Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have Windows 7 Pro 64-bit edition and it seems like every week I get a blue screen since it crashed for some reason.

I have no clue what is causing this.

  1. I have 4 gigs of RAM with 2 of them not 100% sure if they work as they should. I say this because it was on some computer that suffered a power surge and I was given the RAM that was still working for free. So I am not sure if this could cause a problem.

  2. Before I went to Windows 7 Pro 64-bit I had Windows XP Pro. I was able to overclock my Intel E2180 dual core CPU to 3GHz, but now I can't do this anymore and have had to lower it to 2.8GHz.

When I tried to have it at 3GHz my computer would turn on and it would try to power up and it would just fail and shutoff. It made this clicking sound that always followed a shutdown.

So I lowered it to 2.8, used prime95, did a 30 min torture test and it never crashed once. I don't think the temps went past 60 degrees.

However, once in a while I here the same clicking sound as if the computer was just about to lose power but then quickly regains the power. I am not sure if this is because it was about to go into hibernate mode or what.

How can I take a screenshot of the blue screen so that when it happens again (probably next week) I can post something up to show what it says? Thanks.

Here are all my blue screen I have encountered.

A problem has been detected and Windows has been shut down to prevent damage to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen, restart your computer. If this screen appears again, follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

Technical Information:

*** STOP: 0x0000000a (0x0000000000000028, 0x0000000000000002, 0x0000000000000000, 0xfffff80002b18090)

*** ntoskrnl.exe - Address 0xfffff80002ad5f00 base at 0xfffff80002a64000 DateStamp 0x4a5bc600

// I had 3 of the following

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: Ntfs.sys

SYSTEM_SERVICE_EXCEPTION

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000003b (0x00000000c0000005, 0xfffff80002d48b9b, 0xfffff88008e9d080, 
0x0000000000000000)

*** Ntfs.sys - Address 0xfffff880012aea20 base at 0xfffff88001247000 DateStamp 
0x4a5bc14f

A problem has been detected and Windows has been shut down to prevent damage to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 
0x0000000000000000)

*** ntoskrnl.exe - Address 0xfffff80002ad1ed0 base at 0xfffff80002a60000 DateStamp 
0x4a5bc600

Not sure what they really are. Quick good search shows the first one to be a critical file but not sure how to get a new one if it is really corrupted.

Checkdisk

C:\Windows\system32>chkdsk
The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
  160000 file records processed.
File verification completed.
  165 large file records processed.
  0 bad file records processed.
  2 EA records processed.
  62 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
  234340 index entries processed.
Index verification completed.
  0 unindexed files scanned.
  0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
  160000 file SDs/SIDs processed.
Security descriptor verification completed.
  37171 data files processed.
CHKDSK is verifying Usn Journal...
  36260256 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.

 102406310 KB total disk space.
  41217544 KB in 121145 files.
     73576 KB in 37172 indexes.
         0 KB in bad sectors.
    265510 KB in use by the system.
     65536 KB occupied by the log file.
  60849680 KB available on disk.

      4096 bytes in each allocation unit.
  25601577 total allocation units on disk.
  15212420 allocation units available on disk.

Update

Got another crash to add to the list. I guess my computer is trying to go through every different crash it can go through

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: Ntfs.sys

NTFS_FILE_SYSTEM

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x00000024 (0x00000000001904fb, 0xfffff880096d3d98, 0xfffff880096d35f0, 
0xfffff80002ae2167)

*** Ntfs.sys - Address 0xfffff880012233d8 base at 0xfffff88001202000 DateStamp 
0x4a5bc14f
share|improve this question
1  
+1 for being thorough on your info! –  Ivo Flipse Oct 13 '09 at 19:22

10 Answers 10

up vote 6 down vote accepted
+100

You don't need to take a screenshot of the blue screen (although the easiest way is with a digital camera).

You can use BlueScreenView to recreate the BSOD, so please analyze the problem as much as possible on your side, before posting more info.

BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version). For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash.

enter image description here

share|improve this answer
2  
+1 for BlueScreenView –  Ivo Flipse Oct 13 '09 at 19:23
4  
Except it doesn't answer the question... –  AnonJr Oct 16 '09 at 19:46
1  
This is the tool I found for the OP to analyze his aborts. We worked together on trying to get some handle on the problem, as in the beginning this post did not contain enough data. –  harrymc Oct 16 '09 at 19:58

I start a new answer. First to comment on the 3 types of crash info.

1. In IRQL_NOT_LESS_OR_EQUAL Microsoft Support says:

This error usually occurs after the installation of a buggy device driver, system service, or BIOS. To resolve it quickly, restart your computer, and press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

2. In SYSTEM_SERVICE_EXCEPTION they say:

It indicates an exception was raised in a system service which was not handled by the system service.

From your info, the faulting service is Ntfs.sys, meanining the hard disk!

3. In KMODE_EXCEPTION_NOT_HANDLED

This Stop message indicates that a kernel-mode process tried to execute an incorrect or unknown processor instruction.

Here the faulting process is the Windows kernel itself. Bad, very bad.

Analysis:

Either a hardware problem caused by over-clocking, or a bad driver is executing on kernel-level.

Recommendations:

  1. Follow the instructions here: How to Use the Memory Diagnostics Tool in Vista
  2. Do chkdsk

and we'll see how we go from here.

share|improve this answer
    
Hi ok I did method one of the memory check tutorial. I am not sure how deep of a scan it did but it took about 5mins to scan. It found not errors with the memory. I am running the chkdsk now and I will post results soon. –  chobo2 Oct 10 '09 at 21:06

Going by the symptoms you listed: clicking noise and BSODs with ntfs.sys; this would most likely point to a hard drive going bad. That of course is assuming the clicking noise is coming from your hard drive. I'm not sure of anything else that has a clicking noise in a computer that isn't a fan or hard drive, but you may want to try throwing in something like Ultimate Boot CD and running a full check disk on the hard drive. Barring any of these not fixing the issue, you can do the following, in recommended order:

  1. Reinstall the operating system
  2. Try each memory stick separately, in each memory slot.
  3. Replace the hard drive
  4. If you have spare memory, try those
  5. Sacrifice a goat

These are the cheapest solutions to try. After this you start getting into the really expensive components like the motherboard or the processor.

share|improve this answer
    
But would the sound not be constraint if it was the hard drive? Like this sound can be hours even days apart and can last only a couple mins. What is ultimate book CD? –  chobo2 Oct 13 '09 at 23:17
    
If the sound happens every time you crash, then it could very well be connected. If it doesn't then I would rule that out as a symptom. Ultimate Boot CD is a bootable cd that contains a lot of different tools used to backup, troubleshoot, and in some cases, repair a computer. You can make the CD yourself for free, but this requires a legit copy of Windows XP and a blank CD, or you can usually purchase a copy for around 10-20$ online. –  Justin Drury Oct 14 '09 at 3:10

According to the Intel Processor E2000 Series Datasheet your maximum operating temperature should be 73.3 degrees celsius. Since you stated that your maximum temperature is 60 degrees I would guess that shouldn't be a problem.

When you ran prime95 did you run two tests at the same time or just one? Since your processor is dual core, you may not have stressed it 100% and your 60 degrees could point to the problem.

That being said, in my personal experience, I was having random BSODs with Vista x64. Each message was different and occurred at different times. When that happens it is usually a hardware issue. In my case, my water pump had broken and the processor kept stalling itself to keep from overheating. Once I fixed the water pump, all of the BSODs went away. My BSODs had an IRQL_NOT_LESS_OR_EQUAL, one referencing the USB driver, and the KMODE_EXCEPTION_NOT_HANDLED.

Honestly I would check your heatsink and re-seat it. Once you have confirmed that I would run a test like the Windows Memory Diagnostic or memtest86+ to confirm your memory is ok. Again, random BSODs that are unrelated usually have to deal with hardware corruption.

share|improve this answer
    
just check if my heatsink is in the right position? Is that what you mean? When I ran prime95 I did 2 tests. I will tests it again in the coming days to see. How long should I leave it running? –  chobo2 Oct 13 '09 at 23:16

ANSWER : REDUCE OVERCLOCKING LEVEL

According to the specs of Intel E2180 your CPU speed is 2 GHZ, which you're currently overclocking at 2.8 GHZ !

I quote from OverClocking Risks:

Usually processors in the lower range are produced with the same manufacturing process as the CPUs sold in the mid to high range. The higher rated CPUs are factory overclocked and tested, then sold for a premium. Many users will buy the cheaper processor and over clock it to nearly the same speeds of the premium CPUs. This is a great deal if and only if you are lucky enough to get a CPU that just missed the premium cut during initial factory testing. Sometimes, you will be stuck with a CPU that only over clocks slightly above its rating.

In other words, the processor that you have was factory-tested and found to be incapable of sustaining in the long-term much higher clock-rates than what the specs say. If it could, it would have been sold as another model and a different price.

Apparently, you are lucky to have a CPU is of such a good quality that it still works even when cranked up all the way from 2 GHZ to 2.8. Be thankful that it only crashes on you about once a week, maybe when it heats up to unsustainable levels.

However, if you continue overclocking, you risk one day to burn-out completely your CPU.

I suggest that you go down in the overclocking, doing a binary search for the correct level. Meaning that you try 2.4GHZ, and if it still crashes go to 2.2, and if not then try 2.6. We already know from your data that 2.8 is too high.

share|improve this answer

Try http://www.resplendence.com/whocrashed It will give you more information about the BSOD. Also try switching your power profiles to High Performance. I had similar BSOD to you and that solved my problem. It can't seem to handle changing clock speeds.

share|improve this answer
    
I will check this out. –  chobo2 Oct 18 '09 at 23:35

You should install WinDbg Tools from Microsoft (it's free): http://www.microsoft.com/whdc/devtools/debugging/default.mspx

It's very easy to use to dig some information out of a crash. Just install it, start it (actually, right click on it and select "Run as administrator" otherwise you won't be able to have it open the minidump file), and go to menu File -> Open crash dump, then browse to C:\Windows\Minidump, and pick the latest file in there. When the file finishes loading, click on the link '!analyze -v' (or type that yourself in the bottom of the window and hit enter). You'll see lots of information swing by. Look for clues there as to what may have been the cause. Typically, you'll see where the crashing process was (and which process it was, accessing what module etc). If you dig through the help of WinDbg, you can even look at the state of your machine right before the crash pretty extensively.

The nice thing with this, is that you can take any friend's minidump (or full kernel dump) and take a peek at what may have caused their crash too... This is actually the tool Microsoft itself uses to hunt down problems (your minidump gets sent to them if you hit the "Send problem report to microsoft" thingie). If you are very interested in this, there's even a blog here (by MS employees) with plenty of hints about this tool: http://blogs.msdn.com/ntdebugging/default.aspx

share|improve this answer
    
I went and downloaded this one: "Install Debugging Tools for Windows 64-bit Versions" but when I try to install I get "This installation package is not supported by process type. Contact your product vendor." –  chobo2 Oct 12 '09 at 21:07
    
If you can't install the 64-bit version of the debugging tools when you aren't running a 64-bit OS. Do you have two Program Files folders? –  Joshua Oct 12 '09 at 21:27
    
Yes I am sure it is 64-bit version. Seeing that I choose 64bit as the install, IE-8 says is it is the 64bit version and that I have 2 program files one for X86 and one for 64bit –  chobo2 Oct 13 '09 at 23:19
    
It should work, it's done by MS itself... From this page right?: microsoft.com/whdc/devtools/debugging/install64bit.mspx, it says: "When to Use 64-bit Debugging Tools: The 64-bit versions of Debugging Tools for Windows allow you to debug both 32-bit and 64-bit user-mode applications running on 64-bit processors. Use this package to debug both the application and the WOW64 emulator" –  Zoran Oct 14 '09 at 0:19
    
@chobo2: Make sure you download the x64 version, not the Itanium version. –  bk1e Oct 14 '09 at 5:02

Completely remove your overclock and see if this continues. I get the hunch that it won't. It may not be related to the CPU, but the PSU may be failing and the extra power-draw from the OC may be causing the instability.

share|improve this answer
    
"PSU" meaning power supply? I been thinking that maybe because of adding in an extra sticks of ram took a bit of power away and now my powersupply can't give enough power at times to all the parts. –  chobo2 Oct 13 '09 at 23:21
    
Yeah, PSU meaning power supply unit. RAM probably wouldn't take it over the edge, generally it only consumes a watt or so. It could just be slightly unstable with the overclock and it is manifesting itself inder 7 when it didn't previously. I had to back my Q6600 back from 3.4 to 3.2 when I went from XP to Vista. –  MDMarra Oct 13 '09 at 23:50
    
Well mine is already lower then it was before. Use to be 3.0GHZ now it is 2.8GHZ. –  chobo2 Oct 14 '09 at 17:35
2  
You can't troubleshoot stability until you return the system to a completely normal state. If you don't want to remove your OC that's fine, but you can't rule it out until you do. –  MDMarra Oct 14 '09 at 18:05

When you overclocked it did you lock the PCI bus to 100? If not that can introduce instability.

How is the power supply? Do you have a power filter or UPS on it? Is the PSU ok? The click could be an overload relay dropping one of the rails in the PSU which would upset the applecart. I recently added a UPS to my wife's PC because it was crashing when the fridge started. Dodgy rental-house wiring.

Perform a laying-on-of=hands. Reseat all the RAM, cards & connectors - one of them may be a little loose.

share|improve this answer

Have you run a memory test? The Windows 7 install disk has a memory testing app in the recovery console.

The CHKDSK seems to be clean, so hopefully it is not hard drive. If you have another hard drive you may want to swap it in and install, see if the problem happens again. Or you could do a deep scan with something like Spinrite. It is the first thing I reach for when there is a potential hard drive or data corruption issue. And it will also check to see if your HD is overheating. I have seen a lot of kernel and NTFS errors being caused by overheated hard drives.

Were you still overclocking when you installed Windows? If something was off processor wise it may have caused some corruption on install. And a reinstall may solve the problem.

Definitely check your drivers make sure they are all as up to date as possible. Especially chipset drivers. I have had the "IRQL_NOT_LESS_OR_EQUAL" on winxp machines with bad chip-set drivers.

You are sure your temp isn't peaking over 60 degrees? And are you using the Prime95 32 or 64 bit tool?

I had an odd problem the first time I installed Win 7 on my laptop but I re-installed later that day and it seems to be working fine.

share|improve this answer
    
Ya I am running all the testing apps in 64bit. I did a memory test and it found no problems with my memory. –  chobo2 Oct 18 '09 at 23:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.