Solved Multiple BSOD's. Latest Bugcheck code: 0xF4

[Anak]

Dan,

Go to your installed Windows Updates: Control Panel\All Control Panel Items\Windows Update\ Click on Installed Updates in the lower left panel.

In the search box at upper right corner where it says Search for Installed Updates, enter: KB2670838 If it comes up, right click on it and uninstall it, let Windows do its thing then close out gracefully. Restart your machine.

Run to test. Report back any results. If running well, and it shows up again in Updates Hide It!

There is a problem with KB2670838 where a mix of Intel and AMD like you have will cause intermittent BSOD's.

Your .dmp today was: STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

 

[danohall]

Uninstalled KB2670838 and ran computer. That KB uninstalled IE10 and 11. Still was getting computer lockups with the screen jumbled up. Only way to get out was to do a hard reset using the reset button on the computer case. No crashes were reported by windows or who crashed when this was happening. I don't know if these screen lockups are due to verifier.exe or not. Looked around and saw that KB2834140 was supposed to fix the above KB and it was already installed on my computer. Reinstalled everything and turned off verifier.exe.

Crashed a couple of times and have uploaded the info from the lastest one.

 

[Slartybart]

Verifier might well be causing the slowdowns, freezes, crashes. It stress tests the driver..

The information in post# 9 pointed you to the http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html tutorial which begins with:

   Information

Driver Verifier runs in the background, "testing" drivers for bugs. If it finds one, a Blue Screen of Death (BSOD) will result; the corresponding dump file will hopefully show the faulty driver.

and Arc put in extra effort by boxing some important points.

What was not emphasized, but perhaps should be:
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Note

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Leave verifier disabled unless a member requests more testing.

Bill
.

 

[Golden]

fffff880`03777b38  fffff880`0122e588*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
 MpFilter+0x2e588

Driver Reference Table - MpFilter.sys

The above stands out in one the latest .dmp files. Is Windows 7 updated?

 

[danohall]

Yes, all updates have been installed through windows update. I think the last security essentials update was earlier today but I'll go and check again. The thing I didn't understand with verifier running, was I thought if my system crashed it'd be recordable. The two lockups I had just totally scrambled the screen and the only way around it was to do a hard reset. No crashes were recorded. I'd of thought if it stressed the drivers it would record which driver caused the crash.

 

[danohall]

Ok, another crash. Happened when Malwarebytes was scanning. Uploaded results.

 

[danohall]

Yet another crash with the files uploaded. Does anybody have any advice? Right now the configuration I'm running is this. Have uninstalled KB2670838. Unplugged my video card and am running off the intel graphics. All windows updates except for IE10 and 11 are installed. I know this dump is 0x1A, memory management but I ran 8 passes with memtest with no errors found.

Any other suggestions? I've also loaded a file that shows what non microsoft drivers are running.

 

[Slartybart]

.....
The thing I didn't understand with verifier running, was I thought if my system crashed it'd be recordable. The two lockups I had just totally scrambled the screen and the only way around it was to do a hard reset. No crashes were recorded. I'd of thought if it stressed the drivers it would record which driver caused the crash.

Thanks for the clarifying what you expected with verifier. As far as I understand it, the dump is the record.

I had requested a MGADIAG report in a previous post, but.... I forgot to give you the link to the tutorial.
Here it is: http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html
Please follow those instructions and that might give members a little more to work on.

Bill
.

 

[Slartybart]

Thanks dano,

Could you edit the post with the MGADIAG,
select all of the text and
click the # icon on the post menu?

This wraps the test in a code box
and keeps the thread from 
pushing out the sides

I should have mentioned that before.

Thanks,

Bill
.

 

[Anak]

Apologies for not being around, I'm a bit under the weather.....

   Note

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Leave verifier disabled unless a member requests more testing.
Bill
.

Agreed.

fffff880`03777b38  fffff880`0122e588*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
 MpFilter+0x2e588

Driver Reference Table - MpFilter.sys

The above stands out in one the latest .dmp files. Is Windows 7 updated?

Yes, all updates have been installed through windows update. I think the last security essentials update was earlier today but I'll go and check again. The thing I didn't understand with verifier running, was I thought if my system crashed it'd be recordable. The two lockups I had just totally scrambled the screen and the only way around it was to do a hard reset. No crashes were recorded.

A Quote within a Quote to add emphasis:

I'd of thought if it stressed the drivers it would record which driver caused the crash.

From Anak:It will, but, one needs to have a debugger machine hooked up to the problematic machine in order to record it. It will only record the first 20 instances, and when the machine is restarted those are lost and you start over again.

Source: http://www.sevenforums.com/crash-lo...river-verifier-identify-issues-drivers-2.html, and: http://www.sevenforums.com/crash-lo...fier-identify-issues-drivers.html#post1830525

I have seen the MpFilter.sys *** ERROR in earlier .dmp's. but discounted it because Dan said he was up to date, it still bothers me though.

Ok, another crash. Happened when Malwarebytes was scanning. Uploaded results.

I have also seen the mbam.exe fault in earlier .dmps's it showed in this latest round of .dmp's.

SYSTEM_SERVICE_EXCEPTION (3b) PROCESS_NAME:  mbam.exe[URL="http://www.carrona.org/bsodindx.html#0x0000003B"][B]Usual causes:[/B][/URL][URL="http://www.carrona.org/bsodindx.html#0x0000003B"]   System service, Device driver, graphics driver, ?memory[/URL]

My recent concerns,

You misinfo32 report under Problem Devices shows your USB3.0 controller as not having the drivers installed and your extra HDD's finally showed they suffered because of it.

H:\    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_USB3.0_CRW-SM#XD&REV_1.00#201006010301&1#    Failure using the VxD loader.

G:\    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_USB3.0_CRW-CF#MD&REV_1.00#201006010301&0#    Failure using the VxD loader.

K:\    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_USB3.0_CRW-MS&REV_1.00#201006010301&3#    Failure using the VxD loader.

I:\    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_USB3.0_CRW-SD#MS&REV_1.00#201006010301&4#    Failure using the VxD loader.

J:\    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_USB3.0_CRW-SD&REV_1.00#201006010301&2#    Failure using the VxD loader.

Universal Serial Bus (USB) Controller    PCI\VEN_8086&DEV_8C31&SUBSYS_50071458&REV_04\3&11583659&0&A0    The drivers for this device are not installed.

You can either:

• Check here: Code 19 Failure loading Using the VxD Loader? - Norton Community to see if this helps. The secondary link in the first answer deals with CD/DVD drives, but a drive is a drive, right?

• A bigger question I have is why you are running Norton along with MSE? Remove one of the other: Norton Removal Tool Download or: Microsoft Security Essentials Removal Tool Download

• Or Install the USB3 drivers and test.
• Disconnect the extra HDD's and test.
• Remove then reinstall the HDD's drivers.

I also have concerns about the 32GB of RAM you're using, can you supply the make/model of it, and did you check to see if it is on the compatible list for your Gbyte MB?
Here is the list: GIGABYTE - Motherboard - Socket 1150 - GA-Z87X-D3H (rev. 1.x)

The CPU looks okay, but is the MB Bios the F7version or later? GIGABYTE - Motherboard - Socket 1150 - GA-Z87X-D3H (rev. 1.x)

And you would be doing everyone a great service if you included your M, ahh I see Bill asked what I was going to. Thanks Bill, Dan.

Steve

 

[Slartybart]

Thanks Dano,

But the thread is still wide.

I'm not sure if you can do this yet (SF profile maturity), but since you posted the MGADIAG report on a new post, try deleting post# 29
Edit button
Delete button
To delete this message, check the appropriate option below and then
click the 'Delete this Message' button.

• Do Not Delete Message
• Delete Message

If you can't delete a post of yours yet, just select all of the text and press the # icon to wrap it in a code box.

Don't sweat it, though - it just makes using the thread page unwieldy (scroll right to see buttons, etc)

Thanks,

Bill
.

 

[danohall]

Thanks guys. I'll get to some of this later. Today is colonoscopy day...so I gotta split. (TMI...I know).

Steve, I'm not running Norton. I was running it but uninstalled it as a couple previous crashes looked like they were caused by Norton. I used the Norton Removal Tool. You're saying there's still remnants of it on my computer?

Just uninstalled Malwarebytes...again.

I just checked device driver and you're right about the USB 3.0 controller. Not sure what happened there as it was fine the last time I checked device manager, either yesterday or the day before.

I pulled out 2 memory sticks and will verify if they're on Gigabytes sight. Could have swore I did this when I purchased them but that's been awhile. They're Patriot PVI316G186C0K sticks.

Bios is currently F7. I had F8 but downgraded in the past few days to see if that was the problem. When I got the mobo it wouldn't run all 4 sticks of memory with bios version F6. F7 took care of that.

 

[Slartybart]

Everything looks good so far. The USB drivers and memory are good places to focus

Thanks for the feedback on Norton and BIOS - someone might want to check what the different (F6, F7, F8) updates address.

Is Monday that day or is March 10th that day (Diez de Marzo / Cinco De Mayo).
Hope things turn out well with your 'routine' testing.

Bill
.

 

[Anak]

Dan, if you can't delete the the #29 post, as per Bill's explanation (SF profile maturity), just highlight the MGADiag report there, and wrap the #code tag around it. Or you could highlight the report, touch enter or the spacebar to remove it.

You will have to post at least three letters or you will get a warning that you need to lengthen your post to three letters. Just type Post removed for cleanup. You could use that for your reason also. In either case you need to scroll to the right until you see the EDIT Button, that'll get you started and it should be self-explanatory from there.

The only member that can see that EDIT Button is you looking at your posts, no one else.

Thanks guys. I'll get to some of this later. Today is colonoscopy day...so I gotta split. (TMI...I know).

That scan and I don't get along too well.....
Hope you fare better.

Steve, I'm not running Norton. I was running it but uninstalled it as a couple previous crashes looked like they were caused by Norton. I used the Norton Removal Tool. You're saying there's still remnants of it on my computer?

I saw it from back on 2014-02-02 and you have it listed in your system specs as antivirus. Is that when you removed Norton, 02-02-2014?

If you used the auto feature from the tool to fill in your system specs its picking something up. You could try searching for any remnants through Search or regedit32 (Admin rights)

Event[21192]:
  Log Name: System
  Source: Service Control Manager
  Date: 2014-02-02T10:45:27.840
  Event ID: 7031
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Daniel-PC
  Description: 
The Norton Internet Security service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.

Just uninstalled Malwarebytes...again.

Is that MBAM Pro? I had problems running Pro with MSE while real-time was turned on for both. Some users do, some don't.

I just checked device driver and you're right about the USB 3.0 controller. Not sure what happened there as it was fine the last time I checked device manager, either yesterday or the day before.

Okay work on that.

I pulled out 2 memory sticks and will verify if they're on Gigabytes sight. Could have swore I did this when I purchased them but that's been awhile. They're Patriot PVI316G186C0K sticks.

I don't see them listed Dan.

Bios is currently F7. I had F8 but downgraded in the past few days to see if that was the problem. When I got the mobo it wouldn't run all 4 sticks of memory with bios version F6. F7 took care of that.

Okay, Its up to you 'bout the memory; get new approved or you could try memtesting them one at a time or enough sticks to allow the machine to boot.


Bill I'm trying to get over to that thread that Derek asked about, but I'm not sure when.

Steve

 

[danohall]

Just to be safe I deleted both mgadiag posts and put a new one in. Hope this formats properly. It still looks like there's a few lines that go out but I don't want to take a chance of screwing them up.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-XJ82T-KWBQV-TPTBP
Windows Product Key Hash: 4PDBM5m/5EqMgEI7YupF3VFJ47Q=
Windows Product ID: 00426-OEM-9154225-46886
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {3E7D401C-40E0-4508-8FDC-9EAC08B1DF66}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{3E7D401C-40E0-4508-8FDC-9EAC08B1DF66}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-TPTBP</PKey><PID>00426-OEM-9154225-46886</PID><PIDType>3</PIDType><SID>S-1-5-21-1504280806-330243907-2938494783</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>Z87X-D3H</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>F7</Version><SMBIOSVersion major="2" minor="7"/><Date>20130802000000.000000+000</Date></BIOS><HWID>14DF3107018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00182-542-246886-02-1033-7601.0000-0622014
Installation ID: 017050514271216736407475595285874202468361792776188730
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: TPTBP
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 3/10/2014 4:45:38 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 3:7:2014 07:05
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LAAAAAIAAQABAAEAAAABAAAAAQABAAEAHKLMtQQHKHro9q7IxN4Qt2J7yPY=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG                    
  FPDT            ALASKA        A M I
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  DMAR            INTEL         HSW 
  MATS            ALASKA        A M I

 

[Anak]

Looks good from my end Dan.

The #

 box stops any long strings from blowin' out the right side of the thread, if it isn't there the SevenForums Server interprets the string as one long sentence; Kinda like Notepad without word wrap set.

I think Bill mentioned it, but the mgadiag is okay.

Any questions?

 

[danohall]

Yea...just one. What's causing my crashes!!!!!!!

I guess my next step will to be to get some "approved" memory and go from there.

So there are no driver conflicts/issues that anybody can see?

 

[Anak]

Thanks for my chuckle of the day!

Either new RAM or:

Okay, Its up to you 'bout the memory; get new approved or you could try memtesting them one at a time or enough sticks to allow the machine to boot.

Have you checked them to see if they are matched pairs/set? Sometimes that happens from a vendor.

No driver issues that stand out to me

 

[danohall]

I just pulled the two sticks out. All 4 match, for part number and specs. The only thing I see different is the number below the barcode is either PD327-004983 or PD327-000043. Have no clue what that means but each set of two is different colors. Have attached a pic.

 

[Anak]

The different SKU's mean different production runs.

Notice the top two are using a black breadboard and the bottom two are green. Also the green are marked UDimm (Ubuffered) the black are ddr3 dimm's (they're usually buffered if unmarked) that could be your problem right there, they are not a matched set even if the voltages match, which they do.

Now, some may say buffered vs unbuffered, wouldn't matter, but I think it would. I'm kinda pedantic that way.