Unable to resolve BSOD on Custom built DAW

N

nickman

Member
Joined
May 6, 2014
Posts
10
Hi!

Attached are the requested docs.

Not much to tell. BSOD has evaded my tech skill set from resolution for nearly a year. Finally did a clean Win 7 re-install last month, but it did not resolve the issue.

Have mem tested ram (16Gb) - passed

updated drivers

Scanned for malware - Clean

Have dismounted external usb, eSata and firewire drives - did not make a difference.

Replaced the internal 2Tb data drive 042012

BSOD will occur at different times; intermittently. Sometimes while running an app, sometimes while on the web and sometimes while nothing is open. Many times I have come back to the machine after a few hours to find that it has re-booted itself to the Windows log-on screen and generated a crash dump file.

Hope a solution exists...maybe it's time to go back to a Mac :-(

Best,

~Nick

OS - Windows 8.1, 8, 7, Vista ?
Windows 7 Ultimate


· x86 (32-bit) or x64 ?
x64


· What was original installed OS on system?
Clean Install


· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
Full retail version (I purchased it from retailer)


· Age of system (hardware)
2 years old


· Age of OS installation - have you re-installed the OS?
Clean install twice. 04/2012 most recent install


· CPU
AMD Phenom(tm) II X6 1100T Processor 3.30GHz


· Video Card
GeForce GTX 550 Ti


· MotherBoard
ASUS M4A89TD PRO


· Power Supply - brand & wattage (if laptop, skip this one)
Corsair GS800


· System Manufacturer
N/A

· Exact model number (if laptop, check label on bottom)
N/A


· Laptop or Desktop?
Custom Rackmounted Server for Audio Production

· OS - Windows 8.1, 8, 7, Vista ?
Windows 7 Ultimate


· x86 (32-bit) or x64 ?
x64


· What was original installed OS on system?
Clean Install


· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?
Full retail version (I purchased it from retailer)


· Age of system (hardware)
2 years old


· Age of OS installation - have you re-installed the OS?
Clean install twice. 04/2012 most recent install


· CPU
AMD Phenom(tm) II X6 1100T Processor 3.30GHz


· Video Card
GeForce GTX 550 Ti


· MotherBoard
ASUS M4A89TD PRO


· Power Supply - brand & wattage (if laptop, skip this one)
Corsair GS800


· System Manufacturer
N/A

· Exact model number (if laptop, check label on bottom)
N/A


· Laptop or Desktop?
Custom Rackmounted Server for Audio Production
 
Hi,

We have a few different bug checks:

IRQL_NOT_LESS_OR_EQUAL (a)

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

Code: 
2: kd> k
Child-SP          RetAddr           Call Site
fffff880`07da5258 fffff800`0307d169 nt!KeBugCheckEx
fffff880`07da5260 fffff800`0307bde0 nt!KiBugCheckDispatch+0x69
fffff880`07da53a0 fffff800`0308e502 nt!KiPageFault+0x260
fffff880`07da5530 fffff800`030ae06b nt!MiUnlinkPageFromLockedList+0x2a2
fffff880`07da55b0 fffff800`0309ac8f nt!MiResolveTransitionFault+0x16b
fffff880`07da5640 fffff800`0308ac3b nt!MiDispatchFault+0x95f
fffff880`07da5750 fffff800`0307bcee nt!MmAccessFault+0xe1b
fffff880`07da58b0 fffff800`0310cc20 nt!KiPageFault+0x16e
fffff880`07da5a48 fffff800`031b0832 nt!MmQuerySpecialPoolBlockSize+0x20
fffff880`07da5a50 fffff880`012be1ea nt!ExDeferredFreePool+0xe00
fffff880`07da5b00 fffff980`58380fd0 [COLOR=#ff0000]SYMEFA64+0xc1ea[/COLOR]
fffff880`07da5b08 fffff880`013c7371 0xfffff980`58380fd0
fffff880`07da5b10 00000000`00000010 [COLOR=#ff0000]SYMEFA64+0x115371[/COLOR]
fffff880`07da5b18 00000000`00010202 0x10
fffff880`07da5b20 fffff980`4ad9ce50 0x10202
fffff880`07da5b28 fffff880`013c737a 0xfffff980`4ad9ce50
fffff880`07da5b30 fffff980`4ad9ceb8 [COLOR=#ff0000]SYMEFA64+0x11537a[/COLOR]
fffff880`07da5b38 00000000`00010286 0xfffff980`4ad9ceb8
fffff880`07da5b40 fffff880`07da5b58 0x10286
fffff880`07da5b48 00000000`00000001 0xfffff880`07da5b58
fffff880`07da5b50 00000000`00000000 0x1

SYMEFA64.sys is the Symantec Extended File Attributes driver.

MEMORY_MANAGEMENT (1a)

This indicates that a severe memory management error occurred.

BugCheck 1A, {41287, 100000002f, 0, 0}

- The 1st parameter of the bug check is 41287 which indicates an illegal page fault occurred while holding working set synchronization.
Code: 
2: kd> k
Child-SP          RetAddr           Call Site
fffff880`087b1338 fffff800`03061d2e nt!KeBugCheckEx
fffff880`087b1340 fffff800`030c6cee nt! ?? ::FNODOBFM::`string'+0x454f5
fffff880`087b14a0 fffff800`030dae6d nt!KiPageFault+0x16e
fffff880`087b1630 fffff800`030980a3 nt!MiUpdateWsle+0x4d
fffff880`087b16a0 fffff800`030f9306 nt!MiAllocateWsle+0x13f
fffff880`087b16f0 fffff800`030e5c8f nt!MiResolveTransitionFault+0x406
fffff880`087b1780 fffff800`030d5c3b nt!MiDispatchFault+0x95f
fffff880`087b1890 fffff800`030c6cee nt!MmAccessFault+0xe1b
fffff880`087b19f0 fffff880`01b94010 nt!KiPageFault+0x16e
fffff880`087b1b88 fffff880`01b95479 [COLOR=#4b0082]SRTSP64+0x81010[/COLOR]
fffff880`087b1b90 00000000`00000010 [COLOR=#4b0082]SRTSP64+0x82479[/COLOR]
fffff880`087b1b98 fffff880`01b95371 0x10
fffff880`087b1ba0 00000000`00000010 [COLOR=#4b0082]SRTSP64+0x82371[/COLOR]
fffff880`087b1ba8 00000000`00010286 0x10
fffff880`087b1bb0 fffff880`087b1bc0 0x10286
fffff880`087b1bb8 fffff880`0451469d 0xfffff880`087b1bc0
fffff880`087b1bc0 fffff980`5f8b4f38 [COLOR=#ff0000]EX64+0x4b69d[/COLOR]
fffff880`087b1bc8 00000000`00000000 0xfffff980`5f8b4f38

EX64.sys is a Norton driver, and SRTSP64.sys is the Symantec Real Time Storage Protection driver.


Overall, to no surprise, Norton appears to be causing file system conflicts.

Remove and replace Norton with Microsoft Security Essentials for temporary troubleshooting purposes:

 Norton removal - https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us;jsessionid=841A6D40BA6872C47697C6C6B19C8E11.4?entsrc=redirect_pubweb&pvid=f-home

MSE - Microsoft Security Essentials - Microsoft Windows

Regards,

Patrick
 
Will do, Patrick.

I'll see how things behave for a few days, and get back to you with my findings; positive or negative.

Much appreciated,

~Nick
 
This seems to be a 'who crashed output? Can you please attach the dump itself.

Regards,

Patrick
 
Sorry about that.

Several more BSOD occurred as I was attempting to run BSOD_Windows7_Vista_v2.64_jcgriff2_

~Nick
 
Looks like hardware to me at this point. Please run Memtest for NO LESS than ~8 passes (several hours):

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

Regards,

Patrick
 
Will do. Ran Memtest86+ last month and didn't find a smoking gun, but happy to do it again. Have a cd ready to go. Will let you know...

~Nick
 
Passed with flying colors. Same as last month...

Image attached.

What's next?

~Nick
 

Attachments

  • Memtest_Blakrack.jpg
    Memtest_Blakrack.jpg
    197.7 KB · Views: 2
Thanks for running that.

Alright, well, we may have another form of hardware failing here. Can you please enable Driver Verifier for me so I can be sure there's no low-level driver causing corruption?

Driver Verifier:

What is Driver Verifier?

Driver Verifier is included in Windows 8/8.1, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

Before enabling Driver Verifier, it is recommended to create a System Restore Point:

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/8.1 - Restore Point - Create in Windows 8

How to enable Driver Verifier:

Start > type "verifier" without the quotes > Select the following options -

1. Select - "Create custom settings (for code developers)"
2. Select - "Select individual settings from a full list"
3. Check the following boxes -
- Special Pool
- Pool Tracking
- Force IRQL Checking
- Deadlock Detection
- Security Checks (Windows 7 & 8)
- DDI compliance checking (Windows 8)
- Miscellaneous Checks
4. Select - "Select driver names from a list"
5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
7. Click on Finish.
8. Restart.

Important information regarding Driver Verifier:

- If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

- After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

If this happens, do not panic, do the following:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > Search > type "cmd" without the quotes.

- To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
・ Restart and boot into normal Windows.

If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

- Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

- Once in Safe Mode - Start > type "system restore" without the quotes.

- Choose the restore point you created earlier.

-- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

How long should I keep Driver Verifier enabled for?

I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

They will be located in %systemroot%\Minidump

Any other questions can most likely be answered by this article:
Using Driver Verifier to identify issues with Windows drivers for advanced users

Regards,

Patrick
 
Latest crash DMP is of the IRQL_NOT_LESS_OR_EQUAL (a) bug check.

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

Code: 
2: kd> !verifier -f

Verify Flags Level 0x0000092b

  STANDARD FLAGS:
    [X] (0x00000000) Automatic Checks
    [X] (0x00000001) Special pool
    [X] (0x00000002) Force IRQL checking
    [X] (0x00000008) Pool tracking
    [ ] (0x00000010) I/O verification
    [X] (0x00000020) Deadlock detection
    [ ] (0x00000080) DMA checking
    [X] (0x00000100) Security checks
    [X] (0x00000800) Miscellaneous checks

  ADDITIONAL FLAGS:
    [ ] (0x00000004) Randomized low resources simulation
    [ ] (0x00000200) Force pending I/O requests
    [ ] (0x00000400) IRP logging

    [X] Indicates flag is enabled

Verifier is enabled, so this is definitely not a software issue.

Code: 
FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

Instruction pointer misalignment, generally caused by bad RAM/faulty motherboard even if diagnostics pass for RAM.

Regards,

Patrick
 
Thanks, Patrick.

So...

Should I leave Driver Verifier running, or turn it off?

How do I go about this from this point forward, what would the step by step procedure be?

~Nick
 
Disable DV, not necessary.

At this point, if RMA/replacement is available for both RAM and motherboard, I'd go ahead with both.

Regards,

Patrick
 
If I end up replacing the MOBO with an identical one, can I get away without having to re-install everything?
 
Yep, that's generally the case. No promises, though.

I am one to always do a clean install of Windows when new hardware comes along simply because that's just the way I do things.

Regards,

Patrick
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top