Random multiple BSODs on Windows 8.1, 8 and 7

guenthse

New Member
Messages
3
Hi,

this is my first post. I'm from Germany and I hope you'll excuse my English.

About 2 years ago I purchased a used Thinkpad T500 via an authorized reseller. From the beginning I experienced random and non-reproducible BSODs. The notebook was running Windows 7 Prof back then. Given that I wanted to use Linux I did not pay much attention to those instabilities. Linux was running perfectly without any flaws, no matter which distro.
About 1.5 years ago I needed Windows again and decided to try it once again and immediatly got random BSOD again, right after a fresh installation and even after getting all updates and all the newest device drivers. Being within warranty I handed the notebook in to an authorized service partner. They told me they could not find any problems and just replaced the heat pipe. Disappointed I switched back to Linux and never had the time to investigate the problems any further. I also installed Windows 8 and the problems persisted.
Now I decided to investigate any further and decided to install Windows 8.1. From the beginning and also after upgrading to the newest available device drivers I'm experiencing the following BSOD.

Just a screenshot from BlueScreenView:

View attachment 50709

Attached you find the results of SF Diagnostic Tool.

I also get some other instabilities, like crashing System Services, as shown in Event Viewer screenshot:
View attachment 50711

I did some memory tests, several with different versions of MEMTEST86+ and one over 48 hours with Windows Memory Diagnostic. I also ran Intel Processor Diagnostic Tool and got no errors.

Assuming failing device drivers I enabled Driver Verifier as described in the forum (only mentioned tests and non-MS-drivers) and oddly I experienced only 1 BSOD during about 48 hours of operation with activated driver verifier (but unfortunately nothing driver specific). Normally I get at least 2 BSOD a day.

I hope someone can help me. If you need further information, just tell me.

Sebastian
 

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
    System Manufacturer/Model
    Lenovo Thinkpad T500 2082-BQG
    CPU
    Core 2 Duo P8700
    Browser
    Firefox
Hi Guenthse & Welcome to the forums ^_^,

I have analyzed your dump files and below has been provided an analysis of the same for informative purposes :-
Code:
[FONT=arial]0: kd> kb  
ffffd001`e75f5730 fffff803`d12763b1 : ffffd001`e3348180 fffff803`d14e6180 00000000`00000000 00000000`00000000 : nt!MiDemoteCombinedPte+0x42
ffffd001`e75f5820 fffff803`d1288fa5 : ffffe000`ad9656d8 00000000`00000080 00000000`00000080 00000000`ffffffff : [COLOR=#0000ff]nt!MiAgeWorkingSet+0x10f1[/COLOR]
ffffd001`e75f5b30 fffff803`d1288bba : 00000000`00000000 ffffd001`e75f5bf9 ffffe000`ad9656f0 00000000`00000000 : [COLOR=#0000ff]nt!MiTrimOrAgeWorkingSet+0xc1[/COLOR]
ffffd001`e75f5b70 fffff803`d12c3b92 : 00000000`00000000 ffffe000`a9a6a040 00000000`00000001 fffff803`d1200000 : [COLOR=#ff0000]nt!MiProcessWorkingSets+0x1a6[/COLOR]
ffffd001`e75f5c60 fffff803`d133a81e : 00000000`00000008 00000000`00000008 ffffe000`0000000c 00000000`00000000 : [COLOR=#ff0000]nt!MmWorkingSetManager+0x4a[/COLOR]
ffffd001`e75f5c90 fffff803`d12cf794 : ffffe000`a9a6a040 00000000`00000000 00000000`00000080 00000000`00000000 : nt!KeBalanceSetManager+0x11e
ffffd001`e75f5d00 fffff803`d135a5c6 : fffff803`d14e6180 ffffe000`a9a6a040 ffffe000`a9a68300 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd001`e75f5d60 00000000`00000000 : ffffd001`e75f6000 ffffd001`e75f0000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
[/FONT]

According to the Driver verifier dump file, the System was processing Working Sets when the Driver Verifier called in the Bugcheck.
Code:
0: kd> .cxr


0: kd> .cxr 0xffffd001e75f4d00;r
rax=0000000000000001 rbx=c9900001b42a6205 rcx=fffff6bffc193088
rdx=8000000000000000 rsi=0000000000000499 rdi=fffff580108067e8
rip=fffff803d13132a6 rsp=ffffd001e75f5730 rbp=ffffd001e75f5920
 r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
r11=0000098000000000 r12=fffff6bffc193088 r13=7fffffffffffffd0
r14=fffff6bffc193088 r15=0000058000000000
[COLOR=#500050]iopl=0         nv up ei ng nz na po nc[/COLOR]cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!MiDemoteCombinedPte+0x42:
fffff803`d13132a6 49394520        cmp     qword ptr [r13+20h],rax ds:002b:7fffffff`fffffff0=????????????????
Last set context:
rax=0000000000000001 rbx=c9900001b42a6205 rcx=fffff6bffc193088
rdx=8000000000000000 rsi=0000000000000499 rdi=fffff580108067e8
rip=fffff803d13132a6 rsp=ffffd001e75f5730 rbp=ffffd001e75f5920
 r8=0000000fffffffff  r9=8000000000000000 r10=0000007ffffffff8
r11=0000098000000000 r12=fffff6bffc193088 r13=7fffffffffffffd0
r14=fffff6bffc193088 r15=0000058000000000
[COLOR=#500050]iopl=0         nv up ei ng nz na po nc[/COLOR]cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!MiDemoteCombinedPte+0x42:
fffff803`d13132a6 49394520        cmp     qword ptr [r13+20h],rax ds:002b:[COLOR=#008000][B]7fffffff`fffffff0[/B][/COLOR]=????????????????


0: kd> u nt![COLOR=#0000ff]MiDemoteCombinedPte[/COLOR]+0x42
nt!MiDemoteCombinedPte+0x42:
fffff803`d13132a6 49394520        [U][B][COLOR=#ff0000]cmp     qword ptr [r13+20h],rax[/COLOR][/B][/U]
fffff803`d13132aa 762d            jbe     nt!MiDemoteCombinedPte+0x75 (fffff803`d13132d9)
fffff803`d13132ac 33c0            xor     eax,eax
fffff803`d13132ae 488b8c24a0000000 mov     rcx,qword ptr [rsp+0A0h]
fffff803`d13132b6 4833cc          xor     rcx,rsp
fffff803`d13132b9 e8b28a0300      call    nt!_security_check_cookie (fffff803`d134bd70)
fffff803`d13132be 488b9c2400010000 mov     rbx,qword ptr [rsp+100h]
fffff803`d13132c6 4881c4b0000000  add     rsp,0B0h
As we can see from the Context Record, the nt!DemoteComBinedPte was comparing the values between the registers RAX (Which contains 1) and the R13 incremented by 20h.
Code:
0: kd> !pte 7fffffff`fffffff0
                                           VA 7ffffffffffffff0
PXE at FFFFF6FB7DBEDFF8    PPE at FFFFF6FB7DBFFFF8    PDE at FFFFF6FB7FFFFFF8    PTE at FFFFF6FFFFFFFFF8
Unable to get PDE FFFFF6FB7FFFFFF8
[COLOR=#500050][COLOR=#ff0000]WARNING: noncanonical VA, accesses will fault ![/COLOR][/COLOR][/FONT]
As it appears, it was trying to access memory which was invalid or not allowed. I would say that the RAM is failing and add to the fact that you are having numerous different BSOD's.

I would advise you to run Memtest using this **GUIDE** and make sure you complete at least 8 passes.
Have you tried using a different RAM set or removing the RAM modules and then using them one at a time?


Let me know how it goes ^_^.
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hi blueelvis,

thanks for your reply. I just ran MEMTEST86+ on both RAM modules separately and got no errors. Unfortunately I could not test each module on its own in the second RAM slot, because of motherboard limitation I'm only allowed to use one module in slot 1 only.
Nevertheless I also get for example MEMORY_MANAGEMENT BSOD using just one module in slot 1. But I'm recognizing that I'm getting MEMORY_MANAGEMENT BSOD more frequently if I'm just using the 4GB module on it's own than using both together o0
Will try it out with just the 2GB module employed and see how it goes.
Got PAGE_FAULT_IN_NONPAGED_AREA immediatly on reboot with 2GB. How big are the chances, that both memory modules are failing at once?

Just got another idea. I had no problems using Linux for several years on the same laptop, so I'm tending to rule out RAM related problems. Maybe it's the PSU? I noticed more frequent BSOD with taken out battery than just on battery. But also got them on battery. Just read in another thread that Windows is much more "sensitive" to power-related issues than Linux. If so, are there any advices to identify those problems (apart from purchasing new battery and PSU, already got a new battery ca 1.5 years ago and the problems persisted)?

Thanks,

Sebastian
 

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
    System Manufacturer/Model
    Lenovo Thinkpad T500 2082-BQG
    CPU
    Core 2 Duo P8700
    Browser
    Firefox
Hi Sebastian ^_^,

If the memtest has not detected any errors then we would have to keep aside the RAM and think in a different way. Could you please upload a freshly generated SF Diagnostic ZIP File so that it could be analyzed?
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Hey,

thanks for your reply.

Attached you find a freshly generated SF Diagnostic ZIP file.

Best regards,

Sebastian
 

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
    System Manufacturer/Model
    Lenovo Thinkpad T500 2082-BQG
    CPU
    Core 2 Duo P8700
    Browser
    Firefox
Hello Sebastian ^_^,

Your latest dump file was a MEMORY_MANAGEMENT (1a) with the first parameter 41289 which means that an Unknown Memory Management issue occurred which forced the bugcheck.
Code:
0: kd> kChild-SP          RetAddr           Call Site
ffffd001`74c46288 fffff802`70988294 nt!KeBugCheckEx
ffffd001`74c46290 fffff802`7086acff nt! ?? ::FNODOBFM::`string'+0x160e4
ffffd001`74c462f0 fffff802`7086a489 [COLOR=#ff0000]nt!MiLocateWsle+0x2b[/COLOR]
ffffd001`74c46340 fffff802`708675c4 nt!MiDeleteVirtualAddresses+0x5e9
ffffd001`74c465d0 fffff802`70c4b5a5 nt!MiDeleteVad+0x244
ffffd001`74c466d0 fffff802`70c4b258 nt!MiUnmapViewOfSection+0xf9
ffffd001`74c467a0 fffff802`70c006c0 nt!AlpcViewDestroyProcedure+0x1f8
ffffd001`74c46840 fffff802`70c4a6ca nt!AlpcpDestroyBlob+0x28
ffffd001`74c46870 fffff802`70c4a565 nt!AlpcpCaptureViewAttributeInternal+0x15e
ffffd001`74c468e0 fffff802`70c01279 nt!AlpcpCaptureViewAttribute+0x49
ffffd001`74c46930 fffff802`70c01b97 nt!AlpcpCaptureAttributes+0x3d5
ffffd001`74c469a0 fffff802`70c063e9 nt!AlpcpSendMessage+0x787
ffffd001`74c46ac0 fffff802`7096d4b3 nt!NtAlpcSendWaitReceivePort+0x169
ffffd001`74c46b90 00007ffb`96bfb58a nt!KiSystemServiceCopyEnd+0x13
000000bc`490cf188 00000000`00000000 0x00007ffb`96bfb58a

So, it appears that the system was locating a Working Set in the Virtual Memory after which one another function call is there which caused the Bugcheck.
Code:
0: kd> !wsle 2

Working Set @ fffff58010804000
    FirstFree     2767  FirstDynamic        5
    LastEntry     333f  NextSlot            5  LastInitialized     339b
    NonDirect        0  HashTable           0  HashTableSize          0


Reading the WSLE data .......Unable to get Wsle table block - address fffff58010805320 - count 1024 - page 0x200
Apparently, the minidump file has not saved enough information :(

But, one thing which I noticed is everytime the Bugcheck (In most of the dump files) happened, the process running was the
Code:
[B]PROCESS_NAME:  TiWorker.exe[/B]

TiWorker.exe is the Windows module for performing installations. I checked your list of the installed Windows Updates and I found that Update KB2975719 is installed on your system. The update was flawed and Microsoft released the fixed update for it. The problems arising from were of Page_Fault_In_Non_Paged_Area and other Memory Related errors. Please follow the below link and get it fixed :-

August 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

Furthermore, according to your screenshots, there was error in restarting the Network Store Interface Service. Till the time we are troubleshooting, I would advise you to disable the Conexant Soft56K Modem from the BIOS.

If all of this does not solve your problem, please run Driver Verifier according to this **GUIDE**.

Let me know how it goes ^_^.
 

My Computer

System One

  • OS
    Windows 8.1 Industry Pro B-)
    Computer type
    Laptop
    System Manufacturer/Model
    Toshiba
    CPU
    Core I5 2430M @ 2.4GHz
    Memory
    8 GB DDR3 @ 1600MHz Dual Channel ^_^
    Graphics Card(s)
    Intel HD 3000 B-)
    Screen Resolution
    1366x768
    Hard Drives
    Toshiba 500 GB
    Browser
    Google Chrome
    Antivirus
    Windows Defender & Common Sense!
Back
Top