Itunes error leading to brief BSOD

[scamander]

Hi all,

Windows Startup repair occasionally pops up on startup though it can never find what the problem was. Interestingly its occurence dimininished rapidly when I replaced MSE with Avast.

Anyway - loaded up as normal and then got a pop up concerning Itunes. The pop up said "Itunes not installed correctly. Please Re-install. Error 7 (Win error 193).

The screen then flashed up with lines down it (very quickly) then onto a blue screen with various data. Windows then reloaded and everything was fine.

The latter part has happened once or twice before a while ago. I had Windows reinstalled less than a year ago. I have replaced my grpahics card in the summer.

I'm just concerned that one day the pc won't work. I'm unemployed as use the PC daily to search and apply for jobs...so it would be sod's law if this went down.

Any ideas or advice?

 

[JMH]

scamander,

IF you have been getting BSOD'S...

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP.

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[scamander]

JMH,

cheers - you should find the requested info attached. Hope it's done ok!

 

[JMH]

* Avast can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST.

http://files.avast.com/files/eng/aswclear5.exe

Microsoft Security Essentials - Free Antivirus for Windows


* Please download the free version of Malwarebytes.
Update it immediately.
Do a full system scan
Let us know the results at the end.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

 

[scamander]

Hi JMH,

I scan with Malware regularly and did one yesterday and it was all good. As for swtiching back to MSE, I was getting Windows Startup Repair reaularly (2/3 times a week). Since I replaced I've experienced a massive drop in Startup occurences.

I'll go back to using it though - how do you want me to text it exactly??

 

[JMH]

Malwarebytes scan? { or another "breed"}

It would be most unlikely if MSE created the type of problems you describe above...

Advice stands. Up to you to take it or not.

 

[scamander]

JMH,

OK - I'll go back to MSE. I've enabled the minidumps as directed, if I get any more issues I assume I can just repost them on here. I take it there wasn't anything that nasty on them??

 

[scamander]

oh - and it is Malwarebytes I use! Apols for the mis-type.

 

[JMH]

Unfortunately there was nothing definitive.
If you get another DMP upload it here again.

 

[scamander]

cheers JMH!

 

[JMH]

Looking forward to hearing back.

 

[scamander]

Hi JMH,

got a full BSD today upon staup - rebooted with no probs. As per your advice I've attached the minidump file. Much appreciated if you can take a look.

 

[JMH]

These crashes were caused by memory corruption (probably a driver).
Please run these two tests to verify your memory and find which driver is causing the problem.
If you are overclocking anything reset to default before running these tests.
In other words STOP!!!


1-Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html



2-Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Using Driver Verifier to identify issues with Windows drivers for advanced users

 

[scamander]

cheers JMH,

I ran the Memtest a month or so ago and it was all clear. Out of interest I downloaded whocrashed and the reports it gave may make some sense to you:

[FONT=Segoe UI, Arial]Crash dump directory: C:\Windows\Minidump[/FONT]

[FONT=Segoe UI, Arial][FONT=Segoe UI, Arial]Crash dumps are enabled on your computer.
[/FONT][/FONT]

[FONT=Segoe UI, Arial]On Wed 01/02/2012 17:21:23 GMT your computer crashed
crash dump file: C:\Windows\Minidump\020112-20248-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7CC40)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80002EDD3A4, 0x1, 0x0)
Error: [FONT=Segoe UI, Arial]KMODE_EXCEPTION_NOT_HANDLED[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Fri 27/01/2012 08:20:53 GMT your computer crashed
crash dump file: C:\Windows\Minidump\012712-24632-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7CC40)
Bugcheck code: 0x109 (0xA3A039D8957A28BC, 0xB3B7465EE7F6F822, 0xFFFFF80002E625FC, 0x1)
Error: [FONT=Segoe UI, Arial]CRITICAL_STRUCTURE_CORRUPTION[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that the kernel has detected critical kernel code or data corruption.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Fri 27/01/2012 08:20:53 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntkrnlmp.exe[/FONT] (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x109 (0xA3A039D8957A28BC, 0xB3B7465EE7F6F822, 0xFFFFF80002E625FC, 0x1)
Error: [FONT=Segoe UI, Arial]CRITICAL_STRUCTURE_CORRUPTION[/FONT]
Bug check description: This indicates that the kernel has detected critical kernel code or data corruption.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Sat 14/01/2012 08:36:43 GMT your computer crashed
crash dump file: C:\Windows\Minidump\011412-23977-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x445E7F)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80003262E7F, 0xFFFFF88003169238, 0xFFFFF88003168A90)
Error: [FONT=Segoe UI, Arial]SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Sun 08/01/2012 09:34:16 GMT your computer crashed
crash dump file: C:\Windows\Minidump\010812-17784-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7CC40)
Bugcheck code: 0xA (0x3095F40, 0x2, 0x1, 0xFFFFF80002ED6C1F)
Error: [FONT=Segoe UI, Arial]IRQL_NOT_LESS_OR_EQUAL[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

[FONT=Segoe UI, Arial]On Fri 06/01/2012 07:06:31 GMT your computer crashed
crash dump file: C:\Windows\Minidump\010612-22698-01.dmp
This was probably caused by the following module: [FONT=Segoe UI, Arial]ntoskrnl.exe[/FONT] (nt+0x7CC40)
Bugcheck code: 0xA (0x557805C, 0x2, 0x0, 0xFFFFF80002E108E8)
Error: [FONT=Segoe UI, Arial]IRQL_NOT_LESS_OR_EQUAL[/FONT]
file path: C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI, Arial]Microsoft® Windows® Operating System[/FONT]
company: [FONT=Segoe UI, Arial]Microsoft Corporation[/FONT]
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.
[/FONT]

As for the other idea - great call. Going to have to do it when I have 5 mins though.

 

[JMH]

"WhoCrashed" we don't use.

Advice stands as per my Post 13.
Up to you to follow it....or not.