[Win8.1 x64] Multiple BSODs in a new Lenovo Z510 Laptop

seif · Jun 17, 2014

Hello,

I noticed that many people have found solutions to their problems in these forums. I hope I get mine fixed too.

Well I bought a new laptop Lenovo Z510 with 16GB of RAM already and it seems that I am dealing with tons of problems. I got it back to warranty they changed the RAM and the situation seems to have improved significantly.

But even with that I still have faced several BSODs and a lot of problems in the event viewer plus to random crashes for some some apps like firefox.

I attached the files hoping that we get this one sorted.
View attachment SF_17-06-2014.zip

Thank you very very much.

blueelvis · Jun 17, 2014

re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Hi seifsg and welcome to the forums ^_^,

First of all, thanks for your kind words, we try our best to help users solve their problems ^_^.

I have analyzed your Dump files and below has been provided an analysis for informative purposes :-

Code:

**************************Tue Jun 17 15:40:28.503 2014 (UTC + 5:30)**************************Probably caused by : NETIO.SYS ( NETIO!IndexListEnum+261 )
 
BugCheck 1E, {ffffffffc000001d, fffff80000e11091, ffffd000380811e8, ffffd000380809f0}
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x0000001E"]KMODE_EXCEPTION_NOT_HANDLED (1e)[/URL]
 
BUGCHECK_STR:  0x1E_c000001d
 
PROCESS_NAME:  BitTorrent.exe
 
FAILURE_BUCKET_ID:  0x1E_c000001d_BAD_IP_NETIO!IndexListEnum
 
MaxSpeed:     2200
 
CurrentSpeed: 2195
 
  BIOS Version                  8DCN26WW
 
  BIOS Release Date             09/23/2013
 
  Manufacturer                  LENOVO
 
  Product Name                  20287
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue Jun 17 01:23:55.361 2014 (UTC + 5:30)**************************
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+457ba )
 
BugCheck FC, {fffff90140a2a210, abc000015e081863, ffffd0002487aa30, 2}
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x000000FC"]ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)[/URL]
 
BUGCHECK_STR:  0xFC
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  bdagent.exe
 
FAILURE_BUCKET_ID:  0xFC_nt!_??_::FNODOBFM::_string_
 
MaxSpeed:     2200
 
CurrentSpeed: 2195
 
  BIOS Version                  8DCN26WW
 
  BIOS Release Date             09/23/2013
 
  Manufacturer                  LENOVO
 
  Product Name                  20287
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Jun 16 05:19:18.445 2014 (UTC + 5:30)**************************
Probably caused by : win32k.sys ( win32k!ValidateHwndEx+c5 )
 
BugCheck 3B, {c0000005, fffff960001dba35, ffffd0003a062f60, 0}
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x0000003B"]SYSTEM_SERVICE_EXCEPTION (3b)[/URL]
 
BUGCHECK_STR:  0x3B
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  mmc.exe
 
FAILURE_BUCKET_ID:  0x3B_win32k!ValidateHwndEx
 
MaxSpeed:     2200
 
CurrentSpeed: 2195
 
  BIOS Version                  8DCN26WW
 
  BIOS Release Date             09/23/2013
 
  Manufacturer                  LENOVO
 
  Product Name                  20287
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

If we check the blamed modules, we get the Windows Components blamed. Now, since the chance of Windows components being at fault is extremely low, it means that something else drove it into fault. One of the components blamed is the NETIO.sys which handles the Network in Windows to be precise. This means that some application fiddling with the Network caused the bugcheck.
Below is a list of drivers which you must update.

Code:

**************************Tue Jun 17 15:40:28.503 2014 (UTC + 5:30)**************************
[B][U]ew_usbenumfilter.sys        Sat Mar 20 08:38:08 2010 (4BA43C18)[/U][/B]
[B][U]ewusbmdm.sys                Tue Aug 16 14:47:45 2011 (4E4A35B9)[/U][/B]
[B][U]ew_jubusenum.sys            Fri Sep  9 09:21:01 2011 (4E698D25)[/U][/B]
[B][U]ewusbwwan.sys               Mon Nov 28 13:23:32 2011 (4ED33DFC)[/U][/B]
bdvedisk.sys                Thu Sep 27 19:07:29 2012 (50645699)
bdfwfpf.sys                 Wed Oct 17 17:42:10 2012 (507EA09A)
avchv.sys                   Wed Oct 31 22:35:22 2012 (50915A52)
AcpiVpc.sys                 Sun Feb 17 07:22:02 2013 (512037C2)
btmaux.sys                  Tue Apr 23 16:58:02 2013 (51767042)
Rt630x64.sys                Fri Jun 21 14:59:10 2013 (51C41CE6)
Apfiltr.sys                 Mon Jul  1 06:28:35 2013 (51D0D43B)
TeeDriverx64.sys            Wed Jul  3 00:08:08 2013 (51D31E10)
VMNET.SYS                   Fri Jul 19 01:12:50 2013 (51E8453A)
vmnetbridge.sys             Fri Jul 19 01:13:47 2013 (51E84573)
vsock.sys                   Thu Aug  1 08:16:10 2013 (51F9CBF2)
dump_iaStorA.sys            Fri Aug  2 07:09:52 2013 (51FB0DE8)
iaStorA.sys                 Fri Aug  2 07:09:52 2013 (51FB0DE8)
[U][B]trufos.sys                  Wed Aug  7 16:16:25 2013 (52022581)[/B][/U]
btmhsf.sys                  Mon Aug 19 13:51:07 2013 (5211D573)
RTKVHD64.sys                Wed Aug 21 10:18:22 2013 (52144696)
intelppm.sys                Thu Aug 22 14:16:35 2013 (5215CFEB)
gzflt.sys                   Fri Aug 23 16:18:49 2013 (52173E11)
ibtusb.sys                  Tue Sep 10 23:37:42 2013 (522F5FEE)
NETwbw02.sys                Thu Sep 19 13:10:12 2013 (523AAA5C)
nvlddmkm.sys                Tue Oct 29 03:08:03 2013 (526ED93B)
nvpciflt.sys                Tue Oct 29 03:08:28 2013 (526ED954)
[B][U]bdfndisf6.sys               Wed Nov 13 19:05:12 2013 (52838010)[/U][/B]
[B][U]avc3.sys                    Mon Dec  2 15:07:41 2013 (529C54E5)[/U][/B]
[B][U]avckf.sys                   Mon Dec  2 15:09:31 2013 (529C5553)[/U][/B]
hcmon.sys                   Fri Feb 28 08:10:28 2014 (530FF71C)
iwdbus.sys                  Fri Mar 14 03:29:14 2014 (53222A32)
vmnetuserif.sys             Tue Apr 15 03:37:57 2014 (534C5C3D)
vmx86.sys                   Tue Apr 15 05:01:39 2014 (534C6FDB)
igdkmd64.sys                Sat May 17 09:47:35 2014 (5376E2DF)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Jun 16 05:19:18.445 2014 (UTC + 5:30)**************************
gzflt.sys                   Thu Oct  4 17:00:19 2012 (506D734B)
[B][U]trufos.sys                  Wed Mar  6 17:17:58 2013 (51372CEE)[/U][/B]
[U][B]bdfndisf6.sys               Tue Apr  9 19:15:26 2013 (51641B76)[/B][/U]
[U][B]avc3.sys                    Fri Jul 19 19:08:03 2013 (51E9413B)[/B][/U]
[U][B]avckf.sys                   Fri Jul 19 19:11:15 2013 (51E941FB)[/B][/U]
iwdbus.sys                  Thu Jul 25 06:36:12 2013 (51F07A04)
nvlddmkm.sys                Sun Aug 18 23:51:08 2013 (52111094)
nvpciflt.sys                Sun Aug 18 23:51:33 2013 (521110AD)
igdkmd64.sys                Tue Sep 17 05:38:54 2013 (52379D96)

seif · Jun 17, 2014

re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Well that was a really great reply! Appreciated !

The thing is, I have two other laptops(not of the same model) , with the same windows version(windows 8.1 x64) and the same set of software installed such as the HUAWEI and the Bitdefender. They all work in harmony and peace. Could the software installed have problems because of this laptop specific model(drivers ) ?

And for the drivers, I installed all the available drivers from the manufacturer web site.

I bought it a week ago online from a well known webstore in the country, it came preinstalled, and with a lot of problems, so I had to send it back to them, then they claim to have changed the RAM and send it back to me, it come working but unstable showing these errors, should I send it back again to them or this is completely a software problem and not related to hardware.

-- I'm re-posting my reply here too :)

Thank you very much already, I really appreciate and high value the work you do .

Jared · Jun 17, 2014

re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

On top of what blueelvis has said I would like to do somewhat of an analysis, I can't do much given it's a minidump.

Specifically the second dump file which is this:

Code:

BugCheck [COLOR=#ff0000]FC[/COLOR], {[COLOR=#0000ff]fffff90140a2a210[/COLOR], [COLOR=#ff0000]abc000015e081863[/COLOR], ffffd0002487aa30, 2}

This bugcheck indicates an attempted execute of non executable memory has occurred, this is not allowed as it says, this memory cannot be executed.

Looking at the Page table Entries of the address abc000015e081863 I see this:

Code:

3: kd> [COLOR=#008000]!pte abc000015e081863[/COLOR]                                           VA abc000015e081863
PXE at FFFFF6FB7DBED000    PPE at FFFFF6FB7DA00028    PDE at FFFFF6FB40005780    PTE at FFFFF68000AF0408
contains 00C000015B4B9867  contains 046000015B53A867  contains 0000000000000000
GetUlongFromAddress: unable to read from fffff801b1b530f4
pfn 15b4b9    ---DA--UWEV  pfn 15b53a    ---DA--UWEV  [COLOR=#ff0000]not valid[/COLOR]


[COLOR=#ff0000]WARNING: noncanonical VA, accesses will fault ![/COLOR]

As far as I know this means that this address isn't allowed to be executed as it doesn't follow the normal rules of memory management.

Now this is where I have to attempt to make some educated guesses as memory management isn't my strong point although it is the most interesting, I do intend on learning more soon.
Anyway...

These are the CPU registers at the time of the bugcheck with the bugcheck stop error recorded in the rcx register.

Code:

3: kd> [COLOR=#008000]r[/COLOR]
rax=abc000015e081863 rbx=abc000015e081863 rcx=[COLOR=#ee82ee]00000000000000fc[/COLOR]
rdx=fffff90140a2a210 rsi=0000000000000008 rdi=0000000000000001
rip=[COLOR=#ffa500]fffff801b1953ca0[/COLOR] rsp=ffffd0002487a808 rbp=0000000000000003
 r8=abc000015e081863  r9=ffffd0002487aa30 r10=ffffd0002487aa30
r11=ffffe00009fba080 r12=fffff90140a2a210 r13=0000000000000002
r14=ffffd00021c2bc00 r15=fffff90140a2a210
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!KeBugCheckEx:

[COLOR=#ffa500]fffff801`b1953ca0[/COLOR] 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:[COLOR=#ff0000]ffffd000`2487a810[/COLOR]=00000000000000fc

I may be wrong but a memory write operation was meant to take place at ffffd000`2487a810 but instead wrote at fffff90140a2a210

fffff90140a2a210 Is the virtual address that contains non executable memory

The memory that should have been written to ffffd000`2487a810

Code:

3: kd> [COLOR=#008000]!pte ffffd000`2487a810[/COLOR]                                           VA ffffd0002487a810
PXE at FFFFF6FB7DBEDD00    PPE at FFFFF6FB7DBA0000    PDE at FFFFF6FB74000920    PTE at FFFFF6E8001243D0
contains 0000000000E25863  contains 0000000000E24863  contains 000000010F7D2863  contains 80000003EF287963
pfn e25       ---DA--KWEV  pfn e24       ---DA--KWEV  pfn 10f7d2    ---DA--KWEV  pfn 3ef287    -G-DA--KWEV

Is a completely valid address.

Looking at your loaded modules I see you have Intel Rapid Storage Technology installed which is unnecessary and problematic.

Code:

[COLOR=#ff0000]dump_iaStorA[/COLOR]

Uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

Right click on "my computer" icon and click "manage" on the context menu.
It will open the "computer management" window.
Select "Device Manager" in the left pane, It will list all the existing devices up.
Expand "Disc Drives" by clicking on the triangle in front of it.
Select one item under it, right click, uninstall.
Continue the process for all items under "Disc Drives"
Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

seif · Jun 18, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Bad news ... That did not work, I followed almost every step, I used some apps to check for my drivers, and I tried to remove unused ones, things got a little bit messy trying to install drivers that aren't provided by the manufacturer like Nvidia installing 3D Vision while my card doesn't support it, I even have problem with video games not playing sound.
New errors are appearing in the event viewer.Flash player and other apps are crashing randomly...
The weird thing that this more likely related to RAM, while the test is showing positive, could it be related to RAM voltage ?
Both RAMs are 1.5V and when I was researching in some forums, someone said that a Lenovo laptop with a Haswell CPU doesn't support 1.5V RAMs and it needs to be 1.35V RAMs.
Also when I sent it back to warranty I don't know if they have changed both RAMs or a single one, I guess that I bought a laptop with both RAMs not working, could that be a possibility ?
I am attaching a new dumb report file.
View attachment SF_18-06-2014.zip

Jared · Jun 18, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Code:

BugCheck 139, {[COLOR=#ff0000]3[/COLOR], ffffd0002065b6d0, [COLOR=#008000]ffffd0002065b628[/COLOR], 0}

This bugcheck indicates a Kernel security check failed because it found a critical kernel structure had been corrupt.
More specifically a list entry data structure which is caused by drivers or malicious code, however given that it's a stack overflow (Linked list) and not a buffer overflow I have a strong feeling that you have a virus.

It may well be that a driver has called a function too many times which allocates a stack frame each time until it runs out of memory and a stack overflow is caused.

Code:

EXCEPTION_RECORD:  ffffd0002065b628 -- (.exr 0xffffd0002065b628)ExceptionAddress: fffff801867ff95a (nt! ?? ::FNODOBFM::`string'+0x000000000002b7ba)
   ExceptionCode: c0000409 ([COLOR=#ff0000]Security check failure or stack buffer overrun[/COLOR])
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003

Use Kaspersky's TDSSKiller Anti Rootkit utility

Anti-rootkit utility TDSSKiller

Enable Driver Verifier

What is Driver Verifier?

Driver Verifier is a driver monitoring program built into Windows from Windows 2000 and later.
Depending on the settings Driver Verifier stresses the driver selected and tries to force them to crash which causes a BSOD.

How to enable Driver Verifier:

Go to Start
Type in verifier.exe
Click on Create customer settings (for code developers)
Select Standard settings and IRP Logging
Then hit next
Click Select driver names from a list
Select all drivers not created by Microsoft, Macrovision or Unknown
Finally click finish then reboot your computer

What happens if it finds something?

When Driver Verifier finds a violation with a driver it bugchecks the system hopefully with the driver responsible identified.

How long should I run it for?

Normally around 24 hours, if it finds nothing by then chances are it's not a driver issue.

Do I need to do anything in particular when running Driver Verifier?

No, just do what you normally do when the system crashes to help maximize the chances of a crash.

Patrick · Jun 18, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Hi,

I've been silently watching over and I thought I would mention that this looks like RAM to me. If Driver Verifier doesn't catch anything I would go ahead and run Memtest for no less than ~8 passes (several hours):

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Regards,

Patrick

seif · Jun 19, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

@Jared: No malware detected using the tool you provided. The system crashed twice after Driver Verifier have been enabled, I don't know how to identify if the crashes are because of the Verifier.I am attaching files here.View attachment SF_19-06-2014.zip.

@Patrick: I used memtest for about 8 hrs it only went through 2 pass's no probs detected but I have a strong feeling that the prob is related to RAM or other hardware problem because it is a new laptop and I am struggling to fix it in its very first week, I guess I'm going to send it to warranty, what do you think ?

Thank you guys for your participation, appreciated.

Patrick · Jun 19, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

I agree.

Since it is brand new, I would definitely send it in for replacement if that's something you're comfortable with doing. No laptop only a week old should crash like this.

Regards,

Patrick

blueelvis · Jun 19, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

Hi,

Seems like you have advanced further on your way to troubleshoot the problem which is a really good thing ^_^.

I just would like to add a possible cause as well. In 2 out of 6 of your Minidump files, the driver at fault are related to your Networking in Windows and they are Windows components so there is a very rare chance to blame them. I can see the presence of 2 such drivers which are extremely old. Below is the list of those 2 drivers :-

1. HUAWEI Mobile Connect - Bus Enumerate Device (ew_jubusenum.sys) - Dating to year 2011

2. Intel Watchdog Timer (ICCWDT.sys) - Dating to year 2010

@Seniors :- Is it possible that this Intel Watchdog Timer is creating the rest of the BSOD's?

@OP :- Please remove the Huawei Mobile Connect driver and software. Furthermore, could you please verify if the issue still persists in the Safe Mode (It can be accessed by pressing F8 {Most Likely, even though other keys according to your Motherboard are also possible)?

I think that if the issue still persists in the Safe Mode, then as Patrick mentioned that it might be a RAM related problem, but if not then there could be some other fault as well.

Regards,
Pranav

Jared · Jun 19, 2014

Re: Multiple BSODs in a new Lenovo Z510 Laptop - Windows 8.1 x64

The Intel Watchdog Timer isn't necessary and it may well be the cause although I'm not entire sure why there is such driver.

Looking at the technical documentation for the driver is basically says what a watchdog timer is, it's basically a way of monitoring the operating system to see if it's functioning correctly.
It sets a timer for it count down, once it's counted down it calls the other elements and can then be reset by the reaction logic.
The timer is set on a specific task which is then monitored for completion, if it's not been completed within the time interval specific action is taken.

I've never used or looked into this software before but I wouldn't recommend it at all, I would remove it.

Sending it back is probably the best solution but that's your call, if you decide you want to do memtest and other means of debugging then we can but it's looking more like bad RAM as Patrick mentioned.
In fact, looking at the dump files I see that Driver Verifier is enabled but it hasn't caught anything and Page Frame Numbers have been corrupted, although this is usually driver related bad RAM ca also cause such issues, with all this said I think sending it back and getting a replacement/refund would be better.

You mentioned the RAM had already been changed but it could be either incompatible or the DIMM slots could be bad.

The memory being referenced wasn't even valid so a bugcheck would have occurred anyway, even if the IRQL wasn't 2.

Code:

6: kd> [COLOR=#008000]!pte ffffc80110363b28[/COLOR]                                           VA ffffc80110363b28
PXE at FFFFF6FB7DBEDC80    PPE at FFFFF6FB7DB90020    PDE at FFFFF6FB72004408    PTE at FFFFF6E400881B18
contains 0000000000000000
[COLOR=#ff0000]not valid[/COLOR]

[Win8.1 x64] Multiple BSODs in a new Lenovo Z510 Laptop

seif

New member

blueelvis

BSOD Kernel Dump Senior Analyst

seif

New member

Jared

Sysnative Staff, BSOD Kernel Dump Expert

seif

New member

Jared

Sysnative Staff, BSOD Kernel Dump Expert

Patrick

Sysnative Staff

seif

New member

Patrick

Sysnative Staff

blueelvis

BSOD Kernel Dump Senior Analyst

Jared

Sysnative Staff, BSOD Kernel Dump Expert