[Win7] BSOD with multiple causes (Blue Screen View) even after Full Reload

flmoeron

Member
Joined
Jun 7, 2014
Posts
9
I've seen the GREAT support you guys have provided and I'm at the end of my abilities to diagnose the problem...I've gone to Dell and they (for the third time) have recommended wiping the system and starting over once again and it didn't solve the issue either of the previous two attempts so I have no faith in that direciton.

OS - Win 7 Pro
· x86 - x64
· What was original installed OS on system? Win 7 Pro, 64 bit
· Is the OS an OEM version (came pre-installed on system) Yes - 2 full restores attempting to solve
· Age of system (hardware) 4 months
· Age of OS installation - 2 Months
- have you re-installed the OS? YES

· CPU - Intel i5-4300U @1.9Ghz
· Video Card - Intel HD Graphics 4400
· MotherBoard - Intel ???
· Power Supply -LAPTOP (so skipping)

· System Manufacturer DELL
· Exact model number (if laptop, check label on bottom) Latitude E7440

· Laptop

The .zip file is attached per your very well detailed instructions.

View attachment 8214

Thanks and look forward to the review/response.
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Hi,

Thanks for the kind words regarding Sysnative! We certainly do our best.

Most if not all of the dumps are of the BAD_POOL_HEADER (19) bug check.

This indicates that a pool header is corrupt.

Code:
BugCheck 19, {20, [COLOR=#ff0000]fffffa800befd440[/COLOR], fffffa800befd520, 40e0002}

Code:
1: kd> !pool [COLOR=#ff0000]fffffa800befd440[/COLOR]
Pool page fffffa800befd440 region is Nonpaged pool
 fffffa800befd000 size:  420 previous size:    0  (Allocated)  CcVl
 fffffa800befd420 size:   20 previous size:  420  (Free)       AfdB
[COLOR=#4b0082]*fffffa800befd440 size:   e0 previous size:   20  (Free ) [/COLOR][COLOR=#ff0000]*DNE.[/COLOR]
        Owning component : Unknown (update pooltag.txt)

*DNE is a pooltag for the Citrix Deterministic Networks DNE driver. We can confirm this by dumping the call stack:

Code:
1: kd> k
Child-SP          RetAddr           Call Site
fffff880`0921ff68 fffff800`033bdcae nt!KeBugCheckEx
fffff880`0921ff70 fffff880`018afce2 [COLOR=#000080]nt!ExDeferredFreePool+0x12da[/COLOR]
fffff880`09220020 fffff880`01406283 [COLOR=#4b0082]ndis!NdisFreeNetBuffer+0xf2[/COLOR]
fffff880`09220050 fffffa80`0b9a6ec0 [COLOR=#ff0000]dnelwf64+0x6283[/COLOR]
fffff880`09220058 fffffa80`0956f560 0xfffffa80`0b9a6ec0
fffff880`09220060 ffffffff`ffffffff 0xfffffa80`0956f560
fffff880`09220068 00000000`00000000 0xffffffff`ffffffff

dnelwf64.sys is the Citrix Deterministic Networks DNE driver (Cisco VPM Client).

Please for troubleshooting purposes uninstall this ASAP as it appears to be causing NETBIOS conflicts which is in turn leading to pool corruption.

Regards,

Patrick
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

>>
Please for troubleshooting purposes uninstall this ASAP as it appears to be causing NETBIOS conflicts which is in turn leading to pool corruption.

Regards,

Patrick
>>

Patrick,

Thanks for the quick response! I've uninstalled it and we'll see if that accomplishes the goal. If it continues (several crashes per day as you saw in the log, so it shouldn't be too long to see if that rectifies the problem), I'll post to the thread once again. If I'm stable for a week +, I'll close it down.

Thanks Patrick...have a good weekend!

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

My pleasure, I look forward to the update.

I hope you have a great weekend as well!

Regards,

Patrick
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

My pleasure, I look forward to the update.

I hope you have a great weekend as well!

Regards,

Patrick

Patrick,

Well, that was a short lived belief it was fixed LOL! Crashed twice since then. New analysis and report zipped up and attached:

View attachment 8216

Thanks!
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Would you mind deleting every dump on your system minus the latest, and only zipping that one? There are quite a few and the timestamps are bugged for me so I cannot properly sort by time/date.

Regards,

Patrick
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Would you mind deleting every dump on your system minus the latest, and only zipping that one? There are quite a few and the timestamps are bugged for me so I cannot properly sort by time/date.

Patrick,

Cleared out the minidump folder as requested. Left the last two and ran the utility and perfmon again and the file is below:

View attachment 060814_812am.zip


Thanks again!
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Patrick,

Well, crashed twice since the 8am posting of the files before, so I figured I would run the analysis tools again and post the results. So this should contain 4 crashes.

View attachment 8222

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Thanks very much, Brian!

We have a few different bug checks now:

KMODE_EXCEPTION_NOT_HANDLED (1e)

This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Code:
1: kd> k
Child-SP          RetAddr           Call Site
fffff880`033264e8 fffff800`033121bb nt!KeBugCheckEx
fffff880`033264f0 fffff800`032d3d18 nt!KipFatalFilter+0x1b
fffff880`03326530 fffff800`032abcdc nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`03326570 fffff800`032ab75d nt!_C_specific_handler+0x8c
fffff880`033265e0 fffff800`032aa535 nt!RtlpExecuteHandlerForException+0xd
fffff880`03326610 fffff800`032bb4c1 nt!RtlDispatchException+0x415
fffff880`03326cf0 fffff800`03280242 nt!KiDispatchException+0x135
fffff880`03327390 fffff800`0327eb4a nt!KiExceptionDispatch+0xc2
fffff880`03327570 fffff880`01a85ca2 nt!KiGeneralProtectionFault+0x10a
fffff880`03327700 fffff880`01a8021b tcpip!UdpDeliverDatagrams+0x152
fffff880`03327890 fffff880`01a5bf77 tcpip!UdpReceiveDatagrams+0x21b
fffff880`03327930 fffff880`01a5ba8a tcpip!IppDeliverListToProtocol+0xf7
fffff880`033279f0 fffff880`01a5b089 tcpip!IppProcessDeliverList+0x5a
fffff880`03327a90 fffff880`01a58d2f tcpip!IppReceiveHeaderBatch+0x23a
fffff880`03327b70 fffff880`01a58302 tcpip!IpFlcReceivePackets+0x64f
fffff880`03327d70 fffff880`01a5772a tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`03327e50 fffff800`0328c878 tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`03327ea0 fffff880`01a57e22 nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`03327f80 00000000`00000000 tcpip!FlReceiveNetBufferListChain+0xb2

It looks like before the bugcheck is called, the Microsoft TCP/IP driver is delivering datagrams (part of the User Datagram Protocol). Essentially, with UDP, computer applications can send messages, in this case referred to as datagrams, to other hosts on an Internet Protocol (IP) network without prior communications to set up special transmission channels or data paths. For some reason we have an exception occur, and we bugcheck.

BAD_POOL_HEADER (19)

This indicates that a pool header is corrupt.

..again.

Code:
BugCheck 19, {20, [COLOR=#ff0000]fffffa800add9390[/COLOR], fffffa800add9430, 40a000d}

Code:
2: kd> !pool fffffa800add9390
Pool page fffffa800add9390 region is Nonpaged pool
 fffffa800add9000 size:   80 previous size:    0  (Allocated)  SeTl
 fffffa800add9080 size:   60 previous size:   80  (Allocated)  Icp 
 fffffa800add90e0 size:   80 previous size:   60  (Free )  Even (Protected)
 fffffa800add9160 size:   90 previous size:   80  (Allocated)  Vad 
 fffffa800add91f0 size:   d0 previous size:   90  (Allocated)  CcBc
 fffffa800add92c0 size:   d0 previous size:   d0  (Allocated)  CcBc
[COLOR=#4b0082]*fffffa800add9390 size:   a0 previous size:   d0  (Free ) *ViMm[/COLOR]
        Pooltag ViMm : Video memory manager, Binary : dxgkrnl.sys

The pool block which we're looking at within the pool page belongs to *ViMm which is the Video memory manager (dxgkrnl.sys - Direct X Kernel).

Code:
2: kd> k
Child-SP          RetAddr           Call Site
fffff880`0a4c6758 fffff800`033b9cae nt!KeBugCheckEx
fffff880`0a4c6760 fffff880`0b31cecc nt!ExDeferredFreePool+0x12da
fffff880`0a4c6810 fffff880`0ae37ccc dxgmms1!VidMmCloseAllocation+0x44
fffff880`0a4c6840 fffff880`0ae3765f dxgkrnl!DXGDEVICE::DestroyAllocations+0x248
fffff880`0a4c6930 fffff880`0ae3d59b dxgkrnl!DXGDEVICE::ProcessTerminationList+0xa3
fffff880`0a4c6980 fffff960`0021115e dxgkrnl!DxgkCreateAllocation+0x40b
fffff880`0a4c6ab0 fffff800`03285e53 win32k!NtGdiDdDDICreateAllocation+0x12
fffff880`0a4c6ae0 00000000`730913aa nt!KiSystemServiceCopyEnd+0x13
00000000`0023e168 00000000`00000000 0x730913aa

Looks like a pool header is corrupt due to a possible failure during Direct X destroying allocations.

PAGE_FAULT_IN_NONPAGED_AREA (50)

This indicates that invalid system memory has been referenced.

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).

Another common cause is the installation of a faulty system service.

Antivirus software can also trigger this error, as can a corrupted NTFS volume.

Code:
1: kd> k
  *** Stack trace for last set context - .thread/.cxr resets it
Child-SP          RetAddr           Call Site
fffff880`035ee980 fffff880`01d71a87 nt!ExFreePoolWithTag+0x212
fffff880`035eea30 fffff880`01d71c01 [COLOR=#ff0000]afd!AfdFreeEndpointResources+0x157[/COLOR]
fffff880`035eeae0 fffff880`01d46c67 [COLOR=#ff0000]afd!AfdFreeEndpoint+0x21[/COLOR]
fffff880`035eeb10 fffff800`0357bc93 [COLOR=#ff0000]afd!AfdDoWork+0x67[/COLOR]
fffff880`035eeb40 fffff800`0328e261 nt!IopProcessWorkItem+0x23
fffff880`035eeb70 fffff800`0352073a nt!ExpWorkerThread+0x111
fffff880`035eec00 fffff800`032758e6 nt!PspSystemThreadStartup+0x5a
fffff880`035eec40 00000000`00000000 nt!KxStartSystemThread+0x16

NTFS_FILE_SYSTEM (24)

This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.



Right, okay, so this looks like hardware at this point (RAM, HDD, or motherboard).

1. First off, I am a little suspicious of your O2Micro SD Reader driver. With that said, for temporary troubleshooting purposes, please uninstall.

2. If the above fails, please run Memtest for NO LESS than ~8 passes (several hours):

Memtest86+:

Download Memtest86+ here:

Memtest86+ - Advanced Memory Diagnostic Tool

Which should I download?

You can either download the pre-compiled ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).

Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).

How Memtest works:

Memtest86 writes a series of test patterns to most memory addresses, reads back the data written, and compares it for errors.

The default pass does 9 different tests, varying in access patterns and test data. A tenth test, bit fade, is selectable from the menu. It writes all memory with zeroes, then sleeps for 90 minutes before checking to see if bits have changed (perhaps because of refresh problems). This is repeated with all ones for a total time of 3 hours per pass.

Many chipsets can report RAM speeds and timings via SPD (Serial Presence Detect) or EPP (Enhanced Performance Profiles), and some even support changing the expected memory speed. If the expected memory speed is overclocked, Memtest86 can test that memory performance is error-free with these faster settings.

Some hardware is able to report the "PAT status" (PAT: enabled or PAT: disabled). This is a reference to Intel Performance acceleration technology; there may be BIOS settings which affect this aspect of memory timing.

This information, if available to the program, can be displayed via a menu option.

Any other questions, they can most likely be answered by reading this great guide here:

FAQ : please read before posting

3. If Memtest goes at LEAST ~8 passes with no errors, please run Chkdsk (paste log afterwards) and then Seatools:

Chkdsk:
There are various ways to run Chkdsk~


Method 1:

Start > Search bar > Type cmd (right click run as admin to execute Elevated CMD)

Elevated CMD should now be opened, type the following:

chkdsk x: /r

x implies your drive letter, so if your hard drive in question is letter c, it would be:

chkdsk c: /r

Restart system and let chkdsk run.

Method 2:


Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.

If you'd like to get a log file that contains the chkdsk results, do the following:

Press Windows Key + R and type powershell.exe in the run box

Paste the following command and press enter afterwards:

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

This will output a .txt file on your Desktop containing the results of the chkdsk.

If chkdsk turns out okay, run Seatools -

SeaTools | Seagate

You can run it via Windows or DOS. Do note that the only difference is simply the environment you're running it in. In Windows, if you are having what you believe to be driver related issues that may cause conflicts or a false positive, it may be a wise decision to choose the most minimal testing environment (DOS). I always recommend running Seatools in DOS if absolutely possible.

-- Run all tests EXCEPT: Fix All and anything Advanced.
Regards,

Patrick
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Patrick,

Thanks for your continued assistance with this issue. I uninstalled the card reader (it's part of the laptop however, so it reinstalled itself when I rebooted...I have disabled the device however)

I wish I had better news, but the RAM test (I let it run for 11 passes) came back without issues.

I ran the chkdsk and it also came back clean.

I ran Seatools and the Short and Long test came back clean, but wanted to note that the "Short DST" test failed. Not sure if that is due to a manufacturer difference? I also want to note that the "drive information" crashed the Seatools program.

I've attached a .zip file with a screen shot of the RAM test, chkdsk log and Seatools results via snipits placed into a MS Word document.

View attachment 8225

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Can you run Seatools DOS if possible, please? Sounds like a bad drive to me.

Regards,

Patrick
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Patrick,

Do you know of a way to get that bootable CD iso onto a USB stick? I don't have an internal CD-ROM drive on this computer nor do I have an external one to use as a boot device. I attempted to use several ISO to USB utilities, however only one actually created the bootable media from the Seatools ISO, but when attempting to use it, it didn't load FreeDOS and I got the typical "remove media and reboot" message.

I'll be happy to run it if I can get it onto a USB stick successfully.

Thanks,

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

It got me further than I got prior...now I get a prompt that says "FreeDOS" with a flashing cursor after it and no matter what key I type, nothing happens...I let it sit for about 5 minutes without any change and THEN I hit the power button as Cntrl+Alt+Delete wouldn't reboot.

Coincidentally, after that, I attempted to come to this site to provide this update and it crashed again. When it came back up Chkdsk ran by itself to confirm consistency. Perhaps this is a hard drive problem...I'll attempt to run Dell's built in HD diagnostic tool and update the post.

Thanks Patrick,

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Patrick,

I really appreciate your assistance!

I've contacted Dell and they are sending out a replacement hard drive as well as a new motherboard today so that potentially "should" fix my issue based on your assumptions.

By Wednesday I should have the new parts installed and running for 24 hours, so if I find myself with further issues on this laptop, you'll be seeing me start up a new post.

Thank you again for all of your help!

Brian
 
Re: BSOD with multiple causes (Blue Screen View) even after Full Reload of Win 7

Your motherboard may not support booting from a USB. That may be why you're having trouble.

In any case, glad to hear Dell hasn't given you a hard time regarding replacement. I am sure this is a hardware error at this point, so ruling out the motherboard (one of my suspects) will help greatly.

Regards,

Patrick
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top