Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7
Thanks very much, Brian!
We have a few different bug checks now:
KMODE_EXCEPTION_NOT_HANDLED (1e)
This indicates that a kernel-mode program generated an exception which the error handler did not catch.
Code:
1: kd> k
Child-SP RetAddr Call Site
fffff880`033264e8 fffff800`033121bb nt!KeBugCheckEx
fffff880`033264f0 fffff800`032d3d18 nt!KipFatalFilter+0x1b
fffff880`03326530 fffff800`032abcdc nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`03326570 fffff800`032ab75d nt!_C_specific_handler+0x8c
fffff880`033265e0 fffff800`032aa535 nt!RtlpExecuteHandlerForException+0xd
fffff880`03326610 fffff800`032bb4c1 nt!RtlDispatchException+0x415
fffff880`03326cf0 fffff800`03280242 nt!KiDispatchException+0x135
fffff880`03327390 fffff800`0327eb4a nt!KiExceptionDispatch+0xc2
fffff880`03327570 fffff880`01a85ca2 nt!KiGeneralProtectionFault+0x10a
fffff880`03327700 fffff880`01a8021b tcpip!UdpDeliverDatagrams+0x152
fffff880`03327890 fffff880`01a5bf77 tcpip!UdpReceiveDatagrams+0x21b
fffff880`03327930 fffff880`01a5ba8a tcpip!IppDeliverListToProtocol+0xf7
fffff880`033279f0 fffff880`01a5b089 tcpip!IppProcessDeliverList+0x5a
fffff880`03327a90 fffff880`01a58d2f tcpip!IppReceiveHeaderBatch+0x23a
fffff880`03327b70 fffff880`01a58302 tcpip!IpFlcReceivePackets+0x64f
fffff880`03327d70 fffff880`01a5772a tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`03327e50 fffff800`0328c878 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`03327ea0 fffff880`01a57e22 nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`03327f80 00000000`00000000 tcpip!FlReceiveNetBufferListChain+0xb2
It looks like before the bugcheck is called, the Microsoft TCP/IP driver is delivering datagrams (part of the User Datagram Protocol). Essentially, with UDP, computer applications can send messages, in this case referred to as
datagrams, to other hosts on an Internet Protocol (IP) network without prior communications to set up special transmission channels or data paths. For some reason we have an exception occur, and we bugcheck.
BAD_POOL_HEADER (19)
This indicates that a pool header is corrupt.
..again.
Code:
BugCheck 19, {20, [COLOR=#ff0000]fffffa800add9390[/COLOR], fffffa800add9430, 40a000d}
Code:
2: kd> !pool fffffa800add9390
Pool page fffffa800add9390 region is Nonpaged pool
fffffa800add9000 size: 80 previous size: 0 (Allocated) SeTl
fffffa800add9080 size: 60 previous size: 80 (Allocated) Icp
fffffa800add90e0 size: 80 previous size: 60 (Free ) Even (Protected)
fffffa800add9160 size: 90 previous size: 80 (Allocated) Vad
fffffa800add91f0 size: d0 previous size: 90 (Allocated) CcBc
fffffa800add92c0 size: d0 previous size: d0 (Allocated) CcBc
[COLOR=#4b0082]*fffffa800add9390 size: a0 previous size: d0 (Free ) *ViMm[/COLOR]
Pooltag ViMm : Video memory manager, Binary : dxgkrnl.sys
The pool block which we're looking at within the pool page belongs to
*ViMm which is the Video memory manager (dxgkrnl.sys - Direct X Kernel).
Code:
2: kd> k
Child-SP RetAddr Call Site
fffff880`0a4c6758 fffff800`033b9cae nt!KeBugCheckEx
fffff880`0a4c6760 fffff880`0b31cecc nt!ExDeferredFreePool+0x12da
fffff880`0a4c6810 fffff880`0ae37ccc dxgmms1!VidMmCloseAllocation+0x44
fffff880`0a4c6840 fffff880`0ae3765f dxgkrnl!DXGDEVICE::DestroyAllocations+0x248
fffff880`0a4c6930 fffff880`0ae3d59b dxgkrnl!DXGDEVICE::ProcessTerminationList+0xa3
fffff880`0a4c6980 fffff960`0021115e dxgkrnl!DxgkCreateAllocation+0x40b
fffff880`0a4c6ab0 fffff800`03285e53 win32k!NtGdiDdDDICreateAllocation+0x12
fffff880`0a4c6ae0 00000000`730913aa nt!KiSystemServiceCopyEnd+0x13
00000000`0023e168 00000000`00000000 0x730913aa
Looks like a pool header is corrupt due to a possible failure during Direct X destroying allocations.
PAGE_FAULT_IN_NONPAGED_AREA (50)
This indicates that invalid system memory has been referenced.
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Code:
1: kd> k
*** Stack trace for last set context - .thread/.cxr resets it
Child-SP RetAddr Call Site
fffff880`035ee980 fffff880`01d71a87 nt!ExFreePoolWithTag+0x212
fffff880`035eea30 fffff880`01d71c01 [COLOR=#ff0000]afd!AfdFreeEndpointResources+0x157[/COLOR]
fffff880`035eeae0 fffff880`01d46c67 [COLOR=#ff0000]afd!AfdFreeEndpoint+0x21[/COLOR]
fffff880`035eeb10 fffff800`0357bc93 [COLOR=#ff0000]afd!AfdDoWork+0x67[/COLOR]
fffff880`035eeb40 fffff800`0328e261 nt!IopProcessWorkItem+0x23
fffff880`035eeb70 fffff800`0352073a nt!ExpWorkerThread+0x111
fffff880`035eec00 fffff800`032758e6 nt!PspSystemThreadStartup+0x5a
fffff880`035eec40 00000000`00000000 nt!KxStartSystemThread+0x16
NTFS_FILE_SYSTEM (24)
This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.
One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.
Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.
Right, okay, so this looks like hardware at this point (RAM, HDD, or motherboard).
1. First off, I am a little suspicious of your O2Micro SD Reader driver. With that said, for temporary troubleshooting purposes, please uninstall.
2. If the above fails, please run Memtest for NO LESS than ~8 passes (several hours):
Memtest86+:
Download Memtest86+ here:
Memtest86+ - Advanced Memory Diagnostic Tool
Which should I download?
You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).
Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).
How Memtest works:
Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.
The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.
Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.
Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.
This information, if available to the program, can be displayed via a menu option.
Any other questions, they can most likely be answered by reading this great guide here:
FAQ : please read before posting
3. If Memtest goes at LEAST ~8 passes with no errors, please run Chkdsk (paste log afterwards) and then Seatools:
Chkdsk:
There are various ways to run Chkdsk~
Method 1:
Start > Search bar > Type cmd (right click run as admin to execute Elevated CMD)
Elevated CMD should now be opened, type the following:
chkdsk x: /r
x implies your drive letter, so if your hard drive in question is letter c, it would be:
chkdsk c: /r
Restart system and let chkdsk run.
Method 2:
Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.
If you'd like to get a log file that contains the chkdsk results, do the following:
Press Windows Key + R and type powershell.exe in the run box
Paste the following command and press enter afterwards:
get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt
This will output a .txt file on your Desktop containing the results of the chkdsk.
If chkdsk turns out okay, run Seatools -
SeaTools | Seagate
You can run it via Windows or DOS. Do note that the only difference is simply the environment you're running it in. In Windows, if you are having what you believe to be driver related issues that may cause conflicts or a false positive, it may be a wise decision to choose the most minimal testing environment (DOS). I always recommend running Seatools in DOS if absolutely possible.
-- Run all tests
EXCEPT: Fix All and anything Advanced.
Regards,
Patrick
