Blue screen error

I've run the memory diagnostics tool, but that didn't return anything.

More interestingly, Reliability and Performance Monitor shows that there was an application configuration change on Google Update Helper the day before the first crash.

I don't really know what Google Update Helper does. Do I need it? I use Chrome as my main browser.

Blue screens are caused by faulty hardware or faulty hardware drivers.

To See if a Fix is Available

In Control Panel (and select Classic view in the left hand pane) choose Problem Reports and Solutions (type problem in Start's search box), go to Problem History, right click your error and choose Check For Solution. You may also right click and choose Details for more info. Post those details here.

To See if a Recent System Change Caused It

In Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then choose Reliability and Performance Monitor and choose Monitoring Tools then Reliability Monitor (type Reliability in search on Start) . This list is a chart of software installs, uninstalls, Windows updates, and crashes by date (scroll left to see earlier dates). See if your crashes started happening after you installed or uninstalled something.

Standard Hardware Troubleshooting

First lets test what hardware we can. Hardware faults can appear as many software faults, therefore we need to test hardware first..

Please do the following in order. Memory faults can cause disk corruption, disk faults can cause disk corruption. Disk corruption causes corrupted files (which SFC may be able to fix). If you get an hardware error stop and post back. Do not run chkdsk with faulty memory.

Memory Diagnostic

If you haven't run a memory diagnostic then please do so. Click Start - Control Panel - choose Classic View in left hand pane - choose Administrative Tools -  thenMemory Diagnostics Tool.

S.M.A.R.T

Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).

Disk drives in Windows monitor themselves for impending failure. The feature is called S.M.A.R.T. It will detect impending failure 30% of the time. In an elevated command prompt type (it's one line)

wmic /namespace:\root\wmi PATH MSStorageDriver_FailurePredictStatus get active,predictfailure,reason /format:List

If it's on Active will be true, if not on turn it on in the computer's BIOS.

Predict Failure should be False if everything's ok.

In Vista and later if SMART predicts failure Windows prompts the user to run Backup.

Run Chkdsk

In Computer right click all your drives and choose Properties, then Tools tab, then click Check Now. Tick BOTH checkboxes then Start. Reboot. This will take overnight.

SFC

Check for file corruption by clicking Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).

sfc /scannow

Heat

Heat can cause problems like this and also sudden reboots without crashing. Ensure your fans are not clogged with dust.

Processor (CPU)

Intel has a utility to check processors.

32 Bit Windows

https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=19791

64Bit Bit Windows

https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=19792

For Memory Diagnostic Results

Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at Event Viewer (Local) - Applications and Services - Microsoft - Windows - MemoryDiagnostic-Results for entries.

Look for EventID is 1201 or 1101 and Source is MemoryDiagnostic-Results

Double click the entry for details on that entry.

For Chkdsk Results

Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).

edit c:\bootex.log

Does this file exist with something in it?

The following commands query the event logs.

For boot time checking using source name for any Windows version (as it varies).

wmic /append:"%userprofile%\desktop\DiskEvents.html" PATH Win32_NTLogEvent where  (sourcename='Autocheck' or sourcename='Winlogon' or sourcename='WinInit') get /format:HForm

For running chkdsk within Windows.

wmic /append:"%userprofile%\desktop\DiskEvents.html" PATH Win32_NTLogEvent where (sourcename='Chkdsk') get /format:HForm

For warnings about disk problems detected during normal operations and automatic repairs made by Windows at the time the problems were discovered.

wmic /append:"%userprofile%\desktop\DiskEvents.html" PATH Win32_NTLogEvent where  (sourcename='NTFS' or Sourcename='Disk') get /format:HForm

Then to view the file created.

start "" "%userprofile%\desktop\DiskEvents.html"

Click Start - Control Panel (and select Classic view in the left hand pane) choose Administrative Tools then Event Viewer then look at both the Application and System logs (under Windows Logs) for entries.

Look for EventID is 7 and Source is Disk

Look for EventID is 11 and Source is Disk

Look for EventID is 50 and Source is Disk

Look for EventID is 51 and Source is Disk

Look for EventID is 52 and Source is Disk

Look for EventID is 55 and Source is NTFS

Look for EventID is 130 and Source is NTFS

Look for EventID is 134 and Source is NTFS

Look for EventID is 137 and Source is NTFS

Look for EventID is 1001 and Source is Autochk

Look for EventID is 1001 and Source is Winlogon

Look for EventID is 1001 and Source is WinInit

Look for EventID is 1001 and Source is Chkdsk

Look for EventID is 26212 and Source is Chkdsk

Look for EventID is 26213 and Source is Chkdsk

Look for EventID is 26214 and Source is Chkdsk

Double click the entry for details on that entry.

P.S. 7 and 55 are the auto repair codes where windows repairs disk errors silently on the fly. 52 is the SMART warning.

If the results don't get transferred to the event logs from a boot time chkdsk then the results are probably in the following file c:\Bootex.log. This file gets deleted when the results are moved into the event logs.

For SFC Results

Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator. Type (or copy and paste by right clicking in the Command Prompt window and choosing Paste).

findstr /c:"[SR] Cannot" %windir%\logs\cbs\cbs.log|more

This will see which files are corrupted.

To see if it did anything

findstr /c:"[SR] Repairing" %windir%\logs\cbs\cbs.log|more

There are frequent false positives for small text files Windows uses such as desktop.ini and settings.ini. Ignore these.

Did you run the memory test?

They seem completely unrelated to your first problems.

Try above steps.

Here's from one of your dumps (there were two of this type)

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\David Candy\AppData\Local\Temp\Temp1_dump3.zip\Mini122413-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*C:\tmp*http://msdl.microsoft.com/download/symbols;c:\tmp

Executable search path is:

Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 6002.18881.x86fre.vistasp2_gdr.130707-1535

Machine Name:

Kernel base = 0x8203e000 PsLoadedModuleList = 0x82155c70

Debug session time: Wed Dec 25 07:21:31.110 2013 (UTC + 11:00)

System Uptime: 0 days 2:57:16.873

Loading Kernel Symbols

...............................................................

................................................................

...........

Loading User Symbols

Loading unloaded module list

......

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 1b, 0, 820e54b5}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+14 )

Followup: MachineOwner

---

0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000000, memory referenced

Arg2: 0000001b, IRQL

Arg3: 00000000, bitfield :

 bit 0 : value 0 = read operation, 1 = write operation

 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 820e54b5, address which referenced memory

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from 82175874

Unable to read MiSystemVaType memory at 82155420

 00000000

CURRENT_IRQL:  1b

FAULTING_IP:

nt!KiUnwaitThread+14

820e54b5 8b08            mov     ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  82133aec -- (.trap 0xffffffff82133aec)

ErrCode = 00000000

eax=00000000 ebx=00000000 ecx=8863c6c0 edx=00000102 esi=8863c6c0 edi=8863c760

eip=820e54b5 esp=82133b60 ebp=82133b74 iopl=0         nv up ei pl nz na pe nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206

nt!KiUnwaitThread+0x14:

820e54b5 8b08            mov     ecx,dword ptr [eax]  ds:0023:00000000=????????

Resetting default scope

LAST_CONTROL_TRANSFER:  from 820e54b5 to 8208becd

STACK_TEXT: 

82133aec 820e54b5 badb0d00 00000102 820e8d61 nt!KiTrap0E+0x1c5

82133b74 820e7ef6 00000000 8213c2e0 00001760 nt!KiUnwaitThread+0x14

82133c88 820e7e21 82133cd0 82133d02 82133cd8 nt!KiTimerListExpire+0x76

82133ce8 820e8515 00000000 00000000 000a6776 nt!KiTimerExpiration+0x2a0

82133d50 820e677d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba

82133d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND:  kb

FOLLOWUP_IP:

nt!KiUnwaitThread+14

820e54b5 8b08            mov     ecx,dword ptr [eax]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiUnwaitThread+14

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  51da1840

FAILURE_BUCKET_ID:  0xA_nt!KiUnwaitThread+14

BUCKET_ID:  0xA_nt!KiUnwaitThread+14

Followup: MachineOwner

---

and

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Users\David Candy\AppData\Local\Temp\Temp1_dump3.zip\Mini122413-02.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*C:\tmp*http://msdl.microsoft.com/download/symbols;c:\tmp

Executable search path is:

Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Built by: 6002.18881.x86fre.vistasp2_gdr.130707-1535

Machine Name:

Kernel base = 0x8201f000 PsLoadedModuleList = 0x82136c70

Debug session time: Wed Dec 25 07:23:43.614 2013 (UTC + 11:00)

System Uptime: 0 days 0:01:12.347

Loading Kernel Symbols

...............................................................

................................................................

..........

Loading User Symbols

Loading unloaded module list

....

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {2b4, 2, 0, 8afb014b}

Probably caused by : CLASSPNP.SYS ( CLASSPNP!TransferPktComplete+13 )

Followup: MachineOwner

---

0: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 000002b4, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 8afb014b, address which referenced memory

Debugging Details:

---

READ_ADDRESS: GetPointerFromAddress: unable to read from 82156874

Unable to read MiSystemVaType memory at 82136420

 000002b4

CURRENT_IRQL:  2

FAULTING_IP:

CLASSPNP!TransferPktComplete+13

8afb014b 8b98b4020000    mov     ebx,dword ptr [eax+2B4h]

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  82114b74 -- (.trap 0xffffffff82114b74)

ErrCode = 00000000

eax=00000000 ebx=00000000 ecx=88353a00 edx=00000004 esi=86722480 edi=88353ac3

eip=8afb014b esp=82114be8 ebp=82114bfc iopl=0         nv up ei ng nz na pe nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286

CLASSPNP!TransferPktComplete+0x13:

8afb014b 8b98b4020000    mov     ebx,dword ptr [eax+2B4h] ds:0023:000002b4=????????

Resetting default scope

LAST_CONTROL_TRANSFER:  from 8afb014b to 8206cecd

STACK_TEXT: 

82114b74 8afb014b badb0d00 00000004 807af075 nt!KiTrap0E+0x1c5

82114bfc 820c60fb 00000000 88353a08 86722480 CLASSPNP!TransferPktComplete+0x13

82114c34 807ac35b 8672253c 8a204428 82114c64 nt!IopfCompleteRequest+0x11d

82114c44 807acd4a 8497b5e0 88353a08 8672253c ataport!IdeCompleteScsiIrp+0x31

82114c64 807aa020 8497b5e0 00000000 82114c94 ataport!IdeCommonCrbCompletion+0x44

82114c74 807aeef3 8497a0e0 8a204428 8a204428 ataport!IdeTranslateCompletedRequest+0x26

82114c94 807af12d 8497a0e0 8a204428 82117920 ataport!IdeProcessCompletedRequests+0x121

82114ce8 820c95a2 8497a09c 8497a028 00000000 ataport!IdePortCompletionDpc+0xab

82114d50 820c777d 00000000 0000000e 00000000 nt!KiRetireDpcList+0x147

82114d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND:  kb

FOLLOWUP_IP:

CLASSPNP!TransferPktComplete+13

8afb014b 8b98b4020000    mov     ebx,dword ptr [eax+2B4h]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  CLASSPNP!TransferPktComplete+13

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  49e01ee9

FAILURE_BUCKET_ID:  0xD1_CLASSPNP!TransferPktComplete+13

BUCKET_ID:  0xD1_CLASSPNP!TransferPktComplete+13

Followup: MachineOwner

---

0: kd> ln 82156874

(82156874)   nt!MmSystemRangeStart   |  (82156878)   nt!MmUserProbeAddress

Exact matches:

    nt!MmSystemRangeStart = <no type information>