BSOD Question
Running Windows 7 Professional 32-bit, my desktop has exhibited a variety of bad behaviors for the past several weeks. These include applications freezing, black screen, unintended rebooting, and BSOD. Once, when I tried to run Windows startup repair, the utility could not identify any installed Windows operating system. I'm suspecting an impending hardware failure, but don't know how to isolate the problem. I ran the WDC Diagnostic utility on the system HDD, and it passed the Quick Test.
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033
Additional information about the problem:
BCCode: 1000008e
BCP1: C0000005
BCP2: 845A8885
BCP3: CAC53920
BCP4: 00000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\101319
C:\Temp\WER-66565-0.sysdat
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.48
Locale ID: 1033
Additional information about the problem:
BCCode: 1000008e
BCP1: C0000005
BCP2: 845A8885
BCP3: CAC53920
BCP4: 00000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\101319
C:\Temp\WER-66565-0.sysdat
if it passed POST test, it may related to software failure.
check MBR
check MBR
ASKER
Thank you both. I doubt there is a corrupt MBR, because the system loads normally most of the time. The dmp file is attached. 101319-36098-01.dmp
Not an especially useful report - blames fltmgr.sys which is Window's interface between hardware and software
If this has been going on for a while there will be other .dmp files that might tell us more.
Here's the report:
If this has been going on for a while there will be other .dmp files that might tell us more.
Here's the report:
**************************************************************************
*****
*
*
* Bugcheck Analysis
*
*
*
**************************************************************************
*****
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 845a8885, The address that the exception occurred at
Arg3: cac53920, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 7601.18869.x86fre.win7sp1_gdr.150525-0603
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: ffffffff845a8885
BUGCHECK_P3: ffffffffcac53920
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
fltmgr!TreeFindNodeOrParent+11
845a8885 8b4110 mov eax,dword ptr [ecx+10h]
TRAP_FRAME: cac53920 -- (.trap 0xffffffffcac53920)
ErrCode = 00000000
eax=ffffffff ebx=87214f74 ecx=ffffffff edx=ffffffff esi=87bc53c0
edi=87214f64
eip=845a8885 esp=cac53994 ebp=cac53994 iopl=0 nv up ei ng nz na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010286
fltmgr!TreeFindNodeOrParent+0x11:
845a8885 8b4110 mov eax,dword ptr [ecx+10h]
ds:0023:0000000f=????????
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: cef
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2a
CPU_STEPPING: 7
CPU_MICROCODE: 6,2a,7,0 (F,M,S,R) SIG: 28'00000000 (cache) 0'00000000
(init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: WIN64MAIN
ANALYSIS_SESSION_TIME: 10-13-2019 18:36:40.0312
ANALYSIS_VERSION: 10.0.17763.132 amd64fre
LAST_CONTROL_TRANSFER: from 845a88ed to 845a8885
STACK_TEXT:
cac53994 845a88ed 87214f74 87556d60 ffffffff fltmgr!TreeFindNodeOrParent
+0x11
cac539ac 845a8993 87214f74 87556d60 ffffffff fltmgr!TreeLookup+0x17
cac539d0 845a8b18 87214f74 87556d60 ffffffff fltmgr!TreeUnlinkMultiDoWalk
+0x21
cac539f0 845bc208 87214f74 87556d60 ffffffff fltmgr!TreeUnlinkMulti+0x46
cac53a10 845bc6c7 87214f30 00008000 87556d60 fltmgr!DeleteNameCacheNodes
+0x84
cac53a30 845a0cd8 87bc5008 87556d60 87214f30 fltmgr!
FltpRemoveAllNamesCachedForFileObject+0x2d
cac53a9c 845a39f0 cac53af0 86aa8898 86aa8bb4 fltmgr!
FltpPerformPreCallbacks+0x53a
cac53ab4 845a3f01 cac53af0 00000000 87bae640 fltmgr!
FltpPassThroughInternal+0x40
cac53ad8 845a43ba 02c53af0 87bae640 87556d60 fltmgr!FltpPassThrough+0x203
cac53b08 83851d8d 87bae640 86aa8898 87bc6024 fltmgr!FltpDispatch+0xb4
cac53b20 83a50128 8677d838 87556d48 00000000 nt!IofCallDriver+0x63
cac53b64 83a40d01 87556d60 87556d60 87556d48 nt!IopDeleteFile+0x10c
cac53b7c 83893d60 00000000 8745fcb8 87556d48 nt!ObpRemoveObjectRoutine
+0x59
cac53b90 83893cd0 87556d60 83a63b80 c48dc758 nt!
ObfDereferenceObjectWithTag+0x88
cac53b98 83a63b80 c48dc758 8745fcb8 0000016c nt!ObfDereferenceObject+0xd
cac53bdc 83a638a6 c48dc758 b8e0b2d8 8b6dc908 nt!ObpCloseHandleTableEntry
+0x21d
cac53c0c 83a63c40 8b6dc908 8745fc01 00eaf790 nt!ObpCloseHandle+0x7f
cac53c28 83858a66 0000016c 00eaf794 77bb70f4 nt!NtClose+0x4e
cac53c28 77bb70f4 0000016c 00eaf794 77bb70f4 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
00eaf794 00000000 00000000 00000000 00000000 0x77bb70f4
THREAD_SHA1_HASH_MOD_FUNC: 5aaf02a5e78f7e1ddcf534661eed27386842a65e
THREAD_SHA1_HASH_MOD_FUNC_OFFSET:
10822f8e4dff0093c2e84a863ca9bfba57e6e7e4
THREAD_SHA1_HASH_MOD: b6f74e3a60198d497f1cb6d6ebf1dbd56b8e9372
FOLLOWUP_IP:
fltmgr!TreeFindNodeOrParent+11
845a8885 8b4110 mov eax,dword ptr [ecx+10h]
FAULT_INSTR_CODE: 3910418b
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: fltmgr!TreeFindNodeOrParent+11
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fltmgr
IMAGE_NAME: fltmgr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf11
IMAGE_VERSION: 6.1.7600.16385
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x8E_fltmgr!TreeFindNodeOrParent+11
BUCKET_ID: 0x8E_fltmgr!TreeFindNodeOrParent+11
PRIMARY_PROBLEM_CLASS: 0x8E_fltmgr!TreeFindNodeOrParent+11
TARGET_TIME: 2019-10-13T11:43:34.000Z
OSBUILD: 7601
OSSERVICEPACK: 1000
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x86
OSNAME: Windows 7
OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-05-25 17:59:29
BUILDDATESTAMP_STR: 150525-0603
BUILDLAB_STR: win7sp1_gdr
BUILDOSVER_STR: 6.1.7601.18869.x86fre.win7sp1_gdr.150525-0603
ANALYSIS_SESSION_ELAPSED_TIME: 53f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x8e_fltmgr!treefindnodeorparent+11
FAILURE_ID_HASH: {bedfd44b-6314-e564-97c9-d59430e81a9c}
Followup: MachineOwner
---------ASKER
Here is the previous dmp file...101119-30997-01.dmp
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Both experts are much appreciated!
ASKER
There are (2) Corsair Vengeance modules in this system: 4GB 240-Pin DDR3 SDRAM DDR3 1600 (PC3 12800). MemTest86 reported 21 errors: 1 after completing the third pass, and 20 during the 4th pass. Is this acceptable, or is there a defective module? How would I isolate the specific module to replace?
Try removing modules 3 & 4 and repeat the test. If there are no errors then either or both of the modules you've removed are bad, rinse and repeat etc...
Also bear in mind that a failing CPU could cause RAM errors too (but these tend not to go away when you remove memory modules).
AFAIK Corsair have lifetime warranty so if you still have proof of purchase you may be able to get them replaced.
Also bear in mind that a failing CPU could cause RAM errors too (but these tend not to go away when you remove memory modules).
AFAIK Corsair have lifetime warranty so if you still have proof of purchase you may be able to get them replaced.
If it is an older PC this could also be a failing motherboard. Although not as prevalent as it used to be, capacitors have been known to start to fail over time, and memory refreshes are very dependent on voltage which is filtered by these capacitors... Removing half the memory and rerunning the tests, then swapping remaining memory with the pulled sticks and running again might show if the ram is bad, or the system...
ASKER
Thanks for everyone's input. After further testing, the system drive failed the WDC extended test, with bad sectors which could not be repaired. I'm replacing that drive.
C:\Windows\Minidump\101319
Agree with your gut feeling though, especially based on the OS "disappearing" during the repair.
May be tougher to find a hardware fault though, if the drive really is OK (did you test it outside of the PC?) it could be the controller, PSU, RAM, ...
There's no single hardware test that will hunt this down.