Solved Several BSODs in past few days

[Kitti Ritter]

I believe the Blue Screens and hanging applications began after installing the latest Windows updates. The first thing that went wrong was the AVG anti-virus update got hung up. I then ran a manual update which seems to have fixed that problem. Then the Blue Screens started at no particular time or while using any specific software. I was unable to read the Blue Screens as they automatically disappeared from the screen and the computer restarted. When I attempted to run an SFC /scannow, it would not allow me to do so even though I'm the administrator and never had this happen before. I had to create a new user as Admin in order to run the scan. The scan showed no errors. Attached is everything I saved in zip files. I have Windows 7 32 bit, retail OS, pc is 9 months old, reinstalled system once about 6 months ago.

 

[zigzag3143]

These rtwo were Related to AVGIDSFilter.sys IDS Application Activity Monitor Filter Driver. from AVG Technologies

I note you have AVG.
AVG can be a contributing cause of BSOD'S .
Please remove and replace with Microsoft Security Essentials AT LEAST TO TEST

Download tools and utilities | AVG Worldwide

Microsoft Security Essentials - Free Antivirus for Windows

 

[Kitti Ritter]

I uninstalled AVG and reinstalled it. No errors received so far. And I was recognized as the admin when I ran SFC /scannow again. I'm not comfortable with Microsoft products so didn't install their security. When I installed Windows 7, the first thing I did was get rid of the Public User and the Libraries. Then I disabled tabs on IE as they seem redundant since the taskbar already shows all the open windows. However, each time Windows updates are installed, the Libraries appear again. If I were to go back to XP, would it cause any problems with the upgraded hardware on my system? Is it compatible with IE9? Why can't Microsoft create an OS where each option can be selected or not during install? It sure would be better than searching for ways to make it work the way a person wants it to.

 

[zigzag3143]

I uninstalled AVG and reinstalled it. No errors received so far. And I was recognized as the admin when I ran SFC /scannow again. I'm not comfortable with Microsoft products so didn't install their security. When I installed Windows 7, the first thing I did was get rid of the Public User and the Libraries. Then I disabled tabs on IE as they seem redundant since the taskbar already shows all the open windows. However, each time Windows updates are installed, the Libraries appear again. If I were to go back to XP, would it cause any problems with the upgraded hardware on my system? Is it compatible with IE9? Why can't Microsoft create an OS where each option can be selected or not during install? It sure would be better than searching for ways to make it work the way a person wants it to.

Install something else then. My Favorite ie ESET Smart Security ver 5.x

 

[Kitti Ritter]

I uninstalled all of the last batch of Windows updates. Still getting Blue Screens. I will next uninstall AVG and install Microsoft Security Essentials and the Windows updates I previously removed. I also sent AVG the file identified as causing the problem. Thanks for your help. I'll follow up in a couple of days.

 

[Kitti Ritter]

Another Blue Screen

I posted this yesterday. Don't know what happened to it. I uninstalled AVG and installed Microsoft Security Essentials. I installed all Windows updates. That was on Tuesday. At first things seemed to be fine. Then on Wednesday the hang ups began again and finally another Blue Screen. According to one section of the report, the index is corrupted. I rebuilt the index of users only. I was going to rebuild Windows index, but Favorites were included and I didn't know how it would effect that file. Attached are the new dump files.

 

[writhziden]

Loading Dump File [D:\Kingston\BSODDmpFiles\Kitti Ritter\022912-12058-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17713.x86fre.win7sp1_gdr.111025-1505
Machine Name:
Kernel base = 0x83052000 PsLoadedModuleList = 0x8319b4d0
Debug session time: Wed Feb 29 15:16:16.373 2012 (UTC - 7:00)
System Uptime: 0 days 2:17:54.762
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c0539118, lock type that was held (value 1,2,3, or PTE address)
Arg2: c0000185, error status (normally i/o status code)
Arg3: 252a28c0, current process (virtual address for lock type 3, or PTE)
Arg4: a7223000, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc0000185 - The I/O device reported an I/O error.

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c0000185

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

TRAP_FRAME:  ab6bb9f4 -- (.trap 0xffffffffab6bb9f4)
ErrCode = 00000002
eax=a7223000 ebx=8852aef0 ecx=87c22030 edx=00010002 esi=87c22030 edi=a7223000
eip=832a90c0 esp=ab6bba68 ebp=ab6bba7c iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
nt!MiRelocateImageAgain+0x38:
832a90c0 f00fba2800      lock bts dword ptr [eax],0   ds:0023:a7223000=00000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from 830f5e28 to 83130ef4

STACK_TEXT:  
ab6bb854 830f5e28 0000007a c0539118 c0000185 nt!KeBugCheckEx+0x1e
ab6bb8c4 830f9709 ab6bb918 831bc280 ab6bb938 nt!MiWaitForInPageComplete+0x302
ab6bb954 830e296b 831bc280 a7223000 86eee9d8 nt!MiIssueHardFault+0x3b3
ab6bb9dc 83093408 00000001 a7223000 00000000 nt!MmAccessFault+0x2656
ab6bb9dc 832a90c0 00000001 a7223000 00000000 nt!KiTrap0E+0xdc
ab6bba7c 83276b69 a720ba20 00000000 00000000 nt!MiRelocateImageAgain+0x38
ab6bbb9c 832760fb ab6bbbf0 0000000f 00000000 nt!MmCreateSection+0x531
ab6bbc10 8309021a 002ff7c8 0000000f 00000000 nt!NtCreateSection+0x16e
ab6bbc10 77af7094 002ff7c8 0000000f 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
002ff7dc 00000000 00000000 00000000 00000000 0x77af7094


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiWaitForInPageComplete+302
830f5e28 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiWaitForInPageComplete+302

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x7a_c0000185_nt!MiWaitForInPageComplete+302

BUCKET_ID:  0x7a_c0000185_nt!MiWaitForInPageComplete+302

Followup: MachineOwner
---------

Points to bad RAM and/or bad hard disk cabling.

• Check that your hard disk is properly connected to the system.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.

 

[Kitti Ritter]

My computer seems to be running much better, but I ran the tests you recommended.
Here are the requested test results:

 

[writhziden]

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  186880 file records processed.                                          File verification completed.
  194 large file records processed.                                      0 bad file records processed.                                        0 EA records processed.                                              60 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...
  223052 index entries processed.                                         Index verification completed.
  0 unindexed files scanned.                                           0 unindexed files recovered.                                       CHKDSK is verifying security descriptors (stage 3 of 5)...
  186880 file SDs/SIDs processed.                                         Cleaning up 56 unused index entries from index $SII of file 0x9.
Cleaning up 56 unused index entries from index $SDH of file 0x9.
Cleaning up 56 unused security descriptors.
Security descriptor verification completed.
  18087 data files processed.                                            CHKDSK is verifying Usn Journal...
  35651672 USN bytes processed.                                             Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc0000185 at offset 0xb5fde000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0xb5fe9000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0xb5fea000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0xb5fea000 for 0x1000 bytes.
Read failure with status 0xc0000185 at offset 0xb5feb000 for 0x10000 bytes.
Read failure with status 0xc0000185 at offset 0xb5feb000 for 0x1000 bytes.
Windows replaced bad clusters in file 19077
of name \Windows\winsxs\x86_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16385_none_21eca131b6966c32\schannel.dll.
Read failure with status 0xc0000185 at offset 0xb5ec1000 for 0x7000 bytes.
Read failure with status 0xc0000185 at offset 0xb5ec4000 for 0x1000 bytes.
Windows replaced bad clusters in file 85585
of name \Users\James\Pictures\Turtles\GEOEMY~3.JPG.
  186864 files processed.                                                 File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  45240205 free clusters processed.                                         Free space verification is complete.
Adding 4 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
[COLOR="Red"]Windows has made corrections to the file system.[/COLOR]


245070847 KB total disk space.
  63711128 KB in 146042 files.
    101852 KB in 18088 indexes.
        [B][COLOR="red"]16 KB in bad sectors.[/COLOR][/B]
    297031 KB in use by the system.
     65536 KB occupied by the log file.
 180960820 KB available on disk.

      4096 bytes in each allocation unit.
  61267711 total allocation units on disk.
  45240205 allocation units available on disk.

Internal Info:
00 da 02 00 2d 81 02 00 42 9f 04 00 00 00 00 00  ....-...B.......
e7 48 01 00 3c 00 00 00 00 00 00 00 00 00 00 00  .H..<...........
78 5b 1c 00 50 01 1a 00 58 18 1a 00 00 00 1a 00  x[..P...X.......

Windows has finished checking your disk.
Please wait while your computer restarts.

If you have problems again, proceed through the disk check again and re-upload the logs. It appears you had some corrupted data that may have contributed to crashes. You also had some bad clusters (damaged sectors) that could indicate more serious problems with the hard disk.

 

[Kitti Ritter]

Thank you everyone for your help. I'll close this thread and see what happens in the future.

 

[writhziden]

You're welcome to keep the thread open while you do your normal routine on the system to see if the problem is solved. We usually recommend keeping the thread going at least as long as it usually takes for a crash to occur, and even better to keep it updated for a few weeks to be absolutely sure.

 

[Kitti Ritter]

I appreciate the recommendation, but everything is running fine now. Soon I'll be getting another computer. After I get it set up, I'll have the components checked out on this one before giving it to my son. SevenForums is a great place to get help and everyone seems so nice and patient with us who are not computer pros.

 

[writhziden]

On behalf of the members of the forums, thank you for the compliments. Best wishes with the new system and the current one for your son. Let us know if you have any questions, comments, or concerns in the future.