BSOD Restarting W7 Pro 64 Computer

rkelly12 · 25 Aug 2010

Hi - Per instructions on crashes, attached is zip file with BSOD reports and health report. Problem started this am with shutdowns due to DCOM server process launcher service has terminated unexpectedly. DCOM message stopped showing up and system is just rebooting with BSOD about every 10 minutes. Any guidance is appreciated.
Win 7 Pro 64bit.
Asus P5B MB, Intel C2D 6600,
Original W7 install in effect about 9 months, have not reinstalled.
Is a retail version, not OEM.
Has been a very stable system until today.

Thanks in advance for any help.

P.S. I do run Comodo FW and AV. Also ran Malwarebytes today with nothing found. Actually Malwarebytes got about 10 minutes in and the system reboot.
Thanks.

zigzag3143 · 25 Aug 2010

rkelly12 said:

Hi - Per instructions on crashes, attached is zip file with BSOD reports and health report. Problem started this am with shutdowns due to DCOM server process launcher service has terminated unexpectedly. DCOM message stopped showing up and system is just rebooting with BSOD about every 10 minutes. Any guidance is appreciated.
Win 7 Pro 64bit.
Asus P5B MB, Intel C2D 6600,
Original W7 install in effect about 9 months, have not reinstalled.
Is a retail version, not OEM.
Has been a very stable system until today.

Thanks in advance for any help.

These span the period from mar 24 till aug 25. They are caused by memory corruption. To test yours

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

I would also run a system file check

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

Let us know the results from the report at the end.

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows7_BSOD_jcgriff2\052410-10453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0a85a000 PsLoadedModuleList = 0xfffff800`0aa97e50
Debug session time: Mon May 24 10:29:27.668 2010 (GMT-4)
System Uptime: 0 days 0:19:27.200
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff683807f8260, 0, fffff8000a8dfae2, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+1c2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff683807f8260, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000a8dfae2, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000ab020e0
 fffff683807f8260 

FAULTING_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`0a8dfae2 488b19          mov     rbx,qword ptr [rcx]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  wuauclt.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880031167a0 -- (.trap 0xfffff880031167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000007ffffffff8 rbx=0000000000000000 rcx=fffff683807f8260
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000a8dfae2 rsp=fffff88003116930 rbp=00000003807f8266
 r8=0000000000000001  r9=fffffa80023f83f8 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!MiAgeWorkingSet+0x1c2:
fffff800`0a8dfae2 488b19          mov     rbx,qword ptr [rcx] ds:fffff683`807f8260=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000a949b91 to fffff8000a8cbf00

STACK_TEXT:  
fffff880`03116638 fffff800`0a949b91 : 00000000`00000050 fffff683`807f8260 00000000`00000000 fffff880`031167a0 : nt!KeBugCheckEx
fffff880`03116640 fffff800`0a8c9fee : 00000000`00000000 00000980`00000000 00000000`00001000 fffff800`0a9febfe : nt! ?? ::FNODOBFM::`string'+0x40f5b
fffff880`031167a0 fffff800`0a8dfae2 : 00000000`000032f0 00000000`00000001 00000000`00000000 00000000`000032ed : nt!KiPageFault+0x16e
fffff880`03116930 fffff800`0a94ca0e : fffffa80`023f83f8 fffff880`00000001 00000000`00000001 fffff880`03116bb0 : nt!MiAgeWorkingSet+0x1c2
fffff880`03116ae0 fffff800`0a8e06e2 : 00000000`0000048f 00000000`00000000 fffffa80`00000000 00000000`00000003 : nt! ?? ::FNODOBFM::`string'+0x49926
fffff880`03116b80 fffff800`0a8e096f : 00000000`00000008 fffff880`03116c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03116bd0 fffff800`0ab6f166 : fffffa80`02454550 00000000`00000080 fffffa80`02430b30 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03116d40 fffff800`0a8aa486 : fffff800`0aa44e80 fffffa80`02454550 fffff800`0aa52c40 ff3f3bff`2f1f3f1d : nt!PspSystemThreadStartup+0x5a
fffff880`03116d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+1c2
fffff800`0a8dfae2 488b19          mov     rbx,qword ptr [rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+1c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1c2

BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+1c2

Followup: MachineOwner
---------

Old drivers that need updating

Code:

ASACPI.sys fffff880`03e87000 fffff880`03e8f000 0x00008000 0x42476c4c 3/27/2005 22:30:36 GizmoDrv.SYS fffff880`03de2000 fffff880`03ded000 0x0000b000 0x482fbd72 5/18/2008 01:24:02 yk62x64.sys fffff880`01800000 fffff880`01863000 0x00063000 0x49a2ba83 2/23/2009 11:02:27 spldr.sys fffff880`015f1000 fffff880`015f9000 0x00008000 0x4a0858bb 5/11/2009 12:56:27 nvlddmkm.sys fffff880`048f8000 fffff880`053ffb00 0x00b07b00 0x4a0c8387 5/14/2009 16:48:07 GEARAspiWDM.sys fffff880`03e8f000 fffff880`03e9c000 0x0000d000 0x4a1151c0 5/18/2009 08:17:04 amdxata.sys fffff880`00dec000 fffff880`00df7000 0x0000b000 0x4a12f2eb 5/19/2009 13:56:59 LHidFilt.Sys fffff880`028cb000 fffff880`028de000 0x00013000 0x4a391ea3 6/17/2009 12:49:39 LMouFilt.Sys fffff880`028de000 fffff880`028f2000 0x00014000 0x4a391ea7 6/17/2009 12:49:43 LEqdUsb.Sys fffff880`0289f000 fffff880`028b6000 0x00017000 0x4a391eb2 6/17/2009 12:49:54 LHidEqd.Sys fffff880`028c3000 fffff880`028cb000 0x00008000 0x4a391eb4 6/17/2009 12:49:56

CarlTR6 · 25 Aug 2010

Wow, that is a lot of dump files. Ken got it; follow his instructions.

In addition to what Ken suggested, I found this driver which is almost a guarantee of a BSOD:

ASACPI.sys Sun Mar 27 22:30:36 2005

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt

Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.

Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

In addition to the above driver, I find other out of date driver. Win 7 does not like older drivers. They can and do cause memory corruption. Update these drivers:

GizmoDrv.SYS Sun May 18 01:24:02 2008
LEqdUsb.Sys Wed Jun 17 12:49:54 2009
LHidEqd.Sys Wed Jun 17 12:49:56 2009
LHidFilt.Sys Wed Jun 17 12:49:39 2009
LMouFilt.Sys Wed Jun 17 12:49:43 2009
nvlddmkm.sys Thu May 14 16:48:07 2009
yk62x64.sys Mon Feb 23 10:02:27 2009

How To Find Drivers:

- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

If you need help with the drivers, please post.

rkelly12 · 25 Aug 2010

Thanks.

Weird that I don't get any crashes during the 10-15 hours/day that I work on it for the past 9 mo. Sometimes in the am if I left the computer on, it rebooted during the night. Never knew why, but not during day.

I have memtest from when I built the system and ran it for 10 hours with no errors. Will run again and do the scan and post back.

Thank you in advance.

Tews · 25 Aug 2010

And update those drivers!!!!

rkelly12 · 25 Aug 2010

tr6 - I am downloading the drivers. after i unzip the asacpi.sys file and go into the 64 directory, how do I update? Should I just copy these into the windows/system32/directory?

CarlTR6 · 25 Aug 2010

Unzip. There should be an installer file there. It will be an .exe file. Double click on it.

rkelly12 · 26 Aug 2010

Updated the drivers as directed.
Ran SFC /SCANNOW with no problems found.
Ran memtest86 overnight but system was locked up this am (no bsod though, just black screen).

This system has been running overclocked for a year it's an e6600 and has been running about 3.5mhz. I backed off the overclock and lowered the voltage at the same time as above.

The system has settled down significantly. Have not had crash in hours. Can memory or the CPU begin having problems when overclocked for a long time ... like can they start not being able to sustain as much OCing?

Thank you everybody for your help! You guys are great!
I appreciate your help tremendously.

CarlTR6 · 26 Aug 2010

Yes, overclocking can do weird things and show up later. It definitely can lead to premature failures. This may well be your fix. Now that you have reduced your overclocking (I recommend returning to stock and then OC in small increments testing before another increase), try Memtest again and lets make sure your RAM is OK and not damaged.

rkelly12 · 26 Aug 2010

Will start running it now and work on a different computer. Will post back. Thanks.