BSOD on start up.

Lulubop · 28 Jul 2010

Usually happens 1 or 2 times, then it won't happen for the rest of the day. Though the problems returns the next day. I've updated my video card drivers, as well as diagnosed any issues with my memory and Hard Drive, finding no issues. This seems to be effecting my Desktop Windows Manager as well.

Dump File 072810-20826-01.dmp
Crash Time 7/28/2010 1:23:43 PM
Bug Check String MEMORY_MANAGEMENT
Bug Check Code 0x0000001a
Parameter 1 00000000`00003452
Parameter 2 000007fe`fdc93000
Parameter 3 fffff700`01081170
Parameter 4 99d00001`2aab5024
Caused By Driver ntoskrnl.exe
Caused By Address ntoskrnl.exe+70600
File Description NT Kernel & System
Product Name Microsoft® Windows® Operating System
Company Microsoft Corporation
File Version 6.1.7600.16539 (win7_gdr.100226-1909)
Processor x64
Computer Name
Full Path C:\Windows\Minidump\072810-20826-01.dmp
Processors Count 4
Major Version 15
Minor Version 7600

Is it possible this can be related to an outdated Network adapter driver?

Jonathan_King · 28 Jul 2010

It is certainly possible.

Please follow these directions: https://www.sevenforums.com/crashes-d...tructions.html

Lulubop · 28 Jul 2010

After updating the drivers on my network card using the auto update my computer crashes anytime I try to open a browser. I am on my phone at the moment.

Tews · 28 Jul 2010

We really need the .dmp files... can you boot into safe mode and upload them?

Lulubop · 28 Jul 2010

Sorry.

Jonathan_King · 28 Jul 2010

Please enable driver verifier: Using Driver Verifier to identify issues with Drivers

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\DOCUME~1\JK\LOCALS~1\Temp\Temporary Directory 1 for bsod.zip\bsod\Windows7_BSOD_jcgriff2\072710-22947-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`0280b000 PsLoadedModuleList = 0xfffff800`02a48e50
Debug session time: Tue Jul 27 13:26:20.831 2010 (GMT-4)
System Uptime: 0 days 0:13:08.236
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3452, 940b000, fffff700010ae220, bb3000005466f866}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33a23 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 000000000940b000
Arg3: fffff700010ae220
Arg4: bb3000005466f866

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_3452

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028eefb3 to fffff8000287b600

STACK_TEXT:  
fffff880`0832cff8 fffff800`028eefb3 : 00000000`0000001a 00000000`00003452 00000000`0940b000 fffff700`010ae220 : nt!KeBugCheckEx
fffff880`0832d000 fffff800`0284e5a2 : fffffa80`05e33060 fffffa80`00001f05 fffff8a0`00001dd0 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x33a23
fffff880`0832d8b0 fffff800`02b61c4f : fffff8a0`02480a70 fffff880`0832dc20 00000000`00000000 fffffa80`03dfeb60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0832d900 fffff800`02b3a4d1 : 00000000`c0000005 fffff800`02898f01 000007ff`fffac000 fffffa80`05e9cb60 : nt!PspExitThread+0x92f
fffff880`0832d9c0 fffff800`028580e3 : 00000000`00000000 fffff880`0832db40 00000000`00000000 fffff800`02876df0 : nt!PsExitSpecialApc+0x1d
fffff880`0832d9f0 fffff800`02858520 : 00000000`08f5fa10 fffff880`0832da70 fffff800`02b3a5dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0832da70 fffff800`0287a8f7 : fffffa80`03dfeb60 00000000`08f5f8f8 fffff880`0832dbc8 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`0832dbb0 00000000`7767030a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`08f5f8d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7767030a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33a23
fffff800`028eefb3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33a23

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+33a23

BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+33a23

Followup: MachineOwner
---------

Lulubop · 28 Jul 2010

I have it enable following all the steps, but I'm curious as to how I find the memory dump file if/when the blue screen does occur. Or is it the same process I already posted.

Thanks.

Jonathan_King · 28 Jul 2010

It's the same process you used to upload the other dumps.

Lulubop · 29 Jul 2010

Well, since starting the Verifier I have yet to have a BSOD. I like it's safe to rule out any drivers being the issue and I believe the issue is actually with the Memory. Browsing around the board, I ran into a topic where the poster had a similar issue of only getting BSOD on start up and only in the morning after hours of not using there computer. I used the Memok feature that comes with the Mobo and no BSOD for the first time in a few days. I have no idea if this is nothing more than a quick fix, but it seems to be fine for now. Though my desktop windows manager still enables and disables itself during the first few minutes of start up with out warning. Weather that's related to the BSOD I don't know.

**cluberti** · 29 Jul 2010

It looks like, according to the dump that JK posted, the MmCleanProcessAddressSpace function was actually called by MiDeleteAllHashMappings:

Code:

1: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff880`0832cff8 fffff800`028eefb3 nt!KeBugCheckEx
01 fffff880`0832d000 fffff800`0284e5a2 nt! ?? ::FNODOBFM::`string'+0x33a23
02 fffff880`0832d8b0 fffff800`02b61c4f nt!MmCleanProcessAddressSpace+0x96
03 fffff880`0832d900 fffff800`02b3a4d1 nt!PspExitThread+0x92f
04 fffff880`0832d9c0 fffff800`028580e3 nt!PsExitSpecialApc+0x1d
05 fffff880`0832d9f0 fffff800`02858520 nt!KiDeliverApc+0x2eb
06 fffff880`0832da70 fffff800`0287a8f7 nt!KiInitiateUserApc+0x70
07 fffff880`0832dbb0 00000000`7767030a nt!KiSystemServiceExit+0x9c
08 00000000`08f5f8d8 00000000`00000000 0x7767030a

1: kd> u fffff800`0284e5a2
nt!MmCleanProcessAddressSpace+0x96:
fffff800`0284e5a2 488d8e98030000  lea     rcx,[rsi+398h]
fffff800`0284e5a9 e8920c0000      call    nt!MiDeleteAllHashMappings (fffff800`0284f240)
fffff800`0284e5ae 488bc3          mov     rax,rbx
fffff800`0284e5b1 f0480fc18698030000 lock xadd qword ptr [rsi+398h],rax
fffff800`0284e5ba a802            test    al,2
fffff800`0284e5bc 0f853e990a00    jne     nt! ?? ::FNODOBFM::`string'+0x3db00 (fffff800`028f7f00)
fffff800`0284e5c2 80a750040000f7  and     byte ptr [rdi+450h],0F7h
fffff800`0284e5c9 664401afc6010000 add     word ptr [rdi+1C6h],r13w

It looks like, ultimately, cleaning up process space is causing issues on this box. Most of the dumps are exactly the same in exactly the same spot in svchost.exe code, so I'd say it's not very likely this is a hardware or RAM issue, but perhaps a refcount issue in svchost or one of your kernel filter drivers. I'd be taking these to Microsoft PSS, honestly, and getting them to work with you on this.