Windows 7 Win7 64 bit just rebooting

[Oberst Hajj]

I've recently cleared a BSoD issue with my graphics card drivers. My computer is now just rebooting without giving a BSoD.

Here is what WhoCrashed reports:

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.
On Sat 4/19/2014 9:18:05 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0x10046, 0x2, 0x1, 0xFFFFF80002C9A343)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


There was not file in the Minidump (since it was not a BSoD this time). I did not see a way to attache the memory.dmp file (and it's 205MB), so Ive uploaded it to my server if anyone would like to have a look at it.

I'd love some help finding out which driver might be causing this. I'll be running the memory test overnight tonight for further diagnostics.

Thank you for your time and any help you can give.

 

[Jimbo22]

You would get a better result by posting in the BSOD thread and follow the instructions.

http://windowsforum.com/threads/how-to-ask-for-help-with-a-bsod-problem.38837/

 

[Oberst Hajj]

Thanks, I posted here because it was not a BSOD problem.

 

[Saltgrass]

If you think it is a Video driver problem, or basically any driver problem, you need to boot into Safe Mode and deal with it there. You can delete the drivers and all of the installed versions and go back to the original until you update it.

You could also use msconfig.exe to set certain options for booting to see if you can narrow down the possibilities.

But if it is automatically rebooting, it is probably a BSOD, you just don't have it set to do the small memory dumps.

 

[Oberst Hajj]

Thanks Saltgrass. I do have the system setup to give the BSoD and the small memory dumps. That is how I tracked down and fixed the BSoD related to the video driver. That one is fixed. But now I get a random reboot that does NOT show a BSoD or give a mini dump.

Per WhoCrashed:

System Information (local)
computer name: COLHAJJ-PC
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\Windows
Hardware: GA-MA770T-UD3P, Gigabyte Technology Co., Ltd.
CPU: AuthenticAMD AMD Phenom(tm) II X4 955 Processor AMD586, level: 16
4 logical processors, active mask: 15
RAM: 6440869888 total
VM: 2147352576, free: 1943183360

Crash Dump Analysis
Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.
On Sat 4/19/2014 9:18:05 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0x10046, 0x2, 0x1, 0xFFFFF80002C9A343)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


You can see there that it should be logging to the Minidump folder if it produces one... which it's not.

Any thoughts and thanks for the help.

 

[Saltgrass]

You are probably right, but I don't run the utility so I may be misunderstanding what it is showing.

But I see:
Crash dumps are enabled on your computer.
On Sat 4/19/2014 9:18:05 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp

and I might think it would show C:\Windows\Minidump\*.dmp

Anyway, the Safe Mode is still your best option. You can turn off the BSOD automatic restart. I do assume when you say your system is rebooting, you mean continuously..

 

[Saltgrass]

I just checked the memory.dmp (memory.zip) file you said was available, but it appears it is not.

 

[Oberst Hajj]

It's rebooting on its own once or twice a day. And sorry about the link, had a typo in it. Here it is.

 

[Saltgrass]

I downloaded the file and tried to analyze it, but it shows as corrupted and none of the normal information seems to be available. It is probably my fault since I have not tried to analyze a large memory dump before.

There is something called Driver Verifier you could run, which will cause a Blue Screen if a driver misbehaves.

http://msdn.microsoft.com/en-us/library/windows/hardware/ff545448(v=vs.85).aspx

Make sure you know how to turn it off in case it does blue screen. Booting into safe mode command prompt and using verifier /reset should stop the blue screens.

If you knew of something happening around the time of the reboots, it might lead to a solution. Also check the Event Viewer to see if items other than Kernel Power entries are showing up around the time of the reboots, or consistently.

It looks like you are running Avast...any updates for it? Older drivers can also cause problems, but I can't get that information from your dump file.

 

[Oberst Hajj]

Okay, so it shutdown while I was out with the family. Here is the latest WhoCrashed reading:

Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Sun 4/20/2014 10:16:59 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\042014-29265-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75BC0)
Bugcheck code: 0xA (0x4A62D438E5, 0x2, 0x0, 0xFFFFF80002ECA91B)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sat 4/19/2014 9:18:05 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0x10046, 0x2, 0x1, 0xFFFFF80002C9A343)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


I find the part in the red interesting. I also ran the memory test overnight and after 7 passes, no memory errors were reported.

Here is what I see in the Event Viewer, but I don't know what I'm looking at or for

Thanks for all the help on this Saltgrass!

 

[Saltgrass]

If you wanted to attach the minidump file here, or go over to the BSOD forum it might be helpful. You can zip it or use the upload a file button below to attach.

You are getting many errors. Some are probably caused by the shutdowns. But the LoadPerf looks interesting. Can you double click it and show us the messages associated with it?

The Kernel is not causing the problem. Some driver is asking for access to a memory area which makes your system think it has been compromised. Third party drivers are probably not being caught by the process...they can be sneaky...

 

[Oberst Hajj]

I'll try and gather all the info and repost this over in the BSoD section after work today. In the mean time, here is the messages for that LoadPerf you asked about:

General
The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Details
- System
- Provider
[ Name] Microsoft-Windows-LoadPerf
[ Guid] {122EE297-BB47-41AE-B265-1CA8D1886D40}
EventID 3012
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x8000000000000000
- TimeCreated
[ SystemTime] 2014-04-21T09:26:15.988997800Z
EventRecordID 100667
Correlation
- Execution
[ ProcessID] 3212
[ ThreadID] 3424
Channel Application
Computer ColHajj-PC
- Security
[ UserID] S-1-5-18
- UserData
- EventXML
param1 Performance
binaryDataSize 16
binaryData 37070000000000000000000009030000

 

[Saltgrass]

The performance error seems to be a little complicated for me right now. I will study it and see if I can make sense of it.

Where is the mini-dump file 042014-29265-01.dmp

 

[Oberst Hajj]

Here is the minidump.

 

[Saltgrass]

I don't really see anything I could recognize as a problem. If you are running Avast, make sure the Windows version is not running.

You said you had a blue screen problem with a video driver. What did you do to get rid of it? I will normally uninstall the device in Device Manager and then check the box that says uninstall all drivers. I did have a couple of problems with the Video update about WDDM 1.1, 1.2, and 1.3. I had to block it because I got at least one blue screen and later it failed to install, but I am running Nvidia video cards.

I still suggest you run the driver verifier.

Have you tried running a Windows Experience Index update since the situation with your video card?

 

[Oberst Hajj]

Sorry for the delay getting back on this, last couple of days have been super busy. The BSoD are back, so I started this new thread over in that section.