Random BSODs with no pattern or consistent cause

[Veracity]

I have a Lenovo R61 Laptop that I purchased this Summer (the system specs should be visible under my name). About a week and a half ago I started to have BSODs at completely random times: about a minute after startup, some time after hitting the sleep key, and when I alt-tabed in Warcraft 3, those are the only three I can remember but there have been seven since they started. Also, I did not installed anything, hardware or software, for a few weeks before the BSODs. I also have had messages telling me that a registry file has been restored, and after logging in I randomly get a message telling me my system has recovered from a serious problem and do I want to send a report. The page the report pops up almost always talks about hardware or drivers being the cause.

I have:
run memtest for 32 hours (about a month and a half ago)
scanned with macafee, avast, spybot S&D, ad-aware, windows defender and malwarebytes (only windows defender and avast are installed)
run a disk check
defraged my HD
Searched online extensively, with no result
updated my system from lenovo and microsoft
called lenovo
run PC-doctor

The stop errors I have received are
0x0000000a
0x0000008e
0x00000050
0x0000001a

In Depth History
About two days after I received my computer I installed Elder Scrolls 4 Oblivion; It did not install properly and I started to get BSODs so I reformatted and everything was fine. About two weeks after the reformatting I installed Oblivion again, and I started to get BSOD again. I called lenovo and they had me send it in twice, once for the memory and once for the graphics card/system board, I believe that they replaced both the memory and the graphics card/system board and they updated my BIOS. The BSODs that I was receiving were rather random though they were more common when the game had been played recently. I ended uninstalling the game and the BSODs stopped happening, I reinstalled the game and the BSODs started again. I ended up just uninstalling the game and I was fine for the last month until they started again, oblivion has not been installed.

 

[Route44]

Those stop errors especially the 0x8E 0xA are very strong indications of hardware issues. Try running memtest again with your games uninstalled.

I also wonder if you have a heat issue. When playing games it puts a load on the GPU and increases heat.

 

[Bobbye]

We might also be able to troubleshoot the problem using the Event Viewer: Description of the Event Viewer:
Unfortunately, many Windows XP users aren't aware of the Event Viewer, what it is, where it is, how it can help with a problem:
The Event Viewer has logs for everything that happens on the computer. It has logs for Applications. It has logs for the System and it has logs for Security Audit.

There are three types of Events in the System and Apps logs:
1. Information (white circle w/blue i): this is just basic documentation of the normal working of the System or Apps.
2. Warnings (yellow triangle w/black exclamation mark) noting some problem at that moment. Warnings usually resolve on their own. If they do not, they become>>>
3. Errors (red circle w/white X- they document something that didn't work or isn't happening as it should. Each Errors has three parts: an ID#, a Source and a Description. By doing a right click> Properties, the Error will open to a screen that can be copied. These three parts taken together can usually lead to cause and resolution.

There are three sets of logs: System, Applications and Security. By opening the first two to display the Events, you can look for Errors that correspond to the time of the problem- in your case, the BSOD.

Do this on each the System and the Applications logs:
Click to open the log> look for the Error> right click on the Error> Properties> Click on Copy button, top right, below the down arrow and Paste here (Ctrl V)

You can ignore the Categories 1 and 2. If you have a recurring Error with same ID#, same Source and same Description, only one copy is needed. You don't need to include the lines of code in the box below the Description, if any.

 

[Veracity]

I will run memtest when I get a chance, should be this weekend. I will also post the event viewer in info, I have not had a BSOD in the last few days but there are still a lot of red Errors and a bunch of yellow warnings. I will post anything that I can find, especially if I get another BSOD.
Thanks for the help

 

[Bobbye]

You're welcome. Please follow direction for Event Viewer if you need further help.

 

[stevee10001]

sounds lucky

 

[Veracity]

Event viewer logs

Here are all the errors from both the applications and the system event viewer logs (attached). If you would like me to sort them in some way I can do that. Also in the security event viewer there are a lot of errors.

 

[Veracity]

new BSOD

I just received a new BSOD after I started my computer. Before I logged on I was given the message that a system registry file had been replaced by a copy from a log. About 10 seconds later I got the BSOD:
0x0000008E (0xC0000005, 0xBF8BBD10, 0xBA237B9C, 0x000000000)
win32k.sys - Address BF8BBD10 base at BF800000, Data stamp 48CE513A
nothing else was on the BSOD other than the standard info

 

[Bobbye]

It was not my intention to troubleshoot the entire system- just the Error corresponding to the times of the BSOD. But I weeded through the Application Errors:

Firefox is out of date, Update to either version 2.0.16 or v3.0.3
Event Source: Application Error/ Event ID: 1000
Description: Faulting application firefox.exe, version 1.9.0.3180, faulting module js3250.dll, version 4.0.0.0, fault address 0x0004725b.
Description: Faulting application firefox.exe, version 1.9.0.3188, faulting module npswf32.dll, version 9.0.124.0, fault address 0x00002496.

See this for the ESENT Errors: http://support.microsoft.com/kb/910437
Event Source: ESENT/ Event ID:490
Description: svchost (1608) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" for read / write access failed with system error 32
(0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8).

Event Source: ESENT/ Event ID: 474/ Event Categoryatabase Page Cache
Description: wuauclt (3112) The database page read from the file "C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb" at offset 2904064 (0x00000000002c5000) for 4096 (0x00001000) bytes failed verification due to a page checksum mismatch. The expected checksum was 3532816544 (0xd29280a0) and the actual checksum was 3536683168 (0xd2cd80a0). The read operation will fail with error -1018 (0xfffffc06). If this condition persists then please restore the database from a previous backup.

Event Source: ESENT/ Event ID: 477/ Event Category: Logging/Recovery
Description: wuauclt (4084) The log range read from the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" at offset 46592 (0x000000000000b600) for 18432 (0x00004800) bytes failed verification due to a range checksum mismatch. The read operation will fail with error -501 (0xfffffe0b). If this condition persists then please restore the logfile from a previous backup.

Event Source: Application Error/ Event ID: 1000
Microsoft Windows Defender Antispyware> can be caused by the beta version. Uninstall the beta, install the full version.
Description: Faulting application MsMpEng.exe, version 1.1.1593.0, faulting module mpengine.dll, version 1.1.4005.0, fault address 0x001855a1.

McAfee`s Internet Security suite> "scanned with macafee, avast" Remove one of these antivirus programs.
Description: Faulting application Mcshield.exe, version 13.3.1.100, faulting module McScan32.dll, version 5.300.0.2777, fault address 0x0002af80.

Disable this if you are not using it. If you keep it, take it off of Startup.
ThinkVantage Productivity Center Manager from Lenovo.
Event Source: Application Error/ Event ID: 1000
Description: Faulting application lpmgr.exe, version 2.21.0.0, faulting module unknown, version 0.0.0.0, fault address 0x003fe4d0.

I'll check the System Errors a little later.

 

[Veracity]

Thanks for the help and looking at the problems. I put all the Errors into the file because I do not know what errors correspond to the BSODs. The System file is the same way, every error is in there, though there are some that have the same codes a the BSODs in their description.

 

[Bobbye]

I do not know what errors correspond to the BSODs.

TIP: When you get the BSOD, look at computer clock. Events are all time coded. Find Errors corresponding to time of BSOD.

Later on the System Events.

 

[Veracity]

I will look at the system clock next time. I have gotten two BSOD today and neither of them has created an error report, I posted the info on one

0x0000008E (0xC0000005, 0xBF8BBD10, 0xBA237B9C, 0x000000000)
win32k.sys - Address BF8BBD10 base at BF800000, Data stamp 48CE513A

and the other had no info other than that its a 0x0000000a stop error.

 

[Veracity]

I keep on getting the message that a registry file has needed to be recreated, which it has done successfully, when I boot up my computer. I have also gotten a 0x8e stop error twice now very shortly after receiving the message about the registry file. Does anyone know if this is a really bad sign, and should I just live with it while we try to fix the problem or should I restore to a backup that was made before the BSODs started to happen
Thanks for any info that you can give.
Veracity

 

[Bobbye]

TIP: When you get the BSOD, look at computer clock. Events are all time coded. Find Errors corresponding to time of BSOD.

Did you work through the Event Errors instructions I left for the Applications?

Again, I remind you: IF you get an error message, if you get a BSOD, look at the clock for time. Then check both Apps and System logs in the Event Viewer for the Error that corresponds to that time. Copy and paste here.

I cannot tell where the problem may be because you copied the Event log. I need to know what is happening at the time of the Error. You also show both Avast and McAfee errors. That means you're running two antivirus programs. Get rid of one- they can cause a conflict. There is also the problem with Windows Defender.

You have included Error for drivers that aren't starting in Safe Mode. Technically, these aren't errors because they aren't suppose to start in Safe Mode.

Please be selective in the Errors you copy here. It's an easy procedure and will do a lot more good that dropping part of the error message without the rest of the information! The Event logs have 3 pieces of information: Each Event has an identification number, a Source and a Description. Taken together, this is useful in finding the cause and resolution.

 

[Veracity]

After every time I get a problem I look in the event viewer and there is nothing other than the normal info, no yellow or red logs. Sorry about all the random errors I did not know what they corresponded to so I just posted every error in the event viewer. The reason I have errors from Macafee and Avast is that I had Macafee installed, it was having problems so I uninstalled it and installed Avast, they were never installed at the same time. I have also uninstalled Windows defender because it was having problems.

 

[Bobbye]

Please run HijckThis so I can get an idea of what;'s loading. This is NOT the correct use of this program! But it's the best and quickest way for me to see what is loading and try to find a potential for the conflict:

Highjackthis Instructions:
* Make sure you have the LATEST version of HJT (currently v2.0.0.2) it can be downloaded from:
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
* Run the HijackThis Installer and it will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe. Please don't change the directory.
* After installing, the program launches automatically, select Scan now and save a log
* After the scan is complete attach the log here;

How to Attach the log:

https://www.techspot.com/vb/topic19133.html

If I see anything there to indicate possible malware, I will ask you to run additional programs. Please be sure you have done the following:

From the Event Viewer:
1.Firefox is out of date, Update to either version 2.0.16 or v3.0.3
2.See this for the ESENT Errors: http://support.microsoft.com/kb/910437
3.Uninstall Microsoft Windows Defender Antispyware beta, wait on installing full version. (done)
4.This error is from McAfee:
Description: Faulting application Mcshield.exe, version 13.3.1.100, faulting module McScan32.dll, version 5.300.0.2777, fault address 0x0002af80.Was it before you uninstalled it?
5. Disable this if you are not using it. If you keep it, take it off of Startup.
ThinkVantage Productivity Center Manager from Lenovo.

I checked the System Errors to see if I could come up with a 'picture', and this is where it points:

Error code 1000008e> system error 1003>>faulty hardware or drivers. The hardware varies from modems, video cards, USB device to memory or sound cards. Sometimes it proves to be hardware that it is not compatible with Windows XP
Error code 10000050> sys. er. 1003>> potential hardware problems or device drivers that are incompatible with the current hardware (occurring sometimes after a service pack updates the drivers).
Error code 1000000a>> sys, 1003>> potential hardware or drivers.

Troubleshooting Stop messages, such as 0x0A and 0x50:
* If you’ve recently added new hardware, remove it and retest.
* Run hardware diagnostics supplied by the manufacturer.
* Make sure device drivers and system BIOS are up-to-date.
* However, if you’ve installed new drivers just before the problem appeared, try rolling them back to the older ones.
* Open the box and make sure all hardware is correctly installed, well seated, and solidly connected.
* Confirm that all of your hardware is on the Hardware Compatibility List. If some of it isn’t, then pay particular attention to the non-HCL hardware in your troubleshooting.
* Check for viruses.
* Investigate recently added software.
*. Examine (and try disabling) BIOS memory options such as caching or shadowing.
Source: Microsoft Troubleshooting

The System Errors showed the following:
1. #7022/ Service Control Manager:The avast! Antivirus service hung on starting> may not be properly configured..May need to be reinstalled.

 

[Veracity]

Here is the HJT log. A friend in my dorm told me that I should investigate all the start up programs and disable the ones that I did not need, I did this but I did not restart before running HJT, so my changes should not have taken place.

Those stop errors especially the 0x8E 0xA are very strong indications of hardware issues. Try running memtest again with your games uninstalled.

I also wonder if you have a heat issue. When playing games it puts a load on the GPU and increases heat.

Also I ran memtest for about 36 hours approx. 90 passes, it came up with two errors one on pass 38 and one on pass 55. according to my friend the errors could be do to the fact that memtest ran for so long. If you would like more info on the errors just say so and I will post it.

 

[Bobbye]

You are using numerous ThinkPad and Lenova processes. They are all legitimate processes, but you also have processes running for the following programs: Bradford Networks\Client Security Agent and LPMailChecker plus Avast..

I think you need to examine the use and running of all of these processes. I am nor sure if there is overlap in the security area, mostly with functions of Avast. The might be the possible conflict I mentioned with programs running in Real Time. Unfortunately, the more, the better doesn't work well- it causes of conflicts that will actually lower your security coverage,

Have HijackThis remove this entry: Reopen HijackThis> scan only> Check the process
[O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)Vaild but no file
Close HijackThis and all other Widows, click on Fix Checked and reboot into Safe More.

Start> Run> type in 'msconfig' without quotes> enter> Selective Startup> UNCHECK all processes except the antivirus, firewall, touchpad for laptop> Apply> OK.

Reboot into Normal Mode. You will get a nag message that you can just close after checking 'don't show this message again'. Stay in Selective Startup.

 

[Veracity]

A few days ago I was having some weird problems and so I ran memtest again and after about 24 passes it came up with 5500 errors. I have removed the RAM chip that I believe is the bad one and so far my computer seems normal. I am going to get the RAM replaced. Thank you so much for all the help, If anything new comes up I will post on here again. Thanks again
Veracity

 

[CCT]

On top of Bobbyes excellent help, now you seem to be 'Clean' and fixed, you have a SLEW of crap remnants on your comp from old stuff.

Were I you, I'd do a clean install and start FRESH.

Anyway, just an opinion.