Persistent blue screen issues - hardware related?

Jimmy the Rogue

Jimmy the Rogue

Jimmy the Rogue

Associate
Joined
14 Jun 2012
Posts
48
Hello, so I haven't posted about this issue for a while largely because it seemed to go away, but at the same time I haven't really been here either. Anyway, it appears that I cannot turn my PC off without being informed that it bluescreened and "shut down unexpectedly" the next morning, and I'm assuming it must be some kind of memory issue again despite the fact that I extensively tested my RAM. It also simply blue screened this morning for no apparent reason about two minutes after turning it on and browsing iTunes, and that's the first time it has bluescreened without being told to turn off for a while, although consider that the PC is barely two months old.

Also, there is one windows update which refuses to download and continues to fail no matter how many times I try to download it or how many of the recommended steps and tools I use from Microsoft. Could the two be related somehow to a RAM issue? I'm fairly certain it can't be a software problem because as far as I know all of my drivers are up to date, and I've otherwise been very careful.

If anyone can shed some kind of light on what the issue may be and how I can resolve it, I would appreciate it greatly.
 
Jimmy the Rogue said:
Hello, so I haven't posted about this issue for a while largely because it seemed to go away, but at the same time I haven't really been here either. Anyway, it appears that I cannot turn my PC off without being informed that it bluescreened and "shut down unexpectedly" the next morning, and I'm assuming it must be some kind of memory issue again despite the fact that I extensively tested my RAM. It also simply blue screened this morning for no apparent reason about two minutes after turning it on and browsing iTunes, and that's the first time it has bluescreened without being told to turn off for a while, although consider that the PC is barely two months old.

Also, there is one windows update which refuses to download and continues to fail no matter how many times I try to download it or how many of the recommended steps and tools I use from Microsoft. Could the two be related somehow to a RAM issue? I'm fairly certain it can't be a software problem because as far as I know all of my drivers are up to date, and I've otherwise been very careful.

If anyone can shed some kind of light on what the issue may be and how I can resolve it, I would appreciate it greatly.
Click to expand...

Hi Jimmy

go to c:\windows\minidump folder on your pc

in here will be some .dmp files. post it up on forum or skydrive it and link me. ill analyze it and should be able to tell you exactly whats wrong
 
Which windows update is it? At what point does it bluescreen, do you actually see it when shutting down? I would say the two are related.
I did have one update from a long time ago that refused to install. Ended up doing a fresh install in the end.
It may be that the update won't install as it has been superceded by another one. If you can identify which it is you could maybe work backwards.
 
dunn2010 said:
never heard of that. looks like a good app :D

i usually analyze them with debugging tools for windows installed and using command line :D
Click to expand...

Why do things the easy way, eh?

To the OP: sometimes the only way to be sure it's not hardware with an intermittent problem is to try the easy option of booting off a Linux LiveCD (or installing it so you can enable any proprietary graphic card drivers).

That's the quickest but with a bit more work you can re-partition your drive and install a 2nd clean copy of Windows with all your drivers.
 
................................................................
.........................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002e56eb1, fffff880009a9898, fffff880009a90f0}

Probably caused by : memory_corruption ( nt!MmZeroPageThread+3c4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e56eb1, The address that the exception occurred at
Arg3: fffff880009a9898, Exception Record Address
Arg4: fffff880009a90f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MmZeroPageThread+3c4
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0

EXCEPTION_RECORD: fffff880009a9898 -- (.exr 0xfffff880009a9898)
ExceptionAddress: fffff80002e56eb1 (nt!MmZeroPageThread+0x00000000000003c4)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff880009a90f0 -- (.cxr 0xfffff880009a90f0)
rax=0000000000000078 rbx=fffdffffffffffff rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa80068e46c0 rdi=0000000000000078
rip=fffff80002e56eb1 rsp=fffff880009a9ad0 rbp=000000000000007f
r8=0000000000000000 r9=0000058000000000 r10=0000000000000002
r11=0000000000000024 r12=0000000000000024 r13=ff9ffa7fffffffd0
r14=0000000000000080 r15=fffff80003006e80
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MmZeroPageThread+0x3c4:
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0 ds:002b:ff9ffa7f`ffffffe0=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c3100
GetUlongFromAddress: unable to read from fffff800030c31c0
ffffffffffffffff

FOLLOWUP_IP:
nt!MmZeroPageThread+3c4
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff8000312ae6a to fffff80002e56eb1

STACK_TEXT:
fffff880`009a9ad0 fffff800`0312ae6a : fffffa80`069fbb50 00000000`00000080 fffffa80`069fb040 fffff800`02e84eb9 : nt!MmZeroPageThread+0x3c4
fffff880`009a9c00 fffff800`02e84ec6 : fffff800`03006e80 fffffa80`069fbb50 fffff800`03014cc0 01638d44`c3b60f04 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9c40 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a97b0 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MmZeroPageThread+3c4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3

STACK_COMMAND: .cxr 0xfffff880009a90f0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+3c4

BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+3c4

Followup: MachineOwner
---------

So, a driver issue creating memory corruption or something?

Edit: Also I'm trying whocrashed and I'll post my results, but I need to leave for about an hour or so - they'll be somewhat delayed.
 
Last edited:
Jimmy the Rogue said:
................................................................
.........................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002e56eb1, fffff880009a9898, fffff880009a90f0}

Probably caused by : memory_corruption ( nt!MmZeroPageThread+3c4 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e56eb1, The address that the exception occurred at
Arg3: fffff880009a9898, Exception Record Address
Arg4: fffff880009a90f0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!MmZeroPageThread+3c4
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0

EXCEPTION_RECORD: fffff880009a9898 -- (.exr 0xfffff880009a9898)
ExceptionAddress: fffff80002e56eb1 (nt!MmZeroPageThread+0x00000000000003c4)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff880009a90f0 -- (.cxr 0xfffff880009a90f0)
rax=0000000000000078 rbx=fffdffffffffffff rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa80068e46c0 rdi=0000000000000078
rip=fffff80002e56eb1 rsp=fffff880009a9ad0 rbp=000000000000007f
r8=0000000000000000 r9=0000058000000000 r10=0000000000000002
r11=0000000000000024 r12=0000000000000024 r13=ff9ffa7fffffffd0
r14=0000000000000080 r15=fffff80003006e80
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MmZeroPageThread+0x3c4:
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0 ds:002b:ff9ffa7f`ffffffe0=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c3100
GetUlongFromAddress: unable to read from fffff800030c31c0
ffffffffffffffff

FOLLOWUP_IP:
nt!MmZeroPageThread+3c4
fffff800`02e56eb1 f0410fba6d1000 lock bts dword ptr [r13+10h],0

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff8000312ae6a to fffff80002e56eb1

STACK_TEXT:
fffff880`009a9ad0 fffff800`0312ae6a : fffffa80`069fbb50 00000000`00000080 fffffa80`069fb040 fffff800`02e84eb9 : nt!MmZeroPageThread+0x3c4
fffff880`009a9c00 fffff800`02e84ec6 : fffff800`03006e80 fffffa80`069fbb50 fffff800`03014cc0 01638d44`c3b60f04 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9c40 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a97b0 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MmZeroPageThread+3c4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4fa390f3

STACK_COMMAND: .cxr 0xfffff880009a90f0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+3c4

BUCKET_ID: X64_0x7E_nt!MmZeroPageThread+3c4

Followup: MachineOwner
---------

So, a driver issue creating memory corruption or something?

Edit: Also I'm trying whocrashed and I'll post my results, but I need to leave for about an hour or so - they'll be somewhat delayed.
Click to expand...

Nail on the head. go update your drivers etc. if that dosent work quickest way to resolve will probably be a wipe and load.
 
So the WhoCrashed download didn't take nearly as long as I thought it would, but I don't have the time at this second to analyze it in detail (and don't really have the knowledge either) so this is more or less a direct paste.


--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


On Fri 14/09/2012 13:44:10 GMT your computer crashed
crash dump file: C:\Windows\Minidump\sub\091412-15225-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41EB1)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80002E56EB1, 0xFFFFF880009A9898, 0xFFFFF880009A90F0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Fri 14/09/2012 13:44:10 GMT your computer crashed
crash dump file: C:\Windows\Minidump\091412-15225-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x41EB1)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80002E56EB1, 0xFFFFF880009A9898, 0xFFFFF880009A90F0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Fri 14/09/2012 13:44:10 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x7E (0xFFFFFFFFC0000005, 0xFFFFF80002E56EB1, 0xFFFFF880009A9898, 0xFFFFF880009A90F0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug check description: This bug check indicates that a system thread generated an exception that the error handler did not catch.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Fri 14/09/2012 13:37:40 GMT your computer crashed
crash dump file: C:\Windows\Minidump\091412-13353-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5A88)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800DD1E918, 0xFFFFF8800DD1E170, 0xFFFFF880016BF527)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.


On Thu 13/09/2012 02:50:28 GMT your computer crashed
crash dump file: C:\Windows\Minidump\091312-13275-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7F1C0)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA800407A240, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Sat 01/09/2012 19:41:59 GMT your computer crashed
crash dump file: C:\Windows\Minidump\090112-15958-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x7F1C0)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA8004020840, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.


On Sat 25/08/2012 16:02:14 GMT your computer crashed
crash dump file: C:\Windows\Minidump\082512-16645-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5A88)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800377E478, 0xFFFFF8800377DCD0, 0xFFFFF80002E6CD76)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.



--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

7 crash dumps have been found and analyzed. No offending third party drivers have been found. Consider configuring your system to produce a full memory dump for better analysis.
 
says no offending third party drivers. basically means untrusted drivers. might not be untrusted drivers causing issue. i would defiantly go with updating all drivers etc on ya system
 
dunn2010 said:
says no offending third party drivers. basically means untrusted drivers. might not be untrusted drivers causing issue. i would defiantly go with updating all drivers etc on ya system
Click to expand...

The problem is that I was under the impression that all of my drivers were up to date, is there some process I can go through to determine which drivers need updating? You're talking to a complete noob here.
 
Easiest way is to a re-install and let windows update itself.
NB - don't install optional driver updates. Just let the OS sort itself out.
 
If you want to check your drivers, I use the paid for version of Driver Genius Professional Edition. The free version will still tell you whats out of date but just wont automatically update them.

Is your system overclocked?
 
So, I backed up my important files and performed a clean install, and things seemed to be going fine, no blue screens, and finally all windows updates had managed to download (although I'm sceptical that it will stay that way as the update issue has come back before). Then just after I finish downloading my protection, anti-virus, firewall, anti-malware etc., I download Threatfire and I'm prompted to restart my PC. Suddenly after booting and signing in fine, it refuses to stop loading and I can't access my taskbar or programs, and start up recovery doesn't recognise an issue after four attempts.

It's amazing how one slight change can completely bugger up the entire thing. I'm performing a system restore as we speak and hoping for the best.

tribz said:
If you want to check your drivers, I use the paid for version of Driver Genius Professional Edition. The free version will still tell you whats out of date but just wont automatically update them.

Is your system overclocked?
Click to expand...

I've heard poor reviews about the program, and I haven't had much chance to overclock, I haven't been home much in the last two months and when I am here something goes wrong with the damn thing.
 
usually monitors are plug and play,i never use my lg monitor drvers,they should be available to download on the makers website

first id manually set the bclk to 100mhz
then set dram voltage to 1.55v and cpu vtt one or two clicks more than what auto is using,maybe between 1.08-1.10v

then see if its any better,might need to try with one level higher llc,but test with the other settings first
 
wazza300 said:
usually monitors are plug and play,i never use my lg monitor drvers,they should be available to download on the makers website

first id manually set the bclk to 100mhz
then set dram voltage to 1.55v and cpu vtt one or two clicks more than what auto is using,maybe between 1.08-1.10v

then see if its any better,might need to try with one level higher llc,but test with the other settings first
Click to expand...

I thought this was a driver problem?
 
You must log in or register to reply here.
Back
Top Bottom