Blue Screen Crash

LLC0706
LLC0706 used Ask the Experts™
on
Hi

I keep getting Blue Screen Crashes on my Windows 7 computer.  Iiniyially  though it may have been a faulty hard drive, so I brought another one and installed it.  However I 'm still getting the same problem.

I've ran windows memory diagnostic, which didn't report any errors. I've also ran windows verifier, setting it to all drivers.  This picked up a driver error.  I installed and ran Driver Genius, which located 20+ out of date drivers.

I thought this would solve my problem, but it crashed again.

I have 2 500mb internal hard drives installed, one with 2 operating systems installed on it and the other is the data drive.

I've opened the minidump file and attached it, this one and several of the others state memmory corruption.  I have 4 x 1GB sticks of memory installed on a Windows 7 Ultimate 32bit os.

Please can anyone help me solve this problem.


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\My Documents\Blue Screen Crash\New folder\080811-28360-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.x86fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0x82a15000 PsLoadedModuleList = 0x82b5e4d0
Debug session time: Mon Aug  8 20:30:45.977 2011 (UTC + 1:00)
System Uptime: 0 days 0:09:54.460
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, 8ba53ac6, 9724ba9c, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: 8ba53ac6, The address that the exception occurred at
Arg3: 9724ba9c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+18
8ba53ac6 ff              ???

TRAP_FRAME:  9724ba9c -- (.trap 0xffffffff9724ba9c)
ErrCode = 00000000
eax=8665f138 ebx=8664d790 ecx=00000000 edx=00000000 esi=00000000 edi=85c7f080
eip=8ba53ac6 esp=9724bb10 ebp=9724bb20 iopl=0         nv up di ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010082
fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+0x18:
8ba53ac6 ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x8E

PROCESS_NAME:  SearchProtocol

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8ba48eac to 8ba53ac6

FAILED_INSTRUCTION_ADDRESS: 
fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+18
8ba53ac6 ff              ???

STACK_TEXT:  
9724bb20 8ba48eac 860098b8 8665f108 9724bb9c fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+0x18
9724bb30 8ba41cd8 86eb8008 860098b8 8665f108 fltmgr!FltpCleanupStreamListCtrlForFileObjectCloseWithStreamListCtrl+0x10
9724bb9c 8ba449f0 9724bbf0 85f05bd0 85f05da8 fltmgr!FltpPerformPreCallbacks+0x53a
9724bbb4 8ba44f01 9724bbf0 00000000 86f0dcd0 fltmgr!FltpPassThroughInternal+0x40
9724bbd8 8ba453ba 0224bbf0 86f0dcd0 860098b8 fltmgr!FltpPassThrough+0x203
9724bc08 82a4c593 86f0dcd0 85f05bd0 86f0e024 fltmgr!FltpDispatch+0xb4
9724bc20 82c46965 85397900 860098a0 00000000 nt!IofCallDriver+0x63
9724bc64 82c37581 860098b8 860098b8 860098a0 nt!IopDeleteFile+0x10c
9724bc7c 82a8dd60 00000000 8568d030 860098a0 nt!ObpRemoveObjectRoutine+0x59
9724bc90 82a8dcd0 860098b8 82c5a30c ba2d0ce8 nt!ObfDereferenceObjectWithTag+0x88
9724bc98 82c5a30c ba2d0ce8 8568d030 00000390 nt!ObfDereferenceObject+0xd
9724bcdc 82c5a032 ba2d0ce8 bf46a720 8559b490 nt!ObpCloseHandleTableEntry+0x21d
9724bd0c 82c5a3cc 8559b490 8568d001 00c5fb70 nt!ObpCloseHandle+0x7f
9724bd28 82a531ea 00000390 00c5fbb0 77b170b4 nt!NtClose+0x4e
9724bd28 77b170b4 00000390 00c5fbb0 77b170b4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c5fbb0 00000000 00000000 00000000 00000000 0x77b170b4


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !fltmgr
    8ba53ac3 - fltmgr!FltpRemoveAllStreamHandleContextsForFileObject+15
	[ e8:e0 ]
1 error : !fltmgr (8ba53ac3)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Open in new window

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Have you tried only using one stick of memory? It will run slowly, however you can then switch and see if there is a faulty module which the diagnostic isn't picking up!
fastest way to track this on is to use a testing tool called Driver Verifier.
http://msdn.microsoft.com/en-us/windows/hardware/gg487399

If this tool finds a problem, your machine will crash again.  Hopefully with it enabled, it will allow you to easily identify the bad driver.

Enable driver verifier
1) Open an elevated command prompt
2) Type "verifier /standard /all"  (no quotes)
3) Reboot your machine
4) Use machine again until it crashes (hopefully this will be fast :)

After the crash & reboot, go into safe mode.  http://windowshelp.microsoft.com/Windows/en-US/Help/323ef48f-7b93-4079-a48a-5c58eec904a11033.mspx

Disable driver verifier
1) Open an elevated command prompt
2) Type "verifier /reset" (no quotes)
3) Reboot your machine

Then using the steps you followed before, take a look at the new memory dump.

Commented:
The dmp points to your security software...uninstall your security software and then restart the computer...your issue will be resolved.

If possible zip the minidump folder and upload it.



Ded9
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Author

Commented:
Hi ded9

I've attached the minidump file as requested.  How can you tell if it's the security software.  I'm using Norton 360 version 5.  I've never had a aproblem with Norton before.
080811-28360-01.zip
Commented:
After reading the debug code ...and based on my exp....i  have a gut feeling that its only the security software that is causing the blue screen...i might be wrong...but worth try..as it will not break anything.



Ded9


Commented:
The dmp file you have uploaded points to some kind of security software problem...Uninstall norton ...reboot and then monitor the computer.


Ded9
Top Expert 2013
Commented:
i suggest to run memtest86+ :  www.memtest.org
or from rthe UBCD : http://www.ultimatebootcd.com/      

note that if it crashes after 2 hours normally, you have to run the diag at least for the double, and better for 3x as long

Author

Commented:
Hi nobus

Further information which maybe of help to you and the other experts who are assisting me with this problem:

As far as I can recall each time my pc has had a blue screen crash I've either been working with Adobe Fireworks and been working with multiple images, some of them quite large, or had multiple websites open in IE8.  The most recent crash which is detailed here was when I was watching a tutorial video on lynda.com.  On this occasion I only had this site open and Outlook.

Commented:
Did u try uninstalling norton.


Ded9
Top Expert 2013

Commented:
try running the ram test as suggested - maybe overnight?

Author

Commented:
Hi nobus

I'm running the ram test now; can I run the test with all 4 sticks of ram installed and will it tell me which stick if any has a fault, or do I have to run it with just 1 stick installed at a time?
Top Expert 2013

Commented:
you can test all 4 in 1 run -; but locating the faulty stick is sometimes not very easy
But the most important is knowing if they are ok - or not

Author

Commented:
Hi serverman2008

Thanks for your reply, but I've already ran the driver verifier, it located 20+ drivers, which I updated, I then ran the verifier again, this time without any errors.

I thought this would solve my problem, but then it suddenly crashed again when I was watching an online video.

Commented:
Can u upload the new dmp.


Ded9
you followed all the steps even in safe mode?

Author

Commented:
Hi serverman2008

Yes I then started it in safe mode without any problems.

I've just installed Blue Screen View and opened up the last minidump file I've uploadeda copy of it.  It seems to point to a driver called fltmgr.sys.
080811.png

Author

Commented:
Hi ded9

I don't have another another minidump file. The most recent one is the one that I uploaded previously.

However  have installed and ran Blue Screen View, the results can be seen in the reply to comment 36338719.

Commented:
Well the only solution i think is to uninstall your security software...but lets wait for some other suggestions.


Ded9

Author

Commented:
Hi serverman2008

Since I got the BSOD on the 08.08.11 I have received notification of a new release of my video card driver. I've now downloaded and installed this.  The Driver Verifier didn't pick this one up.

Maybe this will fix my problem as my pc crashed as I was watching an online video.  It maybe a coincidence but several other crashes have happened whist I've been using Adobe Fireworks.

Author

Commented:
Hi nobus

I've tested all 4 memory sticks individually and no errors have been detected.

I'll perform a longer test just to make sure.

Author

Commented:
Hi harryhelp

I've tested all 4 memory sticks individually using Memtest86+ and no errors were detected.

Please see other comments for further information and details.
Top Expert 2013

Commented:
how long did you run the ram test?
you can also test by eliminating devices, and running with the minimum setup as described here :
http://www.experts-exchange.com/Hardware/Components/Motherboards/A_1945.html      (Short-overview-of-how-to-troubleshoot-bad-hardware-when-a-pc-does-not-post)

Commented:
If u think its memory then just connect 1 memory chip and montior it for a day...if no crash is reported then connected the second memory chip...Montior ..do the same for other memory chips.


If this is dell computer then run dell diagnostic by tapping F12 on boot....run a test on memory.


Ded9

Commented:
Hi ded9

It's not a Dell computer that I have.  I have an Asus P5Q motherboard with 4 DDR2 DIMM slots and I have 4 x 1GB of OCZ2P800R22K memory installed.  I'm running windows 7 Ultimate 32 bit OS.  This OS recomends using 3GB of RAM, so I've now removed 1 of the memory sticks to see if this might be causing a problem.

Author

Commented:
Hi nobus

I ran Memtest86+ for 6 hours.  I'll do another test and try and run it overnight.

I'll also try your other suggestion of checking the devices for any problems.

Commented:
Any version of Windows 7 requires just 512 MB or 1GB of Ram to run.


Ded9
Top Expert 2013

Commented:
also - did the new dmp point to memory as well?

Author

Commented:
Hi nobus

My pc hasn't crashed again yet; the last crash was on the 08.08.11, the results are detailed in the previous comments.

Author

Commented:
Thank you all for your assistance with this problem.  Since removing 1 module of memory and reducing the ram to 3GB my pc hasn't crashed again.

This may have solved my problem....or not.  If it crashes again then I'll know it hasn't.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial