Windows 7: Random BSODs - no apparent causing-action (0a, c2, c5, d1)

Fluent · 13 Feb 2012

Hi,

First of all thank you, this forum has been helpful in eliminating probable causes for my Blue Screens. Unfortunately, I still cannot pinpoint the cause myself.

They happen randomly; while watching a movie, just clicking on something, but especially when Windows is shutting down. I however, cannot force them to occur.

Actions to date (not in order):
1. Latest MB BIOS.
2. Latest SSD firmware confirmed.
3. MalwareBytes run (no actions required).
4. Driver Verifier run (system restarted after 24 hours with most recent blue screen, though the driver doesn't match the Driver Verifier elected settings recommended in these forums).
5. Computer hardware shop ran stress tests on system, including CPU, RAM, GPU and PSU with no BSOD or issues. These were using the Intel testing kit and a Crysis engine. I also ran Memtest three months ago for a separate BSOD issue (dead SSD).
6. Virus scan with MSE (no actions required).
7. Run sfc /scannow (no issues returned).
8. Windows "upgrade" repair install and disk-cleanup.
9. Updated as many hardware drivers as evident. Wherever I could, I first used DriverSweeper to remove the existing driver.

All my system information is attached to my profile. This Windows install is relatively new (three months ago, with the repair run last week.) All hardware is eight months old, excluding the GPU and Soundcard which are approximately 2 years old. Besides the occasional short-term GPU overclock, nothing else has been overclocked.

Any assistance identifying the problem drivers is greatly appreciated. I am willing to do a fresh install if it is likely to stop the issues - but I'd rather test most other fixes first.

Thanks

writhziden · 13 Feb 2012

The Quote in post #2 of The Windows Subsystem system process terminated unexpectedly may be of interest to you.

Fluent · 13 Feb 2012

I will look verify all my hard-drive controllers are up to date. I have been meaning to do so anyway.
As a note, I do not have any hard-drives (inc the SSD) plugged into the Marvell controllers as I am aware of the inherent issues experienced with them. The SSD is running from the Intel SATA 6Gb/s port.
Unfortunately I do not have a spare platter drive to test an addtional install with. I will speak to my hardware provider and find out if they've experienced other customers with compatability issues.
Thanks.

Fluent · 13 Feb 2012

Are there any other areas from the minidumps I have supplied that need attention?
My hardware supplier confirmed they have run my SSD and Motherboard combination many times without issue, so if updating the controllers doesn't work, and there aren't other areas to check, I will just resort to a full clean install.

Thanks.

writhziden · 13 Feb 2012

I note that your most recent crash was network/antivirus related. Do you have the full versions of MSE and Malwarebytes installed? If so, remove one of the two. Having two full security suites installed is known to cause instability. Also, a crash due to your network adapter driver signifies you may want to update or re-install the driver as it is either outdated or corrupted.

The rest of your crashes point to your file system/SSD drive.

Fluent · 13 Feb 2012

I have full versions of both, but only installed last night after the last crash. I will remove MalwareBytes this evening.

Below is a link which contains accumulated drivers for each P67 motherboard. I have yet to test the downloads, and will comment on their success later, but should be a good reference for future sevenforum users:
Asus P67 Series Information Thread (drivers, BIOSes, overclocking, reviews) **UPDATED 2/9**
If anyone knows why I shouldn't use these links, please advise.

Fluent · 21 Feb 2012

The system is now more stable. The main change seemed to come from updating the SATA Interface Controllers using the link above. Unfortunately two ntoskrnl.exe related BSOD have appeared, both upon shutting the system down.
I have run Memtest 4.0a again to ensure it isn't a RAM issue, but after over 12 passes, it still returned no errors.

Attached is a new system health and dump collection. The warning about antivirus in system health is incorrect as I am running an up-to-date MSE.

Thanks again for your assistance.

writhziden · 21 Feb 2012

Code:




Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Fluent\Windows_NT6_BSOD_jcgriff2\022112-107219-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03204000 PsLoadedModuleList = 0xfffff800`03449670
Debug session time: Tue Feb 21 02:44:35.437 2012 (GMT-7)
System Uptime: 0 days 4:36:52.623
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff8000328872c}

Probably caused by : ntkrnlmp.exe ( nt!KeWaitForSingleObject+17c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000328872c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b3100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeWaitForSingleObject+17c
fffff800`0328872c 4c8938          mov     qword ptr [rax],r15

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88009f01f20 -- (.trap 0xfffff88009f01f20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8006c09b70
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000328872c rsp=fffff88009f020b0 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff880009ea180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x17c:
fffff800`0328872c 4c8938          mov     qword ptr [rax],r15 ds:15c8:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032801e9 to fffff80003280c40

STACK_TEXT:  
fffff880`09f01dd8 fffff800`032801e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09f01de0 fffff800`0327ee60 : fffff8a0`00bd4c40 fffff8a0`00bd4c58 fffff8a0`00bfde70 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`09f01f20 fffff800`0328872c : 00000000`06a3c860 00000000`00000000 00000000`00001000 00000000`00001000 : nt!KiPageFault+0x260
fffff880`09f020b0 fffff800`0325361e : fffff880`00010000 fffffa80`00000022 00000000`00000000 00000000`00000000 : nt!KeWaitForSingleObject+0x17c
fffff880`09f02150 fffff800`032931c5 : fffffa80`06a20100 fffffa80`0952a010 fffffa80`06a3d600 fffffa80`0952a010 : nt!KiAcquireFastMutex+0x4e
fffff880`09f02190 fffff880`016cfd29 : fffffa80`06a3d670 fffffa80`06a3d670 fffff880`09f025e0 00000001`00000000 : nt!ExAcquireFastMutex+0x45
fffff880`09f021c0 fffff880`01694520 : fffffa80`0952a010 fffffa80`06a3d600 00000000`00000000 00000000`00000001 : Ntfs!NtfsWriteFileSizes+0x179
fffff880`09f02320 fffff880`0169cfad : fffffa80`0952a010 fffffa80`06a20180 00000000`00100001 00000000`00000000 : Ntfs!NtfsFlushVolume+0x304
fffff880`09f02450 fffff880`0169d6b4 : fffffa80`0952a010 fffffa80`0952cca0 fffffa80`08d74360 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`09f02530 fffff880`010acbcf : fffffa80`0952cfb0 fffffa80`0952cca0 fffffa80`0952a010 fffff880`09f02558 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`09f025a0 fffff880`010ab6df : fffffa80`066d2de0 00000000`00000000 fffffa80`066d2d00 fffffa80`0952cca0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`09f02630 fffff800`0358921b : 00000000`00000002 fffffa80`08d74360 00000000`00000000 fffffa80`0952cca0 : fltmgr!FltpDispatch+0xcf
fffff880`09f02690 fffff800`0351db85 : fffffa80`0952cca0 fffffa80`08b7ab60 fffffa80`08d74360 fffff880`009ea180 : nt!IopSynchronousServiceTail+0xfb
fffff880`09f02700 fffff800`0327fed3 : fffffa80`08b7ab60 fffffa80`03cb8040 fffffa80`066d2de0 fffffa80`08d74360 : nt!NtFlushBuffersFile+0x171
fffff880`09f02790 fffff800`0327c470 : fffff800`034c289d fffffa80`040386b0 fffff880`025d4610 00000000`00000001 : nt!KiSystemServiceCopyEnd+0x13
fffff880`09f02928 fffff800`034c289d : fffffa80`040386b0 fffff880`025d4610 00000000`00000001 00000000`00000000 : nt!KiServiceLinkage
fffff880`09f02930 fffff800`0351bfee : 00000000`00000000 fffffa80`08b7ab60 00000000`00000080 00000000`00000001 : nt!PopFlushVolumeWorker+0x1bd
fffff880`09f02c00 fffff800`032725e6 : fffff800`033f6e80 fffffa80`08b7ab60 fffff800`03404cc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`09f02c40 00000000`00000000 : fffff880`09f03000 fffff880`09efd000 fffff880`09f026a0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KeWaitForSingleObject+17c
fffff800`0328872c 4c8938          mov     qword ptr [rax],r15

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KeWaitForSingleObject+17c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KeWaitForSingleObject+17c

BUCKET_ID:  X64_0xA_nt!KeWaitForSingleObject+17c

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\Fluent\Windows_NT6_BSOD_jcgriff2\021912-5460-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03212000 PsLoadedModuleList = 0xfffff800`03457670
Debug session time: Sat Feb 18 23:00:40.736 2012 (GMT-7)
System Uptime: 0 days 2:23:52.533
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {8, 2, 0, fffff800033bea9b}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1df )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800033bea9b, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExDeferredFreePool+1df
fffff800`033bea9b 4c395808        cmp     qword ptr [rax+8],r11

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  LogonUI.exe

TRAP_FRAME:  fffff8800a860080 -- (.trap 0xfffff8800a860080)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff800034194f0
rdx=fffffa8006be8a30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033bea9b rsp=fffff8800a860210 rbp=0000000000000000
 r8=fffffa8006a05850  r9=fffffa8006be8000 r10=0000000000000001
r11=fffffa8006be8010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!ExDeferredFreePool+0x1df:
fffff800`033bea9b 4c395808        cmp     qword ptr [rax+8],r11 ds:02a0:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000328e1e9 to fffff8000328ec40

STACK_TEXT:  
fffff880`0a85ff38 fffff800`0328e1e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a85ff40 fffff800`0328ce60 : 00000014`1963ee80 fffff800`0329344a 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a860080 fffff800`033bea9b : 00000000`00000000 fffff800`0328ded3 fffffa80`03ef6b60 fffff960`00290518 : nt!KiPageFault+0x260
fffff880`0a860210 fffff800`033be1a1 : 00000000`00000000 fffffa80`08c5f220 00000000`00000000 74696157`017ae660 : nt!ExDeferredFreePool+0x1df
fffff880`0a8602a0 fffff800`0358588c : fffffa80`08c5f230 fffff880`0a8605e0 00000000`74696157 00000000`00000006 : nt!ExFreePoolWithTag+0x411
fffff880`0a860350 fffff800`03585aee : fffff880`0a860901 fffff880`0a860938 00000000`00000001 000007fe`fb051700 : nt!ObpWaitForMultipleObjects+0x3a6
fffff880`0a860820 fffff800`0328ded3 : fffffa80`03ef6b60 00000000`0024f698 fffff880`0a860a88 00000000`00000003 : nt!NtWaitForMultipleObjects+0xe5
fffff880`0a860a70 00000000`770f18ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0024f678 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770f18ca


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+1df
fffff800`033bea9b 4c395808        cmp     qword ptr [rax+8],r11

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExDeferredFreePool+1df

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0xC5_2_nt!ExDeferredFreePool+1df

BUCKET_ID:  X64_0xC5_2_nt!ExDeferredFreePool+1df

Followup: Pool_corruption
---------

Your hard drive file system driver and file system manager driver were in the stack. Something is still not happy with your SSD, from the looks of it. Hopefully it is just a driver incompatibility. Other possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
Possible cause is Drivers...

Thanks to Dave76 for help understanding possible causes.

If you are overclocking any hardware, please stop.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

Fluent · 21 Feb 2012

Earlier, I tried Driver Verifier on all non-Microsoft drivers with no issues returned. sfc /scannow doesn't return any faults either. Should I repeat Driver Verifier with only Microsoft drivers chosen?
I have run all the SSD health checks and they're returning without errors. I am starting to believe I just have an odd incompatibility - and replacement of the SSD or motherboard costs much more than enduring the odd BSOD, and I don't have components to run a long test to conclude it is the case.
The help from this forum has reduced the frequency by quite a bit, so thank you for your guidance so far (this thread and others)

writhziden · 21 Feb 2012

Run Driver Verifier with all drivers selected. "Automatically select all drivers installed on this computer" should be selected.

Did you run Verifier with all drivers, or are you just content with how the system is responding now?

Windows 7: Random BSODs - no apparent causing-action (0a, c2, c5, d1)

Random BSODs - no apparent causing-action (0a, c2, c5, d1) problems?