BSOD During Windows 7 Shut Down

Norton Security | Norton Internet Security
1

So, for the first time in a while I got a BSOD when I restarted my PC. Before, I had this happen when my motherboard died on me a while back, but I was also having way more issues along with the BSOD at that time. This time, I just got a BSOD, and the computer seems to be running fine. The BSOD only showed up for a bit, so I couldn't see much of what was on it. Something about Windows couldn't shut down properly, and before I could read any error code the screen went black and the computer restarted. When the computer restarted, I did Startup Repair, but it said no issues were found. I checked the memory with Windows Memory Diagnostic Tool, and that didn't have an issue. I pressed F9 at the beginning of the computer boot up, and all the components of the computer were labeled as "Passed". I did a SMART Short-Self Test, and it came out with 0 issues. I also did a chkdsk on the hard drive, with only just the first option selected, and it seemed like there were no issues found with that either. I then proceeded to do a scan in safe mode with Norton Internet Security 2013 (Full Scan), and the latest free version of Malwarebytes (Full Scan), and both scans came out clean. I just came here to post this, because I know this community is highly intelligent when it comes to computer issues, and I just wanted a second opinion to see if I had a hidden virus or malware. I know those malicious things can cause a BSOD. Oh, and I checked the logs in Norton (Intrusion Prevention, Firewall Activities, Unresolved Security Risks, etc.) and they all seem to be fine. The only issue was that Norton blocked an intrusion attempt on the 1st of March, but after that happened I scanned with Norton and Malwarebytes, both came out clean, and the computer seemed to be just fine until tonight with the BSOD. I may not have any issues that are bad on my computer, but I'd just feel better if someone here would tell me if I'm okay or not. Thanks for reading, and thanks for any responses that I may get. :smileyhappy:

 

My PC:

 

Hewlett Packard

AMD Athlon II X4 640 Processor 3.00 GHz

4.00 GB

Windows 7 64 bit

 

My Norton:

 

NIS 2013

20.3.0.36

2

If this is a one time event, I would not worry tt much. One of the bits or bytes got out of place and confuse Windows. If it continues to happen we can help diagnose this.

 

If you want some more info on the BSOD, you can check out BlueScreenView at http://www.nirsoft.net/utils/blue_screen_view.html  The download links are at the bottom of the page.

 

 

 

3

Thank you so very much for your response peterweb. :smileyhappy:

 

The BSOD appeared again this morning, and this time it happened when I started up the computer. All I was able to read this time was IRQL_NOT_LESS_OR_EQUAL, and then it went black again. I was able to get Startup Repair to restore my computer to a previous time, but I'm unsure if that is going to work or not. I say this because I shut down the computer and restarted it a few times last night when I was trying to figure out if my computer was broken or whatever, and didn't get the BSOD until today when I put the computer back on. I had turned the computer on earlier this morning, and it was fine. So, I shut it down, and then I came back to turn it on again, and that's when the BSOD appeared. I downloaded the BlueScreenView software you linked, and was able to see the two BSOD events that have happened. It says that under "Caused by driver" that the fault is ntoskrnl.exe, both times. Under "Caused by Address" it says ntoskrnl.exe+75c40, both times. If you need any more information, I'll gladly post a screenshot of the list in BlueScreenView, or tell you whatever you need to know. Your help is very much appreciated.

4

If you can tell us the Faulting Module it would help. A screenshot would not hurt. 

 

Instructions to post screenshots can be found here
http://community.norton.com/t5/Forum-Feedback/Forum-Tip-How-to-post-screenshots-in-the-forum/m-p/254415#U254415

 

 

 

5

Forgive me, but I have no idea what a Faulting Module is.

 

Here are my screenshots... I hope they don't stretch the forum here:

 

File 1.jpgFile 2.jpg

6

Might want to see if your HP is listed here and check the driver.

Regardless of what that blue screen viewer atating ntoskrnl.exe, look at the screenshot in that page and see if that matches.

http://support.microsoft.com/kb/2670838

 

Dave

7

ntoskrnl is s Windows system file. You need to check your Windows installation.

 

Click on Start and type CMD in the search box. Right click on CMD.exe and click Run as Administrator. In the command window type    'sfc /scannow' without the quotes. This will check your Windows installation.

 

 

 

8

ntoskrnl is more than a windows system file.

It basically IS windows.

 

NT stands for Windows NT.

OS stands for Operating system

krnl stands for kernel the main component of an operating system

 

Put it all together and you get the Windows NT Operating System Kernal.

 

So yes, windows is indeed crashing but it's always something else that is causing it to crash.

Dave

 

 

9

@ DaveH: Thank you for your responses. I clicked on the link and saw the screenshot on that page, and it isn't the same blue screen that I got. My blue screen had IRQL_NOT_LESS_OR_EQUAL on it, while the blue screen in the screenshot on that page you linked has PAGE_FAULT_IN_NONPAGED_AREA. I do not know what the rest of my blue screen stated, since it went by so fast both times that I wasn't able to read any further. I have no idea as to what can be crashing my Windows.

 

@ peterweb: Thank you for your responses as well. I did exactly what you said to do in the CMD window, and after the verification process got to 100% it stated as so, "Windows Resource Protection did not find any integrity violations."

 

I'd still like some more help, if possible, but I also wanted to ask some questions. Is my computer still as safe as it was before I started getting BSOD screens? Could changing the memory and/or the hard drive inside the computer tower fix this BSOD issue, or would a simple re-formatting of the hard drive + re-installation of Windows with the System Restore Disc I got from HP be enough to solve this problem? I would really hate to have to go through the hassle of doing a re-format + re-installation of Windows, and money is tight now, so new computer parts would have to wait. I'm hoping that there's some easy fix, but if not I'll do whatever ya'll think I should do.

 

Since this is a Windows problem, I also wanted to add a comment. When my motherboard broke months ago, I had to keep calling HP to see what the problem was. They kept telling me to re-install Windows 7 with the System Restore Disc, and each time it didn't want to work right. I don't remember how many times I had to keep on doing it, but it was quite a bit, and that was due to them prolonging me from sending the tower into them so that they could check it out themselves and have it fixed. When it was at HP, they diagnosed the computer, and did a full check to see if there were any problems, and all they changed was the motherboard. So, what I'm trying to say is, I hope that re-installing Windows 7 that many times a while back isn't what is giving me these problems now, even though the computer has ran fine since I had HP fix it. This is probably unrelated, but I thought I should mention it.

10

The blue screen "IRQL_NOT_LESS_OR_EQUAL" is almost always caused by a driver.

The bugcheck code 0x0000000A 'usually' means that the driver tried to hit a section of memory it was not supposed to use for one reason or another, most common reason would be because it's reserved for windows.

 

Thats what it looks like, a driver is crashing windows because it's using a memory range it is not supposed to.

 

The hard part is trying to figure what driver it is.  It's almost always nothing to do with windows because windows is the operating system.  It's hard to blame windows when software that wants to run on windows needs to be able to get along with windows and not cause it to crash.

As long as windows files and drivers have not been modified or changed by a virus, infection, or file corruption it becomes a waste of time to try to blame it on windows.

Even in the example I gave above, it was clearly a update from MS that started the crash but now it's become AMD's problem to fix it.

 

First thing I would try is look in the windows\minidump folder.  It's a hiden folder, you will have to change your view settings to show all files and also to unhide system files and folders.

The crash files all have the date as part of the name the one you posted is 03-24-13  March 24'th (yesterday).

 

See if you can find a pattern of when the crashes started and try to remember what changed at that time.

It could be some software or hardware you installed, it could be windows update time of the month, it could be when your Norton product got an update or something of that nature.

 

I usually ask a person a hundred times and they say they didn't do anything at all.

Then I may spend many hours or even days and when I finally figure it out they all of a sudden say "oh yea, I did install that".

 

If you can remember what may have changed thats half the battle.

Otherwise you may need to temporarily uninstall some software or disable some programs from starting and see if the problem goes away.  Or try to find a way to "make it crash" because if you find a certain program or browser causes it to happen that can help narrow down the problem.

 

Since your posting about your problem here I would assume you thought your Norton product may be involved?

 

Dave

 

 

 

 

 

11
DaveH wrote:

[...]

 

See if you can find a pattern of when the crashes started and try to remember what changed at that time.

It could be some software or hardware you installed, it could be windows update time of the month, it could be when your Norton product got an update or something of that nature.

 

I usually ask a person a hundred times and they say they didn't do anything at all.

Then I may spend many hours or even days and when I finally figure it out they all of a sudden say "oh yea, I did install that".

 

If you can remember what may have changed thats half the battle.

 

[...] 

 

Hi frozenstar

 

To assist with DaveH's request above, please include a screenshot of your current Reliability Monitor history graph in your next post (please see the following post for instructions and examples):

 

http://community.norton.com/t5/Norton-360-2013-Norton-Internet/Windows-7-Reliability-Monitor-no-installation-event/m-p/728226#M1484

 

The blue screen event should show as a red 'Windows stopped working' critical event for a particular date in the 'Windows failures' row on the graph. Scroll left on the graph and locate the first instance of a blue screen event. Check for 'Information' events (application/driver/Windows Update installations, etc) on or immediately before this date. Repeat this process for all other blue screen events that you see on this graph (you can use the 'View technical details' action listed against each of these records to get more information about each event for comparison purposes). As noted by the linked thread above, not all software installations will be shown here but whatever information it can provide may prove helpful.

 

Let us know what you find.

 

12

@ DaveH: Thanks for your help. I was thinking that it might be a Norton problem, but I was unsure so that's why I posted this here. All I know is that the night of the first BSOD, I didn't install any new programs. The last software I had installed was Skype, but that was before the day of the first BSOD. When my computer was in the process of restarting, I don't recall any installations happening that Windows Update would do, nor do I remember the sheild being on the Shut Down button. Hmm... before I had tried to restart the computer, I did install some LiveUpdates. I like to do that from time to time, so that my computer is always up to date protection wise. When I was on the computer before the BSOD happened, I was just browsing the internet and listening to music on Spotify. There were no pop-ups from Norton telling me that there was anything wrong, and Firefox didn't tell me that there was a new version of Firefox to install. After the first BSOD I did uninstall Windows Live Essentials, and Skype. Since Skype was the last thing I installed on the computer, and I had uninstalled it the night before the second BSOD, I guess we can rule that software out?

 

@ elsewhere: Thanks for your help. I took some screenshots of the reliability monitor. The first date has some "Informational Events", but those are after the BSOD happened. The "Informational Events" start at 8:22PM for Windows Live Essentials, since I decided to uninstall it. In between the Windows Live successful application removals, there is a D3DX10 uninstallation. After all the Windows Live listings under "Informational Events" there is MSVCRT110, MSVCRT, MSVCRT_amd64, and Microsoft Application Error Reporting. Then, at 9:03PM, it shows Skype 6.2, which along with Windows Live Essentials was the only other thing I uninstalled that night. All are, under Summary, "Successful application removal". On 3/25/2013, there are no "Informational Events". I stated this, because I would have to take more than 2 screenshots due to the list being long, since there's a lot of assets that go along with Windows Live Essentials. I figured it would be shorter to just list them in text form.

 

Also, under Critical Events on 3/24/2013, the last three problems listed are "Windows failed to start because of a problem with the hard disk." On 3/25/2013, the second problem listed is "Windows failed to start due to missing system files."

 

Reliability 1.jpgReliability 2.jpg

13

Hi,

 

Please check your HDD drives, maybe the one containing the OS is about to die.

Same thing with RAM modules and GPU.

If the HDD is about to crash, Windows cannot work properly and crash.

Also check in Event Viewer for any Hardware or Windows events marked as "critical" or "error" & all the Performance Windows logs.

 

B/R,

14

Thanks for your help Apostolos. I only have the drive with Windows on it (labeled C: drive), and an HP Recovery drive (labeled D: drive). Yesterday, I did a full chkdsk on my hard drive (checked both boxes for "Automatically fix file system errors", and "Scan for and attempt recovery of bad sectors"). It seemed like everything came out right, and when the computer restarted, there was a black screen that said "Volume is clean". After that, I did a SMART Extended-Self Test on the hard drive, and that test passed as well. I already previously checked the RAM with Windows Memory Diagnostic Tool, and that passed. I haven't checked the GPU yet, though. I think there's an HP Vision Diagnostics Tool on the computer that I can burn to a disc to check the GPU, though. I remember I had to do that previously when I called up HP for help. Hopefully, that will tell me if the GPU is any good.

 

In Event Viewer I went to Critical, and I realized that on the 7th of January there was the same BSOD that happened, but I don't remember seeing it that day, but I don't remember that day at all, honestly. All three dates that show up under Critical... 1/7/2013, 3/24/2013, 3/25/2013 have a Source of Kernal-Power, Event ID as 41, and a Task Category of (63). The General information that shows up says the same thing for all of them, "The sysytem has rebooted without clearly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly." I also see a lot of errors for Kernel-Event Tracing, which appears to happen almost everyday. I have no idea what that means. I'll post a screenshot of what I'm seeing below. I don't know if the screenshots will help much, but I want to get to the source of this problem.

 

So, you think that I'm having hardware problems?

 

Event Viewer 1.jpgEvent Viewer 2.jpgEvent Viewer 3.jpg

15

Hi,

 

What GPU do you have and what driver version??

Also, I do not want to make yo feel sad, but with so many kernel errors you will probably have to perform a Windows Repair installation and if it doesn't work, reinstall the OS.  :-(

BUT, first of all, check if all the hardware is working as it should, drivers and components and we'll see...

 

Regards,

 

16

Hi again,

 

Also check with this tool the temps: 

CPUID HWMonitor is a hardware monitoring program that reads PC systems main health sensors : voltages, temperatures, fans speed.
http://www.cpuid.com/hwmonitor.php

Also, did you make any RAM changes or changed the default RAM settings?

Your MOBO is to be tested too.

 

 

17

Thank you so very much for your responses Apostolos. Okay, so I tested the computer with HP Vision Diagnostics Tool, and my results are as follows...

 

HDD Passed - SMART OK, Fragmentation OK, Space OK

Graphics Card Passed

System Board Passed

 

My graphics card is a 512MB DDR3 AMD Radeon HD 6450 graphics card [DVI, HDMI, VGA adapter]. I have no idea how to check what driver version I have for it, though, I'm sorry. I always just let Windows Update handle drivers and what not. With RAM, I have never opened up the case and changed a thing inside. I had it under HP's insurance for 2 years, which expired on the 18th of this month. So, only the workers at HP opened it up to replace the motherboard. That sucks that I have to do a Windows Repair installation, which I have no clue how to do, or a full system restore. I downloaded that program that you linked. I have no idea how to read any of what it's showing me, if the temps are fine and what not, so I'm just going to post screenshots.

 

Temps ETC 1.jpgTemps ETC 2.jpg

18

In post 12 the top screenshot shows some entries that say "unsuccessful application removal".

Do you know what that is for?

 

Those events happen just prior to the boot that windows has critical problems.

Dave

19

@ DaveH: Those "unsuccessful application removal" issues apparently happened when I was uninstalling Windows Live Essentials. Windows Live MIME IFilter and Windows Live Writer are the only two things listed at exactly 8:22PM in the Informational events. I had chosen the Uninstall option from the Control Panel. Since Windows Live is going to be shut down soon (or is already, I'm not sure), and I don't use the other applications that come along with it, I don't need that software anymore. I'm surprised that it had any issues, because as I was uninstalling Windows Live Essentials, it seemed like there were no issues.

 

So, I'm wondering, could a hidden virus/malware/root kit be causing these problems on my computer, even though I've been scanning my computer quite frequently with Norton and Malwarebytes? And, would the best option be a re-format + system restore right now? If I still have issues after the fact, I could report back here. I'm just really worried about my computer's security, especially since the computer has been having errors for a long time without me even knowing. I'm curious, though, if I decide to do a system restore, is there a Microsoft official link for Windows 7 SP1? The one thing I hate the most about system restoring is downloading all those updates individually from Windows Update. If no one knows, it's okay.

20

I'm going to send you an email address in a private message, click the little envelope icon in a while.

Send me a half dozen minidump files, they do not contain any personal information.

I'm setup with the windows debugger, it may show more info then your blue screen viewer.

 

Yes it would be very helpful if we knew there was a hidden infection causing this, at least we would be able to know if we are wasting our time trying to fix windows or not.

 

To answer your last question, yes there is a download called "Windows 7 SP1 redistributable" that lets you download the entire service pack in one wack.

 

I'm very bust today, I would be glad to look at those crash dumps but I can't guarantee when it would be or even if it's going to show any additional information.

 

Dave