Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Lenovo Blue Screen - 50 PCs


  • Please log in to reply
10 replies to this topic

#1 jcarter0713

jcarter0713

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:37 AM

Posted 23 December 2015 - 10:11 AM

We have a lab of 50 computers that we moved over the summer into a new lab location. They are all Lenovo ThinkCentre m78. Since the move we have had an issue with them blue screening at random times, and they all bluescreen. So far we have completed the folowing:

- Rolled Back Updates

- Updated All Drivers

- Updated all Lenovo Software

- Changed Boot Order in BIOS (Per Lenovo)

- Unplugged the Network Cable (To test, GPO)

- Placed on a Battery Backup (To test power)

- We have even wiped 25 of these machines and re-installed cleanly

 

With all the above work they still blue screen and it is still the same error. Please see below:

 

==================================================
Dump File         : 121815-15459-01.dmp
Crash Time        : 12/17/2015 4:39:07 PM
Bug Check String  : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code    : 0x0000000a
Parameter 1       : 00000000`1e61fbb8
Parameter 2       : 00000000`0000000f
Parameter 3       : 00000000`00000000
Parameter 4       : fffff800`0300eb60
Caused By Driver  : hal.dll
Caused By Address : hal.dll+1db60
File Description  : 
Product Name      : 
Company           : 
File Version      : 
Processor         : x64
Crash Address     : ntoskrnl.exe+73c40
Stack Address 1   : 
Stack Address 2   : 
Stack Address 3   : 
Computer Name     : 
Full Path         : C:\Windows\Minidump\121815-15459-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7601
Dump File Size    : 272,432
Dump File Time    : 12/18/2015 10:53:11 AM
==================================================
 
 
Any ideas? It is hard to believe they all have a hardware problem since they worked last year and it was not up until we moved them that this problem began happening. Any thoughts will be appreciated.
 
Thanks!

 



BC AdBot (Login to Remove)

 


#2 DavisMcCarn

DavisMcCarn

  • Members
  • 766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:37 AM

Posted 23 December 2015 - 12:44 PM

One of the most common causes of stop 0x0000000A errors is failing memory. Get a copy of the FREE ISO from http://www.memtest86.com/download.htm , burn it to a CD, then boot it on one of the worst machines. Let it run for a while and, if the bottom of the screen stays clean, we'll try something else.
Computer dinosaur, servicing PC's since 1976

#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:37 AM

Posted 24 December 2015 - 05:49 AM

First off, look at the driver that's blamed - it's hal.dll

Most often this is seen as a cause due to incompatibilities or hardware issues (to include memory)

hal.dll is responsible for communicating between the hardware and the OS

 

Now, it's more than one computer, and the BSOD's tended to occur after the move was done.

As such, what's different in the new place vs the old?

What did you use for networking when you disconnected the network cable?  Were the BSOD's still the same type?

How about routers/switches/modems?

ISP?

 

Let's have a look at these reports for one of the machines.

I suggest that this machine will become our "test" machine - so it's one that you'll have to have some leeway working with. (I'd prefer one of the systems that's been wiped already - as that step would be ruled out.

 

Here's the reports I'd like to see:

Please provide this information so we can provide a complete analysis (from the Pinned Topic at the top of the forum):  http://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

Should you have problems with the perfmon report, please disregard it (I don't use it very much anyway).

Should the app lock up for more than 15 minutes while searching for Network information (it does this in my copy of W10), go ahead and kill the app. 
Then navigate to the Documents folder and zip up the 18 reports in the SysnativeFileCollectionApp folder - then upload that with your next post.

If that doesn't work, then you can try this new app (from a friend of mine):  http://omgdebugging.com/bsod-inspector/
When done a Notepad document will open with the name of the file and it's location.
By default it'll be a .zip file located on your Desktop
Simply upload the .zip file with your next post and we'll move on from there.
***********************************************************************************************************

EDIT:  Then, while waiting for a reply, please run Driver Verifier according to these instructions:  http://www.carrona.org/verifier.html


Edited by usasma, 24 December 2015 - 05:50 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 jcarter0713

jcarter0713
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:37 AM

Posted 26 December 2015 - 08:53 AM

@

DavisMcCarn
The mem test ran for almost 8 hours with no issues at all. 
 
@

usasma
The Blue screen report is attached

Attached Files



#5 DavisMcCarn

DavisMcCarn

  • Members
  • 766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:37 AM

Posted 26 December 2015 - 10:12 AM

OK; the most interesting item listed in the event viewer is a series of CRITICAL errors virtually simultaneous to the blue screens.  Common to all of them is an unsafe shutdown which can have two causes; either the PC's are set to automatically reboot after a bluescreen or there are power problems.  I am leaning towards the second because several of the events then also state that the domain controller was unreachable which would indicate a problem at the entire facility rather than the specific PC; but, just in case, do the PC's have an addon graphics card and, if they do, what is its make and model?


Computer dinosaur, servicing PC's since 1976

#6 ttricktt

ttricktt

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:37 AM

Posted 26 December 2015 - 03:04 PM

May I suggest this, take one or two of the worst computers and put them back in their old location, if the old room is still available. Connect them in their original state if you can and let them run for few days or whatever you think is appropriate. 

 

The new lab, if you have a battery backup with management software (E.g. APC Smart-UPS 2200) you can log power input over a period of time. Plug it into one of the power outlets that is used to power one of the computers to monitor power.


Edited by ttricktt, 26 December 2015 - 03:15 PM.


#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:37 AM

Posted 27 December 2015 - 09:06 AM

Only 143 Windows Update hotfixes installed.  Most systems with SP1 have 350 or more.  Please visit Windows Update and get ALL available updates (it may take several trips to get them all).

Missing drivers for this device in Device Manager:

 

Not Available    ACPI\LBA0001\2&DABA3FF&4    The drivers for this device are not installed.

I suspect that this is the driver for this device:  http://support.lenovo.com/us/en/downloads/ds029250

Please install it and then check In Device Manager to see if the error has gone away.

 

System log of event viewer shows a lot of problems with the networking.

Have you checked all of the connections to the domain controller?

Post over in the Networking forums for more expert assistance with that:    http://www.bleepingcomputer.com/forums/f/21/networking/

 

Interestingly, in the raw stack text, cpuz137_x64.sys is present just before the system crashes due to hal.dll

The latest memory dump is a Driver Verifier Enabled dump and it directly blames cpuz137_x64.sys

Please uninstall CPUZ.

Do you have this version of CPUZ on all systems?  If so, this could be your problem.

 

LogMeIn drivers are outdated - do you need them?  Can you uninstall them to test and see if they are a part of the problem?

 

Beyond all that, my guess is hardware/compatibility/low-level driver problems.

And, as it occurs with many systems - one has to wonder if the problem is in the network.

Again, I'd suggest asking over in the Networking forums for some more expert assistance:    http://www.bleepingcomputer.com/forums/f/21/networking/

 

Analysis:
The following is for informational purposes only.
**************************Thu Dec 24 11:54:46.547 2015 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\122415-19843-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: 7601.19045.amd64fre.win7sp1_gdr.151019-1254
System Uptime: 0 days 13:13:53.936
*** WARNING: Unable to verify timestamp for cpuz137_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz137_x64.sys
Probably caused by : cpuz137_x64.sys ( cpuz137_x64+2073 )
BugCheck A, {1e84fbb8, f, 0, fffff80002a2cb60}
BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)
Arguments:
Arg1: 000000001e84fbb8, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a2cb60, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  LTSVC.exe
FAILURE_BUCKET_ID:  X64_0xA_VRF_cpuz137_x64+2073
  BIOS Version                  9ZKT38AUS
  BIOS Release Date             05/19/2013
  Manufacturer                  LENOVO
  Product Name                  INVALID             
  Baseboard Product             Annapurna CRB
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue Dec 22 11:13:09.509 2015 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\122315-18922-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: 7601.19045.amd64fre.win7sp1_gdr.151019-1254
System Uptime: 0 days 18:43:09.526
*** WARNING: Unable to verify timestamp for cpuz137_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz137_x64.sys
Probably caused by : cpuz137_x64.sys ( cpuz137_x64+1ff2 )
BugCheck A, {1eeaf8c0, f, 1, fffff80002a37b07}
BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)
Arguments:
Arg1: 000000001eeaf8c0, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a37b07, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  LTSVC.exe
FAILURE_BUCKET_ID:  X64_0xA_cpuz137_x64+1ff2
  BIOS Version                  9ZKT38AUS
  BIOS Release Date             05/19/2013
  Manufacturer                  LENOVO
  Product Name                  INVALID             
  Baseboard Product             Annapurna CRB
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Dec 17 16:39:07.921 2015 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\121815-15459-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: 7601.19045.amd64fre.win7sp1_gdr.151019-1254
System Uptime: 0 days 0:17:38.832
*** WARNING: Unable to verify timestamp for cpuz137_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz137_x64.sys
Probably caused by : cpuz137_x64.sys ( cpuz137_x64+2073 )
BugCheck A, {1e61fbb8, f, 0, fffff8000300eb60}
BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)
Arguments:
Arg1: 000000001e61fbb8, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000300eb60, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  LTSVC.exe
FAILURE_BUCKET_ID:  X64_0xA_cpuz137_x64+2073
  BIOS Version                  9ZKT38AUS
  BIOS Release Date             05/19/2013
  Manufacturer                  LENOVO
  Product Name                  INVALID             
  Baseboard Product             Annapurna CRB
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Dec 17 12:16:09.261 2015 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\121715-19624-01.dmp]
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Built by: 7601.19045.amd64fre.win7sp1_gdr.151019-1254
System Uptime: 0 days 0:30:57.001
*** WARNING: Unable to verify timestamp for cpuz137_x64.sys
*** ERROR: Module load completed but symbols could not be loaded for cpuz137_x64.sys
Probably caused by : cpuz137_x64.sys ( cpuz137_x64+2073 )
BugCheck A, {1fd3fb18, f, 0, fffff80002a31b60}
BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)
Arguments:
Arg1: 000000001fd3fb18, memory referenced
Arg2: 000000000000000f, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a31b60, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  LTSVC.exe
FAILURE_BUCKET_ID:  X64_0xA_cpuz137_x64+2073
  BIOS Version                  9ZKT38AUS
  BIOS Release Date             05/19/2013
  Manufacturer                  LENOVO
  Product Name                  INVALID             
  Baseboard Product             Annapurna CRB
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``


3rd Party Drivers:
The following is for information purposes only.
Any drivers in RED should be updated or removed from your system. And should have been discussed in the body of my post.
**************************Thu Dec 24 11:54:46.547 2015 (UTC - 5:00)**************************
amdxata.sys                 Fri Mar 19 12:18:18 2010 (4BA3A3CA)
usbfilter.sys               Tue Aug 28 21:27:12 2012 (503D6FF0)
amdhub30.sys                Wed Nov 28 21:58:45 2012 (50B6CF65)
amdxhc.sys                  Wed Nov 28 21:58:47 2012 (50B6CF67)
RtDashPt.sys                Wed Mar  6 04:20:34 2013 (51370A62)
Rt64win7.sys                Tue Jun 18 03:52:16 2013 (51C011B0)
cpuz137_x64.sys             Mon Feb 17 09:22:16 2014 (53021B18)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue Dec 22 11:13:09.509 2015 (UTC - 5:00)**************************
lmimirr.sys                 Tue Apr 10 18:32:45 2007 (461C108D)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Dec 17 16:39:07.921 2015 (UTC - 5:00)**************************
LMIRfsDriver.sys            Mon Jul 14 12:26:56 2008 (487B7E50)
RaInfo.sys                  Fri Jan 11 07:19:28 2013 (50F00350)
http://www.carrona.org/drivers/driver.php?id=amdxata.sys
http://www.carrona.org/drivers/driver.php?id=usbfilter.sys
http://www.carrona.org/drivers/driver.php?id=amdhub30.sys
http://www.carrona.org/drivers/driver.php?id=amdxhc.sys
RtDashPt.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys
http://www.carrona.org/drivers/driver.php?id=cpuz137_x64.sys
http://www.carrona.org/drivers/driver.php?id=lmimirr.sys
http://www.carrona.org/drivers/driver.php?id=LMIRfsDriver.sys
http://www.carrona.org/drivers/driver.php?id=RaInfo.sys
 


Edited by usasma, 27 December 2015 - 09:25 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#8 jcarter0713

jcarter0713
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:37 AM

Posted 27 December 2015 - 09:25 AM

@

DavisMcCarn

Amd radeon hd 7540d. Integrated graphics, not add on.

 

@

ttricktt

We have plugged it up to a UPS before and it still blue screens.

 

@

usasma

 

CPUZ is only installed on this particular machine

LogMeIn has been uninstalled from all of them and they still blue screen

We will get everything updated and see what happens



#9 jcarter0713

jcarter0713
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:37 AM

Posted 27 December 2015 - 09:32 AM

@usasma

 

Also, something i forgot to mention, we have taken it off site back to a IT bench, to work on it, separate network, and it still blue screens. We also unplugged the network cable and it still blue screened with it unplugged. Does this lead you to believe it could still be a networking issue?

 

Thanks!

 



#10 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:37 AM

Posted 27 December 2015 - 10:11 AM

We have been working on the presumption that it's something common to all systems.

This could be the network - or it could be that the systems all have (or are missing) some software/hardware thing that's causing the BSOD's

 

Your off-site experiment tends to rule out an external networking problem - great work!
But, this makes it more likely that you're going to have to fix all 50 machines individually! Ugghh!!!

 

Once you uninstall CPUZ, try running Driver Verifier again.

If CPUZ was fragile enough, it could BSOD more quickly than another driver.  And, as such, this could conceal the true problem from Driver Verifier.

 

Personally I think that the missing ACPI thing is the biggest problem.  And that the missing Windows Updates could contribute to it also.

I use the technical term "thing" :)  as I'm uncertain if it's the ACPI device driver or another device.

That will be determined when you install the ACPI device driver from the link I provided - and then check Device Manager to see if the error is fixed.


Edited by usasma, 27 December 2015 - 10:14 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#11 DavisMcCarn

DavisMcCarn

  • Members
  • 766 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:37 AM

Posted 27 December 2015 - 10:25 AM

I'm with usasma, a missing ACPI driver will wreak havoc on a PC! It is the power management, after all.

I'm curious; though, what kind of temps is CPU-Z giving you? Personally, I prefer SIW which gives anyone way more information than anything else.
Computer dinosaur, servicing PC's since 1976




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users