Random BSODs in W7 Enterprise 64 bit

peibol · 25 Aug 2010

Hi all:

It's been three weeks since I mounted my PC and I haven't been able to properly set up my system with W7. After diving into the forums I can't get the rigth solution, so I've decided to ask for some help.

- Windows 7 Enterprise 64 bit (also tried with Proffesional 64 bit)
- The system is brand new (but the primary HD is 2 years old, SATA and the GPU, 3 years old)
- Motherboard Asus P7P55D, Intel i5-750, 4GB DDR3 RAM, nvidia 7600GS 256MB
- Windows update totally executed (but the language packs)
- Full retail version. Original, I work in the University and the license is valid for the crew.
- Regarding the age of OS installation... This installation is running since 3 or 4 days ago, but since I mounted the PC a month ago I've been trying and reinstalling several times. Initially I thought the problem was with the DVB tuner, but this time I removed it from the very beginning of the installation... and BSODs are appearing.

I attach the info files.
Cheers!!

CarlTR6 · 25 Aug 2010

Hi peibol. Welcome to the forum. I will take a look at your your info.

Error code 1A, MEMORY_MANAGEMENT. Usual causes are Device driver, memory, kernel

Error code 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M. Usual causes are Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control

Unfortunately, the dumps do give us a specific cause; but they do tell where we will need to look for the cause.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_info.zip\Windows7_BSOD_jcgriff2\082510-27846-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02819000 PsLoadedModuleList = 0xfffff800`02a56e50
Debug session time: Wed Aug 25 12:33:16.897 2010 (GMT-4)
System Uptime: 0 days 3:16:35.958
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000f2a5d0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000f2a5d0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028fcf9e to fffff80002889740

STACK_TEXT:  
fffff880`0818a828 fffff800`028fcf9e : 00000000`0000001a 00000000`00041790 fffffa80`00f2a5d0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0818a830 fffff800`028bcdf9 : 00000000`00000000 00000000`0f6eefff fffffa80`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`0818a9f0 fffff800`02ba21d0 : fffffa80`0ada2cc0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0818ab10 fffff800`02ba25db : 00000000`00000000 00000000`0f260000 fffffa80`00000001 fffffa80`05ec58e0 : nt!MiUnmapViewOfSection+0x1b0
fffff880`0818abd0 fffff800`02888993 : fffffa80`070d2b60 fffff880`0818aca0 fffffa80`07046060 fffffa80`05805da0 : nt!NtUnmapViewOfSection+0x5f
fffff880`0818ac20 00000000`77c6fffa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0bffe148 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c6fffa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33906
fffff800`028fcf9e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33906

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_info.zip\Windows7_BSOD_jcgriff2\082510-30997-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02803000 PsLoadedModuleList = 0xfffff800`02a40e50
Debug session time: Wed Aug 25 09:14:52.910 2010 (GMT-4)
System Uptime: 0 days 0:08:14.971
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff800029a7000, fffff88003185778, fffff88003184fe0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+174 )

Followup: Pool_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800029a7000, The address that the exception occurred at
Arg3: fffff88003185778, Exception Record Address
Arg4: fffff88003184fe0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+174
fffff800`029a7000 4c395008        cmp     qword ptr [rax+8],r10

EXCEPTION_RECORD:  fffff88003185778 -- (.exr 0xfffff88003185778)
ExceptionAddress: fffff800029a7000 (nt!ExDeferredFreePool+0x0000000000000174)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000013c40f4d
Attempt to read from address 0000000013c40f4d

CONTEXT:  fffff88003184fe0 -- (.cxr 0xfffff88003184fe0)
rax=0000000013c40f45 rbx=0000000000000004 rcx=fffffa800365e6c0
rdx=fffff8a003a74690 rsi=0000000000000000 rdi=fffff8a003916010
rip=fffff800029a7000 rsp=fffff880031859b0 rbp=0000000000000000
 r8=fffff8a003a2d790  r9=fffff8a003a74460 r10=fffff8a003a74470
r11=0000000000000001 r12=fffffa800365e500 r13=0000000000000000
r14=000000000000000a r15=0000000000000001
iopl=0         nv up ei ng nz ac po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
nt!ExDeferredFreePool+0x174:
fffff800`029a7000 4c395008        cmp     qword ptr [rax+8],r10 ds:002b:00000000`13c40f4d=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000013c40f4d

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aab0e0
 0000000013c40f4d 

FOLLOWUP_IP: 
nt!ExDeferredFreePool+174
fffff800`029a7000 4c395008        cmp     qword ptr [rax+8],r10

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff800029a84c1 to fffff800029a7000

STACK_TEXT:  
fffff880`031859b0 fffff800`029a84c1 : 00000000`00000000 fffff8a0`039161a0 00000000`00000000 fffffa80`036eab60 : nt!ExDeferredFreePool+0x174
fffff880`03185a40 fffff800`02849c09 : fffff8a0`03b0bd60 fffff8a0`03b0bda0 fffff800`6d695346 fffff8a0`03b0b270 : nt!ExFreePoolWithTag+0x411
fffff880`03185af0 fffff880`01238646 : fffff880`01238550 00000000`00000001 fffff880`01238550 fffffa80`00000313 : nt!FsRtlUninitializeBaseMcb+0x41
fffff880`03185b20 fffff800`02880961 : fffffa80`036eab60 fffff880`03185b50 00000000`00000000 fffffa80`00000003 : Ntfs!NtfsMcbCleanupLruQueue+0xf6
fffff880`03185cb0 fffff800`02b17c06 : 01cb3e31`3529aba4 fffffa80`036eab60 00000000`00000080 fffffa80`0366d9e0 : nt!ExpWorkerThread+0x111
fffff880`03185d40 fffff800`02851c26 : fffff880`02f63180 fffffa80`036eab60 fffff880`02f6dfc0 00010000`000009d8 : nt!PspSystemThreadStartup+0x5a
fffff880`03185d80 00000000`00000000 : fffff880`03186000 fffff880`03180000 fffff880`031859f0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+174

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff88003184fe0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExDeferredFreePool+174

BUCKET_ID:  X64_0x7E_nt!ExDeferredFreePool+174

Followup: Pool_corruption
---------

The problem appears to be corrupted memory as evidenced by this error code, c0000005. This may not be bad RAM as many thing can corrupt memory.

Two thing jump out immediately:

1. ASACPI.sys Sun Mar 27 22:30:36 2005.

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt

Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

2. I recommend that you uninstall AVG while you are troubleshooting. AVG is know to cause BSOD's on some Win 7 systems. Download and install Microsoft Security Essentials in its place.

After you have updated ASACPI.sys, uninstalled AVG, and installed MSE, run your system and let's see if you get another BSOD. If you do, the next step will be to test your RAM.

Post back and let us know. Upload any additional dumps you get.

peibol · 25 Aug 2010

Thanks for the quick answer CarlTR6.

I did a MemTest86 test (overnight, the full standard tests) and it was a complete success.

If it may help, the memory data is: OCZ DDR3 PC3-12800 Obsidian 4Gb (2x2048) - CL9 Low voltage. I know they are made for 1600MHz and that the processor supports up to 1333, but it's supposed there is no problem with "down-speeding".

CarlTR6 · 25 Aug 2010

You are welcome and thanks for the additional information. At this point I suspect that driver and possibly AVG are the causes.

peibol · 25 Aug 2010

Well, I've done the homework. Installed the ATK (ASACPI) from ASUS and restarted, checked it's from 2009, uninstalled AVG and restarted again and MSE is being updated by now.

I will restart and i will post back within a week if there is no bsod problems...

Thanks

CarlTR6 · 25 Aug 2010

Excellent. I hope you will be BSOD free and the fix is this simple! :)

peibol · 25 Aug 2010

Arrg, I've just woken up and the first thing I've seen is the bsod

The info is attached.

Cheers!

**cluberti** · 25 Aug 2010

It's another memory management dump, but this one looks like someone is attempting to free a PTE that still has a PFN handle reference, so there is likely a driver on here misbehaving (actually, VERY likely). I'm going to suggest enabling driver verifier, rebooting, and using the system as normal to see if it gets another BSOD (hopefully it will, and will show us what's doing this).

peibol · 26 Aug 2010

Thanks.
I'm proceeding in that way enabling the driver verifier.
I'll post it back.

peibol · 26 Aug 2010

I've already got the BSOD. What kind of report should I attach? The dump files? (I'm writing from another PC, so the BSOD is still in the target PC)

Should I disable driver verifier after rebooting?