Solved occasional random BSOBs recently.

[dipde1985]

over the last month i have been getting occasional BSOB that i know nothing about.
please help find the source. I basically have never got BOSD on a regular basis before, and try to keep the pc in ship shape.

i think i followed the dmp upload instructions properly. but let me know if otherwise.


i put together my pc a couple of years ago and there has not been any hardware changes in and last few months. nor can i recall any software changes in this time frame. I manually update via windows update most of my drivers.

the issue is occurring sometimes when i am away from the pc and something completely randomly when browsing the web. (Firefox with several tabs is always on my pc).

each time a mini memory dmp has been created as attached.


details:

-I have norton 360 runing and always updated.
-There are seemingly no temerature issue with this pc as both CPU and GPU temp hardly go above 65 deg. I don't game. Mainly just firefox, Office, and VLC.
-i dont knw how, and hence don't overclock
-system restore is off on this pc. Not sure when that happened, maybe after i set up the SSD a few months a go.


thanks in advance.

 

[koolkat77]

Welcome to SevenForums

Let us first take a look at your most recent .dmps bugchecks and usual causes.

STOP 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Usual causes: None listed
BugCheck 1000007E, {ffffffffc0000005, fffff80004ec369b, fffff880039167c8, fffff88003916020}
Probably caused by : ntkrnlmp.exe ( nt!ExpScanGeneralLookasideList+a0 )
-----------------------------------------------------------
STOP 0x00000019: BAD_POOL_HEADER 
Usual causes:  Device driver
BugCheck 19, {22, fffff8a00d65c000, 1, 0}
GetPointerFromAddress: unable to read from fffff80005100100
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72d6 )
-----------------------------------------------------------
STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
BugCheck 1E, {0, 0, 0, 0}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
-----------------------------------------------------------
STOP 0x00000019: BAD_POOL_HEADER 
Usual causes:  Device driver
BugCheck 19, {20, fffffa800bef3ae0, fffffa800bef3da0, 42c4108}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )
-----------------------------------------------------------
STOP 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
Usual causes:  Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
BugCheck 1E, {ffffffffc0000005, fffff80000b98ce0, 0, 0}
Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : IDSvia64.sys ( IDSvia64+3389b )

Norton is often responsible for stuff like this:

fffff800`00b9b0c8  fffff880`01f34843 tcpip!TcpInspectReceive+0xd3
fffff800`00b9b0d0  fffffa80`10ecb620
fffff800`00b9b0d8  fffff880`01e702e6 tcpip!TcpTcbAcceptDatagram+0x46
fffff800`00b9b0e0  fffffa80`10ecb780
fffff800`00b9b0e8  00000000`edecd1c3
fffff800`00b9b0f0  fffffa80`0ff68c40
fffff800`00b9b0f8  fffff880`01c881a7 ndis!NdisFreeNetBufferList+0x87
fffff800`00b9b100  fffff800`00b9b2b0
fffff800`00b9b108  fffff880`01f10771 tcpip!TcpDelayOrScheduleAck+0x51
fffff800`00b9b110  fffff880`07867848 nwifi!Dot11AllocateRecvMdlAndMemForNdis6
fffff800`00b9b118  00000000`00000000
fffff800`00b9b120  fffff800`04ec6bb0 nt!KiKernelCalloutExceptionHandler
fffff800`00b9b128  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b130  fffff800`04ec6eca nt!KiIdleLoop+0x5a
fffff800`00b9b138  00000000`00000000
fffff800`00b9b140  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b148  00000000`00000000
fffff800`00b9b150  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b158  fffff800`04ecf2db nt!KeBugCheckEx+0x11b
fffff800`00b9b160  fffffa80`0e2a3800
fffff800`00b9b168  fffff880`078a1300 nwifi!Dot11Mem+0x180
fffff800`00b9b170  fffff880`078a1300 nwifi!Dot11Mem+0x180
fffff800`00b9b178  fffffa80`0d7c57f0
fffff800`00b9b180  00000000`00000000
fffff800`00b9b188  00000000`00000000
fffff800`00b9b190  00000000`00000286
fffff800`00b9b198  fffff800`04ecf199 nt!KiBugCheckReturn+0x5
fffff800`00b9b1a0  00000000`0000001e
fffff800`00b9b1a8  fffff800`00b9cc40
fffff800`00b9b1b0  fffff800`00b9b940
fffff800`00b9b1b8  fffff800`00b9b2c0
fffff800`00b9b1c0  fffff800`00b9c0e8
fffff800`00b9b1c8  fffff800`04ec6bbe nt!KiKernelCalloutExceptionHandler+0xe
fffff800`00b9b1d0  00000000`00000000
fffff800`00b9b1d8  fffff800`04efa320 nt!_C_specific_handler
fffff800`00b9b1e0  fffff800`050d595c nt!BBTBuffer <PERF> (nt+0x28595c)
fffff800`00b9b1e8  fffff800`04eddb0c nt!IopTimerDispatch+0x12f
fffff800`00b9b1f0  00000000`00000000
fffff800`00b9b1f8  fffff800`04ef9e2d nt!RtlpExecuteHandlerForException+0xd
fffff800`00b9b200  fffff800`050d5770 nt!BBTBuffer <PERF> (nt+0x285770)
fffff800`00b9b208  fffff800`050122f0 nt!_imp_NtOpenSymbolicLinkObject+0x4de8
fffff800`00b9b210  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b218  fffff800`00b9c0e8
fffff800`00b9b220  fffff800`00b9b2c0
fffff800`00b9b228  fffff800`04ef8c05 nt!RtlDispatchException+0x415
fffff800`00b9b230  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b238  fffff800`00b9b278
fffff800`00b9b240  fffff800`00b9c0e8
fffff800`00b9b248  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b250  ffff0080`014f2f57
fffff800`00b9b258  fffffa80`0bc851a0
fffff800`00b9b260  00000000`00000000
fffff800`00b9b268  00000000`00000000
fffff800`00b9b270  fffff800`00b9cc40
fffff800`00b9b278  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b280  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b288  fffff800`00b9b7e0
fffff800`00b9b290  00000000`00000000
fffff800`00b9b298  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b2a0  fffff800`00b9d000
fffff800`00b9b2a8  fffff800`00b97000
fffff800`00b9b2b0  00000000`00000000
fffff800`00b9b2b8  fffffa80`0ff68c40
fffff800`00b9b2c0  fffff800`04ec6eca nt!KiIdleLoop+0x5a
fffff800`00b9b2c8  fffff800`04e50000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff800`00b9b2d0  fffff800`050d3910 nt!BBTBuffer <PERF> (nt+0x283910)
fffff800`00b9b2d8  fffff800`00b9cc40
fffff800`00b9b2e0  00000000`00000000
fffff800`00b9b2e8  fffff800`00b9b310
fffff800`00b9b2f0  fffff800`04ec6bb0 nt!KiKernelCalloutExceptionHandler
fffff800`00b9b2f8  fffff800`05015fac nt!_imp_NtOpenSymbolicLinkObject+0x8aa4
fffff800`00b9b300  fffff800`00b9b7e0
fffff800`00b9b308  fffffa80`00000000
fffff800`00b9b310  fffffa80`0a378800
fffff800`00b9b318  fffff880`01d7a872 NETIO!NetioDereferenceNetBufferListChain+0x132
fffff800`00b9b320  fffffa80`0a249a60
fffff800`00b9b378  fffff880`01e53c60 tcpip!FlpReturnNetBufferListChain
fffff800`00b9b380  fffffa80`0a39c490
fffff800`00b9b388  fffff880`01e57544 tcpip!IppReceiveHeadersHelper+0x454
fffff800`00b9b658  fffff880`01e5774a tcpip!IppProcessDeliverList+0x5a
fffff800`00b9b660  00000000`00000000
fffff800`00b9b668  fffff880`01f6e9a0 tcpip!Ipv4Global
fffff800`00b9bbe8  fffff880`01e53c12 tcpip!FlReceiveNetBufferListChain+0xb2
fffff800`00b9bbf0  fffff880`01e53470 tcpip!FlReceiveNetBufferListChainCalloutRoutine
fffff800`00b9bbf8  fffff880`01d4d395 ndis!ethFilterDprIndicateReceivePacket+0x385
fffff800`00b9bc00  00000000`00000002
fffff800`00b9bc18  fffff880`01e5b902 tcpip!IpSecTlPacketsOutProcessing+0x2

fffff800`00b9c538  fffff880`041c3ee0Unable to load image \SystemRoot\System32\Drivers\N360x64\0604000.009\SYMNETS.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMNETS.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMNETS.SYS
 SYMNETS+0x55ee0
-----------------------------------------------------------
fffff800`00b9c388  fffff880`0ce0b2a1Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121006.001\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
 IDSvia64+0xb2a1

One dump which shows what was causing BSOD exactly:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80000b98ce0, 0, 0}

Unable to load image \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IDSvia64.sys
*** ERROR: Module load completed but symbols could not be loaded for IDSvia64.sys
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : IDSvia64.sys ( IDSvia64+3389b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80000b98ce0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+6a182faf0317de30
fffff800`00b98ce0 089cb90000f8ff  or      byte ptr [rcx+rdi*4-80000h],bl

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000510f100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff80000b99c08 -- (.exr 0xfffff80000b99c08)
ExceptionAddress: fffff8000500b617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff80000b99cb0 -- (.trap 0xfffff80000b99cb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000b163d6c604830 rbx=0000000000000000 rcx=fffffa800bd700a0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000500b617 rsp=fffff80000b99e40 rbp=0000000000001000
 r8=0000000000000000  r9=fffff80005068620 r10=fffff80005067588
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`0500b617 48895808        mov     qword ptr [rax+8],rbx ds:000b163d`6c604838=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80004f6883b to fffff80004ee01c0

STACK_TEXT:  
fffff800`00b98c28 fffff800`04f6883b : 00000000`0000001e ffffffff`c0000005 fffff800`00b98ce0 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b98c30 fffff800`04f331e4 : fffff800`00b98e78 fffff880`00000078 fffffa80`0c211308 fffff880`04f08b3f : nt!KipFatalFilter+0x1b
fffff800`00b98c70 fffff800`04f0b3ac : fffff800`00b98ce0 fffff880`04f08c08 00000000`00000001 fffffa80`0ad91040 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff800`00b98cb0 fffff800`04f0ae2d : fffff800`05023c48 fffff800`00b9bb10 00000000`00000000 fffff800`04e61000 : nt!_C_specific_handler+0x8c
fffff800`00b98d20 fffff800`04f09c05 : fffff800`05023c48 fffff800`00b98d98 fffff800`00b99c08 fffff800`04e61000 : nt!RtlpExecuteHandlerForException+0xd
fffff800`00b98d50 fffff800`04f1ab81 : fffff800`00b99c08 fffff800`00b99460 fffff800`00000000 00000000`00000005 : nt!RtlDispatchException+0x415
fffff800`00b99430 fffff800`04edf842 : fffff800`00b99c08 fffff800`05068620 fffff800`00b99cb0 00000000`000000f7 : nt!KiDispatchException+0x135
fffff800`00b99ad0 fffff800`04ede14a : fffffa80`141be660 fffffa80`141be6c0 fffffa80`0bcce100 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`00b99cb0 fffff800`0500b617 : 00000000`00080000 fffff800`00000000 fffffa80`0b9b8e10 fffffa80`0b9b8550 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b99e40 fffff880`0ce5889b : 00000000`00000000 00000000`00000f5c 00000000`00000000 fffff800`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff800`00b99f30 00000000`00000000 : 00000000`00000f5c 00000000`00000000 fffff800`00000000 00000000`00000000 : IDSvia64+0x3389b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
IDSvia64+3389b
fffff880`0ce5889b ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  IDSvia64+3389b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: IDSvia64

IMAGE_NAME:  IDSvia64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  503d8308

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+3389b

BUCKET_ID:  X64_0x1E_c0000005_IDSvia64+3389b

Followup: MachineOwner
---------

0: kd> lmvm IDSvia64
start             end                 module name
fffff880`0ce25000 fffff880`0cea7000   IDSvia64 T (no symbols)           
    Loaded symbol image file: IDSvia64.sys
    Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.1.2\Definitions\IPSDefs\20121005.002\IDSvia64.sys
    Image name: IDSvia64.sys
    Timestamp:        Wed Aug 29 08:48:40 2012 (503D8308)
    CheckSum:         00081FFB
    ImageSize:        00082000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

SYMNETS.SYS = Symantec/ Norton NIS/ N360 driver Driver Reference Table
IDSvia64.sys = Norton Internet Security Driver Reference Table

I'd suggest you to uninstall Norton Internet Security, for some reason it's known to cause BSODs. Uninstall using the Norton Removal Tool

Recommended antivirus program for Windows 7 based on stability compared to others:-

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Update your graphic card drivers to their latest:

0: kd> lmvm atikmdag
start             end                 module name
fffff880`04e51000 fffff880`0590f000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Wed Feb 15 08:51:52 2012 (4F3B1DC8)
    CheckSum:         00A5DE83
    ImageSize:        00ABE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to ATI then delete remnants of its drivers using Driver Fusion - Driver Sweeper

Install the latest drivers, get them from the AMD website or from here

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Let us know the results and further BSODs if any

 

[dipde1985]

Cheers. I am happy that it is a software thing at least. though i must say that i am a bit surprised (and disheartened) that it is Norton as i have been using it for about 12 years without an issue.

I did all of your other suggestions and there no issues found.

anyway i was going to upgrade to windows 8 in the next few weeks anyway so i guess i'l just do it sooner rather than later and start with a fresh format.

will update if there are further related issues.

thank you very much

 

[koolkat77]

You're welcome, keep us posted either way.

 

[koolkat77]

You can mark the thread as solved if there were no more BSOD-s.

Let us know if there are any other issues

 

[koolkat77]

• If your problem is solved please use the
  
  Mark this thread as solved link at the top of your thread or down on the left corner