Windows 7: Daily Blue Screens

MustangCSA · 28 Aug 2010

I recently installed Windows 7 Ultimate x64 on my computer. It was a fresh retail install. I was getting a lot of BSOD the first day I installed it, and after searching around the web and these forums I figured I just needed to update as many drivers as I could. So I installed all the drivers from the ASUS website, Logitech, HP and anything else I could think of that was connected to my PC. And everything seemed great after that. Windows 7 ran for like 3 days without a single hiccup, then today it started again. So if anyone is kind enough to look through the info I attached to see if they can find anything I would really appreciate it. I think I included all the information I needed to, let me know if you need something else. Thanks.

zigzag3143 · 28 Aug 2010

Quote: Originally Posted by MustangCSA

I recently installed Windows 7 Ultimate x64 on my computer. It was a fresh retail install. I was getting a lot of BSOD the first day I installed it, and after searching around the web and these forums I figured I just needed to update as many drivers as I could. So I installed all the drivers from the ASUS website, Logitech, HP and anything else I could think of that was connected to my PC. And everything seemed great after that. Windows 7 ran for like 3 days without a single hiccup, then today it started again. So if anyone is kind enough to look through the info I attached to see if they can find anything I would really appreciate it. I think I included all the information I needed to, let me know if you need something else. Thanks.

These are all caused by memory corruption. This may be being casued by a browser helper object (CI.DLL)

What browser are you using, and what addons? does this happen mostly when you are surfing?

You should test your memory

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Let us know the answer and results

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082810-26925-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
Debug session time: Sat Aug 28 20:22:38.850 2010 (GMT-4)
System Uptime: 0 days 0:05:29.489
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88000d5d66f, fffff8800393dc50, 0}

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88000d5d66f, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800393dc50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
CI!MFKeyIsTrustedRootKey+70b3
fffff880`00d5d66f 8b1488          mov     edx,dword ptr [rax+rcx*4]

CONTEXT:  fffff8800393dc50 -- (.cxr 0xfffff8800393dc50)
rax=000000005c790166 rbx=000000004f8a0f19 rcx=000000000000060f
rdx=24884ddc78288c6a rsi=00000000024884dd rdi=000000005ca0c1b6
rip=fffff88000d5d66f rsp=fffff8800393e628 rbp=000000008288c6a0
 r8=000000001f8d699f  r9=000000005ca0c1b6 r10=fffff88000d9c0d0
r11=fffff8800393e7a0 r12=0000000000000002 r13=fffff8a00000a3d0
r14=0000000000000160 r15=0ffffffffffffff0
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
CI!MFKeyIsTrustedRootKey+0x70b3:
fffff880`00d5d66f 8b1488          mov     edx,dword ptr [rax+rcx*4] ds:002b:00000000`5c7919a2=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88000d5d66f

STACK_TEXT:  
fffff880`0393e628 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!MFKeyIsTrustedRootKey+0x70b3


CHKIMG_EXTENSION: !chkimg -lo 50 -d !CI
    fffff88000d5d662 - CI!MFKeyIsTrustedRootKey+70a6
    [ 44:40 ]
1 error : !CI (fffff88000d5d662)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffff8800393dc50 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

MustangCSA · 28 Aug 2010

Hi thanks for the quick reply. I'm using Firefox 3.6.8 as my browser, and the only add-ons i have installed are Adblock Plus, Gmail Watcher, Hp Smart Web Printing (It came with the driver download) and then there are two Java Console (6.0.21 and 6.0.20) in the Add-ons window. I seems to happen whether or not I'm using the browser, like it will happen after a reboot or just with the comp sitting there. I'm pretty sure its not the RAM, I went a couple months with G.Skill going back and forth because of a few bad sticks I got from them. The ram currently in there has all been tested individually. Each stick has gone over 12 hours of memtest without any errors, and then all four sticks together have gone 24 hours without any errors. They are running at their stock speeds (800) with a 2N command rate.

**cluberti** · 28 Aug 2010

If you're sure the RAM is OK, then it's time to enable driver verifier and get another dump.

zigzag3143 · 28 Aug 2010

Quote: Originally Posted by MustangCSA

Hi thanks for the quick reply. I'm using Firefox 3.6.8 as my browser, and the only add-ons i have installed are Adblock Plus, Gmail Watcher, Hp Smart Web Printing (It came with the driver download) and then there are two Java Console (6.0.21 and 6.0.20) in the Add-ons window. I seems to happen whether or not I'm using the browser, like it will happen after a reboot or just with the comp sitting there. I'm pretty sure its not the RAM, I went a couple months with G.Skill going back and forth because of a few bad sticks I got from them. The ram currently in there has all been tested individually. Each stick has gone over 12 hours of memtest without any errors, and then all four sticks together have gone 24 hours without any errors. They are running at their stock speeds (800) with a 2N command rate.

Cluberti is correct that Driver Verifier is the next step, but just before that you can try booting FF in safe mode (just to test) to see in the BHO (java, or addon) is the cause.

Good luck

Ken

MustangCSA · 28 Aug 2010

It just happened again twice. First time I was looking at a web page in firefox and went to open up the device manager and then it crashed. Then again less than 10 minutes later it bsod in the middle of me trying to post a reply here about the first time lol. I will try Driver Verify and let you guy knows. Thanks.

MustangCSA · 28 Aug 2010

Ok so I attempted to go to the web page that cluberti linked to about Driver Verifier and it happened again. So after that I started firefox in safe mode and before I could get to that site it did it again. I managed to get there and enable driver verifier, but when I rebooted after follow the instructions on the site it bsod before it booted all the way. Then it boot into some startup repair utility and restored from an earlier point. Any ideas? Which dump files should I attach here for you guys to see?

UPDATE: It happened again seconds after I posted this reply.

MustangCSA · 28 Aug 2010

Here is the last four .dmp files from the Minidump folder that were produced since the last time I posted. Let me know what you guys think I'm going to take a break from this stressful thing for a couple hours. Thanks again for the help.

**cluberti** · 29 Aug 2010

The dumps all point to potential memory corruption - 3 of the 4 point to corruption of the code integrity module, and one points to an obsolete logmein driver that predates Windows 7:

Code:

3: kd> vertarget
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a06000 PsLoadedModuleList = 0xfffff800`02c43e50
Debug session time: Sat Aug 28 22:28:45.995 2010 (GMT-4)
System Uptime: 0 days 0:00:24.024
 
0: kd> !chkimg -lo 50 -db !CI
2 errors : !CI (fffff88000eff44a-fffff88000eff662)
fffff88000eff440  00  48  8b  6c  24  10  c3  cc  cc  cc *c8  cc  cc  cc  cc  cc .H.l$...........
...
fffff88000eff660  43  18 *40  33  c7  81  f1  2b  a5  00  00  41  03  4b  68  8b C.@3...+...A.Kh.
 
0: kd> lmvm CI
start             end                 module name
fffff880`00ee0000 fffff880`00fa0000   CI         (pdb symbols)          d:\symbols\ci.pdb\5F1BDC2205AC402CB0F09FC7CF17A3701\ci.pdb
    Loaded symbol image file: CI.dll
    Mapped memory image file: D:\Symbols\CI.dll\4A5BE01Dc0000\CI.dll
    Image path: \SystemRoot\system32\CI.dll
    Image name: CI.dll
    Timestamp:        Mon Jul 13 21:32:13 2009 (4A5BE01D)
    CheckSum:         000C6E0E
    ImageSize:        000C0000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ci.dll
    OriginalFilename: ci.dll
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  Code Integrity Module
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
 
3: kd> lmvm lv302a64
start             end                 module name
fffff880`07520000 fffff880`07522380   lv302a64 T (no symbols)           
    Loaded symbol image file: lv302a64.sys
    Image path: \SystemRoot\system32\DRIVERS\lv302a64.sys
    Image name: lv302a64.sys
    Timestamp:        Sat Jul 26 11:06:31 2008 (488B3D77)
    CheckSum:         0000B638
    ImageSize:        00002380
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

MustangCSA · 30 Aug 2010

OK first off thanks for all the help so far. I'm pretty sure the driver you where talking about in the last post was for my webcam. I updated the driver for that but continued getting BSOD. I decided to reinstall the whole thing and hope it helped. So I reinstalled Windows 7 and then installed all the drivers for my motherboard from the ASUS website and every other piece of hardware connected to the computer. Everything went good for about a day and then in the last few hours I've gotten about 3 more Blue Screens. I wanted to point out that in the "Resource and Performance Monitor" it has an error about a device not working properly. It says that a standard PS/2 keyboard is reporting an error and won't be available. I am using a usb Logitech Classic Keyboard 200 and a Logitech wireless mouse that came in a keyboard/mouse combo (MX3200), but I don't have the keyboard anymore. I installed driver for the keyboard/mouse combo. I'm not sure if that could be causing the problem or not, but I did notice that. I've attached the dump, let me know if you guys have any other suggestions.

Windows 7: Daily Blue Screens

Daily Blue Screens problems?