# bsod crash (Memory management?)



## weepigeonface (Mar 19, 2009)

Hi all, 

Avg recently removed Trojan generic13.AZYO. Ever since then My laptop (fujitsu Siemens Amilo Li 2727 running vista home basic) has been crashing. Sometimes I get bsod and a restart sometimes system just freezes (mouse pointer moves but cannot click anything or get task manager) and I have to force shut down. When system reboots sometimes it does check disk sometimes not. I originally posted in the Malware forum but my logs are clean. Tetonbob advised that problems may be due to lack of disk space (had less than 1GiB free) but with his advice I managed to clear up about 13 GiB. System was running ok and I thought problems were gone as I had laptop running for several hours last night with no incident. Today, However, I cannot get any more than 10 minutes of usage before a crash. Please Help!!!!

Laura


----------



## joeten (Dec 4, 2008)

hi first turn off auto restart http://pcsupport.about.com/od/windowsvista/ht/arestartvista.htm you can then get the error code and post it


----------



## weepigeonface (Mar 19, 2009)

Hi joeten, 

Thanks in advance for any help. 

Just managed to turn off the automatic restart before it crashed again (I'm using another computer just now). 

The blue screen technical information was as follows:

*** STOP: 0x0000008E (0xc0000005, 0x8B1F1C7F, 0xA9357920,0x00000000)
*** luafv.sys - Address 8B1F1C7F base at 8B1E2000, Datestamp 47918afb

Hope this means something to you !

Regards Laura


----------



## weepigeonface (Mar 19, 2009)

Tried to boot up again and got this message:

KERNEL_STACK_INPAGE_ERROR

Tech Info:
*** STOP:00000077 (0x00000001, 0x00000000, 0x00000000, 0x805F0C70)

Physical memory dump failed with status 0xC000009C

I will leave my laptop off until I recieve further instruction. 

Laura


----------



## Old Rich (May 31, 2007)

The first error message looks to be memory faults. . you can click on the link to Memtest in my signature for a good memory tester

Also see this: http://support.microsoft.com/kb/315335

For the second error see this: http://support.microsoft.com/kb/315266


----------



## weepigeonface (Mar 19, 2009)

Sorry to be really thick but what link do I click in the mem tester? 

Also the other links seem to pertain to xp. What do I actually need to do to fix this? Again apologies for knowing nothing. 

Laura


----------



## Old Rich (May 31, 2007)

If you have a floppy dirve, click the Precompiled Package for floppy and put it on a floppy disc

If you want to burn a CD, click the Precompiled Bootable ISO (zip ) and burn the image to a cd

Look thru the top part of the page for more on how to use it.

Also look thru this tutorial: http://www.techspot.com/vb/topic62524.html


----------



## weepigeonface (Mar 19, 2009)

I have winRAR but it says not to use this. What Should I use? I am genuinely no good at this stuff and don't even understand half of it. Sorry


----------



## Old Rich (May 31, 2007)

What do you want to do . . floppy disc or CD?


----------



## usasma (Apr 11, 2009)

The first crash dump refers to luafv.sys - which is a component of Norton's Live Update. It's possible that the virus has corrupted your Norton installation. I'd suggest uninstalling your Norton using the Norton Removal Tool (free).

Make sure you have another program to protect your system as soon as you remove the Norton (so download it before you start). You can download the Norton Removal Tool from here: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039


----------



## weepigeonface (Mar 19, 2009)

I don't have any Norton products installed (i did a double check on my programs and there is nothing there) I got rid of it ages ago and currently run AVG 8.5 

???? :4-dontkno


----------



## Old Rich (May 31, 2007)

You seem to have remnanst of Norton left . . run the Norton removal tool usasma reccomended.


----------



## jcgriff2 (Sep 30, 2007)

weepigeonface said:


> *** STOP: 0x0000008E (0xc0000005, 0x8B1F1C7F, 0xA9357920,0x00000000)
> *** luafv.sys - Address 8B1F1C7F base at 8B1E2000, Datestamp 47918afb
> 
> 
> ...


Hi - 

I would like to add that these 2 bugchecks along with the parms indicate to me that you may have a problem with your hard drive.

The bugcheck *0x8e* with the 0xc0000005 exception = kernel mode app encountered a memory access violation. The probable cause listed is the Microsoft LUA file Virtualiztion filter driver*luafv.sys* - it virtualizes files that an app tried to write to a folder that it should not have (like \ProgramData). The end result is the redirection to the user profile virtual store area.

The *0x77* bugcheck = requested page of kernel data from the paging file could not be read into memory. The 1st parm 0x1 = the page was retrieved from a disk. Add to this the last quoted line from your post - 

```
Physical memory dump failed with status 0xC000009C
```
The system could not write the memory dump because of possible bad blocks (sectors) on the hard disk. The latter is the literal definition of the NT STATUS code 0xc000009c.

Run *chkdsk /r* - then reboot when it gives message

Regards. . .

jcgriff2

.


----------



## joeten (Dec 4, 2008)

hi also run the memtest just to check.i would take the option for burning to a disc you can use img burn to do that http://www.imgburn.com/index.php?act=download use any of the mirror links to download it


----------



## weepigeonface (Mar 19, 2009)

Sorry, I have been away for a few days. Which Norton removal tool should I use? When I click the link it gives me a list of Norton products. I have no idea which one was originally there so don't know which option to choose.


----------



## Old Rich (May 31, 2007)

try the first one . . I think they are all the same


----------



## usasma (Apr 11, 2009)

AFAIK all the Norton Removal Tools are the same - the differences are in the instructions that Symantec will give you to save your license information.


----------



## weepigeonface (Mar 19, 2009)

Hello all!

After running the Norton Removal tool and rebooting my computer ran check disk. Since then I have been using my laptop with no troubles at all (touch wood!). I am hoping that all is well. I would like to thank everyone for their help and advice. Could anyone suggest what caused the problems in the first place? Obviously want to ensure this doesn't happen again. 

Thanks Again 
Laura


----------



## Old Rich (May 31, 2007)

Hard to say . . Norton does not play well with others and may have been competing for resources with you other anti-virus.


----------



## weepigeonface (Mar 19, 2009)

Spoke to soon!

Still having error KERNAL_STACK_INPAGE_ERROR

Windows gives this info

Problem signature:
Problem Event Name:	BlueScreen
OS Version:	6.0.6001.2.1.0.768.2
Locale ID:	2057

Additional information about the problem:
BCCode:	1a
BCP1:	00000030
BCP2:	80E23128
BCP3:	AF63E000
BCP4:	80D270BC
OS Version:	6_0_6001
Service Pack:	1_0
Product:	768_1

Files that help describe the problem:
C:\Windows\Minidump\Mini062209-01.dmp
C:\Users\Laura\AppData\Local\Temp\WER-133708-0.sysdata.xml
C:\Users\Laura\AppData\Local\Temp\WERF890.tmp.version.txt

Any suggestions on how to fix this would be greatly appreciated as it is starting to really get me down. 

Laura


----------



## usasma (Apr 11, 2009)

2 different BSOD's
The KERNAL_STACK_INPAGE_ERROR is a STOP 0x77, while the error message is for a MEMORY_MANAGEMENT (STOP 0x1a).

The STOP 0x1a is a memory error, while the STOP 0x77 is a pagefile error (with the emphasis on hardware errors for both.

So, try this:
- Memory diagnostic: http://usasma.vox.com/library/post/bootable-memory-test-diagnostics.html
- Hard drive diagnostic: http://usasma.vox.com/library/post/bootable-hard-drive-diagnostics.html
- Startup repair (to fix any file system errors): http://www.bleepingcomputer.com/tutorials/tutorial148.html
- reset the pagefile: http://usasma.vox.com/library/post/deleterecreate-the-pagefile.html

If everything passes/completes successfully, then we'll move on to other diagnostics.


----------

