Solved Kernel-Power Event ID 41 BSOD playing game

[Richiebro72]

Recently my laptop has crashed a couple of times while gaming. It first crashed around three weeks back when playing Dota 2 and today when playing Team Fortress 2. I checked my event viewer and the critical error from both occasions was Kernel Power Event ID 41. On the first crash, the screen simply went black and the laptop turned off. On the second crash, the system shut itself down and a blue screen appeared. Also the second crash was accompanied with a BugCheck error Event Id 1001 telling me a dump was saved. I've attached the dump file so hopefully it can be accessed easily on the forum. Any help with this issue would be greatly appreciated.

Event Kernel-Power
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2013-09-10T08:06:49.766033600Z" />
<EventRecordID>419678</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>Richie-HP</Computer>
<Security UserID="S-1-5-18" />
</System>

Event BugCheck
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-09-10T08:07:50.000000000Z" />
<EventRecordID>419675</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>RICHIE-HP</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">0x00000024 (0x00000000001904fb, 0xfffff88002fcc8d8, 0xfffff88002fcc130, 0xfffff880012aee27)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">091013-61916-01</Data>
</EventData>
</Event>

Here are my specs:
Laptop
Computer Manufacturer
HP Pavilion G6
OS
Windows 7
CPU
AMD E2-3000M APU with Radeon(tm) HD Graphics 1.8ghz
Memory
8gb RAM
Graphics Card(s)
AMD Radeon 6380g

 

[Arc]

Post it following the Blue Screen of Death (BSOD) Posting Instructions.

 

[Richiebro72]

Sorry about that, I'm new. Here's the new Zip file following the BSOD Posting Instructions. I hope this thread is in the right place. Please let me know if I've done anything wrong.

 

[Arc]

Do some Disc checks.

1. Run chkdsk /f/r, following the option two of the tutorial Disk Check
2. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

Update the AMD SATA Controller AHCI 1.2 Device DriverFrom AMD Chipset Drivers. It is old.

fffff880`00e2f000 fffff880`00e46000   amd_sata   (deferred)             
    Image path: \SystemRoot\system32\drivers\amd_sata.sys
[COLOR=Red]    Image name: amd_sata.sys
    Timestamp:        Fri Jun 17 00:37:44 2011[/COLOR] (4DFA5480)
    CheckSum:         0001BC1D
    ImageSize:        00017000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall AVG, at least for a test. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.


Let us know the results.

---------------------------------------------------------------------------
BSOD ANALYSIS:

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88002fcc8d8, fffff88002fcc130, fffff880012aee27}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+1e7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88002fcc8d8
Arg3: fffff88002fcc130
Arg4: fffff880012aee27

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88002fcc8d8 -- (.exr 0xfffff88002fcc8d8)
ExceptionAddress: fffff880012aee27 (Ntfs!NtfsCommonClose+0x00000000000001e7)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88002fcc130 -- (.cxr 0xfffff88002fcc130)
rax=0200011200000001 rbx=fffffa8009555a40 rcx=fffffa8009cdda58
rdx=fffff8a00d0d7140 rsi=fffff8a00d0d7010 rdi=fffff88002fccc38
rip=fffff880012aee27 rsp=fffff88002fccb10 rbp=fffff80003032280
 r8=0000000000000000  r9=0000000000000009 r10=0000000000000004
r11=fffff8800126f018 r12=fffffa80070e2180 r13=0000000000000000
r14=05351bcf08000000 r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Ntfs!NtfsCommonClose+0x1e7:
fffff880`012aee27 488908          mov     qword ptr [rax],rcx ds:002b:02000112`00000001=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c4100
GetUlongFromAddress: unable to read from fffff800030c41c0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+1e7
fffff880`012aee27 488908          mov     qword ptr [rax],rcx

FAULTING_IP: 
Ntfs!NtfsCommonClose+1e7
fffff880`012aee27 488908          mov     qword ptr [rax],rcx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800129e32b to fffff880012aee27

STACK_TEXT:  
fffff880`02fccb10 fffff880`0129e32b : fffffa80`09555a40 fffff8a0`0d0d7140 fffff8a0`0d0d7010 fffffa80`070e2180 : Ntfs!NtfsCommonClose+0x1e7
fffff880`02fccbe0 fffff800`02e96261 : 00000000`00000000 fffff800`03184a00 fffff800`03032201 00000000`0000000d : Ntfs!NtfsFspClose+0x15f
fffff880`02fcccb0 fffff800`0312abae : 00000000`00000000 fffffa80`060e3b50 00000000`00000080 fffffa80`060ce740 : nt!ExpWorkerThread+0x111
fffff880`02fccd40 fffff800`02e7d8c6 : fffff880`009e9180 fffffa80`060e3b50 fffff880`009f3f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fccd80 00000000`00000000 : fffff880`02fcd000 fffff880`02fc7000 fffff880`02fcc9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCommonClose+1e7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5167f5fc

STACK_COMMAND:  .cxr 0xfffff88002fcc130 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1e7

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonClose+1e7

Followup: MachineOwner
---------

 

[Richiebro72]

Thanks for the reply.
Here's ChkDsk results. It went quickly (3-4 hours) and seems to have come up good. (Let me know if I haven't posted this correctly).

Checking file system on C: The type of the file system is NTFS. A disk check has been scheduled. Windows will now check the disk. CHKDSK is verifying files (stage 1 of 5)... 473856 file records processed. File verification completed. 701 large file records processed. 0 bad file records processed. 0 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)... 569332 index entries processed. Index verification completed. 0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)... 473856 file SDs/SIDs processed. Cleaning up 4785 unused index entries from index $SII of file 0x9. Cleaning up 4785 unused index entries from index $SDH of file 0x9. Cleaning up 4785 unused security descriptors. Security descriptor verification completed. 47739 data files processed. CHKDSK is verifying Usn Journal... 37646288 USN bytes processed. Usn Journal verification completed. CHKDSK is verifying file data (stage 4 of 5)... 473840 files processed. File data verification completed. CHKDSK is verifying free space (stage 5 of 5)... 27214505 free clusters processed. Free space verification is complete. Windows has checked the file system and found no problems. 463339519 KB total disk space. 353679904 KB in 393456 files. 206256 KB in 47740 indexes. 0 KB in bad sectors. 595335 KB in use by the system. 65536 KB occupied by the log file. 108858024 KB available on disk. 4096 bytes in each allocation unit. 115834879 total allocation units on disk. 27214506 allocation units available on disk. Internal Info: 00 3b 07 00 77 bb 06 00 00 32 0c 00 00 00 00 00 .;..w....2...... 96 b8 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Windows has finished checking your disk. Please wait while your computer restarts.

SeaTools for Dos would not recognize my SATA drive. i think it is because it has to be configured in the Bios to IDE and not AHCI, but I am reluctant to do this because re-configuring it back from IDE to AHCI after the disk check will apparently require a repair install or tampering with the registry. Is there an alternative hard drive diagnostic tool to confirm there is nothing wrong with the SATA disk?

I've updated the Graphics Drivers. They were old.

I still have yet to uninstall AVG and install Microsoft Security Essentials and scan for any viruses or malware. So i'll let you know how that goes.

I haven't had any further blue screens so far. I'll test the laptop on some more games.

 

[Richiebro72]

Hi, I got another bluescreen after I finished my game of dota 2 and closed the game down. Bluescreen view tells me the it was caused by atikmpag.sys=8df1. I think it might be a graphics driver problem. I did update my graphics drivers last week. I've uploaded the minidump zip folder. Please help.

 

[Arc]

I think it might be a graphics driver problem.

Yes, it is.

BugCheck 19, {20, fffffa8006cb5860, fffffa8006cb58e0, 4080005}

*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
[COLOR=Red]Probably caused by : atikmpag.sys[/COLOR] ( atikmpag+8df1 )

Followup: MachineOwner
---------

No tress of driver update last week.

fffff880`03e00000 fffff880`03e53000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
[COLOR=Red]    Image name: atikmpag.sys
    Timestamp:        Wed Sep 28 15:04:53 2011[/COLOR] (4E82EA3D)
    CheckSum:         00052B9E
    ImageSize:        00053000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update your ATI/AMD display driver.
You can get it from the link in our forum, http://www.sevenforums.com/graphic-...alyst-video-driver-windows-7-a.html#post17671, or you may go to AMD Graphics Driver and Software and opt for Automatically Detect and Install the appropriate driver for your card.

During installation, you may opt for advanced installation, and install the display driver only, not the Catalyst Control Center.

Your GPU is AMD Radeon(TM) HD 6380G .... so 13.4 WHQL should be supported there.

 

[Richiebro72]

I made sure to update my graphics driver right this time. One day later i blue screened again while playing Call of Duty 4 online. It froze, made a terrible noise, then blue screened. IRQL Not Less or Equal. It seems to only happen when playing games. Could it be faulty RAM by chance? I did upgrade my Ram about three or four months back. I ran a memtest86 with both RAM sticks in for four hours and no errors came up. Any help will be really appreciated.

 

[Arc]

There is one failing module in this crash dump. That is AVG IDS Application Activity Monitor Driver.

fffff880`047419b8  fffff880`0401b994Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=avgidsdrivera.sys"]avgidsdrivera.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=avgidsdrivera.sys"]avgidsdrivera.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=avgidsdrivera.sys"]avgidsdrivera.sys[/URL]
 avgidsdrivera+0x1b994

Description here: Driver Reference Table - avgidsdrivera.sys

Uninstall AVG. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Let us know the results. Depending on those, we will decide about hardware tests.

 

[Richiebro72]

I've unistalled AVG and installed Microsoft security essentials and MBAM.
The MBAM results came back clean.
17/09/2013 8:34:33 p.m.
mbam-log-2013-09-17 (20-34-33).txt

Scan type: Full scan (C:\|D:\|E:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 647407
Time elapsed: 3 hour(s), 33 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

I'll do a full Microsoft Security Essentials scan tomorrow.

 

[Arc]

Basically we want to see how it goes without AVG and with MSE, as AVG is visible to be failing there.

 

[Teerex]

With the BSOD moving from one driver to another, I think this might rather be caused by faulty memory than any particular driver being too outdated. Can you get/borrow any replacement memory to test this assumption?

 

[Richiebro72]

So I haven't had a blue screen for over a month now. I think it was AVG conflicting with my computer. Thanks for all your help. I will mark as solved.

 

[Arc]

Thanks for the feedback. I know what I am doing, and so I dont like conflicts of suggestions.

I will stick to my way of debugging only, and will suggest others to follow it .... if they are ready to take the responsibility of an issue.