Windows 7: persistent system stability issues - need help pinpointing problem

slinton · 12 Jan 2012

Hey guys,
Thank you for taking a look at my dump files. Long story short, I built this computer last May and it has had persistent stability problems. Every couple months I will get a BSOD. I keep it updated, run MSE scans frequently, and am not OC'ing anything. The most recent BSOD was preceded by an error that mentioned power, but I don't remember the exact wording. My system specs are on my profile. Thanks again!

writhziden · 12 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\slinton\Windows_NT6_BSOD_jcgriff2\112711-30576-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e56000 PsLoadedModuleList = 0xfffff800`0309b670
Debug session time: Sun Nov 27 15:02:13.990 2011 (UTC - 7:00)
System Uptime: 0 days 0:04:51.036
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff88007021596, fffff880072ad5e0, 0}

Unable to load image \SystemRoot\system32\drivers\spsys.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for spsys.sys
*** ERROR: Module load completed but symbols could not be loaded for spsys.sys
Probably caused by : spsys.sys ( spsys+21596 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff88007021596, Address of the instruction which caused the bugcheck
Arg3: fffff880072ad5e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
spsys+21596
fffff880`07021596 d6              ???

CONTEXT:  fffff880072ad5e0 -- (.cxr 0xfffff880072ad5e0)
rax=fffff880072b29d7 rbx=fffff7804000002c rcx=0000000000000000
rdx=0000000000004800 rsi=fffff8a00313d000 rdi=fffff880072af088
rip=fffff88007021596 rsp=fffff880072adfc0 rbp=0000000000000000
 r8=00000000000098dc  r9=fffff880072ae100 r10=fffff8a0024bb200
r11=0000000000000617 r12=fffff8a018fb85f0 r13=00000000bffe002c
r14=fffff8a00313e010 r15=0000087fc0000004
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
spsys+0x21596:
fffff880`07021596 d6              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  sppsvc.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000020 to fffff88007021596

STACK_TEXT:  
fffff880`072adfc0 00000000`00000020 : fffff880`00000200 fffff8a0`00000108 fffff880`00000188 fffff880`0000028b : spsys+0x21596
fffff880`072adfc8 fffff880`00000200 : fffff8a0`00000108 fffff880`00000188 fffff880`0000028b fffff8a0`00000034 : 0x20
fffff880`072adfd0 fffff8a0`00000108 : fffff880`00000188 fffff880`0000028b fffff8a0`00000034 00000000`00000000 : 0xfffff880`00000200
fffff880`072adfd8 fffff880`00000188 : fffff880`0000028b fffff8a0`00000034 00000000`00000000 fffff880`00000000 : 0xfffff8a0`00000108
fffff880`072adfe0 fffff880`0000028b : fffff8a0`00000034 00000000`00000000 fffff880`00000000 00000000`00000000 : 0xfffff880`00000188
fffff880`072adfe8 fffff8a0`00000034 : 00000000`00000000 fffff880`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`0000028b
fffff880`072adff0 00000000`00000000 : fffff880`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`00000034


FOLLOWUP_IP: 
spsys+21596
fffff880`07021596 d6              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  spsys+21596

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: spsys

IMAGE_NAME:  spsys.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a085e7a

STACK_COMMAND:  .cxr 0xfffff880072ad5e0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_spsys+21596

BUCKET_ID:  X64_0x3B_spsys+21596

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\slinton\Windows_NT6_BSOD_jcgriff2\121511-43227-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03056000 PsLoadedModuleList = 0xfffff800`0329b670
Debug session time: Thu Dec 15 15:45:09.868 2011 (UTC - 7:00)
System Uptime: 0 days 0:00:44.304
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8008adb790, fffffa8008adba70, fffff800033d68b0}

c0000005 Exception in ext.Analyze debugger extension.
      PC: 000007fe`fe0a17a6  VA: 00000000`00000001  R/W: 0  Parameter: 00000000`00000000
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8008adb790, Terminating object
Arg3: fffffa8008adba70, Process image file name
Arg4: fffff800033d68b0, Explanatory message (ascii)

Debugging Details:
------------------

c0000005 Exception in ext.analyze debugger extension.
      PC: 000007fe`fe0a17a6  VA: 00000000`00000001  R/W: 0  Parameter: 00000000`00000000

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\slinton\Windows_NT6_BSOD_jcgriff2\011212-26005-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03013000 PsLoadedModuleList = 0xfffff800`03258670
Debug session time: Thu Jan 12 14:37:32.140 2012 (UTC - 7:00)
System Uptime: 0 days 0:26:47.576
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003093434, fffff8800865fa30, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceHandler+7c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003093434, Address of the instruction which caused the bugcheck
Arg3: fffff8800865fa30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IopfCompleteRequest+754
fffff800`03093434 488b4008        mov     rax,qword ptr [rax+8]

CONTEXT:  fffff8800865fa30 -- (.cxr 0xfffff8800865fa30)
rax=00000e7900007f57 rbx=fffffa800af52ffb rcx=fffffa80052049a0
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa800af52c10
rip=fffff80003093434 rsp=fffff88008660410 rbp=00000000a000000c
 r8=000000000000000b  r9=0000000000000000 r10=fffffa8005d4cf80
r11=fffff880086604f8 r12=00000000a0000003 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210202
nt!IopfCompleteRequest+0x754:
fffff800`03093434 488b4008        mov     rax,qword ptr [rax+8] ds:002b:00000e79`00007f5f=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  mbam.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003093434

STACK_TEXT:  
fffff880`0865f168 fffff800`0308f1e9 : 00000000`0000003b 00000000`c0000005 fffff800`03093434 fffff880`0865fa30 : nt!KeBugCheckEx
fffff880`0865f170 fffff800`0308eb3c : fffff880`0865f3b0 fffff800`03067971 fffff800`031eae10 fffff880`08660990 : nt!KiBugCheckDispatch+0x69
fffff880`0865f2b0 fffff800`030bb4fd : fffff800`032acbbc 00000000`00000000 fffff800`03013000 fffff880`086601d8 : nt!KiSystemServiceHandler+0x7c
fffff880`0865f2f0 fffff800`030ba2d5 : fffff800`031da788 fffff880`0865f368 fffff880`086601d8 fffff800`03013000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0865f320 fffff800`030cb361 : fffff880`086601d8 fffff880`0865fa30 fffff880`00000000 fffffa80`0af52c10 : nt!RtlDispatchException+0x415
fffff880`0865fa00 fffff800`0308f2c2 : fffff880`086601d8 fffffa80`0af52ffb fffff880`08660280 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`086600a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceHandler+7c
fffff800`0308eb3c b801000000      mov     eax,1

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceHandler+7c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiSystemServiceHandler+7c

BUCKET_ID:  X64_0x3B_nt!KiSystemServiceHandler+7c

Followup: MachineOwner
---------

Nothing obvious stands out. Have you at any time run registry cleaners? They are known to cause erratic blue screen crashes after mucking up the registry. If not, run through the following steps and report back after each before proceeding to the next step. Since your blue screen crashes are intermittent, you can run these at whatever pace you want.

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs.
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors.
Check for viruses.
Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
Download the Fakerean removal tool but do not run it yet.
Start your computer in Safe Mode
Unzip VIPRE Rescue and let it run.
Run a full scan with Malwarebytes.
Run the fakerean removal tool.
Install all Windows Updates and update your device drivers (see Installing and updating drivers in 7, Driver Reference Table - sysnative.com - MVP and Drivers and Downloads for driver updating).
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

slinton · 12 Jan 2012

Thanks a lot for the quick reply, writhziden! To answer your question, I have never run any registry cleaners. I will start working my way down the list this weekend, and will report any problems or interesting findings. Thanks again.

writhziden · 12 Jan 2012

Quote: Originally Posted by slinton

Thanks a lot for the quick reply, writhziden! To answer your question, I have never run any registry cleaners. I will start working my way down the list this weekend, and will report any problems or interesting findings. Thanks again.

No problem. Post back if you have any questions, comments, or concerns.

slinton · 31 Jan 2012

Hi writhziden,
Just a quick update. I checked both my master and slave HDDs and both did not show any errors. I will plan on running step 2 tomorrow. Haven't had a BSOD since I started this thread. Thanks for the assistance so far!

writhziden · 31 Jan 2012

You're welcome. Thanks for posting back and letting us know how things are going.

slinton · 04 Feb 2012

Hi writhziden, I ran sfc /scannow and windows found no damaged files. I am now on step 3, and I have a rookie question about how to enter safe mode. When I restart my machine, pressing F8 sends me to boot options. There are three boot options: my master HDD, my slave HDD, and the CD drive. Since both my master and slave are the same make/model, I can't tell them apart in the boot selection menu. Does it matter which one I choose? Is this the right way to enter safe mode? Thank you!

writhziden · 04 Feb 2012

You are changing the boot order using BIOS settings. That unfortunately will not get you into safe mode. See if Advanced Boot Options gives you better steps for entering the advanced boot options and then choose safe mode.

Were you ever able to get into Safe Mode? How are things running?

slinton · 26 Feb 2012

Yes, I was able to get into Safe Mode. I ran VIPRE and MBAM and neither showed any evidence of malware on my system. I will run the fakerean tool later today. I haven't had any BSODs or other issues with my machine. Thanks for your help so far!

writhziden · 19 Mar 2012

No problem. How is the system responding at this time?

Windows 7: persistent system stability issues - need help pinpointing problem

persistent system stability issues - need help pinpointing problem problems?