BSOD, Need A Hand

plue · 26 Jul 2010

Hello everyone,

I found this forum (luckily) in the process of trying to resolve the Blue Screens I have gotten the last couple times. I have recently updated my BIOS as well as downloaded some Graphics Drivers from Nvidia. Not sure which is causing the problem, if either.

Windows 7 . . .
- x64
- the original installed OS on the system is W7
- full retail version

- System is less than one year old.
- Age of the OS installation is same as the hardware, so it's quite recent.
The error message I got was:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 1033

Additional information about the problem:
BCCode: 3b
BCP1: 00000000C0000005
BCP2: FFFFF80002BB8327
BCP3: FFFFF880092AC850
BCP4: 0000000000000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\072610-19874-01.dmp
C:\Users\Freywala\AppData\Local\Temp\WER-31886-0.sysdata.xml

Thanks in advance for any help you guys could give me.

plue

Lordbob75 · 26 Jul 2010

First off, lets try putting the BIOS back to the default it came with, and see if that is solved.
If not, then revert the GPU driver update as well.

All 3 BSoDs could have been caused by memory or hardware, so I would guess the BIOS update is the culprit.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Windows7_BSOD_jcgriff2.zip\Windows7_BSOD_jcgriff2\042310-20687-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Thu Apr 22 23:19:05.139 2010 (UTC - 7:00)
System Uptime: 0 days 4:07:41.436
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41201, fffff68000200100, cae00002bd22e447, fffffa800e05cc50}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13bb2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: fffff68000200100
Arg3: cae00002bd22e447
Arg4: fffffa800e05cc50

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41201

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  iw4mp.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ae357e to fffff80002a83600

STACK_TEXT:  
fffff880`0bec39b8 fffff800`02ae357e : 00000000`0000001a 00000000`00041201 fffff680`00200100 cae00002`bd22e447 : nt!KeBugCheckEx
fffff880`0bec39c0 fffff800`02a51ace : 00000000`00060000 fffffa80`0d56eb60 00000000`00000000 cae00002`bd22e447 : nt! ?? ::FNODOBFM::`string'+0x13bb2
fffff880`0bec3a00 fffff800`02a5176a : fffffa80`0e05cc50 fffffa80`0d2c1b30 fffffa80`0d2c1b30 00000000`40020000 : nt!MiQueryAddressState+0x2ae
fffff880`0bec3a50 fffff800`02d6bac8 : fffff880`00000004 00000000`40021000 fffffa80`0e05cc50 fffff800`00000000 : nt!MiQueryAddressSpan+0xaa
fffff880`0bec3ac0 fffff800`02a82853 : 00000000`00000240 fffffa80`0d56eb60 fffff880`0bec3bc8 00000000`0bede798 : nt!NtQueryVirtualMemory+0x386
fffff880`0bec3bb0 00000000`775300ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0bede778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775300ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+13bb2
fffff800`02ae357e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+13bb2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13bb2

BUCKET_ID:  X64_0x1a_41201_nt!_??_::FNODOBFM::_string_+13bb2

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Windows7_BSOD_jcgriff2.zip\Windows7_BSOD_jcgriff2\072510-21496-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a63000 PsLoadedModuleList = 0xfffff800`02ca0e50
Debug session time: Sun Jul 25 21:22:55.328 2010 (UTC - 7:00)
System Uptime: 0 days 1:05:40.405
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002adb7c4, fffff88008b34848, fffff88008b340b0}

Probably caused by : ntkrnlmp.exe ( nt!ExAcquireResourceExclusiveLite+54 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002adb7c4, The address that the exception occurred at
Arg3: fffff88008b34848, Exception Record Address
Arg4: fffff88008b340b0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExAcquireResourceExclusiveLite+54
fffff800`02adb7c4 f0480fba696000  lock bts qword ptr [rcx+60h],0

EXCEPTION_RECORD:  fffff88008b34848 -- (.exr 0xfffff88008b34848)
ExceptionAddress: fffff80002adb7c4 (nt!ExAcquireResourceExclusiveLite+0x0000000000000054)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000060
Attempt to write to address 0000000000000060

CONTEXT:  fffff88008b340b0 -- (.cxr 0xfffff88008b340b0)
rax=0000000000000702 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff8a00838b100 rsi=fffff8a00838b200 rdi=fffff80002c4de80
rip=fffff80002adb7c4 rsp=fffff88008b34a80 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff8800127d980
r11=fffff88008b34b50 r12=0000000000000000 r13=0000000000000001
r14=fffffa800ca73040 r15=0000000000010001
iopl=0         nv up di pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010046
nt!ExAcquireResourceExclusiveLite+0x54:
fffff800`02adb7c4 f0480fba696000  lock bts qword ptr [rcx+60h],0 ds:002b:00000000`00000060=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000060

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0b0e0
 0000000000000060 

FOLLOWUP_IP: 
nt!ExAcquireResourceExclusiveLite+54
fffff800`02adb7c4 f0480fba696000  lock bts qword ptr [rcx+60h],0

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff8800124d142 to fffff80002adb7c4

STACK_TEXT:  
fffff880`08b34a80 fffff880`0124d142 : 00000000`00000001 fffff8a0`0838b270 fffff800`02c785a0 fffff880`0127eea0 : nt!ExAcquireResourceExclusiveLite+0x54
fffff880`08b34af0 fffff880`012535f3 : fffff880`01253550 fffff880`01253550 fffff800`02c785a0 fffffa80`0ca73040 : Ntfs!NtfsLockNtfsMcb+0x22
fffff880`08b34b20 fffff800`02ae0861 : fffffa80`0ca73040 fffff880`08b34b50 00000000`00000000 00000000`00000003 : Ntfs!NtfsMcbCleanupLruQueue+0xa3
fffff880`08b34cb0 fffff800`02d78a86 : 00000000`06236217 fffffa80`0ca73040 00000000`00000080 fffffa80`0a35e040 : nt!ExpWorkerThread+0x111
fffff880`08b34d40 fffff800`02ab1b06 : fffff880`02f64180 fffffa80`0ca73040 fffffa80`0a38e680 00000000`00000246 : nt!PspSystemThreadStartup+0x5a
fffff880`08b34d80 00000000`00000000 : fffff880`08b35000 fffff880`08b2f000 fffff880`08b349f0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAcquireResourceExclusiveLite+54

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88008b340b0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExAcquireResourceExclusiveLite+54

BUCKET_ID:  X64_0x7E_nt!ExAcquireResourceExclusiveLite+54

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_Windows7_BSOD_jcgriff2.zip\Windows7_BSOD_jcgriff2\072610-19874-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Mon Jul 26 14:43:18.109 2010 (UTC - 7:00)
System Uptime: 0 days 0:22:20.218
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002bb8327, fffff880092ac850, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+277 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bb8327, Address of the instruction which caused the bugcheck
Arg3: fffff880092ac850, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExFreePoolWithTag+277
fffff800`02bb8327 458b8780000000  mov     r8d,dword ptr [r15+80h]

CONTEXT:  fffff880092ac850 -- (.cxr 0xfffff880092ac850)
rax=0000000000000200 rbx=fffff8a0031f30c0 rcx=00000000000021e3
rdx=fffff8800316a180 rsi=0000000000000003 rdi=0000000000000001
rip=fffff80002bb8327 rsp=fffff880092ad220 rbp=0000000000000000
 r8=0000000000010f18  r9=0000000000000020 r10=fffff80002a13000
r11=00000000000006c7 r12=0000000000000002 r13=fffff8a0031f30d0
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExFreePoolWithTag+0x277:
fffff800`02bb8327 458b8780000000  mov     r8d,dword ptr [r15+80h] ds:002b:00000000`00000080=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iw4mp.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002bb8327

STACK_TEXT:  
fffff880`092ad220 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExFreePoolWithTag+0x277


FOLLOWUP_IP: 
nt!ExFreePoolWithTag+277
fffff800`02bb8327 458b8780000000  mov     r8d,dword ptr [r15+80h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExFreePoolWithTag+277

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff880092ac850 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExFreePoolWithTag+277

BUCKET_ID:  X64_0x3B_nt!ExFreePoolWithTag+277

Followup: MachineOwner
---------

~Lordbob

plue · 26 Jul 2010

Thank you for the response Lordbob.

Would you happen to know how I could revert to my previous BIOS version? The one I had originally was the one that was originally there, and this was my first ever flash.

Sorry if this is a silly question, I'm a bit of a 'noob'.

Lordbob75 · 26 Jul 2010

The same way that you upgraded it, just with the previous version of the BIOS instead.

~Lordbob

plue · 26 Jul 2010

Is there a way to find which version of the BIOS I had earlier? Unfortunately I did not record it before I started installing the new one.

Lordbob75 · 26 Jul 2010

Try using the next newest one.

~Lordbob

plue · 26 Jul 2010

The thing is, it is the newest one available on the Evga site.

Lordbob75 · 26 Jul 2010

plue said:

The thing is, it is the newest one available on the Evga site.

No, the NEXT newest one. So the one that came out just BEFORE the newest one.

~Lordbob

plue · 26 Jul 2010

Thank you for clarifying. I'll try your suggestion ASAP, and update my condition. Thanks so much for the help so far.

CarlTR6 · 26 Jul 2010

I suggest that you uninstall AVG antivirus and install Microsoft Security Essentials in its place while you are troubleshooting. AVG is known to cause BSOD's on some Win 7 systems. After you get your sytem running smoothly, you can reinstall AVG and see what happens. However, I recommend that you stay with MSE or Avast.

I also found three older drivers on your system. Win 7 generally does not like older drivers. I cannot say these drivers are causing your BSOD's; but I can say they do contribute to the stability of your system. The critcal one to update is UsbFltr.sys dated 2007.

Try to update your drivers from the manufacturers' sites instead of using Windows Update or through Device Manager.

mcdbus.sys Tue Feb 24 05:34:07 2009 - MagicISO SCSI Host Controller belongs to the software MagicDisc or Driver for MagicISO SCSI Host Controller by MagicISO, Inc.

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Realtek 8101E/8168/8169 NDIS 6.20 64-bit Driver for Realtek 8101E/8168/8169 PCI/PCIe Adapters (network driver)

UsbFltr.sys Mon Apr 09 06:09:44 2007 - Usbfltr.sys is an Ortek USB Keypad Driver is a driver file from company Waytech Development, Inc. belonging to product Ortek USB Keypad. ORtek Download

Update these drivers, reboot and post back. If you need help, don't hesitate to ask.