Random BSOD errors 0x00000A/0x000001E

[Ibebryan]

I have been getting these errors alot. I recently cleared my harddrive and reinstalled windows to get rid of this problem (i was getting these same errors and more before i reinstalled windows). for the first couple days i had no problems with BSOD. after a couple days the 0x000001E and 0x00000A errors started occuring every hour or so at completely random times. The only things that i know of that could be causing problems are my hard drive and my BIOS not being up to date. My harddrive has been making alot of grinding noises lately and i have a feeling it is on its last leg. Also my BIOS is out of date. The thing is, i have also received errors occasionally like 0x000000x5 that directly say there is a problem with corrupted drivers or driver malfunction.

I have linked the dump files below. hope somebody can help me out!

 

[koolkat77]

nvlddmkm.sys                Wed Oct 23 12:21:50 2013 (52676AFE)

Lately we have experienced some issues with the latest driver. Install the 314.22 WHQL only.

• Uninstall All nvidia items in Control Panel > Programs and features
  • 3D Vision Control Driver
  • 3D Vision Driver
  • Graphics Driver
  • HD Audio Driver
  • PhysX
  • nvidia Update
  (Are you using nvidia chipset drivers? If so, dont uninstall anything other than those are listed).
• Now follow Drivers - Clean Left over Files after Uninstalling
• Boot normally now. Go to Drivers - Download NVIDIA Drivers, Download 314.22 WHQL. While installing, Select Custom (Advanced) install. In the next page, follow this settings:
  
  

Let us know the results.

• Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:
  • Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase
  • Help protect your PC with Microsoft Security Essentials
  • Malwarebytes Free

   Note

:info: Do not start the trial version of MalwareBytes

• Also take a look at: Good & Free System Security Combination

• Virus Check:
  • Make scans with these tools below:
    • TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
    • Online Virus Scanner Eset
• Application conflict:
  • Reduce the start-up items. This will help avoid software conflicts:
    • Remove Startup Programs in Windows 7
    • Clean Startup in Windows 7

• System File Checker
  • The SFC /SCANNOW Command - System File Checker scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible. If you have modified your system files as in theming explorer/system files, running sfc /scannow will revert the system files to it's default state.
    • Link to full tutorial: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
• Run Disk Check in Windows 7
  • Run this on your Hard Drive(s). This will show you how to run Check Disk or chkdsk in Windows 7 to check a selected hard disk for file system errors and bad sectors on it. With both boxes checked for all HDDs and with Automatically fix file system errors. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
    • Link to full tutorial: http://www.sevenforums.com/tutorials/433-disk-check.html

• Test and Diagnose RAM issues with MEMTEST86+
  • Pay close attention to Part 3 of the tutorial "If you have errors". Take the test for at least 7-10 passes. It may take up to 22 passes to find problems.
    • Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

• Check for heating issues using Speccy or HWmonitor
  • HWMonitor CPUID - System & hardware benchmark, monitoring, reporting
  • Speccy - System Information - Free Download
    • Please upload a summary tab using Speccy. http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

If you are overclocking any hardware, please stop. Reset any changed values back to default and reset/clear CMOS: Clear CMOS - 3 Ways to Clear the CMOS - Reset BIOS. Uninstall any overclocking tool as these can also be a reason of blue screens.

Start Menu\Programs\ASUS	Public:Start Menu\Programs\ASUS	Public
Start Menu\Programs\ASUS\AI Suite II	Public:Start Menu\Programs\ASUS\AI Suite II	Public

• Revo Uninstaller "Free"
  • Use Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling. This allows you to remove leftover registry entries of the software.
    • Link to download: Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Let us know the results.

 

[Ibebryan]

i have done everything you listed and nothing has changed, if anything my computer is crashing more (same 0x01e and 0x0a errors) i added my new dmp files and all that gets pulled from sf diagnostic tool! hopfully somebody can help!

 

[koolkat77]

What were the results?
Of Memtest, Clearing CMOS?

 

[Ibebryan]

What were the results?
Of Memtest, Clearing CMOS?

memtest ran through 11 passes with no errors. cleared the CMOS

 

[koolkat77]

Well okay. I have requested for more help on your thread. I'm out of ideas.

Enable Driver Verifier to see if it catches any misbehaving driver:

• :tip: Driver Verifier - Enable and Disable
• :info: Using Driver Verifier to identify issues with Drivers

 

[essenbe]

If you would, please fill out your system specs as completely as possible. If you would like to see what we like, at the bottom left of this post click my system specs and you will see mine. Yours Say custom build, so you may not need it, but if you need to know how, this will help. http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

You mention a 'grinding' hard drive. What brand drive is it? That is not normal and could account for much of the problem you are having. Download the manufacturers diagnostic program and run the short and long test to see if there are errors. I could give you a link to the diagnostic test if I knew your system specs.

 

[Ibebryan]

updated my system info and my hard drive manufacturer is western digital.

 

[essenbe]

You can download their diagnostic tool at WD Support / Downloads / SATA & SAS / WD Black I would use the data Lifeguard for DOS as I think it will do a better job. It runs from ram and the hard drive is not in use while the test is running.

Also, if you haven't already, run the system file checker, sfc /scannow http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[Ibebryan]

alright ill try it out and post back with the results!

 

[x BlueRobot]

[COLOR=Red]BugCheck 1E[/COLOR], {[COLOR=Blue]ffffffffc0000096[/COLOR], [COLOR=Orange]fffff80002ea7dda[/COLOR], 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+1ba )

4: kd> [COLOR=SeaGreen]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`0335aee8 fffff800`02ec2738 nt!KeBugCheckEx
fffff880`0335aef0 fffff800`02e77242 nt! ?? ::FNODOBFM::`string'+0x487ed
fffff880`0335b590 fffff800`02e75b4a nt!KiExceptionDispatch+0xc2
fffff880`0335b770 fffff800`02ea7dda nt!KiGeneralProtectionFault+0x10a
fffff880`0335b900 fffffa80`081b79c8 [COLOR=Red]nt!KeStackAttachProcess[/COLOR]+0x1ba
fffff880`0335b980 fffff880`0335ba80 0xfffffa80`081b79c8
fffff880`0335b988 00000000`00000000 0xfffff880`0335ba80

The problem lies with the nt!KeStackAttachProcess, which is a very dangerous function to call and should be used with extreme caution as a result of the difficulties it can cause with IRPs and asynchronous I/O (deadlocks etc.). The function is used to attach a thread to another process' address space, which will explain the the mov instructions being used on both the cr8 and cr3 control registers. These registers can only be called at Ring Level 0.

4: kd> [COLOR=SeaGreen]u[/COLOR]
[COLOR=Blue]nt!KeStackAttachProcess+0x1ba[/COLOR]:
[COLOR=Orange]fffff800`02ea7dda[/COLOR] 0f22d8         [COLOR=Red] mov     cr3,rax[/COLOR] <-- Privileged Instruction (Move data from [I]rax[/I] into [I]cr3[/I])
fffff800`02ea7ddd 410fb6c4        movzx   eax,r12b
fffff800`02ea7de1 440f22c0        [COLOR=Red]mov     cr8,rax[/COLOR] <-- Privileged Instruction (Move data from [I]rax[/I] into [I]cr8[/I])
fffff800`02ea7de5 48c7452000000000 mov     qword ptr [rbp+20h],0
fffff800`02ea7ded 488b7c2460      mov     rdi,qword ptr [rsp+60h]
fffff800`02ea7df2 4c8b642458      mov     r12,qword ptr [rsp+58h]
fffff800`02ea7df7 488bac2480000000 mov     rbp,qword ptr [rsp+80h]
fffff800`02ea7dff 4883c468        add     rsp,68h

Generally, the cr8 register is used to primarily handle priority of external interrupts (interrupts from I/O devices).

The cr3 register is used to for virtual addressing, and converting linear addresses into physical addresses using page tables and page table directories etc. This is probably the most relevant instruction for faulting function call. This is in fact where the problem happened.

I believe the CPU may have still been running at User-Mode level (Ring 3) or any level higher than Ring 0, for this exception to have happened.

4: kd> [COLOR=SeaGreen]!error ffffffffc0000096[/COLOR]
Error code: (NTSTATUS) 0xc0000096 (3221225622) - {EXCEPTION}  Privileged instruction.

 

[x BlueRobot]

My general advice would be to run Driver Verifier. The General Protection Fault also makes sense here, since the this exception is called when a privileged instruction is called at the wrong level.

 

[Ibebryan]

My general advice would be to run Driver Verifier. The General Protection Fault also makes sense here, since the this exception is called when a privileged instruction is called at the wrong level.

so what exactly is the problem. your post before confused me more than anything. can you dumb it down just a bit? also i am running driver verifier currently and will post back when i learn anything new.

 

[Ibebryan]

i have been running driver verifier for about 8-10 hours with no bsod at all. Usually by now my computer would bsod on its own without driver verifier running so im a bit confused myself.

 

[Ibebryan]

ran driver verifier over night. first time i was happy to see it crashed I have included the dump files from those crashes that happened over night.

 

[x BlueRobot]

[COLOR=Red]BugCheck F4[/COLOR], {[COLOR=Blue]3[/COLOR], [COLOR=SeaGreen]fffffa80091efb30[/COLOR], fffffa80091efe10, fffff800031cd7b0}

----- ETW minidump data unavailable-----
Probably caused by : wininit.exe

(NTSTATUS) [COLOR=Blue]0xc0000006[/COLOR] - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

0: kd> [COLOR=SeaGreen]!process fffffa80091efb30 3[/COLOR]
GetPointerFromAddress: unable to read from fffff80003100000
PROCESS fffffa80091efb30
    SessionId: none  Cid: 0278    Peb: 7fffffdc000  ParentCid: 01b0
    DirBase: 1c162d000  ObjectTable: fffff8a001e5af90  HandleCount: <Data Not Accessible>
    Image: wininit.exe
    VadRoot fffffa80091ca820 Vads 65 Clone 0 Private 692. Modified 1132. Locked 2.
    DeviceMap fffff8a000007eb0
    Token                             fffff8a001e5a060
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         103640
    QuotaPoolUsage[NonPagedPool]      26720
    Working Set Sizes (now,min,max)  (1589, 50, 345) (6356KB, 200KB, 1380KB)
    PeakWorkingSetSize                1589
    VirtualSize                       49 Mb
    PeakVirtualSize                   52 Mb
    PageFaultCount                    1857
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      793

There's lots of Stop 0xF4's, which usually indicates some problem with the hard-drive, in this case the paging mechanism seemed to have failed as a result of a I/O error.

Disable Driver Verifier, and have you followed Essenbe's suggestions?

 

[x BlueRobot]

Interesting call stack here too:

0: kd>[COLOR="SeaGreen"] k[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`086c6098 fffff800`02f55bf0 nt!KeBugCheckEx
01 fffff880`086c60a0 fffff800`02ed5cee nt! ?? ::FNODOBFM::`string'+0x4518f
02 fffff880`086c6200 fffff800`02f2636e nt!KiPageFault+0x16e
03 fffff880`086c6398 fffff800`032df7fe nt!wcsstr+0x56
04 fffff880`086c63a0 fffff800`032df860 nt!SiIsWinPEBoot+0x4e
05 fffff880`086c63e0 fffff800`032e2952 nt!SiCheckForUfdWinpeBoot+0x30
06 fffff880`086c64c0 fffff800`032e2a1d nt!SiCheckForAlternateSystemDisk+0x12
07 fffff880`086c64f0 fffff800`032e479e nt!SiGetBiosSystemDisk+0x9d
08 fffff880`086c6570 fffff800`032fa4a7 nt!SiGetBiosSystemPartition+0x2e
09 fffff880`086c65c0 fffff800`032dfb5a nt!SiGetSystemPartition+0x27
0a fffff880`086c65f0 fffff800`0326554d nt!SiGetSystemDeviceName+0x3a
0b fffff880`086c6650 fffff800`032e5207 nt!IopRetrieveSystemDeviceName+0xac
0c fffff880`086c66b0 fffff800`0323c6f9 nt!IoQuerySystemDeviceName+0x37
0d fffff880`086c66f0 fffff800`031e33ad nt! ?? ::NNGAKEGL::`string'+0x52a6c
0e fffff880`086c6aa0 fffff800`02ed6e53 nt!NtQuerySystemInformation+0x4d
0f fffff880`086c6ae0 00000000`76fe161a nt!KiSystemServiceCopyEnd+0x13
10 00000000`0104c098 00000000`00000000 0x76fe161a

 

[Ibebryan]

[COLOR=Red]BugCheck F4[/COLOR], {[COLOR=Blue]3[/COLOR], [COLOR=SeaGreen]fffffa80091efb30[/COLOR], fffffa80091efe10, fffff800031cd7b0}

----- ETW minidump data unavailable-----
Probably caused by : wininit.exe

(NTSTATUS) [COLOR=Blue]0xc0000006[/COLOR] - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

0: kd> [COLOR=SeaGreen]!process fffffa80091efb30 3[/COLOR]
GetPointerFromAddress: unable to read from fffff80003100000
PROCESS fffffa80091efb30
    SessionId: none  Cid: 0278    Peb: 7fffffdc000  ParentCid: 01b0
    DirBase: 1c162d000  ObjectTable: fffff8a001e5af90  HandleCount: <Data Not Accessible>
    Image: wininit.exe
    VadRoot fffffa80091ca820 Vads 65 Clone 0 Private 692. Modified 1132. Locked 2.
    DeviceMap fffff8a000007eb0
    Token                             fffff8a001e5a060
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         103640
    QuotaPoolUsage[NonPagedPool]      26720
    Working Set Sizes (now,min,max)  (1589, 50, 345) (6356KB, 200KB, 1380KB)
    PeakWorkingSetSize                1589
    VirtualSize                       49 Mb
    PeakVirtualSize                   52 Mb
    PageFaultCount                    1857
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      793

There's lots of Stop 0xF4's, which usually indicates some problem with the hard-drive, in this case the paging mechanism seemed to have failed as a result of a I/O error.

Disable Driver Verifier, and have you followed Essenbe's suggestions?

i started running the long scan and everytime it gets about 3-4 hours into the scan my computer crashes.

 

[Ibebryan]

my hard drive is constantly running and has a very noticeable grinding sound. could replacing it resolve these issues? also before every crash my devices connected to the USB ports usually stop working. usually my mouse and headset specifically

 

[Ibebryan]

i got the hard drive test to finish and it says it found no bad sectors.