277 : 00000000`00000000 fffffa80`06eee000 fffffa80`06849960 00000000`00000000 : nt!VerifierObReferenceObjectByHandle+0xdf
fffff880`082ed8f0 00000000`00000000 : fffffa80`06eee000 fffffa80`06849960 00000000`00000000 fffff880`082ed9b0 : KernExplorer64+0x1277


STACK_COMMAND:  kb

FOLLOWUP_IP: 
KernExplorer64+1277
fffff880`06f9d277 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  KernExplorer64+1277

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: KernExplorer64

IMAGE_NAME:  KernExplorer64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc52d94

FAILURE_BUCKET_ID:  X64_0xc4_3c_KernExplorer64+1277

BUCKET_ID:  X64_0xc4_3c_KernExplorer64+1277

Followup: MachineOwner
---------

 

[thetruenorth]

thanks wish.
uninstalled ad aware & reinstalled essentials ( just seemed a little slow)
do I reset the verifier after i get a blue screen or does it stay setup?
I'll reset it just incase

 

[thetruenorth]

Thanks wish.
uninstalled ad aware & Avira antivirus, reinstalled essentials ( just seemed a little slow)
do I reset the verifier after a blue screen? I did just in case.
I've been crash free since the last one, over a day now
again tkx wish, feels like I'm getting somewhere with this

 

[thetruenorth]

Another crash with no blue screen..........
do I reset verifier?

 

[wish]

Yes, you may turn off the verifier for time being, and see how it goes.

 

[thetruenorth]

thanks wish, I'll report back here in a few days