1

This occurs just after I log into Windows 7 Home Premium.

Does any body what this means and how to resolve the issue?

Tamara Wijsman
  • 57,463
ben950
  • 722
  • 2
    This program may help...http://www.nirsoft.net/utils/blue_screen_view.html – Moab Apr 08 '11 at 14:55
  • 1
    Journeyman - I suggest it's not a duplicate since ben950's circumstances are different. He says bluescreen happens immediately after login, where as the linked-to question bluescreens happen randomly. – Joshua Apr 08 '11 at 15:02

3 Answers3

3

This is likely a hardware problem. It is very difficult to determine because it is a generic-enough message that it could be any number of subsystem components - graphics, CPU, memory failure, hard disk or controller, etc.

My first suggestion is to run Memtest, which will test the stability of the memory subsystem. Usually if you're able to get through this your CPU has a good chance of survival as well.

Next would be to see if Windows boots into Safe Mode, by hitting F8 before Windows starts up (just before the "Loading Microsoft Windows" appears on bootup). If you are able to successfully get into Safe Mode, you can start trouble-shooting other hardware components by enabling / disabling or uninstalling / reinstalling drivers.

Tamara Wijsman
  • 57,463
Joshua
  • 4,372
1

This is likely a malfunctioning driver activated as it occurs after login, or do you experience randomness?

Please read this article to troubleshoot your BSOD, try to see if Safe Mode works and check the Event Log.

If you can get there, please upload the dump file so we can analyze for you which driver did this.

Edit:

Not checking the crash dump is trying to fix a problem without knowing what the problem is.

So, you can try to remotely obtain the crash dump file, it is located at one of these two paths:

  1. C:\Windows\MEMORY.DMP

  2. C:\Windows\Minidump\*.DMP

The best way would be to connect the hard drive to another computer...

Edit 2:

The driver that is crashing your computer multiple times is mfehidk.sys, from McAfee, your virus scanner.

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.

Probably caused by : mfehidk.sys ( mfehidk+188e9 )

If we list the module, we get:

fffff880`03ab2000 fffff880`03afba00   mfehidk  T (no symbols)           
    Loaded symbol image file: mfehidk.sys
    Image path: \SystemRoot\system32\drivers\mfehidk.sys
    Image name: mfehidk.sys
    Timestamp:        Fri Jul 31 23:59:58 2009 (4A73695E)
    CheckSum:         0004F637
    ImageSize:        00049A00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

It's April 2011 and that driver dates back to July 2009, that's horribly out of date for a virus scanner.

If you can get into safe mode you can try to remove the virus scanner, if not you could attempt to rename C:\Windows\System32\drivers\mfehidk.sys so that the operating system should not load it anymore.

There are ony two dumps mentioning the iastor.sys driver, which is related to your hard disk. This makes sense as either the virus scanner driver or the hard disk driver is accessing memory in such way that the other one can't write to it, as a virus scanner scans files but this one seems to do it too early...

See how both dumps have problems reading or writing the memory:

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx.
The memory could not be %s.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arg1: 00000000000007e1, memory referenced
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800112a4ff, address which referenced memory

So, the steps to take are:

  • Prevent the virus scanner from loading, with either safe mode or by renaming the driver.

    This will verify if the virus scanner is the culprit.

  • If it's not the virus scanner, do a error scan on your memory and hard disk.

Edit 3:

As you are crashing on the iastor.sys only now, I've looked at its date.

fffff880`010ba000 fffff880`011d6000   iaStor    Fri Jun 05 03:53:40 2009 (4A287AA4)

If I look at mine I see this:

enter image description here

So, updating your Intel Rapid Storage Technology drivers might fix your issue.

Uninstall any Intel Matrix RAID and Intel Rapid Storage Technology drivers first if possible...

Gareth
  • 18,809
Tamara Wijsman
  • 57,463
  • 1
    Or try Last known good config. Better bug check page here...http://msdn.microsoft.com/en-us/library/ff560129(v=VS.85).aspx... main page ...http://msdn.microsoft.com/en-gb/library/ff542347.aspx – Moab Apr 08 '11 at 14:59
  • sorry i am now experancing problems trying to login in safe mode. another blue screen that just poped up is system_service_exception. if and when it eventualy i will post log of erroe from event log – ben950 Apr 08 '11 at 15:47
  • @Moab: Actually, the title mentions the bug check that does contain "Driver". Thanks for the other info! – Tamara Wijsman Apr 09 '11 at 00:22
  • @ben950: Try a repair from the installation medium, as it sounds random try Josh's answer. Do you remember if you have connected any devices to your computer lately or installed any software/drivers that might have done this? Updated the question with an alternative way to get to the dump file... – Tamara Wijsman Apr 09 '11 at 00:23
  • i managed to try and do a system restore but it still has the same problem. i have narrowed down the error message to iastor.sys is casing the problem. i think i might try a system repair to see if this works – ben950 Apr 11 '11 at 08:08
  • i have found the logs but it wont let me upload the document to here and the logs are massive for me to ocpy paste – ben950 Apr 11 '11 at 12:04
  • @ben950: Put it in a zip file, the size should decrease. Then use any upload site. For text, copy paste it to a site like Pastebin... – Tamara Wijsman Apr 11 '11 at 12:06
  • @ben950: No, you need to upload the dumps, not copy paste the text out of them. In a result your first link is unreadable and you seem to have copied the wrong link for the second one... – Tamara Wijsman Apr 11 '11 at 12:42
  • so like this http://www.speedyshare.com/files/27902148/minidumps.zip http://www.speedyshare.com/files/27901991/MEMORY.zip – ben950 Apr 11 '11 at 12:47
  • @ben950: Yes, I've updated my post for the minidumps, now checking the other one. – Tamara Wijsman Apr 11 '11 at 13:45
  • 1
    @ben950: I can't open the MEMORY.DMP, but it's not necessary as the minidumps show the issue. – Tamara Wijsman Apr 11 '11 at 13:47
  • 1
    Thank you very much it was to do with mcaffee which i am in the process of geting rid of i dont no why i actualy left it there. once again thankyou – ben950 Apr 11 '11 at 13:57
  • ok i have removed mcafee from the pc but it is still bringing up a blue screen when i boot normaly into windows any other suggestions? i have done a memory test and this passed with 0 problems – ben950 Apr 11 '11 at 15:18
  • What errors is it showing now? Check your hard disk SMART status and run an error scan on it, see also: http://superuser.com/questions/157266/when-to-stop-using-a-hdd-what-rules-software-apply/157276#157276 – Tamara Wijsman Apr 11 '11 at 15:48
  • i have not run an error scan on the harddrive and it has come back with 0 errors. do you want me to attach any more logs? – ben950 Apr 12 '11 at 07:49
  • now i am getting the blue screen message system_service_exception Stop 0x0000003b – ben950 Apr 12 '11 at 08:23
  • the instruction at 0xfd277048 referenced memory 0xfd13b498 the memory cannot be written – ben950 Apr 12 '11 at 08:32
  • and another bluescreen that just flashed up is page_fault_in_nonpaged_area – ben950 Apr 12 '11 at 09:09
  • Can't tell much about those blue-screens without dumps, try updating your drivers and disconnect any hardware that you don't need for proper operation. – Tamara Wijsman Apr 12 '11 at 10:31
  • what dumps do u need memory.dmp and mini dumps again? – ben950 Apr 12 '11 at 10:47
  • @ben950: The latest, those that have the time that it occurred next to them. – Tamara Wijsman Apr 12 '11 at 10:49
  • here are the minidumps im just uploading the memory.dmp at the moment http://www.speedyshare.com/files/27920874/minidump.zip – ben950 Apr 12 '11 at 11:30
  • @ben950: Updated the bottom of my answer. – Tamara Wijsman Apr 12 '11 at 12:03
  • thanks and to find the new intel stuff i just go on there site ? – ben950 Apr 12 '11 at 12:11
  • Yes, try to find the newest version of their drivers there. – Tamara Wijsman Apr 12 '11 at 12:51
  • ok. also what program of software do you use to read the dumps? – ben950 Apr 12 '11 at 13:03
  • 1
    WinDbg, from the Debugging Tools for Windows, I use !analyze -v to get a lot of information and lm t to get the timestamps for the drivers, lm v gvies a lot more information but takes a long time. Make sure that you set your symbols right. – Tamara Wijsman Apr 12 '11 at 13:14
  • 1
    Thanks My laptop seems to now be functioning without any blue screen once again thanks you – ben950 Apr 13 '11 at 08:35
0

Had this happen and diagnosed the problem for weeks. Eventually read a few posts in the darkest corners of the web which gave me some hope. Took my laptop apart, dusted it thoroughly, removed the very hard and dry thermal paste off the CPU, GPU and chipset and replaced with fresh paste. Booted, working, no more issues.

Before doing the above I ran every benchmark and memory test I could find. Downgraded my video card driver to the standard windows driver, disabled network cards and anything else i did not use. Booted into safe mode etc... trying to determine where the problem lay. Checked the thermals on my laptop, looked good within specifications. None of this helped though.

user986363
  • 201