Solved Random BSOD (probably) caused by graphical driver issue

[MaynardJ]

Hi,

I have had quite a few BSODs in the past few weeks. Error messages have been diverse, SYSTEM_SERVICE_EXCEPTION, IRQL_NOT_LESS_OR_EQUAL being the most common ones.

Two weeks ago, my brother-in-law (working in ICT) tried to help me out with an overheating issue causing the PC to go black and reset. BSODs were less frequent back then. We fixed one of the fans in the PC casing, solving the overheating problem.

Also, he uninstalled my GPU (Radeon 5970), downloaded the most recent drivers and removed the old ones. At least I think that's what he did... after that the BSODs started happening.

According to BlueScreenView, recent BSODs have been caused by drivers ntoskrnl.exe, atikmdag.sys and atikmpag.sys. I guess the latter two are related to my GPU, and some stuff hasn't been installed or removed properly. The files were formerly installed in an AMD folder on my SSD C drive, but free space started running low so I had the latest driver package (15.7.1, I think) downloaded to my (larger) D drive. Could this be part of the problem?

Unfortunately, I have no zip file to upload right now. I followed the posting instructions and ran DM Log Collector 3 times. This program said it saved a zip file to my desktop, but I just don't see it.

Also, strangely, BlueScreenView has not listed any BSODs that happened after September 30.

For starters, I hope you guys can help me create the zip file I should upload or get more info on the BSODs that occurred in October so far. After that, I hope we can fix these BSODs.

 

[axe0]

Hi Maynardj,

Welcome to the 7forums.

Is your desktop full of shortcuts, files and folders?
If that is the case, please create a new folder and put there temporary some files to create space and try running the tool again.

Please check {windows partition}\windows\minidump and check if there are any dump files saved.
Please make sure your pc is configured for small dump files How to configure minidump | Windows 7 tutorial

 

[MaynardJ]

There are quite a few shortcuts on the desktop but it's definitely not full.

There are dumpfiles in the minidump folder on my C drive, but none more recent than September 30.

I changed the advanced system properties to "Small memory dump" and ran DM Log Collector again. Still, nothing is saved to my desktop.

After that, I moved a lot of desktop shortcuts to a temporary folder and ran the log collector yet again. Still no zipped file.

After posting this, I rebooted the PC and ran the log collector another time. Still nothing.

This morning, I tried using SF Diagnostic Tool. Again, nothing and yes, I ran it as an administrator.

I googled this problem I'm having with the programs, and this other thread said the default locations in the registry may be wrong. I don't really know what that means or how to fix it.

 

[axe0]

I do know what that means, but don't know what needs to be changed.

Please do the following:

• Open an admin command prompt
• Copy/paste "sfc/scannow" (without quotes) and press enter
• When it finished reboot your system
• Open again an admin command prompt
• Enter sfc/scannow again

If sfc/scannow does NOT say "Windows Resource Protection did not find any integrity violation", please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

 

[MaynardJ]

I did the SFC scan, and it found damaged files that can't be repaired right now. I tried to upload the log file, but Windows tells me I'm not authorized to open it.

Also, the file is 15.7 MB and I'd have to compress it before uploading, but Windows won't allow that either.

When I right-click on the file, I don't see the option "Open as administrator". Should I adjust my system settings somewhere before trying again?

EDIT: This is getting weird... now the file is almost 200 MB. I better run the SFC scan again.

 

[axe0]

Please try sfc, reboot, sfc a few times.

If sfc/scannow does NOT say "Windows Resource Protection did not find any integrity violation", please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.

 

[MaynardJ]

I did that, and I just did it again. Now the log file is about 700 kb. I just get an error message when I try to upload it; Windows tells me I'm not authorized to open the file.

 

[axe0]

Try to use a 3rd party uploader.

 

[MaynardJ]

Does that mean I should copy the file to my OneDrive? And then, what do I do with it?

Please be more specific, I don't think I understood your last post.

 

[axe0]

You could try OneDrive, Google Drive, dropbox or any other uploader.
When you have uploaded the files, copy the link and paste it in your post to share it.
Depending on the uploader, you sometimes need to change the rights, but I'll let you know that and how.

 

[MaynardJ]

Thanks, I was a bit confused on how OneDrive works. I just saw it as some extra storage space on my PC that somehow synchronizes with the online service. Turns out I have lo log on the Live website to actually upload files to the folders there.

I'm uploading the CBS.log file to OneDrive right now, which is gonna take a while since it's huge. So, if I store it in the online Public folder and post the link to the folder here, you can view it? Exactly which link do you need?

The BSOD problem may be (partially) solved. My brother (who assembled this PC) reminded me about the way it used to crash back when it was new (5 or 6 years ago), which turned out to be caused by faulty BIOS settings. The crashes due to the (fixed) overheating caused Windows to suggest a system recovery (or something like that), which didn't completely succeed but may have reset the BIOS settings to default. So I looked up the stuff we marked in the motherboard manual, entered BIOS and manually changed the DRAM Bus Voltage to 1.65. That was yesterday, and so far today I haven't had any BSODs (though I haven't been doing a lot on the PC).

So, the BSODs just might (partially) be history, but I'd still love to hear if there's something wrong with my drivers. At least, that's what BlueScreenView seems to suggest.

 

[axe0]

In onedrive, right click on the file/folder and click share.
In the pop-up click on Create link/url (or whatever it is), choose what you want for the rights and click on create link/url.
Copy the link and paste it in your post.

 

[MaynardJ]

Done uploading. Here's the file:

https://onedrive.live.com/redir?resid=61CD6865B2999148!288&authkey=!AA7MHYfYcckado8&ithint=file,log

 

[axe0]

The file is 500MB+, too big to open for my notepad or any other program I use.
If you have Ccleaner, run it to clear this file up, but without clearing dumps

If you are using a program like Ccleaner please stop using it while troubleshooting.
This because programs like Ccleaner remove dump files that are needed to troubleshoot.
Or configure Ccleaner to not remove dump files:

 

[MaynardJ]

I just ran CCleaner for the first time in way too long, it removed like 2.5 GB of crap. Memory dumps were left alone as you instructed.

Then I ran the "scannow" command again and looked for the cbs.log file, but it seems like it's still over 700 MB. Is it still "refreshing" or something, should I try again tomorrow?

 

[axe0]

Make sure in the System part Windows Log Files is checked.

 

[MaynardJ]

It was, and the file is still huge.

I googled this problem and might have a solution:

https://social.technet.microsoft.co...spersistlog-can-delete?forum=winservermanager

Start/Stop Windows Modules Installer service in Windows 7 from Services, Regedit or CMD

In short: temporarily disable the Windows Module Installer service, delete the CBS.log file and run "sfc/scannow" again to create a new one.

Does that sound like a plan to you?

 

[axe0]

Are you able to delete the file manually?
UAC will prompt, just allow.

 

[MaynardJ]

Deleted, recreated (only like 1 MB now), uploaded, posted:

https://onedrive.live.com/redir?resid=61CD6865B2999148!289&authkey=!AHuDyosOADdJxGE&ithint=file,log

Hope you can find the driver problem if there actually is any. I'm calling it a day.

 

[axe0]

Repair install

2015-10-17 23:58:13, Info                  CSI    00000367 [SR] [COLOR="red"]Cannot repair member file[/COLOR] [l:18{9}]"[COLOR="red"]ehres.dll[/COLOR]" of Microsoft-Windows-ehome-ehres, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2015-10-17 23:58:13, Info                  CSI    00000368 [SR] This component was referenced by [l:176{88}]"Microsoft-Windows-MediaCenter-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.MediaCenter"
2015-10-17 23:58:13, Info                  CSI    00000369 Hashes for file member \??\C:\Windows\ehome\ehres.dll do not match actual file [l:18{9}]"ehres.dll" :
  Found: {l:32 b:lhtTn3REVhB3MudeO6nKepJ6n8i6LAV4uMY25qTZFaw=} Expected: {l:32 b:GibbbuCnCqSVlIpo9jRTxqvNduH8zq6Qn5IvKNJ38Q0=}
2015-10-17 23:58:13, Info                  CSI    0000036a Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-ehome-ehres_31bf3856ad364e35_6.1.7600.16385_none_ae00f59c6a2932c3\ehres.dll do not match actual file [l:18{9}]"ehres.dll" :
  Found: {l:32 b:lhtTn3REVhB3MudeO6nKepJ6n8i6LAV4uMY25qTZFaw=} Expected: {l:32 b:GibbbuCnCqSVlIpo9jRTxqvNduH8zq6Qn5IvKNJ38Q0=}
2015-10-17 23:58:13, Info                  CSI    0000036b [SR] Could not reproject corrupted file [ml:520{260},l:40{20}]"\??\C:\Windows\ehome"\[l:18{9}]"ehres.dll"; [COLOR="Red"]source file in store is also corrupted[/COLOR]