Solved

BugCheck event id 1001 and Kernel-Power event id 41

Posted on 2013-05-10
9
6,815 Views
Last Modified: 2013-05-14
Experts, thank you for reading

my windows 7 pc keeps rebooting. when left idle for few hours, it crashes. in event viewer I see bugcheck event and then critical kernel power. there is memory.dmp and minidumps so I tried to install SDK for win 7 but installation fails.

another user with window 8 pc starts with same problem with his laptop reboots like 3 times in an hour

I don't know where to begin, how to determine the cause of this? please Help.

BugCheck event id 1001:

Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          10/05/2013 08:25:40
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      P28
Description:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000050 (0xff900098, 0x00000000, 0x82a0430c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051013-17628-01.


Kernel-Power event 41:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          10/05/2013 08:25:25
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      P28.domain.local
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
0
Comment
Question by:russus
  • 5
  • 3
9 Comments
 
LVL 20

Expert Comment

by:wolfcamel
ID: 39154689
several things to look at:
are the machines dust free and fans all spinning ok?
all service packs and patches?
run an app like Ccleaner to kill all temp files etc (wont fix it but will help speed up the diagnostic process)
Run malware bytes and do a spyware scan
I would guess it is just a coincidence with the two machines.
Change memory and/or graphics cards if this is possible.
0
 

Author Comment

by:russus
ID: 39154701
my desktop pc is 2 yrs old so it must have dust in there. the windows 8 pc is a 2 weeks old sony laptop.

on my win7 pc, windows update up to date, I use regcure pro so scanned and cleaned, did windows defender scan and Sophos scan with no infection reported.
i'll open the desktop pc and check if all fans are running
0
 

Author Comment

by:russus
ID: 39154706
all 3 fans running ok
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 39154939
Please provide at least two ZIPped minidumps of the same PC. STOP 0x50 is a hardware or driver error; if the minidumps show the same source of failure, it is most likely a driver issue.
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 

Author Comment

by:russus
ID: 39154953
regcure deleted all my minidump files. will have to wait for it to crash again. anything else i can do at the moment?
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 39154991
Remove dust, preferably with something able to blow.
Perform the W7 memory test (using the boot menu - press F8 on boot).
Make sure the crash dump is a kernel dump (no mini dump) - see System Properties, Advanced, Startup and Recovery. When there, you might want to uncheck the auto-reboot option on crash, which allows you to see the BSOD with some brief info.
0
 

Author Comment

by:russus
ID: 39160952
Experts

i arrived this morning and i had the blue screen (attached). then i went for a meeting and when i got back, i see the exact same blue screen.
please see attached the minidump and blue screen.
please tell me where the problem is.
much appreciated, thank you
051313-19437-01.dmp
2013-05-13-09.38.17.jpg
0
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39161177
This is a different BSOD than before: 0x7F = Unexpected Kernel Mode Trap, with an argument of Double Fault.
The minidump points to savonaccess.sys, and the stack dump fits to that:
PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8ba9e269 to 8b203224

STACK_TEXT:  
ba8faffc 8ba9e269 868934e8 ba8fb014 ba8fb060 fltmgr!FltGetInstanceContext
WARNING: Stack unwind information not available. Following frames may be wrong.
ba8fb00c 8ba9d31f 868934e8 857d44c0 857d4460 savonaccess+0x11269
ba8fb060 8b202aeb 857d44c0 ba8fb080 ba8fb0ac savonaccess+0x1031f
ba8fb0cc 8b2059f0 ba8fb110 87ac6530 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
ba8fb0e4 8b2191fe ba8fb110 8b21cf3c 00000000 fltmgr!FltpPassThroughInternal+0x40
ba8fb0f8 8b2198b7 ba8fb110 87ac6530 87ac6724 fltmgr!FltpCreateInternal+0x24
ba8fb13c 8327fc29 8651b020 8651b7c0 87ac6748 fltmgr!FltpCreate+0x2c9
ba8fb154 8bab8ff1 87b1dd48 8688c030 87ac6530 nt!IofCallDriver+0x63
ba8fb170 8327fc29 8688c030 87ac6530 87b1dda4 fslx+0x5ff1
ba8fb188 8348f506 96738cec ba8fb330 00000000 nt!IofCallDriver+0x63
ba8fb260 8346ed1e 8688c030 c5675440 86b5ad20 nt!IopParseDevice+0xee6
ba8fb2dc 8347f147 00000000 ba8fb330 00000240 nt!ObpLookupObjectName+0x4fa
ba8fb33c 834e0880 ba8fb868 85675440 8587d300 nt!ObOpenObjectByName+0x165
ba8fb498 834e0e42 ba8fb868 00100000 8587d300 nt!IopFastQueryNetworkAttributes+0x127
ba8fb504 8348f78f 8587d300 96738b6c ba8fb6b0 nt!IopQueryNetworkAttributes+0x40
ba8fb5e0 8346ed1e 8688c030 95675440 8587d300 nt!IopParseDevice+0x116d
ba8fb65c 8347f147 00000000 ba8fb6b0 00000240 nt!ObpLookupObjectName+0x4fa
ba8fb6bc 83475c25 ba8fb868 85675440 ba8fb700 nt!ObOpenObjectByName+0x165
ba8fb738 834994a4 85fb4028 00100000 ba8fb868 nt!IopCreateFile+0x673
ba8fb784 832868ba 85fb4028 00100000 ba8fb868 nt!NtCreateFile+0x34
ba8fb784 8328434d 85fb4028 00100000 ba8fb868 nt!KiFastCallEntry+0x12a
ba8fb828 8baddf5a 85fb4028 00100000 ba8fb868 nt!ZwCreateFile+0x11

Open in new window

All calls prior to the savonaccess.sys call are file/network filter driver calls.

savonaccess.sys is Sophos Anti-Virus On-Access Driver (for Vista). Deinstalling Sophos should help, maybe you can get a bugfix or new release.
0
 

Author Comment

by:russus
ID: 39161633
i uninstalled sophos completely. installed avg temporary. will leave pc on overnight to test. thank you for your help
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

No matter the version of Windows you are using, you may have some problems with Windows Search running too slow or possibly not running at all. Before jumping into how you can solve this issue, just know there are many other viable alternative deskt…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now