Windows 7: Random BSODs when system is Idle.

Azyrael · 22 Apr 2011

Ok I have read the instructions so hoping I have everything you need.
The BSODs are random but seem to happen only when the system is idle/unattended. As if I am using it the machine seems to run fine, but leave it idle for a while or leave it playing music and it will just restart. I disabled the restart on crash then found it will just display a black screen no shown BSOD. But once restarted there is the recovery info.

Here is the last couple I have logged.

Code:

 Problem signature:
    Problem Event Name:                        BlueScreen
    OS Version:                                          6.1.7600.2.0.0.256.48
    Locale ID:                                             3081
  
  Additional information about the problem:
    BCCode:                                               3b
    BCP1:                                                    00000000C0000005
    BCP2:                                                    FFFFF8800578C817
    BCP3:                                                    FFFFF88009CA8900
    BCP4:                                                    0000000000000000
    OS Version:                                          6_1_7600
    Service Pack:                                       0_0
    Product:                                               256_1


 

Problem signature:
    Problem Event Name:                        BlueScreen
    OS Version:                                          6.1.7601.2.1.0.256.48
    Locale ID:                                             3081
  
  Additional information about the problem:
    BCCode:                                               3b
    BCP1:                                                    00000000C0000005
    BCP2:                                                    FFFFF8800669E817
    BCP3:                                                    FFFFF880095B38F0
    BCP4:                                                    0000000000000000
    OS Version:                                          6_1_7601
    Service Pack:                                       1_0
    Product:                                               256_1
  

 

Problem signature:
    Problem Event Name:                        BlueScreen
    OS Version:                                          6.1.7601.2.1.0.256.48
    Locale ID:                                             3081
  
  Additional information about the problem:
    BCCode:                                               3b
    BCP1:                                                    00000000C0000005
    BCP2:                                                    FFFFF88005906817
    BCP3:                                                    FFFFF88009BC68F0
    BCP4:                                                    0000000000000000
    OS Version:                                          6_1_7601
    Service Pack:                                       1_0
    Product:                                               256_1
  


 Problem signature:
    Problem Event Name:                        BlueScreen
    OS Version:                                          6.1.7601.2.1.0.256.48
    Locale ID:                                             3081
  
  Additional information about the problem:
    BCCode:                                               d5
    BCP1:                                                    FFFFF98003BB2ED0
    BCP2:                                                    0000000000000000
    BCP3:                                                    FFFFF880058411AA
    BCP4:                                                    0000000000000000
    OS Version:                                          6_1_7601
    Service Pack:                                       1_0
    Product:                                               256_1

Once restarted the machine runs fine untill left idle again. I tried running the driver verifier and found I got a BSOD before windows loaded and I was unable to even start windows normally with the verifierenabled I have to boot safe mode and turn it off to post this. The last BSOD info in the code was the one generated while having the driver verifier turned on.

Attached is my "NT6_BSOD_jcgriff2" and "perfmon"
My System specs are as follows

Code:

System Manufacturer/Model Number
CPU
AMD Phenom II X6 1090T

Motherboard
Gigabyte GA-890XA-UD3

Memory
8gb (2x4gb G Skill Intl)

Graphics Card(s)
Radeon HD 5850

Sound Card
Sound Blaster X-Fi Xtreme Audio 

Monitor(s) Displays
Samsung 20"205bw & 19"943N

Hard Drives
OCZ Veritex 2 160gb SSD
2x Seagate 1TB Baracua Sata II drives in Raid

PSU
Antec Truepower New 750watt

Case
Lian Li PC61

Cooling
Thermaltake Ultra 120

If there is anything else you need to help me work out the cause please let me know.

Regards
Azyrael

CarlTR6 · 22 Apr 2011

Hi, Azyrael, and welcome to the forum. I am sorry you are having problems. Hopefully, we can help you solve it.

I looked at your five most recent dumps. Four out of the five blame atikmdag.sys, your video driver, for the crash. The remaining dump blames usbfilter.sys. USBFILTER.sys is a USB upper class filter driver for AMD SB700 chipsets. It detects arrival and removal of USB 1.0/1.1 audio devices. All of the dumps indicate or reference memory corruption.

1. Your version of Kaspersky is a known cause of conflicts and BSOD's on some Win 7 systems. I recommend that you completely uninstall Kaspersky using this removal tool: Tool. Wheil you are troubleshooting, download and install Microsoft Security Essentials: http://www.microsoft.com/security_essentials/. Once your system is stable you can install Kaspersky again; but not not reinstall your current version. Get the latest version.

2. Regarding atikmdag.sys, I recommend that you uninstall the Catalyst Control Center and only install the display driver. CCC is a know problem with some Win 7 systems. Here is the link to ATI: Global Provider of Innovative Graphics, Processors and Media Solutions | AMD

3. See if there is an update for usbfilter.sys. Update your chipset drivers through this link: AMD.com | Support & Downloads

Follow the above suggestions and let's see how your system runs. Post back and let us know.

Code:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`03406000 PsLoadedModuleList = 0xfffff800`0364be90
Debug session time: Thu Apr 21 05:59:26.539 2011 (GMT-4)
System Uptime: 0 days 3:22:18.679
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800669e817, fffff880095b38f0, 0}

Probably caused by : atikmdag.sys ( atikmdag+90817 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800669e817, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880095b38f0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+90817
fffff880`0669e817 8b4820          mov     ecx,dword ptr [rax+20h]

CONTEXT:  fffff880095b38f0 -- (.cxr 0xfffff880095b38f0)
rax=0000000000000000 rbx=fffffa8007cb26e0 rcx=fffffa800846b1f0
rdx=0000000000000000 rsi=0000000000000015 rdi=fffffa8007b9a340
rip=fffff8800669e817 rsp=fffff880095b42d0 rbp=fffffa800846b1f0
 r8=0000000000000015  r9=fffff88006a60970 r10=0000000000000000
r11=fffff880095b4420 r12=0000000000000000 r13=fffffa8008b72010
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
atikmdag+0x90817:
fffff880`0669e817 8b4820          mov     ecx,dword ptr [rax+20h] ds:002b:00000000`00000020=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800669e817

STACK_TEXT:  
fffff880`095b42d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0x90817


FOLLOWUP_IP: 
atikmdag+90817
fffff880`0669e817 8b4820          mov     ecx,dword ptr [rax+20h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+90817

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cef1f94

STACK_COMMAND:  .cxr 0xfffff880095b38f0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_atikmdag+90817

BUCKET_ID:  X64_0x3B_atikmdag+90817

Followup: MachineOwner
---------

Debug session time: Fri Apr 22 04:15:51.524 2011 (GMT-4)
System Uptime: 0 days 0:00:15.664
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D5, {fffff98003bb2ed0, 0, fffff880058411aa, 0}

Unable to load image \SystemRoot\system32\DRIVERS\usbfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for usbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for usbfilter.sys

Could not read faulting driver name
Probably caused by : usbfilter.sys ( usbfilter+41aa )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff98003bb2ed0, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff880058411aa, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b10e8
 fffff98003bb2ed0 

FAULTING_IP: 
usbfilter+41aa
fffff880`058411aa 8b4230          mov     eax,dword ptr [rdx+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xD5

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003399280 -- (.trap 0xfffff88003399280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88003399478
rdx=fffff98003bb2ea0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880058411aa rsp=fffff88003399410 rbp=0000000000000002
 r8=0000000000000000  r9=fffff880058411a5 r10=0000000000000100
r11=fffff880009b2180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
usbfilter+0x41aa:
fffff880`058411aa 8b4230          mov     eax,dword ptr [rdx+30h] ds:2180:fffff980`03bb2ed0=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000342c2ac to fffff80003480640

STACK_TEXT:  
fffff880`03399118 fffff800`0342c2ac : 00000000`00000050 fffff980`03bb2ed0 00000000`00000000 fffff880`03399280 : nt!KeBugCheckEx
fffff880`03399120 fffff800`0347e76e : 00000000`00000000 fffff980`03bb2ed0 fffffa80`08bdc000 fffff980`03baad80 : nt! ?? ::FNODOBFM::`string'+0x4621f
fffff880`03399280 fffff880`058411aa : fffff880`03399478 00000000`00000000 fffff980`03baad80 fffffa80`08d41f40 : nt!KiPageFault+0x16e
fffff880`03399410 fffff880`03399478 : 00000000`00000000 fffff980`03baad80 fffffa80`08d41f40 00000000`00000000 : usbfilter+0x41aa
fffff880`03399418 00000000`00000000 : fffff980`03baad80 fffffa80`08d41f40 00000000`00000000 fffff880`03399478 : 0xfffff880`03399478


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbfilter+41aa
fffff880`058411aa 8b4230          mov     eax,dword ptr [rdx+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbfilter+41aa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbfilter

IMAGE_NAME:  usbfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b3082ae

FAILURE_BUCKET_ID:  X64_0xD5_VRF_usbfilter+41aa

BUCKET_ID:  X64_0xD5_VRF_usbfilter+41aa

Followup: MachineOwner
---------

Azyrael · 26 Apr 2011

Thank you very much CarlTR6. After downloading the latest version of the catalyst drivers for my video card without the control panel and the latest sb southbridge chipset drivers, my issues appear to have been resloved.

Since those 2 were updated my system hasn't crashed or hung. As for my kaspersky I am running the corporate version and as far as I can tell it is the latest version, and seeing the systme is stable i haven't bothered removing that yet.

Thank you again
Azyrael

Windows 7: Random BSODs when system is Idle.

Random BSODs when system is Idle. problems?