[busdriver12]

Greetings,

The past couple of days my PC has been restarting with a blue screen for no apparent reason. I haven't installed any new software recently or been anywhere unusual online so not sure if it's software or hardware related. It's just gone out with a blue screen about 15 mins ago when I wasn't at the machine and I managed to copy the following from the Windows "check for problem" dialog.

-------

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 3081

Additional information about the problem:
BCCode: 3b
BCP1: 00000000C0000005
BCP2: FFFFF80002EB7B05
BCP3: FFFFF8800AF93290
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\072013-24382-01.dmp
C:\Users\Phil\AppData\Local\Temp\WER-50466-0.sysdata.xml

Read our privacy statement online:
http://go.microsoft....88&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

------

I am running Windows 7 on a Core I7 3770 CPU 8Gb RAM 1Tb HDD.
Any ideas where to look or where to go from here?

TIA

Edited by busdriver12, 20 July 2013 - 05:49 AM.

[Advertisements]

Please do the following and post the requested logs.

• Please download the Event Viewer Tool by Vino Rosso VEW and save it to your Desktop:
• Double-click VEW.exe
• Under 'Select log to query', select (as appropriate):
  
  • Application
  • System
• Under 'Select type to list', select (as appropriate):
  
  • Error
  • Information
  • Warning

Then use the 'Date of events' or 'Number of events' as follows:

Either:

• Click the radio button for 'Number of events'
  Type 3 in the 1 to 20 box (or any number from 1 to 20)
  Then click the Run button.
  Notepad will open with the output log.
  
  
• Click the radio button for 'Date of events'
  In the From: boxes type today's date (presuming the crash happened today) 04 11 2012
  In the To: boxes type today's date (presuming the crash happened today) 04 11 2012
  Then click the Run button.
  Notepad will open with the output log.

Please post the Output log in your next reply


[*] Click the radio button for 'Date of events'
In the From: boxes type today's date (presuming the crash happened today) 20 07 2013
In the To: boxes type today's date (presuming the crash happened today) 20 07 2013
Then click the Run button.
Notepad will open with the output log.
[/list]Please post the Output log in your next reply




Download WhoCrashed from the link in my signature below
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.
Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it Say Yes
WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply

http://www.resplendence.com/downloads

[rshaffer61]

Please do the following and post the requested logs.

• Please download the Event Viewer Tool by Vino Rosso VEW and save it to your Desktop:
• Double-click VEW.exe
• Under 'Select log to query', select (as appropriate):
  
  • Application
  • System
• Under 'Select type to list', select (as appropriate):
  
  • Error
  • Information
  • Warning

Then use the 'Date of events' or 'Number of events' as follows:

Either:

• Click the radio button for 'Number of events'
  Type 3 in the 1 to 20 box (or any number from 1 to 20)
  Then click the Run button.
  Notepad will open with the output log.
  
  
• Click the radio button for 'Date of events'
  In the From: boxes type today's date (presuming the crash happened today) 04 11 2012
  In the To: boxes type today's date (presuming the crash happened today) 04 11 2012
  Then click the Run button.
  Notepad will open with the output log.

Please post the Output log in your next reply


[*] Click the radio button for 'Date of events'
In the From: boxes type today's date (presuming the crash happened today) 20 07 2013
In the To: boxes type today's date (presuming the crash happened today) 20 07 2013
Then click the Run button.
Notepad will open with the output log.
[/list]Please post the Output log in your next reply




Download WhoCrashed from the link in my signature below
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.
Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it Say Yes
WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply

http://www.resplendence.com/downloads

[busdriver12]

G'Day rshaffer61,
Thanks for helping me

Before I start, the system has now become extremely unstable in that it now resets itself about a minute or two after start up making it impossible to be able to run the machine long enough to run these scans. However, I have booted it into safe mode and it is quite stable there which is where the scans were run from. I am posting from another machine on my network.

I was a little confused about your VEW instructions as you gave the same instruction twice, so I went with the date method. Due to the size of VEW.txt (Over 700Kb) I have attached it to the post and pasted in log file from Whocrashed

------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Sat 20/07/2013 23:05:07 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-19188-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0x5D136)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF9600008D136, 0xFFFFF88008DBE230, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 20/07/2013 23:05:07 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: win32k.sys (win32k!EngBitBlt+0x27A96)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF9600008D136, 0xFFFFF88008DBE230, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 20/07/2013 23:00:12 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-22417-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x19 (0x22, 0x2000000000000000, 0x0, 0x0)
Error: BAD_POOL_HEADER
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 22:43:46 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-18844-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002F19CEC, 0xFFFFF8800B023E50, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 22:36:40 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-22838-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x4688)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF8800B14E7C8, 0xFFFFF8800B14E020, 0xFFFFF80002E8B434)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 20/07/2013 22:32:54 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-21777-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA8004CD29B0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 22:30:56 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072113-21528-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002E93AEE, 0xFFFFF880088B3E40, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 12:58:13 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-22573-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0xA (0xFFFFFA801B6B9010, 0x2, 0x1, 0xFFFFF80002F87CA6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 12:56:18 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-21762-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80002EBF64D, 0x0, 0xFFFFFFFFFFFFFFFF)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 12:51:07 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-24055-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002E94E84, 0xFFFFF88008EE64A0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 12:24:21 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-21808-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x4688)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88009F18978, 0xFFFFF88009F181D0, 0xFFFFF88001EBAAA5)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Sat 20/07/2013 12:17:49 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-22666-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x31, 0xFFFFFA8006CE5C10, 0xFFFFF88003603000, 0xFFFFF8A0059DDA64)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 11:15:37 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-24382-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002EB7B05, 0xFFFFF8800AF93290, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 20/07/2013 10:20:32 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072013-22526-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0xA (0xFFFFFA801B6C9010, 0x2, 0x1, 0xFFFFF80002F42CA6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 19/07/2013 11:23:01 GMT your computer crashed
crash dump file: C:\Windows\Minidump\071913-19578-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA8001CDBC80, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

51 crash dumps have been found and analyzed. Only 15 are included in this report. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

klif.sys (Klif Mini-Filter [fre_wlh_x64], Kaspersky Lab ZAO)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

Attached Files

•  VEW.txt   741.55KB   201 downloads

[rshaffer61]

First a explanation of the errors you are getting

Stop error code 0x0000003B (SYSTEM_SERVICE_EXCEPTION)
A computer that is running Windows 7 or Windows Server 2008 R2 may crash when you use some IEEE 1394 devices.

0x00000019: BAD_POOL_HEADER
A pool header issue is a problem with Windows memory allocation. Device driver issues are probably the msot common, but this can have diverse causes including bad sectors or other disk write issues, and problems with some routers. (By theory, RAM problems would be suspect for memory pool issues, but I haven’t been able to confirm this as a cause.)

0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software. I suggest running ChkDsk or ScanDisk as a first step; then disable all file system filters such as virus scanners, firewall software, or backup utilities. Check the file properties of NTFS.SYS to ensure it matches the current OS or SP version. Update all disk, tape backup, CD-ROM, or removable device drivers to the most current versions.

0x0000001A: MEMORY_MANAGEMENT
This memory management error is usually hardware related. See the General Troubleshooting of STOP Messages checklist above. If this occurs while installing Windows, also check the Windows system requirements including the amount of RAM and disk space required to load the operating system. If none of the above resolves the problem, see the MSDN article linked above for further steps.

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows.

These actions might prevent an error like this from happening again:

Download and install updates and device drivers for your computer from Windows Update.
Scan your computer for computer viruses.
Check your hard disk for errors.

0x0000001E: KMODE_EXCEPTION_NOT_HANDLED
The Windows kernel detected an illegal or unknown processor instruction. A Stop 0x1E condition can be caused by invalid memory and access violations similar to those that generate Stop 0xA errors. This default Windows error handler typically intercepts these problems if error-handling routines are not present in the code itself.

Now there are three things that are shared with these errors. Memory, HD and drivers. So first Lets check what we can outside of Windows.


Run hard drive diagnostics: http://www.tacktech....ay.cfm?ttid=287
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: http://www.imgburn.com/ to burn .iso file to a CD (chose "Write image file to disc" option), and make the CD bootable.

NOTE. If your hard drive is made by Toshiba, try the Hitachi DFT CD Image version of the software

Thanks to Broni for the instructions







A If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...


1. Download - Pre-Compiled Bootable ISO (.zip). If you prefer to use the USB version then use this link USB KEY
2. Unzip downloaded /memtest86+-4.20.iso.zip file.
3. Inside, you'll find /memtest86+-4.20.iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:



8. Locate memtest86+-4.20.iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:



10. Once the CD is created, boot from it, and memtest will automatically start to run. You may have to change the boot sequence in your BIOS to make it work right.

To change Boot Sequence in your BIOS

Reboot the system and at the first post screen (where it is counting up memory) start tapping the DEL button
This will enter you into the Bios\Cmos area.
Find the Advanced area and click Enter
Look for Boot Sequence or Boot Options and highlight that click Enter
Now highlight the first drive and follow the directions on the bottom of the screen on how to modify it and change it to CDrom.
Change the second drive to the C or Main Drive
Once that is done then click F10 to Save and Exit
You will prompted to enter Y to verify Save and Exit. Click Y and the system will now reboot with the new settings.


The running program will look something like this depending on the size and number of ram modules installed:




It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.



The following image is the test results area:



The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.

[busdriver12]

G'Day again rshaffer61,

I must admit I was taken aback by the results. This PC was bought in January and a little worrying to think that there was a potential hardware fault. As I couldn't get it to even start normally any more in Windows, I started it up in safe mode. Interestingly, it remains up in safe mode with no hint of instability but as soon as I try to boot normally it doesn't make it to the welcome screen :/

I located the diagnostics for my HDD (Segate 1Tb) and downloaded them, but they would not install in safe mode. I decided to skip to the memory test next. As I have two 4Gb sticks installed, I removed one of them and rebooted and voila! It booted normally without a glitch. I reinserted the memory module to determine if it was at fault and it still booted without error or instability. Now that I have my machine running normally I installed the SeaTools (HDD diagnostics) and wasn't really sure what tests I should be running. There was no creation of a bootable disk/CD so I went with a 'Short drive self test' which it passed. Wasn't too sure where to go from here but it appears to be OK.

As the manual method of checking the memory modules appears to have made my machine stable I am wondering where to go from here.

Thanks for your help so far and await your reply.

Phil

[rshaffer61]

If you are running the test from within Windows then you have the Windows version. It is possible that the memory just needed to be reseated.
If possible there should be a advance or long test available on the SeaTools. Can you run that to make sure the HD is good please.

[busdriver12]

Just a short one to let you know I'll be running the longer HDD test later today as time has been of a premium here. I have had one more reboot (after leaving it running for a few hours) so will remove and reseat the other memory stick. After the reboot, windows ran chkdsk and marked a section of the HDD bad so there may be a problem with it. Seeing the machine is barely 6 months old, I think I will be returning it to the shop I bought it from to have it sorted if this problem does turn out to be hardware related.

Will run the long test in Seatools when I get home from work tonight.

Thanks for your time and patience so far - the time difference between us does not help (I think I am 13 hrs ahead of you).

Phil

[rshaffer61]

No problem Phil and since the chkdsk has found a bad area then yes a replacement is needed. This may also be part of the BSOD's you are getting as at least 2 of the rorror codes suggest a possible HD problem. I think you have found the issues with the memory and now the HD. Please update me with the findings of the long test.

[busdriver12]

I've run both the 'Long Generic' and 'SMART' tests in Seatools and both passed. Not sure where to go from here. I've had the PC running for over 5 hours with no sign of instability.

Thanks for your time. You may have indirectly solved my problem by pointing me to reseat the RAM modules. Whatever the outcome, thanks for you time and efforts

Phil

[rshaffer61]

OK lets run it for the next 24 to 48 hours like you normally would. If no issues arise then I would say the memory being reseated may have resolved it. I would suggest you watch that HD now and keep a eye out for any issues there. Please keep me updated as to how the system is running.

[busdriver12]

If you are running the test from within Windows then you have the Windows version. It is possible that the memory just needed to be reseated.
If possible there should be a advance or long test available on the SeaTools. Can you run that to make sure the HD is good please.

Hi rshaffer61, sorry for the lateness, but have not had much spare time over the past couple of days.

The day after I re-seated the first RAM stick the PC ran rock solid for over 6 hours that evening. However, during the shut down that night, the PC restarted but due to the lateness let it shut down. The following morning it rebooted a couple of times and it looks like it's misbehaving again. I currently have the PC running in safe mode and each time I do so (run in safe mode) it behaves itself which makes me think this is a software issue. Both memory sticks have been re-seated and it's passed Seagate's diagnostics but seeing it's still under warranty it may be wise to take it back to the shop. However, I'd like to exhaust the software avenue first. Below is a what WhoCrashed reported from all the crashes since I last posted:

------

Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Wed 24/07/2013 9:52:50 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072413-18720-01.dmp
This was probably caused by the following module: peauth.sys (peauth+0x701BE)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF88008F171BE, 0xFFFFF8800C07A300, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\drivers\peauth.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Protected Environment Authentication and Authorization Export Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Wed 24/07/2013 9:52:50 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: peauth.sys (peauth+0x701BE)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF88008F171BE, 0xFFFFF8800C07A300, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\drivers\peauth.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Protected Environment Authentication and Authorization Export Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Tue 23/07/2013 21:56:35 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072413-19156-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0xA (0xFFFFFA801B6E5010, 0x2, 0x1, 0xFFFFF80002F46CA6)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 23/07/2013 21:54:43 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072413-25178-01.dmp
This was probably caused by the following module: dxgkrnl.sys (dxgkrnl+0x2F708)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF880054BC708, 0xFFFFF88008AECB80, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\drivers\dxgkrnl.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics Kernel
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Tue 23/07/2013 15:29:40 GMT your computer crashed
crash dump file: C:\Windows\Minidump\072313-27877-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x41284, 0x140067001, 0x41, 0xFFFFF70001080000)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

------

After each crash the following dialog comes from Kaspersky (my virus scanner):

https://www.dropbox..../KAV01_60pc.jpg

Clicking on the 'List of files' links shows:

https://www.dropbox..../KAV02_60pc.jpg

Hope this info is not too vague.

Thanks for your persistence.

Phil

Edited by busdriver12, 24 July 2013 - 04:31 AM.

[rshaffer61]

I still believe chkdsk finding a bad area of your hd is where the issue is originating from. Since it is still under warranty then I would suggest having it looked at so it will be covered. I can have you run the following to verify System Files are intact and working to be sure.

SFC /Scannow Win7

Go HERE and read the tutorial that shows how to do SFC or System File Checker and running in a Elevated Command Prompt in Vista and Win7.

[busdriver12]

I still believe chkdsk finding a bad area of your hd is where the issue is originating from. Since it is still under warranty then I would suggest having it looked at so it will be covered. I can have you run the following to verify System Files are intact and working to be sure.

Hi again rshaffer61

I have come to the same conclusion as yourself, that the HDD is on the way out which is disappointing considering the age of the system (6 months). I have bought an external hard drive today with the express purpose of backing up what's on the HDD. I started the PC up today and it has continuously crashed with a blue screen. FYI, I have photogrphed the screen with my DSLR camera and placed the screens here:

https://www.dropbox....wgmx/4yVmoNC5Bu

The last screen which is the result of chksdk (no /F) which pretty much confirms your analysis. I will be returning the PC to the shop I bought it from with the view of getting the HDD replaced. Before I do, I'll be backing up the files not covered by my dropbox a/c.

I'm not going to go with SFC until I have done the backup with the external HDD so I can ensure the integrity of my data. As a final note, it's interesting to note that despite the numerous blue screens, the system remains rock solid in safe mode which is allowing me to recover my data.

I'd like to say a big thanks for the help you've given me on this. When I come to some sort of definitive answer I'll post in this thread for anyone else that may have been following our discussion.

Thanks once again

Edited by busdriver12, 25 July 2013 - 07:06 AM.

[rshaffer61]

Yep I forgot to mention to backup your files before taking it to a shop because the warranty won't cover backing up of files. The hd itself should be covered under warranty along with the re-installation of the original OS and programs. Yes please update me when you have the final resolution or if there are any other questions I can answer for you. I want to say it has been a honor to assist you and thank you for doing such a great job. I await your results and I hope the shop gets you up and running quickly.

[busdriver12]

G'Day rshaffer61,

Yep I forgot to mention to backup your files before taking it to a shop because the warranty won't cover backing up of files. The hd itself should be covered under warranty along with the re-installation of the original OS and programs. Yes please update me when you have the final resolution or if there are any other questions I can answer for you. I want to say it has been a honor to assist you and thank you for doing such a great job. I await your results and I hope the shop gets you up and running quickly.

Just an update,

I have managed to get all my vital files backed up to an external HDD - no data loss. All the installed software I have install disks for so no worries there. However, the machine has become that unstable that it cannot make it past the windows starting screen without blue screening. I've tried to run sfc in safe mode and it blue screens part of the way through the scan.

I've been tossing up whether to attempt a repair from the Windows install DVD or just leave it for when it goes back to the shop this week. I've successfully booted from the disk and am looking at the various recovery options. I've run the memory diagnostic but as I cannot boot cleanly into windows normally, never got to see the log file/report it produced.

That's where I'm up to at present. The only semblance of stability is when I run it in safe mode which I'm grateful for as it's allowed me to get the last of my files off it

Once again, thanks so much for hanging in there and for your advice/suggestions. I'll re-post back in this thread later in the week once a solution has been reached. I hope this little drama of mine has helped anyone else who may have been reading it.

Phil