I'm getting blue screens, mostly when trying to boot a program that required a lot of memory (games, photo editing software.) So far I've only managed to catch one set of error codes:

BCCode: 1000008e
BCP1: C0000005
BCP4: 00000000
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

It's on a Sony VAIO Laptop VGN FW-41E, Vista OS service pack 2.

I have not noticed any issues other in performance as of late, just BSOD's when I start software that requires some memory, but I never had issues with these exact same programs before.

Help and/or hints are required on how to actually figure out what's the root of this BSOD issue and how can I fix it.

Edit/Update: Managed to retrieve previous BlueScreen error codes, they were all 100008e.
I made a bootable CD with MemTest like you suggested and let it run until completion. It took about 30 minutes and returned 0 errors. Which I suppose makes no sense, but since I don't know too much about this stuff I'll let you be the judge of that. What's next?

Thank you for the replies, people. Much appreciated!
It did generate 1 minidump once, I used WinDbg on it. Here are the contents:

FAULTING_MODULE: e3447000 nt


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction on 0x%08lx refers to memory on 0x%08lx. A read or write change in memory has failed: %s.

FAULTING_IP: aswSP+cadc adc6fadc 66833841 cmp word ptr [eax],41h

TRAP_FRAME: b96df7a0 -- (.trap 0xffffffffb96df7a0) ErrCode = 00000000 eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=ea6bfd88 edi=ea6bfdb8 eip=adc6fadc esp=b96df814 ebp=b96dfacc iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 aswSP+0xcadc: adc6fadc 66833841 cmp word ptr [eax],41h ds:0023:00000000=???? Resetting default scope





LAST_CONTROL_TRANSFER: from adc70251 to adc6fadc

WARNING: Stack unwind information not available. Following frames may be wrong. b96dfacc adc70251 b96dfb1c ea6bfdb8 ea6bfd88 aswSP+0xcadc b96dfb28 adc8bf88 ea6bfdb8 00000930 b96dfb9c aswSP+0xd251 b96dfb4c e3665c73 ea6bfdb8 00000930 b96dfb9c aswSP+0x28f88 b96dfb74 e36667f5 ea6bfdb8 00000930 e355448c nt+0x21ec73 b96dfc18 e36577b1 eaa7f3e0 a30f61e0 b96dfd14 nt+0x21f7f5 b96dfc88 e36578a1 a30f61e0 b96dfd14 00000000 nt+0x2107b1 b96dfcb8 e3657aae b1d23f18 a30f61e0 b96dfd14 nt+0x2108a1 b96dfd34 e3491c7a 00000114 ffffffff 02e3ec28 nt+0x210aae b96dfd64 777b5cd4 badb0d00 02e3eb98 00000000 nt+0x4ac7a b96dfd68 badb0d00 02e3eb98 00000000 00000000 0x777b5cd4 b96dfd6c 02e3eb98 00000000 00000000 00000000 0xbadb0d00 b96dfd70 00000000 00000000 00000000 00000000 0x2e3eb98


FOLLOWUP_IP: aswSP+cadc adc6fadc 66833841 cmp word ptr [eax],41h






Followup: MachineOwner ---------

This appears to be related to avast? Any ideas? Should remove the program / reinstall? What's the vista driver fault it refers to? Do I need to update something?

  • Try running the memory test overnight rather than a single pass. It will keep repeating the test until you stop it, so just start and check the next morning. I personally prefer Memtest86+, but the one Luke suggested should be more or less the same. – Bob Jun 2 '12 at 11:14

Bad memory. Run MemTest86 and report the results. Download the ISO image, and burn it to a CD. It's only a couple MBs, so it shouldn't be much to download. Reboot your computer, and make sure it's set to boot from the CD Drive first (you may need to press F12 or F8 as the system is booting to select a different device)

  • It's not legitimate to make such a claim ("Bad memory"). This can have all kinds of reasons, including malware and bad memory. The asker would have to give a minimum amount of useful information, such as the output of !analyze -v from en.wikipedia.org/wiki/WinDbg or a download location for the minidump file. No up- or downvote. – 0xC0000022L Jun 1 '12 at 23:00
  • The four times I've seen it, it was bad memory, so I suggested that. I haven't seen malware cause it yet, and I haven't seen drivers give THIS code... Although I must agree, that doesn't mean it can't happen – Canadian Luke Jun 1 '12 at 23:32
  • okay, fair enough. Admittedly I'm more exposed to malware issues, working in the anti-malware industry. – 0xC0000022L Jun 1 '12 at 23:34

This bug-check code can have all kinds of reasons, including malware and bad memory. But the likeliest from experience is that some kernel mode code (usually a driver) is doing something bad. Most bad memory cases lead to crashes early on in the boot phase, unlike with Windows 9x versions that would crash randomly after the system was fully booted. That's not to say it isn't bad memory and I would certainly recommend verifying or falsifying that possibility using memtest86 or memtest86+ as suggested by Luke. (okay, so you ruled that one out already ...)

You would have to give a minimum amount of useful information, such as the output of !analyze -v from WinDbg or a download location for the minidump file (usually found in %SystemRoot%\Minidump). With the presented information no respectable answer is possible even for the most seasoned Windows kernel/driver developer.

See KERNEL_MODE_EXCEPTION_NOT_HANDLED_M and more specifically KERNEL_MODE_EXCEPTION_NOT_HANDLED (make sure to perform the steps from the Resolution section).

Given this is a laptop, I reckon that a recent hardware change is unlikely, but it is one of the possible reasons - be it memory or other hardware. But !analyze -v is often able to point to the culprit (i.e. the driver), even though this can be unreliable with actual hardware issues (or malware tinkering in kernel space).

Generally I wouldn't trust any malware-infested system and would restore it from a known-clean backup. However, since you ask for a remedy (be it just for data backup purposes or something else), I suggest you use a boot media from one of the many anti-malware companies to scan the system "offline". Trinity Rescue Kit is a solution that offers several antivirus scanners on the same boot media. Other similar live CDs can be found here.

If you want to attempt to rescue a running system, consider that renaming a file in use (DLL or EXE) is usually the best way to prevent a (malicious) program from starting automatically after a restart. Another similar approach is to create a folder of the same name as is known to be created by the malware, because in this case the malware will usually fail to create a file with the same name (being coded to dumb to check for such cases).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.