Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen of Death


  • This topic is locked This topic is locked
10 replies to this topic

#1 Wang Yuan Ji

Wang Yuan Ji

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 18 June 2011 - 11:58 AM

Hi,

I have gotten the Blue Screen of Death in the past often. Every time, the Blue Screen of Death was distorted so I could not read it. After a little while though, the Blue Screen of Death stopped occurring on its own so I had not bothered seeking assistance. Today I got a Blue Screen of Death. I downloaded an application (BlueScreenView by NirSoft) I learned about only a couple of days ago. I ran BlueScreenView and it provided me with the following results:

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: win32k.sys

KERNEL_DATA_INPAGE_ERROR

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000007a (0xe1c922e8, 0xc0000185, 0xbf854bed, 0x2860a860)

*** win32k.sys - Address 0xbf854bed base at 0xbf800000 DateStamp 0x4d6f95bd

-

According to BlueScreenView, two files may be responsible for the Blue Screen of Death: ntkrnlpa.exe and win32k.sys

* I have not attempted to fix anything

--

I'm also having difficulty installing my HP deskjet 3840 series printer (probably unrelated). When I tried to print something, the computer said the driver for the printer was not installed so I uninstalled it and attempted a clean installation. The computer did not automatically run the installation disc. I opened the E: drive, right-clicked HP Deskjet 3840 series then selected Install. The printer went through the installation process until it reached the following status: Initializing Connection Manager. After that, the installation disc rolled back all changes made to the system as a result of the installation process then displayed a window stating there was an error (an error code or a reason for the error was not given). I attempted to install the printer in safe mode and received the following prompt: The system administrator has set policies to prevent this installation.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:14 AM

Posted 18 June 2011 - 03:41 PM

Let's try this.

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file.

When scanning is done, click Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

louis

#3 Allan

Allan

  • BC Advisor
  • 8,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:14 AM

Posted 18 June 2011 - 03:46 PM

From Microsoft:

KERNEL_DATA_INPAGE_ERROR
Explanation:

This Stop message indicates that the requested page of kernel data from the paging file could not be read into memory. This Stop message is usually caused by a bad block (sector) in a paging file, a virus, a disk controller error, or failing RAM. In rare cases, it is caused when nonpaged pool resources run out. It is also caused by defective hardware.
User Action:

If the I/O status is C0000185 and the paging file is on a SCSI disk, the disk cabling and SCSI termination should be checked for problems. Check your computer for viruses, using any up-to-date, commercial virus scanning software that examines the Master Boot Record of the hard disk. An I/O status code of 0xC000009C or 0xC000016A normally indicates the data cannot be read from the disk due to a bad block (sector). If you can restart the system after the error, Autochk runs automatically and attempts to map out the bad sector. If Autochk does not scan the hard disk for errors, manually launch the disk scanner. Run Chkdsk /f /r on the system partition. Restart the system before the disk scan begins. If you cannot start the system due to the error, use the Recovery Console and run Chkdsk /r. Caution: If your system partition is formatted with the FAT file system, the long file names used by Windows 2000 can be damaged if Scandisk or another MS-DOS–based hard disk tool is used to verify the integrity of your hard disk from an MS-DOS prompt. (An MS-DOS prompt is typically derived from an MS-DOS startup disk or from starting MS-DOS on a multiboot system.) Always use the Windows 2000 version of Chkdsk on Windows 2000 disks. Another common cause of this Stop message is failing RAM. Run hardware diagnostics supplied by the system manufacturer, especially the memory scanner. For details on these procedures, see the owner’s manual for your computer. Check that all network adapters in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure network adapter contacts are clean. Check the System Log in Event Viewer for additional error messages that might help pinpoint the device causing the error. Disabling memory caching of the BIOS might also resolve it. Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error. For more troubleshooting information about this Stop message, refer to the Microsoft Knowledge Base at http://support.microsoft.com/support.

http://www.microsoft.com/resources/d...d_stp_fvlq.asp

Stop 0x0000007A or KERNEL_DATA_INPAGE_ERROR

The Stop 0x7A message indicates that a page of kernel data was not found in the paging (virtual memory) file and could not be read into memory. This might be due to incompatible disk or controller drivers, firmware, or hardware.
Interpreting the Message

This Stop message has four parameters:

1. Lock type value (0x00000001, 0x00000002, 0x00000003, or page table entry (PTE) address).
2. I/O status code.
3. If the lock type is 0x00000001, this parameter represents the current process. If the lock type is 0x00000003, this parameter represents the virtual address.
4. The virtual address that could not be read into memory.

Frequently, the cause of this error can be determined from the second parameter, the I/O status code. Some common status codes are:

* 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources.
* 0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad blocks (sectors) on the hard disk.
* 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data or power cables, a problem with SCSI termination, or improper controller or disk configuration.
* 0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad blocks (sectors) on the hard disk.
* 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, or defective disk cabling, or two devices attempting to use the same resources.

For information about other possible status codes that might be returned, see the file Ntstatus.h of the Windows XP Professional Driver Development Kit (DDK). For more information about the DDK, see the Driver Development Kits link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.
Resolving the Problem

The following suggestions are specific to Stop 0x7A errors. For additional troubleshooting suggestions that apply to all Stop errors, see "Stop Message Checklist" later in this appendix.

* Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk controller error, virus infection, or memory hardware problems. In extremely rare cases, depleted nonpaged pool resources can cause this error. If the first and third parameters are zero, the stack signature in the kernel stack is missing, an error typically caused by defective hardware. If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues. An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found. You can try to correct this by restarting the computer. If a problem with disk integrity exists, Autochk, a program that attempts to mark bad disk sectors as defective so that they are not used in the future, starts automatically. If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run Chkdsk provided in "Stop 0x00000024 or NTFS_FILE_SYSTEM" earlier in this appendix. For more information about Autochk and Chkdsk, see "Troubleshooting Disks and File Systems" in this book.
* Another cause of Stop 0x7A messages is defective, malfunctioning, or failed memory hardware, such as memory modules, Level 2 (L2) SRAM cache, or video adapter RAM. If you added new hardware recently, remove and replace it to determine if it is causing or contributing to the problem. Run diagnostics software supplied by the system manufacturer to determine if the component has failed.
* Check the hardware manufacturer's Web site for updates to disk adapter firmware or drivers that improve compatibility. Verify that your disks and controller support the same set of advanced features, such as higher transfer rates. If necessary, select a slower transfer rate if an update is not yet available. Consult your hardware or device documentation for more information.

Important
o You can install disk controller drivers not present on the Windows XP Professional operating system CD by responding to the following prompt shortly after starting Setup:
o Press F6 if you need to install a third party SCSI or RAID driver.
o Press F6, and when prompted, provide the appropriate storage controller driver (ATA or SCSI) supplied by the manufacturer.
* The problem might also be due to cracks, scratched traces, or defective components on the motherboard. If all else fails, take the system motherboard to a repair facility for diagnostic testing.
* Problems that cause Stop 0x7A messages can also cause Stop 0x77 messages. For more information about Stop 0x77 messages, see "Stop 0x00000077 or KERNEL_STACK_INPAGE_ERROR" earlier in this appendix.

For more information about Stop 0x7A messages, see the Microsoft Knowledge Base link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources. Search using keywords winnt, 0x0000007A, and 0x7A.

#4 Wang Yuan Ji

Wang Yuan Ji
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 18 June 2011 - 03:48 PM

Thanks for replying and here's the report as requested.

==================================================
Dump File : Mini061811-01.dmp
Crash Time : 6/18/2011 10:31:32 AM
Bug Check String : KERNEL_DATA_INPAGE_ERROR
Bug Check Code : 0x0000007a
Parameter 1 : 0xe1c922e8
Parameter 2 : 0xc0000185
Parameter 3 : 0xbf854bed
Parameter 4 : 0x2860a860
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+54bed
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6090 (xpsp_sp3_gdr.110303-1621)
Processor : 32-bit
Crash Address : ntkrnlpa.exe+22f43
Stack Address 1 : ntkrnlpa.exe+3eba2
Stack Address 2 : ntkrnlpa.exe+3f70f
Stack Address 3 : ntkrnlpa.exe+49269
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini061811-01.dmp
Processors Count : 1
Major Version : 15
Minor Version : 2600
Dump File Size : 65,536
==================================================

#5 Allan

Allan

  • BC Advisor
  • 8,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:14 AM

Posted 18 June 2011 - 03:49 PM

Please see my post above. First thing I'd suggest is testing the ram:

To check the ram, download memtest (http://memtest.org/). Burn it to a cd using a dedicated .iso burning utility (http://www.petri.co.il/how_to_write_iso_files_to_cd.htm), make sure the cd drive is at the top of the boot order in bios, then boot to the newly created cd and run the utility.

#6 Wang Yuan Ji

Wang Yuan Ji
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 18 June 2011 - 05:31 PM

I ran the memory test as instructed - It passed.

#7 Allan

Allan

  • BC Advisor
  • 8,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:14 AM

Posted 18 June 2011 - 05:39 PM

Okay, first.....What is new or different since the last time everything worked properly (ie, new hw, new sw, virus, error, etc)?


Then, based on Microsoft's diagnosis I suggest you do the following:

1) Disable the pagefile (set it to zero), rebot, then re-enable the pagefile (system managed). If the pagefile is corrupt, this will help

2) Boot to the Recovery Console and run chkdsk /r

3) Open the case and make sure all cables are firmly seated (especially those to and from the hd.

#8 Wang Yuan Ji

Wang Yuan Ji
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 18 June 2011 - 06:32 PM

There isn't a difference in my computer's performance that I know of (before and after the BSOD and the malware cleaning process). I don't know how to perform any of the solutions you mention in your last post. The following is a list of software installations and uninstallations:

June 12th-15th:

Download (from CNET) and install mp3rocket
mp3rocket installs toolbar(s) without authorization
GeeksToGo assists with cleaning computer of malware
System Restore points (including newly created points after flushing System Restore) stop functioning properly

* I sent a private message to the moderator who helped me clean the computer about the System Restore issue. Now that I think about it.. I wonder if it's okay to perform certain solutions while the System Restore isn't working?

June 15th:

(18:58) Install Firefox Nightly 7.0a1
(20:07) Download Process Explorer 14.12
(24:00) Install Emergency Recovery Utility NT 1.1

June 16th:
(11:17) Install Notepad++
(11:20) Install NoteTab Light

June 17th:

(09:30) Overwrite Sandboxie 3.54 with 3.56
(10:28) Overwrite Google Chrome 13.0.782.24 Beta with 14.0.794.0 Beta

June 18th:

(10:31) Blue Screen of Death
(10:55) Install mp3DirectCut
(01:58) Remove Alky for Applications
(02:00) Remove Gadget Installer
(02:01) Remove Windows Sidebar

I downloaded DirectX 9 (from Filehippo) and installed it. The prompt, after the installation process, stated DirectX 9 was installed successfully and ready to use. I checked for desktop icons, folders in C:\Program Files and entries in Add/ Remove Programs but there are none. I attempted to perform a System Restore (using the restore point created automatically by Windows during the installation process) but it failed. I attempted to perform additional System Restores using most other restore points but all of them failed.

Edited by Wang Yuan Ji, 18 June 2011 - 08:14 PM.


#9 Allan

Allan

  • BC Advisor
  • 8,629 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:06:14 AM

Posted 19 June 2011 - 07:40 AM

Okay. I was not aware this was a malware related issue - I wish you'd mentioned that in your original post. You might want to check with the malware folks on this forum and make sure your system is indeed "clean". Regardless, even after some malware issues there is so much damage remaining the only GOOD option is a fresh install.

Edited by Allan, 19 June 2011 - 07:40 AM.


#10 Wang Yuan Ji

Wang Yuan Ji
  • Topic Starter

  • Members
  • 139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:14 AM

Posted 19 June 2011 - 09:34 AM

It was 3 days, from the time I experienced the BSOD, that I got my computer cleaned. During the 3 days spent cleaning the computer and the 3 days after, I did not experience any problems with the computer (aside from what might be a faulty System Restore). I'll check out the appropriate forum just to be sure my computer is indeed clean though.

Edit: I have SafeXP. SafeXP allows me to easily configure the computer to clear the Pagefile on reboot - Should I proceed to do so while waiting for a response in the 'Am I infected? What do I do?' forum?

Edited by Wang Yuan Ji, 19 June 2011 - 11:04 AM.


#11 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:14 AM

Posted 19 June 2011 - 11:08 AM

OP initiated new topic at http://www.bleepingcomputer.com/forums/topic404814.html/page__p__2298881#entry2298881 .

Based on the fact that new malware topic is now opened...and in the interests of avoiding confusio, I will close this post.

After AII topic is reolved, if the topic needs reopening...just send me a PM and I will reopen it.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users