Windows 7 HP 8540w numerous BSOD within first day

[MartinC]

Hi everyone.

I'm Martin and I'm new to this forum and Windows 7. I have bought a brand new laptop, HP 8540w yesterday and already had a number of BSODs - even while trying to write this post. (Firefox being the only opened application)

To me they seem to just come randomly - not when I have started a specific application or task.

I'm running Windows 7 Professional 64Bit and have so far installed the following software:
Firefox
Avira Antivir
ZoneAlarm
Adobe Reader / Flash player
Skype, Trillian

Two of the crashes seemed to have happened while the machine was inactive and I was not in the room. I came back to see the Windows Login screen and a pop up saying Windows had recovered from a crash.

Minidumps are attached and help would be highly appreciated, as I have no idea where to start looking for the cause, since it seems so random.

Thank you!
Martin

 

[Saltgrass]

You might start by checking the event viewer for errors. Click on the error and it will give you details about the problem. Type event in the Start Menu Search box and you should be given the option or go through Administrative tools.

Someone will look at the dump file soon.

 

[webscaper]

You are getting a 7f bugcheck which is usually indicative of a stack overflow. I see you have zone alarm installed which is known for tis kind of bugcheck. Please uninstall zone alarm using the removal tool: Link Removed due to 404 Error

Then see how it goes.

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
[COLOR=Red]Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT[/COLOR]
Arg2: 0000000080050033
Arg3: 00000000000006f8
Arg4: fffff80003038e58

• 0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault:
  • A kernel stack overflow. This overflow occurs when a guard page is hit, and the kernel tries to push a trap frame. Because there is no stack left, a stack overflow results, causing the double fault. If you think this overview has occurred, use Link Removed due to 404 Error to determine the stack limits, and then use Link Removed due to 404 Error with a large parameter (for example, kb 100) to display the full stack.
  • A hardware problem.

3: kd> !thread
GetPointerFromAddress: unable to read from fffff800032a8000
THREAD fffff880039ddfc0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
GetUlongFromAddress: unable to read from fffff800031e6b74
Owning Process            fffff800031f9140       Image:         <Unknown>
Attached Process          fffffa8003aec9e0       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      368806       
Context Switch Count      517694             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80003078da0)
Stack Init fffff880039fbdb0 Current fffff880039fbd40
[COLOR=Blue]Base fffff880039fc000 Limit fffff880039f6000 Call 0[/COLOR] [COLOR=Red]<-----stack limits[/COLOR]
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
[COLOR=DarkOrchid]fffff880`039d9ce8[/COLOR] fffff800`0306fb69 : 00000000`0000007f 00000000`00000008 00000000`80050033 00000000`000006f8 : nt!KeBugCheckEx
[COLOR=DarkOrchid]fffff880`039d9cf0[/COLOR] fffff800`0306e032 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
[COLOR=DarkOrchid]fffff880`039d9e30[/COLOR] fffff800`03038e58 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2 (TrapFrame @ fffff880`039d9e30)
[COLOR=Blue][COLOR=Red]fffff880`039f5ce0[/COLOR] [/COLOR]00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!SeAccessCheckFromState+0x58

Base fffff880039fc000 Limit fffff880039f6000

fffff880039f5ce0 is not within the the stack limits shown above.

 

[MartinC]

Hi,
Thanks for your quick response!
Uninstalling ZoneAlarm as we speak to test this option. In the meantime I have attached some of the error messages I found in the Event Viewer. Each of the BSOD has a "The system has rebooted without cleanly shutting down first", a "The previous system shutdown at 09:56:46 on ‎22/‎05/‎2010 was unexpected" and a "The computer has rebooted from a bugcheck." one. These last ones are all slightly different from each other and are in the second text file.

There is also a MEMORY.DMP - but it is around 400 MB in size.

Maybe the files attached are of further help? Will get back if Zone Alarm is deinstalled. There is no way to test for this though i assume, as I dont know what lead to the crash.

Thanks, Martin

 

[Saltgrass]

Just for info, what type of ZoneAlarm are you using and what version?

Do you know your Anti-virus is Win 7 compatible?

Maybe uninstalling ZoneAlarm will help, I know one version always froze with me if I used the firewall and Microsoft Security Essentials.

If not, you don't have so many programs you cannot uninstall some to check.

I suppose you have the capability to re-image the computer so you can start from scratch if necessary. But make sure you have made all the backup/repair/DVDs/images that might be recommended by HP so if you need them later, they will be available.

I will add the following from another miniu-dump which might help someone see the problem.

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
the operating system. The only supported way to extend a kernel
mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80003254c40
Arg4: 0000000000000000

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'bthpan' and 'spsys.sys' overlap

BUGCHECK_STR: 0xc4_91

 

[MartinC]

ZoneAlarm Version is 9.1.007.

Also found a thread in a different forum describing very similar sympthoms and cause. ZoneAlarm instability on Windows 7 x64. - Technology Questions

According to website Avira Antivir is compatible with Win 7 64 Bit.

I haven't had blue screens since deinstalling and will try this for a few more days. The difficulty is, that I cannot reproduce the error.

 

[MartinC]

So far haven't had any more BSODs. Using COMODO Firewall now instead of ZoneAlarm.

Thanks for your help and quick responses!

Best,
Martin