[SOLVED] A whole range of BSoDs

niemiro · Mar 12, 2012

Hello all!

I am posting here rather than at TSF because I want to be the first person to be helped in this forum. I actually do have a BSoD problem. This isn't a wind up or anything!

I have actually had it for quite a while, but I haven't had the time to deal with it until now. I have looked through the dumps, but I can't see anything obvious, although I am no expert (my user title is wrong!) and maybe you guys can work some trickery on them to reveal their secrets.

I tried Driver Verifier, and that didn't reveal any additional clues in the minidumps, except for increasing the frequency of the BSoDs, so I turned it back off. If there are better settings to use, then I would love to hear them (I think I just turned them all on, except for Low Resource Simulation, for all non-MS drivers).

These minidumps all look infuriatingly like they need a full kernal dump to analyse from, however, it isn't being created. I believe that this is because I have 16GB memory (

) and only 14.7GB of free space on my small C:\ SSD???

Additonally, I built that machine myself a good few months back, and the BSoDs have occured right from the very start. I am concerned that it might be caused by some piece of hardware.

Whilst I attempt to free up space on my C:\ drive, if any of you could offer any assistace on the minidumps and everything else in the report, I would be immensely grateful.

Code:

[FONT=verdana][COLOR=#000000][B]·[/B] OS - Vista/ Windows 7 ? [B]Windows 7
·[/B] x86 (32-bit) or x64 ? [B]x64[/B]
[B]·[/B] What was original installed OS on system? [B]No, I manually installed it (home built machine)
·[/B] Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? [B][COLOR=#000000]I bought it from a retailer, and manually installed it, but I bought an OEM copy. [/COLOR]
·[/B] Age of system (hardware) [B]About 6 months
· [/B]Age of OS installation - have you re-installed the OS? [B]About 6 months

· [/B]CPU [B]Intel Core i7 2600k
· [/B]Video Card [B]Sapphire AMD Radeon HD 6850 Vapor-X
· [/B]MotherBoard [B]ASUS P8Z68-V PRO
· [/B]Power Supply - [B]brand & wattage Corsair Professional Series HX750/HX850 -- 750W or 850W (I can't remember! Need to look it up if you want to know! Sorry!) 
[/B]
[B]·[/B] System Manufacturer [B]Home built
·[/B] Exact model number (if laptop, check label on bottom) [B]N/A[/B][/COLOR][/FONT]

Thanks a lot :)

Richard

Wrench97 · Mar 12, 2012

Have you run Memtest+ on it yet?
D/L Memtest+ burn it to a CD using a free program like Imgburn if you need one then boot from the CD to test the ram, let it run for at least 6 passes or until you see an error.

What Brand and model is the ram?
Are you running the Bios setting for the Ram on auto or did you manually set the speed, timing and voltage?

Vir Gnarus · Mar 13, 2012

For DV, make sure to turn off IRP Logging and Force Pending I/O Requests. The latter will give you false positives like Low Resource Simulation, and the former is very good stuff but can only be accessed through live kernel debugging, so unless you wanna try your hand at it don't bother.

niemiro · Mar 13, 2012

Wrench97 said:
Have you run Memtest+ on it yet?
D/L Memtest+ burn it to a CD using a free program like Imgburn if you need one then boot from the CD to test the ram, let it run for at least 6 passes or until you see an error.

What Brand and model is the ram?
Are you running the Bios setting for the Ram on auto or did you manually set the speed, timing and voltage?

I haven't actually run Memtest86+ recently (I have, the night I finished building it as a test, but not recently). I shall run it overnight sometime in the next few days and report back.

I am hoping that it isn't the RAM, because whilst researching, I discovered that Scan had an excellent Today Only offer on that day which actually made it cheaper for me to purchase the motherboard, CPU, RAM and heatsink I wanted in a bundle together, which means that if even one stick of RAM is bad, I will have to return all of those components. However, I can't deny facts, and if the test fails, the test fails!

The RAM is not overclocked (nothing in my system is overclocked), and is set at "auto" in the BIOS.

The RAM is: 16GB (4x4GB) Corsair Vengeance LP, DDR3, 1600Mhz.

Vir Gnarus said:
For DV, make sure to turn off IRP Logging and Force Pending I/O Requests. The latter will give you false positives like Low Resource Simulation, and the former is very good stuff but can only be accessed through live kernel debugging, so unless you wanna try your hand at it don't bother.

I shall give another attempt at DV, with the proper settings, and a more empty C:\ drive, and see what happens and report back.

Thank you both very, very much for your response.

Vir Gnarus · Mar 13, 2012

This is very interesting. In a good bit of your crashdumps, they involve a fault in the function nt!MiReplenishPageSlist (which I believe is done when freeing memory as you can tell from the rest of the stack). Even more curious is the fact that in all these cases where this is involved, the same memory address is addressed, which is bffffa80`087bcf10. Immediately you should tell that this is a bad address as it has a 'b' at the end of it. However, the fact it's always the same exact address, being performed by the same function, is very bewildering.

I did a bit of disassembly, and now I'm even a bit more befuddled about it. Here's what I mean:

Code:

2: kd> .cxr 0xfffff8800c52aed0
rax=04000000002cfafb rbx=bffffa80086f0f10 rcx=0000058000000000
rdx=0000000000000050 rsi=000000000000000e rdi=0000000000000002
rip=fffff800032a2f00 rsp=fffff8800c52b8b0 rbp=fffffa80087be710
 r8=fffff800034b24c0  r9=fffffa800cbfa000 r10=fffffa800cbfb358
r11=fffff88003565180 r12=fffff800034b24c0 r13=2aaaaaaaaaaaaaab
r14=fdffffffffffffff r15=0000058000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MiReplenishPageSlist+0xc0:
[COLOR=#ff0000]fffff800`032a2f00[/COLOR] f00fba6b1000    lock bts dword ptr [[COLOR=#ff0000]rbx+10h[/COLOR]],0 ds:002b:[COLOR=#ff0000]bffffa80`086f0f20[/COLOR]=????????

So the instruction at fffff800`032a2f00 referenced the bad address by getting what's in the rbx register, adding 10h to it, and then using that as an address. As you can tell in the short list of general registers that rbx does in fact have that oddball address with the 'b' in it, but how did it get it? Time to disassemble starting from the bad instruction and working upwards (backwards):

Code:

fffff800`032a2ef6 48895c2420      mov     qword ptr [COLOR=#0000cd][rsp+20h[/COLOR]],[COLOR=#006400]rbx     < [I]rbx moved into spot where rsp+20h directs too.[/I][/COLOR]
fffff800`032a2efb 33ed            xor     ebp,ebp
fffff800`032a2efd 4c8bf9          mov     r15,rcx
fffff800`032a2f00 f00fba6b1000    lock bts dword ptr [[COLOR=#006400]rbx[/COLOR]+10h],0     [COLOR=#006400][I]< bad instruction[/I][/COLOR]

Fortunately whatever was in the rbx register was slapped into the stack (hence using rsp, or stack pointer register), and since the minidumps retain the faulting stack, we should be able to get the value. So let's see what's stuffed there that rbx placed onto the stack:

Code:

2: kd> dq @[COLOR=#0000cd]rsp+20[/COLOR]
fffff880`0c52b8d0  [COLOR=#4b0082]fffffa80`086f2710[/COLOR] 00000000`00000000
fffff880`0c52b8e0  00000000`0000007b 00000000`002cfbfb
fffff880`0c52b8f0  fffff880`0c52b980 00000000`0000007f
fffff880`0c52b900  00000000`00000000 fffffa80`086f3f10
fffff880`0c52b910  fffffa80`0cbfb338 fffff800`032a16bf
fffff880`0c52b920  fffffa80`0cbfb338 00000000`0000007b
fffff880`0c52b930  fffffa80`086f3f10 00000000`0000007b
fffff880`0c52b940  fffffa80`0cbfb400 00000000`00000001

So this is the address that was grabbed from the rbx register. It looks similar, but not much the same, as the bad address. Let's compare the two bit-wise. Remember that the bad address wasn't originally made just straight from the rbx register. Rather, the instruction also added 10h to it and then used the result as the memory address. So to imitiate what should have happened, let's add 10h to the address in the stack and then compare that to the bad address:

Code:

2: kd> .formats [COLOR=#4b0082]fffffa80`086f2710[/COLOR]+10;.formats[COLOR=#ff0000] bffffa80`086f0f20[/COLOR]
Evaluate expression:
  Hex:     [COLOR=#4b0082]fffffa80`086f2720[/COLOR]
  Decimal: -6047172450528
  Octal:   1777777650001033623440
  Binary:  1[COLOR=#4b0082]1[/COLOR]111111 11111111 11111010 10000000 00001000 01101111 [COLOR=#4b0082]00100111[/COLOR] 00100000
  Chars:   .....o' 
  Time:    ***** Invalid FILETIME
  Float:   low 7.19674e-034 high -1.#QNAN
  Double:  -1.#QNAN
Evaluate expression:
  Hex:     [COLOR=#ff0000]bffffa80`086f0f20[/COLOR]
  Decimal: -4611692065599844576
  Octal:   1377777650001033607440
  Binary:  1[COLOR=#ff0000]0[/COLOR]111111 11111111 11111010 10000000 00001000 01101111 [COLOR=#ff0000]00001111[/COLOR] 00100000
  Chars:   .....o. 
  Time:    ***** Invalid FILETIME
  Float:   low 7.19392e-034 high -1.99983
  Double:  -1.99866

As you can tell, from bits, they look reeeeeeally close to each other. However, aside from the 'b' at the end, the second octet in each number doesn't look close. I can't tell how from hardware how both a bit would be removed and then one set a couple digits away, almost as if it was shifted over a little. I guess this could happen from hardware, but then why is it that this exact same address is referenced in multiple crashdumps using the same function? I'm puzzled. Maybe I'm missing something here based on my lack of knowledge.

Btw, just so you know, I went ahead and dumped the raw stacks for some of your crashdumps and noticed they involved your graphics drivers in an attempt to draw something. I found they're dated from Dec 2011 so you may wanna look at updating em. Go ahead and run Prime95 and Memtest as well, just to be safe.

usasma · Mar 14, 2012

Just my 2¢:
Ensure SSD firmware is fully updated
Do not use Marvell controller with SSD if at all possible (have seen too many problems with SSD's on this controller)
Ensure that any other controller is fully updated from the controller manufacturer's website ( http://downloadcenter.intel.com )

Win7 doesn't like wireless USB devices. Especially if using an upgraded Vista driver it will surely cause BSOD's (yours dates from 2007).
Re-enable it, then uninstall the software and remove (uninstall) the device in Device Manager (it's not being used according to systeminfo.txt) FYI - the NetGear Wizard is still loading at startup.

Found ATITool in the programs - it's a known cause of BSOD's in Win7 systems: http://www.carrona.org/drivers/search.php?id=atitool Are you overclocking your video card? If so, have you run Furmark on it since overclocking it?

I notice that there were no memory dumps in February. What was done differently before and after?
Running the 8 memory dumps from March.....

Older drivers: Need updating or removing.
PxHlpa64.sys Fri Feb 02 16:24:22 2007 (45C3AC06) - belongs to a CD/DVD program, uncertain which one

scmndisp.sys Wed Jan 17 02:48:03 2007 (45ADD4B3) - belongs to NetGear wireless stuff (makes the Wireless adapter the prime suspect IMO)

VMNetSrv.sys Wed Jan 16 06:52:01 2008 (478DEFE1) - belongs to VMWare
vmm.sys Tue Feb 12 06:38:20 2008 (47B1852C) - belongs to VMWare

Further info on BSOD error messages available at: http://www.carrona.org/bsodindx.html

The following info is just FYI, I've already addressed the issues that I saw in the above paragraphs
3RD PARTY DRIVERS PRESENT IN THE DUMP FILES

Code:

[font=lucida console]
dsfksvcs.sys     Mon Feb 08 23:06:20 2010 (4B70DF3C)
DSFOleaut32.sys  Mon Feb 08 23:06:19 2010 (4B70DF3B)
jraid.sys        Tue Aug 10 05:28:44 2010 (4C611BCC)
VBoxDrv.sys      Mon Dec 19 07:43:53 2011 (4EEF3189)
iaStor.sys       Tue Mar 22 21:53:28 2011 (4D895298)
MpFilter.sys     Tue Feb 21 00:28:43 2012 (4F432B8B)
PxHlpa64.sys     Fri Feb 02 16:24:22 2007 (45C3AC06)
vmm.sys          Tue Apr 07 09:25:54 2009 (49DB5462)
ElbyCDIO.sys     Thu Dec 16 17:58:13 2010 (4D0A9985)
mv91xx.sys       Fri Aug 27 05:49:22 2010 (4C778A22)
mvxxmm.sys       Fri Aug 27 05:49:03 2010 (4C778A0F)
amdxata.sys      Fri Mar 19 12:18:18 2010 (4BA3A3CA)
VBoxUSBMon.sys   Mon Dec 19 07:43:53 2011 (4EEF3189)
vpcnfltr.sys     Sat Nov 20 06:35:20 2010 (4CE7B278)
vpcvmm.sys       Sat Nov 20 06:35:48 2010 (4CE7B294)
scmndisp.sys     Wed Jan 17 02:48:03 2007 (45ADD4B3)
dsfroot.sys      Mon Feb 08 23:06:12 2010 (4B70DF34)
speedfan.sys     Fri Mar 18 12:08:46 2011 (4D83838E)
atikmpag.sys     Tue Feb 14 21:13:12 2012 (4F3B14B8)
windrvr6.sys     Tue Aug 31 07:15:04 2010 (4C7CE438)
VBoxNetAdp.sys   Mon Dec 19 07:43:53 2011 (4EEF3189)
VClone.sys       Sat Jan 15 11:21:04 2011 (4D31C970)
dump_iaStor.sys  Tue Mar 22 21:53:28 2011 (4D895298)
atikmdag.sys     Tue Feb 14 21:51:52 2012 (4F3B1DC8)
btath_a2dp.sys   Thu Sep 16 07:34:42 2010 (4C9200D2)
btath_rcp.sys    Thu Jun 24 02:17:21 2010 (4C22F871)
AtihdW76.sys     Tue Dec 06 04:14:25 2011 (4EDDDCF1)
VBoxNetFlt.sys   Mon Dec 19 07:43:51 2011 (4EEF3187)
btath_bus.sys    Thu Jun 24 02:17:43 2010 (4C22F887)
vpcusb.sys       Sat Nov 20 06:35:31 2010 (4CE7B283)
usbrpm.sys       Sat Nov 20 06:37:19 2010 (4CE7B2EF)
vpchbus.sys      Sat Nov 20 06:35:38 2010 (4CE7B28A)
RMCAST.sys       Sat Nov 20 05:49:51 2010 (4CE7A7CF)
RTKVHD64.sys     Tue Nov 23 05:14:08 2010 (4CEB93F0)
asmthub3.sys     Wed Sep 14 03:36:19 2011 (4E705973)
mqac.sys         Mon Jul 13 20:26:13 2009 (4A5BD0A5)
NisDrvWFP.sys    Tue Feb 21 00:30:26 2012 (4F432BF2)
hidbth.sys       Mon Jul 13 20:06:52 2009 (4A5BCC1C)
usbcir.sys       Mon Jul 13 20:06:36 2009 (4A5BCC0C)
ftdibus.sys      Fri Mar 18 09:46:18 2011 (4D83622A)
ftser2k.sys      Fri Mar 18 09:46:04 2011 (4D83621C)
btfilter.sys     Fri Oct 22 02:40:47 2010 (4CC131EF)
btath_hcrp.sys   Tue Jun 29 05:30:43 2010 (4C29BD43)
btath_flt.sys    Thu Jun 24 02:17:38 2010 (4C22F882)
btath_lwflt.sys  Mon Sep 13 04:26:54 2010 (4C8DE04E)
asmtxhci.sys     Wed Sep 14 03:36:09 2011 (4E705969)
GEARAspiWDM.sys  Mon May 18 08:17:04 2009 (4A1151C0)
igdkmd64.sys     Tue Feb 14 13:47:30 2012 (4F3AAC42)
HECIx64.sys      Tue Oct 19 19:33:43 2010 (4CBE2AD7)
e1c62x64.sys     Wed Jul 20 12:37:53 2011 (4E270461)
VMNetSrv.sys     Wed Jan 16 06:52:01 2008 (478DEFE1)
MpFilter.sys     Mon Nov 07 17:24:33 2011 (4EB85AA1)
atikmpag.sys     Mon Dec 05 21:12:14 2011 (4EDD79FE)
atikmdag.sys     Mon Dec 05 21:52:23 2011 (4EDD8367)
AtihdW76.sys     Tue Oct 18 03:09:49 2011 (4E9D263D)
igdkmd64.sys     Wed Aug 31 15:53:13 2011 (4E5E9129)
vmm.sys          Tue Feb 12 06:38:20 2008 (47B1852C)
VMMR0.r0         Mon Dec 19 07:43:49 2011 (4EEF3185)
VBoxDDR0.r0      Mon Dec 19 07:43:49 2011 (4EEF3185)
VBoxDD2R0.r0     Mon Dec 19 07:43:49 2011 (4EEF3185)
WPRO_41_1879.sys Tue Feb 23 15:53:20 2010 (4B844040)
[/font]

Code:

[font=lucida console]
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\031212-9968-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Mon Mar 12 13:27:30.477 2012 (UTC - 4:00)
System Uptime: 0 days 0:02:16.305
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
PROCESS_NAME:  svchost.exe
BUGCHECK_STR:  RAISED_IRQL_FAULT
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_svchost.exe_nt!KiSystemServiceExit+245
Bugcheck code 0000004A
Arguments 00000000`77a2137a 00000000`00000002 00000000`00000000 fffff880`0d989b60
BiosVersion = 0501
BiosReleaseDate = 05/09/2011
CPUID:        "Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz"
MaxSpeed:     3400
CurrentSpeed: 3400
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\031012-7971-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar 10 04:30:50.941 2012 (UTC - 4:00)
System Uptime: 0 days 0:40:45.768
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+c0 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  iexplore.exe
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiReplenishPageSlist+c0
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`03304f00 00000000`00000000 ffffffff`ffffffff
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\031012-7690-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar 10 03:49:19.015 2012 (UTC - 4:00)
System Uptime: 0 days 0:18:17.843
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+150 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  iexplore.exe
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiReplenishPageSlist+150
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`032a8f90 00000000`00000000 ffffffff`ffffffff
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\030312-8876-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar  3 05:23:46.414 2012 (UTC - 4:00)
System Uptime: 0 days 0:22:05.242
Probably caused by : win32k.sys ( win32k!memset+b0 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  SnippingTool.e
FAILURE_BUCKET_ID:  X64_0x3B_win32k!memset+b0
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`032a2f00 fffff880`0c52aed0 00000000`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\030312-8985-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar  3 05:01:02.596 2012 (UTC - 4:00)
System Uptime: 0 days 0:08:34.424
Probably caused by : win32k.sys ( win32k!memset+b0 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  SnippingTool.e
FAILURE_BUCKET_ID:  X64_0x3B_win32k!memset+b0
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`032f3f00 fffff880`0c20bd10 00000000`00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\030312-27081-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar  3 04:37:44.378 2012 (UTC - 4:00)
System Uptime: 0 days 0:01:11.206
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+150 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  postgres.exe
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiReplenishPageSlist+150
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`032aef90 00000000`00000000 ffffffff`ffffffff
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\030312-28329-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar  3 04:35:46.215 2012 (UTC - 4:00)
System Uptime: 0 days 0:01:07.042
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+c0 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  CCC.exe
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiReplenishPageSlist+c0
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`032bef00 00000000`00000000 ffffffff`ffffffff
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\030312-29218-01.dmp]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sat Mar  3 04:33:47.918 2012 (UTC - 4:00)
System Uptime: 0 days 0:01:22.635
Probably caused by : memory_corruption ( nt!MiReplenishPageSlist+c0 )
BUGCHECK_STR:  0x1E_c0000005
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  nexserv.exe
FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiReplenishPageSlist+c0
Bugcheck code 0000001E
Arguments ffffffff`c0000005 fffff800`032eef00 00000000`00000000 ffffffff`ffffffff
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
  [/font]

niemiro · Mar 20, 2012

Hello,

Firstly, I would like to thank you all very much for everything you have posted. I have been incredibly busy recently, and I would just like to say that I haven't forgotten this thread, and I am immensely grateful for the help received. I have started working though the suggestions given, and I shall post a full reply to each of you over the next few days.

Thank you so much again,

Richard

niemiro · Mar 21, 2012

I need to dash, but just a quick message. I just got another BSoD. The minidump with just analyze -v wasn't too helpful (it looked just the same as the others), but on the actual BSoD itself it cited windrvr6.sys as the cause. This is highly likely, and I know exactly what it is for: my Atmel AVR ISP MKII programmer, for my Tech project. My Tech project has a deadline in 4 days. I cannot remove it until then, but after the deadline I will and will report back.

I shall still report back on everything else here to prevent future BSoDs.

Richard

P.S. I shall upload the minidumps soon.

Dave76 · Apr 7, 2012

Sometimes I think I see RAM issue lurking behind every tree...

Have had some success adjusting RAM settings, so if you want you can try a couple of settings changes.
Motherboard BIOS standard settings seem to be based on 4GB RAM, so when you add more RAM the timings and voltages are inadequate. More memory chips need more voltage to run correctly.
Some RAM on some systems seems to run ok, as far as I can tell, must be due to different hardware interacting.
My 8GB RAM runs fine at all default settings.

The Intel RAM/IMC voltage rule is to stay within 0.50v, if you RAM is 1.65v then your IMC should be at least 1.15v, or if your RAM is 1.50v then you have more room to make adjustments.
When having RAM issues with more than 4GB RAM, first bump the CPU IMC voltage, usually +0.05v will do it.
Standard IMC voltage is 1.10v, so bump it to 1.15v.
With 16GB RAM you may need to bump the DRAM voltage to 1.55v, if you have 1.50v RAM.
If you have 1.65v RAM, that will be more difficult, Intel recommends max RAM voltage to be 1.65v to keep from causing CPU damage, so raising above that is not recommended even though some do.

With voltages at DRAM 1.55v and CPU IMC (VCCIOVoltage in your EFI) 1.15v and your still getting crashes then lock the first four RAM timings to the SPD recommended settings and the 'Command Rate' to 2T. This will help stabilize the RAM.

You can post the Memory and SPD tabs from CPUZ for more clarification.

usasma · Apr 7, 2012

@Dave76 - Don't worry about seeing RAM issues lurking everywhere.
It's just not possible for each of us to know everything that there is about fixing each and every BSOD
We all experience a bit of success in fixing them for users - but we can't fix all of them all by our lonesome.

That's where the rest of us come in. A fresh perspective can lead to other solutions.
For example, the only time I even mention memory timings/settings/voltages is when it involves an Asus P4 or P5 motherboard. Then all I do is tell the user to "follow the timings/settings/voltages from the RAM manufacturer"

So, should I encounter a RAM issue - I probably won't fix it (or even notice it) and will have to ask for assistance.
I recall a day (only a couple of years back) when there was no one to ask for help. That's why I got into the BSOD field.
I'm grateful to have a nice, friendly place where we can talk about these problems and ask each other for assistance.

Capt.Jack Sparrow · Apr 17, 2012

Hi there!

It's a great learning thread. Great analysis Vir Gnarus! When I checked the logs to understand Vir Gnarus diagnosis I noticed something not sure if it's relevent.

Code:

X64_RAISED_IRQL_FAULT_svchost.exe_nt!KiSystemServiceExit+245

I think according to your svchost log the svchost.exe_nt!KiSystemServiceExit+245 is IPROSetMonitor a part of the Intel Network unified wired and wireless driver set. You might wanna look into that, also I saw some WMI crashes in Event Log it's a good idea to rebuild it. If you're not sure how to rebuild the WMI i'll give your a batch file.

niemiro · Apr 17, 2012

Capt.Jack Sparrow said:
Hi there!
It's a great learning thread. Great analysis Vir Gnarus! When I checked the logs to understand Vir Gnarus diagnosis I noticed something not sure if it's relevent.

Code:

X64_RAISED_IRQL_FAULT_svchost.exe_nt!KiSystemServiceExit+245

I think according to your svchost log the svchost.exe_nt!KiSystemServiceExit+245 is IPROSetMonitor a part of the Intel Network unified wired and wireless driver set. You might wanna look into that, also I saw some WMI crashes in Event Log it's a good idea to rebuild it. If you're not sure how to rebuild the WMI i'll give your a batch file.

Thanks for your input. I have removed it as a precaution. After removing the Jungo driver, I have seen a very marked decrease in BSoDs (famous last words), but not a total eradication. After removing that driver, the remaining BSoDs were mostly 3B: System Service Exception. Neither of these really explain away the 0x116 and 0x117, or my artifacts (these are curious - these occur only in Internet Explorer, and only once I hit more than ~ 3000 tabs (excessive I know!). Even when IE is artifacting badly, I can minimise it and use other programs perfectly - temps have been good every time I monitor, even when artifacting)

I have not forgotten this thread, do greatly appreciate all responses, and will come back to all of you this week. I want to run hardware tests next, but my computer has been processing data for the last month. My data processor now has excellent resume support!

Thanks again, to all.
Richard

Vir Gnarus · Apr 18, 2012

3000 tabs? I could easily see this being caused by memory issues. Remember that not only is there an over-encompassing memory limitation dependent on your RAM, but there's also memory restrictions on threads, stacks, processes and more, as well as your different types of pools. When any of those get exhausted, unusual behavior (yes, even artifacting) commonly occurs. When Mark made his Pushing the Limits of Windows presentation he showed examples of different symptoms caused by these various types of memory exhaustion, and one of them is artifacting of window contents for specific processes.

Vir Gnarus · Apr 18, 2012

Howdy Captain!

I'm curious as to where you got IPROSetMonitor from the svchost.exe that was in the callstack, since svchost is a host service, plus there's a number of svchost processes that will run simultaneously. What pointed ya to IPROSetMonitor specifically? Thanks!

Capt.Jack Sparrow said:
Hi there!

It's a great learning thread. Great analysis Vir Gnarus! When I checked the logs to understand Vir Gnarus diagnosis I noticed something not sure if it's relevent.

Code:

X64_RAISED_IRQL_FAULT_svchost.exe_nt!KiSystemServiceExit+245

I think according to your svchost log the svchost.exe_nt!KiSystemServiceExit+245 is IPROSetMonitor a part of the Intel Network unified wired and wireless driver set. You might wanna look into that, also I saw some WMI crashes in Event Log it's a good idea to rebuild it. If you're not sure how to rebuild the WMI i'll give your a batch file.

Capt.Jack Sparrow · Apr 18, 2012

Vir Gnarus said:
Howdy Captain!

I'm curious as to where you got IPROSetMonitor from the svchost.exe that was in the callstack, since svchost is a host service, plus there's a number of svchost processes that will run simultaneously. What pointed ya to IPROSetMonitor specifically? Thanks!

Hi,

You can call it a hunch. I was helping a guy who had a similar bugcheck which turn out to be IPROSetMonitor it happens 2 or 3 times. It's a system service so it's can be easily disabled and check it doesn't consume much time and rest of the svchost services seems to be harmless. I mostly check the defaulters like ASCAPI.sys etc if nothing obvious shows up. Again I might be wrong. My knowdege on BSOD is very limited. I'm still learning. But you theory about 3000+ Tab and Memory does make a lot of sense.

Vir Gnarus · Apr 19, 2012

Ahh, I see I see. Also, what "svchost log" were you referring too, and how did ya figure he had IPROMonitor? I figure you mean the system event log? Again, thanks a mil!

Capt.Jack Sparrow said:
Vir Gnarus said:

Howdy Captain!

I'm curious as to where you got IPROSetMonitor from the svchost.exe that was in the callstack, since svchost is a host service, plus there's a number of svchost processes that will run simultaneously. What pointed ya to IPROSetMonitor specifically? Thanks!

Click to expand...

Hi,

You can call it a hunch. I was helping a guy who had a similar bugcheck which turn out to be IPROSetMonitor it happens 2 or 3 times. It's a system service so it's can be easily disabled and check it doesn't consume much time and rest of the svchost services seems to be harmless. I mostly check the defaulters like ASCAPI.sys etc if nothing obvious shows up. Again I might be wrong. My knowdege on BSOD is very limited. I'm still learning. But you theory about 3000+ Tab and Memory does make a lot of sense.

Capt.Jack Sparrow · Apr 19, 2012

Vir Gnarus said:
Ahh, I see I see. Also, what "svchost log" were you referring too, and how did ya figure he had IPROMonitor? I figure you mean the system event log? Again, thanks a mil!

Capt.Jack Sparrow said:

Vir Gnarus said:

Howdy Captain!

I'm curious as to where you got IPROSetMonitor from the svchost.exe that was in the callstack, since svchost is a host service, plus there's a number of svchost processes that will run simultaneously. What pointed ya to IPROSetMonitor specifically? Thanks!

Click to expand...

Hi,

You can call it a hunch. I was helping a guy who had a similar bugcheck which turn out to be IPROSetMonitor it happens 2 or 3 times. It's a system service so it's can be easily disabled and check it doesn't consume much time and rest of the svchost services seems to be harmless. I mostly check the defaulters like ASCAPI.sys etc if nothing obvious shows up. Again I might be wrong. My knowdege on BSOD is very limited. I'm still learning. But you theory about 3000+ Tab and Memory does make a lot of sense.

Click to expand...

There is a Tasklist_svchost.txt file in his Collected files. I just went through them.

Vir Gnarus · Apr 19, 2012

Doh! I never have bothered to check that file in the past. I will rethink neglecting it next time. Thanks!

Capt.Jack Sparrow · Apr 19, 2012

Yup! JC's collection tools collects alot of info

LilBambi · Apr 19, 2012

What a great learning thread! Thank you all.

Intel network wired and wireless drivers are certainly one of the first things I update on most computers. They invariably are out of date.

But causing BSODs really hadn't come up for that because it's one of the first things I update. Mainly from a security standpoint. The network drivers sit at the Internet gateway to the machine.

But now I will start looking more closely before I update them to see if there are similar BSODs going on before I update.

Very interesting stuff!

I hope to learn much more about BSODs here! It's better to learn about them and how to fix them than the usual frustration and ultimate: :banghead:

:thumbsup2:

[SOLVED] A whole range of BSoDs

Senior Administrator, Windows Update Expert

Administrator, Hardware Expert

BSOD Kernel Dump Expert

Senior Administrator, Windows Update Expert

BSOD Kernel Dump Expert

Retired Admin

Senior Administrator, Windows Update Expert

Senior Administrator, Windows Update Expert

Visiting Expert, BSOD Kernel Dump Senior Analyst

Retired Admin

BSOD Kernel Dump Expert

Senior Administrator, Windows Update Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Expert

BSOD Kernel Dump Senior Analyst