I.T. Pro here, need BSOD help

What is the actual error code ?

you've taken the same initial steps i probably would've taken my self. Microsoft claims 70% of BSOD is caused by 3rd party driver.

So what 3rd party hardware / add-on do you have that isn't an Asus product? that'd be another clue. Doesn't necessarly have to one of the 3 things in Device Manager.


Are you logging crash dump files?

1. Navigate to System Properties.
Right click My Computer, select Properties or press the WinKey + Pause.
2. Click Advanced, and under Start Up and Recovery, select Settings.
3. Click on the dropdown arrow under Write Debugging Information.
4. Select Kernal Memory Dump.
5. Then verify the output is C:\MEMORY.DMP or %SystemRoot%\MEMORY.DMP


There are two different types of Windows Memory Dumps. Mini Dumps and full Memory Dumps. Both have the extension of .dmp. Ensure you are logging the dump files.

Then, go out and snag WinDBG and the latest Microsoft Symbols for your OS.

load a .dmp file in WinDBG and see if it points us to anything.

Do you carry this laptop around with you? Laptop motherboards that allow for RAM to be upgraded can sometimes have the modules come lose which would cause your problem. If you carry it around in a backpack, it is possible you may have a loose one.

Other possibilities as another person mentioned is that your RAM is going bad. Also could be a heat issue due to dust or a bad fan causing issues.

yehhhh, i still have my reservations about this being a memory issue.

seriously. check out WinDBG. it and Microsoft Symbols will pretty much tell you exactly the problem.

and it take all of about 10 minutes of effort.

quote:

---

seriously. check out WinDBG. it and Microsoft Symbols will pretty much tell you exactly the problem.

---

Downloading the .Net framework now so I can try this out.

Okay, I downloaded 150,000 symbols, which should I use?

It'd be for Ntoskrnl.exe. Windows 7 64 bit SP1. Lemme see if I can get it to pull it automatically, post as soon as I find it.

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002c5c047, 0, 7efa0000}

Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c5c047, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000000007efa0000, Parameter 1 of the exception

Debugging Details:
------------------


READ_ADDRESS: 0000000000000000

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`02c5c047 66390a cmp word ptr [rdx],cx

BUGCHECK_STR: 0x1E_c0000005_R

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME: fffff8800335b8b0 -- (.trap 0xfffff8800335b8b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000000007efa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c5c047 rsp=fffff8800335ba48 rbp=fffff8800335bb80
r8=0000000000000000 r9=fffff8800335ba88 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`02c5c047 66390a cmp word ptr [rdx],cx ds:00000000`7efa0000=????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002cbba17 to fffff80002c7bf00

STACK_TEXT:
fffff880`0335b028 fffff800`02cbba17 : 00000000`0000001e ffffffff`c0000005 fffff800`02c5c047 00000000`00000000 : nt!KeBugCheckEx
fffff880`0335b030 fffff800`02c7b542 : fffff880`0335b808 fffffa80`0f19f6f0 fffff880`0335b8b0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`0335b6d0 fffff800`02c7a0ba : 00000000`00000000 fffffa80`0f19f6f0 00000000`00860000 fffffa80`0ad1a540 : nt!KiExceptionDispatch+0xc2
fffff880`0335b8b0 fffff800`02c5c047 : fffff800`02c5c0d2 00000000`00000010 00000000`00000082 fffff880`0335ba78 : nt!KiPageFault+0x23a
fffff880`0335ba48 fffff800`02c5c0d2 : 00000000`00000010 00000000`00000082 fffff880`0335ba78 ffffffff`8000071c : nt!RtlImageNtHeaderEx+0x3f
fffff880`0335ba50 fffffa80`0ad13b07 : fffff880`0335bb80 00000000`00000000 fffffa80`0ad17250 fffffa80`0ad1a750 : nt!RtlImageNtHeader+0x1e
fffff880`0335ba80 fffff880`0335bb80 : 00000000`00000000 fffffa80`0ad17250 fffffa80`0ad1a750 00000000`00000000 : 0xfffffa80`0ad13b07
fffff880`0335ba88 00000000`00000000 : fffffa80`0ad17250 fffffa80`0ad1a750 00000000`00000000 00000000`00000000 : 0xfffff880`0335bb80


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlImageNtHeaderEx+3f
fffff800`02c5c047 66390a cmp word ptr [rdx],cx

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!RtlImageNtHeaderEx+3f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

IMAGE_VERSION: 6.1.7600.16385

FAILURE_BUCKET_ID: X64_0x1E_c0000005_R_nt!RtlImageNtHeaderEx+3f

BUCKET_ID: X64_0x1E_c0000005_R_nt!RtlImageNtHeaderEx+3f

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x1e_c0000005_r_nt!rtlimagentheaderex+3f

FAILURE_ID_HASH: {21d14c9f-2a21-53b1-a72a-81ba3a9e09ce}

Followup: MachineOwner
---------

quote:

---

and run a checkdisk tonight

---

That was going to be my 2 cents. I was having BSOD problems on my rig and ran a checkdisk and haven't had one sense. Drivers can be bitches.

I went to work Tuesday, left my laptop running. Came back and it had Blue Screened and rebooted. Same thing, notskrnl.exe supposedly caused the error. I went through the device manager (nothing yellowed) and expanded everything and clicked update driver. There were two that it worked for, the video card, and something else that I can't recall offhand. It made me think, so I went in and disabled power saving settings so where the screen can turn off, but the HDD cannot, the system cannot sleep, and I disabled hibernation.

I then ran Verifier.exe, which tests drivers continuously and tried to make them fail, thus BSODing, and writing a log of specifically what caused it. I began that process at 4:30pm yesterday. Just logged in to check, and it's still up and running, chugging away.

So.... with a little luck, that did it. The video card drivers I was using were the latest (which were a few months old) from Asus's website for the 560M NVidia card. Not sure which one Windows put on, or if the other driver it changed could have been the culprit. But hopefully that fixed it, I'll report back in a few days just so there's a log of how it was resolved if it IS in fact resolved.