Solved

BugCheck event id 1001 and Kernel-Power event id 41

Posted on 2013-05-10
9
7,297 Views
Last Modified: 2013-05-14
Experts, thank you for reading

my windows 7 pc keeps rebooting. when left idle for few hours, it crashes. in event viewer I see bugcheck event and then critical kernel power. there is memory.dmp and minidumps so I tried to install SDK for win 7 but installation fails.

another user with window 8 pc starts with same problem with his laptop reboots like 3 times in an hour

I don't know where to begin, how to determine the cause of this? please Help.

BugCheck event id 1001:

Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          10/05/2013 08:25:40
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      P28
Description:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000050 (0xff900098, 0x00000000, 0x82a0430c, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 051013-17628-01.


Kernel-Power event 41:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          10/05/2013 08:25:25
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      P28.domain.local
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
0
Comment
Question by:russus
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
9 Comments
 
LVL 20

Expert Comment

by:wolfcamel
ID: 39154689
several things to look at:
are the machines dust free and fans all spinning ok?
all service packs and patches?
run an app like Ccleaner to kill all temp files etc (wont fix it but will help speed up the diagnostic process)
Run malware bytes and do a spyware scan
I would guess it is just a coincidence with the two machines.
Change memory and/or graphics cards if this is possible.
0
 

Author Comment

by:russus
ID: 39154701
my desktop pc is 2 yrs old so it must have dust in there. the windows 8 pc is a 2 weeks old sony laptop.

on my win7 pc, windows update up to date, I use regcure pro so scanned and cleaned, did windows defender scan and Sophos scan with no infection reported.
i'll open the desktop pc and check if all fans are running
0
 

Author Comment

by:russus
ID: 39154706
all 3 fans running ok
0
Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

 
LVL 70

Expert Comment

by:Qlemo
ID: 39154939
Please provide at least two ZIPped minidumps of the same PC. STOP 0x50 is a hardware or driver error; if the minidumps show the same source of failure, it is most likely a driver issue.
0
 

Author Comment

by:russus
ID: 39154953
regcure deleted all my minidump files. will have to wait for it to crash again. anything else i can do at the moment?
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 39154991
Remove dust, preferably with something able to blow.
Perform the W7 memory test (using the boot menu - press F8 on boot).
Make sure the crash dump is a kernel dump (no mini dump) - see System Properties, Advanced, Startup and Recovery. When there, you might want to uncheck the auto-reboot option on crash, which allows you to see the BSOD with some brief info.
0
 

Author Comment

by:russus
ID: 39160952
Experts

i arrived this morning and i had the blue screen (attached). then i went for a meeting and when i got back, i see the exact same blue screen.
please see attached the minidump and blue screen.
please tell me where the problem is.
much appreciated, thank you
051313-19437-01.dmp
2013-05-13-09.38.17.jpg
0
 
LVL 70

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39161177
This is a different BSOD than before: 0x7F = Unexpected Kernel Mode Trap, with an argument of Double Fault.
The minidump points to savonaccess.sys, and the stack dump fits to that:
PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8ba9e269 to 8b203224

STACK_TEXT:  
ba8faffc 8ba9e269 868934e8 ba8fb014 ba8fb060 fltmgr!FltGetInstanceContext
WARNING: Stack unwind information not available. Following frames may be wrong.
ba8fb00c 8ba9d31f 868934e8 857d44c0 857d4460 savonaccess+0x11269
ba8fb060 8b202aeb 857d44c0 ba8fb080 ba8fb0ac savonaccess+0x1031f
ba8fb0cc 8b2059f0 ba8fb110 87ac6530 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
ba8fb0e4 8b2191fe ba8fb110 8b21cf3c 00000000 fltmgr!FltpPassThroughInternal+0x40
ba8fb0f8 8b2198b7 ba8fb110 87ac6530 87ac6724 fltmgr!FltpCreateInternal+0x24
ba8fb13c 8327fc29 8651b020 8651b7c0 87ac6748 fltmgr!FltpCreate+0x2c9
ba8fb154 8bab8ff1 87b1dd48 8688c030 87ac6530 nt!IofCallDriver+0x63
ba8fb170 8327fc29 8688c030 87ac6530 87b1dda4 fslx+0x5ff1
ba8fb188 8348f506 96738cec ba8fb330 00000000 nt!IofCallDriver+0x63
ba8fb260 8346ed1e 8688c030 c5675440 86b5ad20 nt!IopParseDevice+0xee6
ba8fb2dc 8347f147 00000000 ba8fb330 00000240 nt!ObpLookupObjectName+0x4fa
ba8fb33c 834e0880 ba8fb868 85675440 8587d300 nt!ObOpenObjectByName+0x165
ba8fb498 834e0e42 ba8fb868 00100000 8587d300 nt!IopFastQueryNetworkAttributes+0x127
ba8fb504 8348f78f 8587d300 96738b6c ba8fb6b0 nt!IopQueryNetworkAttributes+0x40
ba8fb5e0 8346ed1e 8688c030 95675440 8587d300 nt!IopParseDevice+0x116d
ba8fb65c 8347f147 00000000 ba8fb6b0 00000240 nt!ObpLookupObjectName+0x4fa
ba8fb6bc 83475c25 ba8fb868 85675440 ba8fb700 nt!ObOpenObjectByName+0x165
ba8fb738 834994a4 85fb4028 00100000 ba8fb868 nt!IopCreateFile+0x673
ba8fb784 832868ba 85fb4028 00100000 ba8fb868 nt!NtCreateFile+0x34
ba8fb784 8328434d 85fb4028 00100000 ba8fb868 nt!KiFastCallEntry+0x12a
ba8fb828 8baddf5a 85fb4028 00100000 ba8fb868 nt!ZwCreateFile+0x11

Open in new window

All calls prior to the savonaccess.sys call are file/network filter driver calls.

savonaccess.sys is Sophos Anti-Virus On-Access Driver (for Vista). Deinstalling Sophos should help, maybe you can get a bugfix or new release.
0
 

Author Comment

by:russus
ID: 39161633
i uninstalled sophos completely. installed avg temporary. will leave pc on overnight to test. thank you for your help
0

Featured Post

SuperAntiSpyware Licenses Discounted by 25% !

Exclusive offer to Experts Exchange Members!
Buy SuperAntiSpyware License(s) from us and save 25% on the regular purchase price.
- Includes Full SuperAntiSpyware Vendor Support Entitlements
- Your Subscription does not begin until you activate your license
- Buy for your friends

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Desktop loading is delayed 38 85
Why do itunes files not play? 17 61
Changing Monitor IDs 3 54
Windows 7 - How to Extend Hard Drive Boot Partition 12 62
While working, an annoying popup showing below will come and we cannot cancel or close it form the screen. The error message will come again and again.
There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question