Windows 7: bsod s mostly before windows screen showing ...

suyac · 25 Aug 2010

Hi,

I've been getting a few bsod's lately and can't figure out what's the cause.
they mostly happen just before the windows screen to load, but there are some cases when they happen during various windows operations (nothing specific).

I attached the dump file from the latest restart...

Thank you,
Cristi

CarlTR6 · 25 Aug 2010

Hi Cristi. Welcome to the forum. I will take a look.

The stop error code in this dump file is 3B, SYSTEM_SERVICE_EXCEPTION. the usual causes are System service, Device driver, graphics driver, ?memory.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082410-16785-01.zip\082410-16785-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50
Debug session time: Tue Aug 24 03:50:04.388 2010 (GMT-4)
System Uptime: 0 days 0:53:35.980
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002dff0bf, fffff880072eebc0, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002dff0bf, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880072eebc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+233
fffff800`02dff0bf 4c395008        cmp     qword ptr [rax+8],r10

CONTEXT:  fffff880072eebc0 -- (.cxr 0xfffff880072eebc0)
rax=00000000000c4322 rbx=0000000000000001 rcx=fffffa800395c310
rdx=fffff8a00c0ba600 rsi=0000000000000000 rdi=fffff8a00a3edd80
rip=fffff80002dff0bf rsp=fffff880072ef590 rbp=0000000000000000
 r8=fffff8a00852b9e0  r9=fffff8a00c0ba890 r10=fffff8a00c0ba8a0
r11=0000000000000001 r12=fffffa800395c140 r13=0000000000000000
r14=0000000000000006 r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!ExDeferredFreePool+0x233:
fffff800`02dff0bf 4c395008        cmp     qword ptr [rax+8],r10 ds:002b:00000000`000c432a=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  SC2.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002dff0bf

STACK_TEXT:  
fffff880`072ef590 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x233


FOLLOWUP_IP: 
nt!ExDeferredFreePool+233
fffff800`02dff0bf 4c395008        cmp     qword ptr [rax+8],r10

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+233

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff880072eebc0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

Followup: Pool_corruption
---------

I noticed the error c0000005 in the dump which indicates memory corruption. I find several drivers on your system that can cause memory corruption We will start with this one.

ASACPI.sys Sun Mar 27 22:30:36 2005

Quote:

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

I also find another commons BSOD cause.

Quote:

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads

You can use MagicDisc as an alternative.

Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

I find other older drivers on your system that need updating. Win 7 does not like older drivers; they can and do cause memory corruption.

Quote:

AsUpIO.sys Sun Jul 05 22:21:38 2009
RTKVHD64.sys Fri May 22 14:04:20 2009
Rtnic64.sys Mon Mar 31 01:39:38 2008
usbVM303.sys Sun Mar 25 00:26:25 2007
vvftav303.sys Sat Jun 23 01:46:10 2007

Update these drivers from the manufacturers' websites rather than using Windows Update or Device Manager.

Quote:

How To Find Drivers:

Quote:

- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Please let us know if you need help in finding these drivers.

CarlTR6 · 25 Aug 2010

I have edited my post with additional information. Please refresh your screen.

Here is some help with the drivers.

vvftav303.sys - Filter 303, Vimicro Corporation. I think this may be a VIMICRO USB PC Camera (ZC0301PLH) Driver. Try to update this driver. If you cannot update it, uninstall the the hardware and the software. It is very obsolete.

usbVM303.sys - see above.

Rtnic64.sys - Realtek Ethernet NIC driver Realtek. Update this driver

RTKVHD64.sys - Realtek High Definition Audio Function Driver Realtek. Update this driver.

AsUpIO.sys - I think this is part of Asus PCProbe Utility ASUSTeK Computer Inc.-Support- Update this driver or update the utility.

Let us know if you need help.

suyac · 25 Aug 2010

thank you very much for you advices.
i will update all drivers mentioned and come back if the problem still persists.

Cristi.

suyac · 25 Aug 2010

ok , so i updated all except these 2 : vvftav303.sys + usbVM303.sys
i have a web camera but it is made by a4 tech (Welcome to www.A4Tech.com::Product).

how can i get rid of these 2 drivers (i guess i don't need them ?)

suyac · 29 Aug 2010

all went ok, no more bsods before windows screen so far.
now i was playing a sc2 game and i got another one, irq_not_less bla bla.

i attached the minidump, can you guys please take a look ?

Thank you,
Cristi

suyac · 29 Aug 2010

and another one 4 minutes apart ...

(

CarlTR6 · 29 Aug 2010

Quote: Originally Posted by suyac

ok , so i updated all except these 2 : vvftav303.sys + usbVM303.sys
i have a web camera but it is made by a4 tech (Welcome to www.A4Tech.com::Product).

how can i get rid of these 2 drivers (i guess i don't need them ?)

Using Windows Explore, navigate to c:\windows\system32\drivers. Find those two drivers and rename them from .sys to to .bak. Reboot. This way if anything breaks when you renmanr the drivers, you can reverse it by renaming them again.

Quote: Originally Posted by suyac

all went ok, no more bsods before windows screen so far.
now i was playing a sc2 game and i got another one, irq_not_less bla bla.

i attached the minidump, can you guys please take a look ?

Thank you,
Cristi

Quote: Originally Posted by suyac

and another one 4 minutes apart ...

(

I will take a look at the dumps.

CarlTR6 · 29 Aug 2010

You have a hardware problem. The first dump is error code A, IRQL_NOT_LESS_OR_EQUAL. The second dump is more telling. It is error code 124. Here is a link to read on error code 124 and what you need to do.

[2-Int] Stop 0x124 - what it means and what to try

Post back with any questions.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082910-19890-01.zip\082910-19890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50
Debug session time: Sun Aug 29 06:08:16.771 2010 (GMT-4)
System Uptime: 0 days 1:57:23.364
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8007f7d728, 2, 1, fffff80002ccfe32}

Probably caused by : ntkrnlmp.exe ( nt!KiTryUnwaitThread+182 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8007f7d728, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ccfe32, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f030e0
 fffffa8007f7d728 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiTryUnwaitThread+182
fffff800`02ccfe32 48894108        mov     qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  SC2.exe

TRAP_FRAME:  fffff880031225a0 -- (.trap 0xfffff880031225a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800410e100 rbx=0000000000000000 rcx=fffffa8007f7d720
rdx=fffffa8003a42168 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ccfe32 rsp=fffff88003122730 rbp=fffff880009e9180
 r8=0000000000000000  r9=0000000000000000 r10=fffff880009e9180
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!KiTryUnwaitThread+0x182:
fffff800`02ccfe32 48894108        mov     qword ptr [rcx+8],rax ds:3050:fffffa80`07f7d728=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ccaca9 to fffff80002ccb740

STACK_TEXT:  
fffff880`03122458 fffff800`02ccaca9 : 00000000`0000000a fffffa80`07f7d728 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`03122460 fffff800`02cc9920 : 00000000`00000000 fffffa80`03a42060 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`031225a0 fffff800`02ccfe32 : fffffa80`03b192a0 fffff880`0478af79 fffffa80`04de3480 fffff800`02d7f9f4 : nt!KiPageFault+0x260
fffff880`03122730 fffff800`02cd53f1 : fffffa80`0502ec18 fffffa80`0502ec18 00000000`00000000 fffffa80`0502ec10 : nt!KiTryUnwaitThread+0x182
fffff880`03122790 fffff800`02cd6d7d : fffffa80`0502ec10 fffffa80`03fb8488 fffffa80`03fb8488 00000000`00000000 : nt!KiTimerWaitTest+0x2d1
fffff880`03122810 fffff800`02cd74be : 00000010`662c2737 fffff880`03122e88 00000000`0006e3a6 fffff880`009eca48 : nt!KiProcessExpiredTimerList+0x6d
fffff880`03122e60 fffff800`02cd6cb7 : fffffa80`04f2acca fffffa80`0006e3a6 fffffa80`04f24000 00000000`000000a6 : nt!KiTimerExpiration+0x1be
fffff880`03122f00 fffff800`02cd1865 : 180b111c`0d131e0d fffffa80`0445f060 00000000`00000000 fffff880`04763480 : nt!KiRetireDpcList+0x277
fffff880`03122fb0 fffff800`02cd167c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`07ee9ba0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTryUnwaitThread+182
fffff800`02ccfe32 48894108        mov     qword ptr [rcx+8],rax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiTryUnwaitThread+182

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xA_nt!KiTryUnwaitThread+182

BUCKET_ID:  X64_0xA_nt!KiTryUnwaitThread+182

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082910-17768-01.zip\082910-17768-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c1e000 PsLoadedModuleList = 0xfffff800`02e5be50
Debug session time: Sun Aug 29 06:26:18.693 2010 (GMT-4)
System Uptime: 0 days 0:00:08.144
Loading Kernel Symbols
....................................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 124, {0, fffffa8004bca748, 0, 0}

Probably caused by : hardware

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa8004bca748, Address of the WHEA_ERROR_RECORD structure.
Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------


BUGCHECK_STR:  0x124_GenuineIntel

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`02fe06b0 fffff800`02ed8a89 : fffffa80`04bca720 fffffa80`039feb60 00000000`0000000c 00000000`00000001 : nt!WheapCreateLiveTriageDump+0x6c
fffff880`02fe0bd0 fffff800`02dba667 : fffffa80`04bca720 fffff800`02e335f8 fffffa80`039feb60 00000002`00000005 : nt!WheapCreateTriageDumpFromPreviousSession+0x49
fffff880`02fe0c00 fffff800`02d22c45 : fffff800`02e95360 fffffa80`04bb94f8 fffffa80`04bb94f0 fffffa80`039feb60 : nt!WheapProcessWorkQueueItem+0x57
fffff880`02fe0c40 fffff800`02c9b961 : fffff880`00c30e00 fffff800`02d22c20 fffffa80`039feb60 00000000`00000000 : nt!WheapWorkQueueWorkerRoutine+0x25
fffff880`02fe0c70 fffff800`02f32c06 : 00000000`00000000 fffffa80`039feb60 00000000`00000080 fffffa80`039e8b30 : nt!ExpWorkerThread+0x111
fffff880`02fe0d00 fffff800`02c6cc26 : fffff880`009e9180 fffffa80`039feb60 fffff880`009f3f40 000007fe`fbe489a0 : nt!PspSystemThreadStartup+0x5a
fffff880`02fe0d40 00000000`00000000 : fffff880`02fe1000 fffff880`02fdb000 fffff880`02fe09b0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_0x124_GenuineIntel_PROCESSOR_BUS_PRV

BUCKET_ID:  X64_0x124_GenuineIntel_PROCESSOR_BUS_PRV

Followup: MachineOwner
---------

Windows 7: bsod s mostly before windows screen showing ...

bsod s mostly before windows screen showing ... problems?