Frequent BSOD Win7 Pro x64

Smuckerz · Mar 4, 2014

· Win7 Pro· x64· System ordered without OS, self installed.· Age: 1 month· Age of OS: 1 month. have not reinstalled· i7-4700mq· GTX 780m· P17SM· Sager· NP8275· Laptop

Patrick · Mar 4, 2014

Hi,

We have various different bug checks:

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

Code:

0: kd> knL
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 fffff880`223695e0 00000000`1801220a SynTP+0x36b8
01 fffff880`223695e8 00000000`00000001 0x1801220a
02 fffff880`223695f0 00000000`00000004 0x1
03 fffff880`223695f8 00000000`0023ae37 0x4
04 fffff880`22369600 000000d4`00040000 0x23ae37
05 fffff880`22369608 fffffa80`1bec43e0 0xd4`00040000
06 fffff880`22369610 00000004`00000001 0xfffffa80`1bec43e0
07 fffff880`22369618 00000acc`00000d53 0x4`00000001
08 fffff880`22369620 00000000`00000046 0xacc`00000d53
09 fffff880`22369628 00000000`03030024 0x46
0a fffff880`22369630 00000000`00000000 0x3030024

^^ The pagefault was caused by SynTP.sys which is the Synaptic Touch Pad driver.

PAGE_FAULT_IN_NONPAGED_AREA (50)

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

KMODE_EXCEPTION_NOT_HANDLED (1e)

This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Code:

Code:

4: kd> .exr 0xfffff880009db1e8
ExceptionAddress: fffff8000308525f (nt!KiDeferredReadyThread+0x000000000000034f)
   ExceptionCode: c0000005 (Access violation)

IRQL_NOT_LESS_OR_EQUAL (a)

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

----------------------

1. Remove Sunbelt ASAP as it's very likely causing conflicts.

2. Update touch pad driver - Drivers ? Synaptics

3. If you're still crashing after both of the above, remove EaseUS Todo Backup.

Regards,

Patrick

Smuckerz · Mar 4, 2014

Thank you :) Let's see how this goes. Have you run into many cases of either Vipre or other AV's being the cause of BSOD's?

Patrick · Mar 4, 2014

Have you run into many cases of either Vipre or other AV's being the cause of BSOD's?

Indeed, especially Sunbelt. I have solved a few Sunbelt cases and posted them to my blog, however I seem to have not tagged them. Unfortunate, but keep me updated!

Regards,

Patrick

Smuckerz · Mar 9, 2014

Well, pulled sunbelt, touchpad driver updated to newest/generic one from synaptic's site, and the backup thingie is removed. Here's another of the file grabber thingie outputs

Patrick · Mar 9, 2014

Okay, let's do two things before I recommend hardware diagnostics for RAM and HDD:

1. Set the system to generate Kernel-Dumps: Creating a Kernel-Mode Dump File (Windows Debuggers)

C:\Windows is the MEMORY.DMP path.

It will be too large to attach here, so you'll need to host it on something like Ondrive, Dropbox, etc, and then link it here.

2. Enable Driver Verifier after following #1:

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8/8.1, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・ Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:
Using Driver Verifier to identify issues with Windows drivers for advanced users

Regards,

Patrick

Smuckerz · Mar 9, 2014

Kk, Am on it. System is already setup to generate Kernel dumps, do you have any interest in the .dmp from the latest crash or only if it crashes after enabling driver verifier?

Patrick · Mar 9, 2014

Great!

do you have any interest in the .dmp from the latest crash or only if it crashes after enabling driver verifier?

Only if it crashes afterwards.

Regards,

Patrick

Smuckerz · Mar 10, 2014

Yup, failure to load windows. nvlddmkm.sys have zipped the memory.dmp, looking for a place to upload it now.

Smuckerz · Mar 10, 2014

Here's the dump file: https://www.dropbox.com/s/1b1rtwx1t4kfzg2/memory.zip

Patrick · Mar 10, 2014

It's corrupt. Can you try re-zipping and re-uploading?

Regards,

Patrick

Smuckerz · Mar 10, 2014

Geez, yes, Give me a moment.

Smuckerz · Mar 10, 2014

Uploading now, says it'll take like 5 minutes or so.

Smuckerz · Mar 10, 2014

here ya go, this one seems to work better. https://www.dropbox.com/s/69nghyte53rbtqv/MEMORY-2.zip

Patrick · Mar 10, 2014

That worked, thanks!

The attached DMP file is of the DRIVER_VERIFIER_DETECTED_VIOLATION (c4) bug check.

This is the general bug check code for fatal errors found by Driver Verifier.

BugCheck C4, {f6, ac, fffffa801fa71b30, fffff8800f3010a1}

2nd parameter of the bug check = Value of the handle being referenced.

3rd parameter of the bug check = Current process address.

Code:

6: kd> !process fffffa801fa71b30
PROCESS fffffa801fa71b30
    SessionId: 1  Cid: 0e98    Peb: 7fffffdd000  ParentCid: 0d5c
    DirBase: 77439f000  ObjectTable: fffff8a0020b3860  HandleCount:  64.
    Image: rundll32.exe
    VadRoot fffffa801fa6e8f0 Vads 64 Clone 0 Private 929. Modified 1793. Locked 0.
    DeviceMap fffff8a0008b7ed0
    Token                             fffff8a0020b3a50
    ElapsedTime                       00:00:00.612
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         149864
    QuotaPoolUsage[NonPagedPool]      7560
    Working Set Sizes (now,min,max)  (1906, 50, 345) (7624KB, 200KB, 1380KB)
    PeakWorkingSetSize                1906
    VirtualSize                       74 Mb
    PeakVirtualSize                   74 Mb
    PageFaultCount                    1926
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      1044

^^ The process is rundll32.exe which is a process essentially responsible for running DLLs and placing its libraries in the memory. Its current handle count is 64.

If we run !handle on the value:

Code:

6: kd> !handle ac

PROCESS fffffa801fa71b30
    SessionId: 1  Cid: 0e98    Peb: 7fffffdd000  ParentCid: 0d5c
    DirBase: 77439f000  ObjectTable: fffff8a0020b3860  HandleCount:  64.
    Image: rundll32.exe

Handle table at fffff8a0020b3860 with 64 entries in use

00ac: Object: fffff8a0025b71b0  GrantedAccess: 00020019 Entry: fffff8a0020b42b0
Object: fffff8a0025b71b0  Type: (fffffa8018bb37a0) Key
    ObjectHeader: fffff8a0025b7180 (new version)
        HandleCount: 1  PointerCount: 1
        Directory Object: 00000000  Name: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001\NVSPCAPS

^^ Registry path above, let's take a look:

Code:

6: kd> !reg findkcb \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001\NVSPCAPS


Found KCB = fffff8a002041a70 :: \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001\NVSPCAPS

Now that we have the Key Control Block address, let's go further:

Code:

Key              : \REGISTRY\MACHINE\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0001\NVSPCAPS
RefCount         : 1
Flags            : CompressedName,
ExtFlags         :
Parent           : 0xfffff8a000b6b258
KeyHive          : 0xfffff8a000023010
KeyCell          : 0x117b520 [cell index]
TotalLevels      : 9
MaxNameLen       : 0x0
MaxValueNameLen  : 0x34
MaxValueDataLen  : 0x30
LastWriteTime    : 0x 1cf1d79:0xee9f4a83
KeyBodyListHead  : 0xfffff8a002041ae8 0xfffff8a002041ae8
SubKeyCount      : 0
ValueCache.Count : 40
ValueCache.List  : 0x00000000011808d8
Owner            : 0x0000000000000000
KCBLock          : 0xfffff8a002041b60
KeyLock          : 0xfffff8a002041b70

The reference count is 1, therefore only one process has an handle open to that registry key. The Flags indicates the name of the key is in a compressed form, and the registry key is current 9 levels deep into the registry. \REGISTRY\MACHINE\SYSTEM would be 3 levels (each \).

NVSPCAPS is in relation to nVidia, and in the thread we have a few nVidia video driver calls:

Code:

Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0c0e2878 fffff800`0355c4ec : 00000000`000000c4 00000000`000000f6 00000000`000000ac fffffa80`1fa71b30 : nt!KeBugCheckEx
fffff880`0c0e2880 fffff800`03571bf4 : 00000000`000000ac fffffa80`1fa71b30 00000000`00000004 00000000`0a014bb4 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0c0e28c0 fffff800`03329890 : fffff800`033c5780 fffff880`0c0e2b10 fffff880`0c0e2c00 fffff880`0c0e2ea0 : nt!VfCheckUserHandle+0x1b4
fffff880`0c0e29a0 fffff800`0339f6b5 : 00000000`00000000 fffff880`00000001 fffffa80`18bb37a0 fffffa80`18b77000 : nt! ?? ::NNGAKEGL::`string'+0x2027e
fffff880`0c0e2a70 fffff800`030cee53 : fffffa80`1fa71620 fffff880`0c0e2e28 00000000`00000002 00000000`00000000 : nt!NtQueryValueKey+0x115
fffff880`0c0e2c00 fffff800`030cb410 : fffff800`03560d96 fffff880`0f3010a1 fffff880`0c0e2ea0 fffff880`0c0e2e98 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0c0e2c70)
fffff880`0c0e2e08 fffff800`03560d96 : fffff880`0f3010a1 fffff880`0c0e2ea0 fffff880`0c0e2e98 fffff800`030cb410 : nt!KiServiceLinkage
fffff880`0c0e2e10 fffff880`0f3010a1 : fffff880`0c0e38ca fffff880`0c0e2ee0 fffff880`0c0e38b8 fffff880`0c0e3600 : nt!VfZwQueryValueKey+0x76
fffff880`0c0e2e60 fffff880`0f3008ea : 00000000`00000000 00000000`00000000 fffff880`0c0e2ff0 fffff880`0c0e2ff0 : nvlddmkm+0x9b0a1
fffff880`0c0e2f10 fffff880`0f34b80a : fffff880`0f30086d fffff980`013d4bd0 fffffa80`1c697000 00000000`00000000 : nvlddmkm+0x9a8ea
fffff880`0c0e2fb0 fffff880`0f319bfc : fffff880`0c0e3880 00000000`00000004 fffff880`0c0e39b8 fffffa80`1c697000 : nvlddmkm+0xe580a
fffff880`0c0e3030 fffff880`0f30c6bc : fffff880`0c0e3588 00000000`00000000 fffff880`0c0e3180 fffff880`0fb872dc : nvlddmkm+0xb3bfc
fffff880`0c0e3080 fffff880`0fb873bb : 00000000`00000010 fffff880`0fb872dc 00000000`00000010 00000000`00010286 : nvlddmkm+0xa66bc
fffff880`0c0e34a0 fffff880`0f30bb6b : fffff880`0f79b130 fffff880`0c0e3599 fffffa80`1c697000 00000000`00000000 : nvlddmkm!nvDumpConfig+0x2a2f93
fffff880`0c0e34e0 fffff880`0fb699b9 : fffff880`0c0e3810 fffff880`0c0e3669 fffff880`0c0e3810 fffff880`0c0e3810 : nvlddmkm+0xa5b6b
fffff880`0c0e3600 fffff880`0fc08a25 : 00000000`00000000 00000000`00000000 00000000`4e562a2a 00000000`01000003 : nvlddmkm!nvDumpConfig+0x285591
fffff880`0c0e36d0 fffff880`0fee3f50 : 00000000`00000000 00000000`00000000 fffff880`0c0e3810 00000000`00000018 : nvlddmkm!nvDumpConfig+0x3245fd
fffff880`0c0e3700 fffff880`0fed7093 : 00000000`00000000 00000000`00000000 fffff880`0c0e3b60 00000000`00000003 : dxgkrnl!DXGADAPTER::DdiEscape+0x50
fffff880`0c0e3730 fffff960`001e1942 : 00000000`000ef608 fffffa80`1fa71620 00000000`02703500 00000000`00000020 : dxgkrnl!DxgkEscape+0x7af
fffff880`0c0e3ab0 fffff800`030cee53 : 00000000`00000008 000007fe`f933f000 00000000`02703501 ffffffff`ffffffff : win32k!NtGdiDdDDIEscape+0x12
fffff880`0c0e3ae0 000007fe`ff2613ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0c0e3ae0)
00000000`000eefb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`ff2613ea

Ensure you have the latest video card drivers. If you are already on the latest video card drivers, uninstall and install a version or a few versions behind the latest to ensure it's not a latest driver only issue. If you have already experimented with the latest video card driver and many previous versions, please give the beta driver for your card a try.

Regards,

Patrick

Smuckerz · Mar 10, 2014

Thank you again, will update the drivers and see how it goes. Will let you know how it goes.

Patrick · Mar 10, 2014

Great, I look forward to your update.

Regards,

Patrick

Smuckerz · Mar 11, 2014

And another BSOD, here's a link for the dump. https://db.tt/6mrwMdmG

Patrick · Mar 11, 2014

More Direct X faults, so let's run a Memtest for NO LESS than ~8 passes (several hours). If it passes, your GPU is faulty.

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Regards,

Patrick

Smuckerz · Mar 11, 2014

Thank you. nVidia just released another new driver, so I've updated to that one(from the one I updated yesterday lol). Activated driver verifier again and it booted to windows, so I'm letting that go again(previous time with verifier it crashed as soon as I attempted to log in to windows). Wonder if the new driver might help

Frequent BSOD Win7 Pro x64

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member

Member

Sysnative Staff

Member

Member

Member

Sysnative Staff

Member

Sysnative Staff

Member

Sysnative Staff

Member