Windows 7: BSOD 0x1000007e and 0x0000003b unexplained

oofymo1 · 06 Mar 2012

Windows 7 ultimate x64
- Not the original. System came with Windows vista x64
- Full retail upgrade

- Age of the hardware is about 3 years or so.
- OS was just upgraded a few months ago

Random BSOD started occurring after upgrading to Windows 7 ultimate.
I installed a Bamboo tablet and a few days afterwards they appeared and continued even after uninstalling.

There was a period when I'd get them in vista, but it's been months since then.

Thanks for the help.

Vir Gnarus · 06 Mar 2012

In every case there is a missing bit at the end of the offending address. The fact that this is the same bit all the time might hint to it being software-generated error, but we will see.

First, turn on Driver Verifier for the duration of the troubleshooting, to see if it catches any bad driver (if a driver is the cause). In addition to not checking Low Resource Simulation, also do the same for IRP Logging and Force Pending I/O Request. Provide any crashdumps for any crashes that may occur after you turn on DV (make sure to restart the PC after your finish setting up DV to save the changes).

In addition, you'll want to do some hardware tests, first starting with Prime95 (Torture Test, Large FFTs, 9+ hours), and then Memtest86+ (7+ passes).

Analysts:

Code:

This occurs in just about every dump file:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bb49bc, Address of the instruction which caused the bugcheck
Arg3: fffff880035d0b20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+100
fffff800`02bb49bc 4c8b02          mov     r8,qword ptr [rdx]

CONTEXT:  fffff880035d0b20 -- (.cxr 0xfffff880035d0b20)
rax=fffff80002c0f890 rbx=0000000000000000 rcx=fffff80002c0f890
rdx=bffffa80061dc010 rsi=0000000000000000 rdi=fffffa800586a2b0
rip=fffff80002bb49bc rsp=fffff880035d1500 rbp=0000000000000000
 r8=bffffa80061dc010  r9=fffffa8006ce9450 r10=0000000000000001
r11=0000000000000000 r12=fffff80002c0f340 r13=0000000000000000
r14=0000000000000016 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`02bb49bc 4c8b02          mov     r8,qword ptr [rdx] ds:002b:bffffa80`061dc010=????????????????
Resetting default scope

oofymo1 · 06 Mar 2012

Hi, thanks for the response.

I tried using the Driver Verifier but when I re-booted, the computer just froze up. It didn't even give a BSOD.
I tried rebooting and going into safemode but none of the changes to DV were saved.
Should I just go to the next step with Prime and Memtest?

writhziden · 06 Mar 2012

Problem Devices:

Code:

Not Available	ACPI\ENE0100\3&2411E6FE&1	The drivers for this device are not installed.
Base System Device	PCI\VEN_197B&DEV_2382&SUBSYS_30FC103C&REV_00\4&2C0D0C43&0&0028	The drivers for this device are not installed.
Base System Device	PCI\VEN_197B&DEV_2383&SUBSYS_30FC103C&REV_00\4&2C0D0C43&0&0328	The drivers for this device are not installed.
Base System Device	PCI\VEN_197B&DEV_2384&SUBSYS_30FC103C&REV_00\4&2C0D0C43&0&0428	The drivers for this device are not installed.

Make sure you have all drivers installed for your system. Missing base system device drivers can lead to crashes like you are experiencing. Drivers - Install Vista Drivers on Windows 7 if need be.

Antivirus Software:

Code:

avastsvc.exe	c:\program files\avast software\avast\avastsvc.exe	1616	8	200	1380	3/6/2012 12:48 PM	7.0.1407.0	43.72 KB (44,768 bytes)	2/28/2012 1:45 PM
avastui.exe	c:\program files\avast software\avast\avastui.exe	2512	8	200	1380	3/6/2012 12:49 PM	7.0.1407.0	3.84 MB (4,031,368 bytes)	2/28/2012 1:45 PM

Possible out of date drivers:

Code:

agrsm64	fffff880`05c1c000	fffff880`05d3e000	Mon Nov 10 08:01:35 2008 (49184ccf)	00119433		agrsm64.sys
Rt64win7	fffff880`04398000	fffff880`043ca000	Thu Feb 26 02:04:13 2009 (49a65b0d)	0002eb30		Rt64win7.sys
GEARAspiWDM	fffff880`043ca000	fffff880`043d7000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys

agrsm64.sys
Rt64win7.sys
GEARAspiWDM.sys

Code:


Loading Dump File [D:\Kingston\BSODDmpFiles\oofymo1\New folder\Windows_NT6_BSOD_jcgriff2\030612-30778-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a08000 PsLoadedModuleList = 0xfffff800`02c4d670
Debug session time: Tue Mar  6 11:47:44.994 2012 (UTC - 7:00)
System Uptime: 0 days 0:03:05.914
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002bb49bc, fffff880035d0b20, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bb49bc, Address of the instruction which caused the bugcheck
Arg3: fffff880035d0b20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+100
fffff800`02bb49bc 4c8b02          mov     r8,qword ptr [rdx]

CONTEXT:  fffff880035d0b20 -- (.cxr 0xfffff880035d0b20)
rax=fffff80002c0f890 rbx=0000000000000000 rcx=fffff80002c0f890
rdx=bffffa80061dc010 rsi=0000000000000000 rdi=fffffa800586a2b0
rip=fffff80002bb49bc rsp=fffff880035d1500 rbp=0000000000000000
 r8=bffffa80061dc010  r9=fffffa8006ce9450 r10=0000000000000001
r11=0000000000000000 r12=fffff80002c0f340 r13=0000000000000000
r14=0000000000000016 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`02bb49bc 4c8b02          mov     r8,qword ptr [rdx] ds:002b:bffffa80`061dc010=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  BlueScreenView

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002bb49bc

STACK_TEXT:  
fffff880`035d1500 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100


FOLLOWUP_IP: 
nt!ExDeferredFreePool+100
fffff800`02bb49bc 4c8b02          mov     r8,qword ptr [rdx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+100

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff880035d0b20 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

Followup: Pool_corruption
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\oofymo1\New folder\Windows_NT6_BSOD_jcgriff2\030612-29780-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02a57000 PsLoadedModuleList = 0xfffff800`02c9c670
Debug session time: Tue Mar  6 11:40:28.268 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:06.188
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002ad8f35, fffff880023aa5c8, fffff880023a9e20}

Probably caused by : dxgmms1.sys ( dxgmms1!VidSchiWaitForSchedulerEvents+1bc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ad8f35, The address that the exception occurred at
Arg3: fffff880023aa5c8, Exception Record Address
Arg4: fffff880023a9e20, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiCommitThreadWait+1d5
fffff800`02ad8f35 488bbb90000000  mov     rdi,qword ptr [rbx+90h]

EXCEPTION_RECORD:  fffff880023aa5c8 -- (.exr 0xfffff880023aa5c8)
ExceptionAddress: fffff80002ad8f35 (nt!KiCommitThreadWait+0x00000000000001d5)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880023a9e20 -- (.cxr 0xfffff880023a9e20)
rax=0000000000000000 rbx=bffffa8005ae2b60 rcx=fffff880023aa7c0
rdx=fffffdfffdc16c4a rsi=fffffa8005ae2c20 rdi=fffff80002c49e80
rip=fffff80002ad8f35 rsp=fffff880023aa800 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000001
r11=fffffa800479394e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!KiCommitThreadWait+0x1d5:
fffff800`02ad8f35 488bbb90000000  mov     rdi,qword ptr [rbx+90h] ds:002b:bffffa80`05ae2bf0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d06100
 ffffffffffffffff 

FOLLOWUP_IP: 
dxgmms1!VidSchiWaitForSchedulerEvents+1bc
fffff880`04f5927c 8bd8            mov     ebx,eax

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002ad844a to fffff80002ad8f35

STACK_TEXT:  
fffff880`023aa800 fffff800`02ad844a : fffffa80`05add000 fffff880`04e2e6e6 fffff880`000000ce fffffa80`05add000 : nt!KiCommitThreadWait+0x1d5
fffff880`023aa890 fffff880`04f5927c : fffffa80`00000002 fffff880`023aaba8 00000000`00000001 00000000`00000000 : nt!KeWaitForMultipleObjects+0x272
fffff880`023aab50 fffff880`04f2c2c6 : ffffffff`ff676980 fffffa80`0573d010 00000000`00000000 00000000`00000000 : dxgmms1!VidSchiWaitForSchedulerEvents+0x1bc
fffff880`023aabf0 fffff880`04f58e7a : 00000000`00000000 fffffa80`05b09d50 00000000`00000080 fffffa80`0573d010 : dxgmms1!VidSchiScheduleCommandToRun+0x1da
fffff880`023aad00 fffff800`02d6efee : 00000000`02e99efe fffffa80`05ae2b60 fffffa80`03cde890 fffffa80`05ae2b60 : dxgmms1!VidSchiWorkerThread+0xba
fffff880`023aad40 fffff800`02ac55e6 : fffff880`009e8180 fffffa80`05ae2b60 fffff880`009f2f40 6d373730`702b4c43 : nt!PspSystemThreadStartup+0x5a
fffff880`023aad80 00000000`00000000 : fffff880`023ab000 fffff880`023a5000 fffff880`023aa680 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  dxgmms1!VidSchiWaitForSchedulerEvents+1bc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce799c1

STACK_COMMAND:  .cxr 0xfffff880023a9e20 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_dxgmms1!VidSchiWaitForSchedulerEvents+1bc

BUCKET_ID:  X64_0x7E_dxgmms1!VidSchiWaitForSchedulerEvents+1bc

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Caused by DirectX/Graphics Card/Graphics Card Driver.

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

If you are overclocking any hardware, please stop.
Try re-installing DirectX using the Download: DirectX Redist (June 2010) - Microsoft Download Center - Download Details and see how the system responds.

Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.
1. Download the latest drivers for your display card(s)
2. Click Start Menu
3. Right Click My Computer/Computer
4. Click Manage
5. Click Device Manager from the list on the left
6. Expand Display adapters
7. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
8. Restart your computer after uninstalling drivers for all display cards
9. Install the latest driver for the display cards once Windows starts
Alternatively:
1. Login as an adminstrative user
2. Download the latest drivers for your display card(s)
3. Click Start Menu
4. Click Control Panel
5. Click Hardware and Sound
6. Click Device Manager (the last link under Devices and Printers)
7. Expand Display adapters
8. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer after uninstalling drivers for all display cards
10. Install the latest driver for the display cards once Windows starts
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

oofymo1 · 07 Mar 2012

Thank you, I've downloaded a few of the drivers so far, upgraded DirectX and the graphic drivers.

But I'm having issues finding out what driver ACPI\ENE0100\3&2411E6FE&1 is, and where to download it.

writhziden · 07 Mar 2012

Does this help at all? unknown acpi driver - HP Support Forum

It is very difficult to assist you without knowing what model your HP computer is. Please use System Info - See Your System Specs as a guide to fill out your system specs in your profile.

Vir Gnarus · 07 Mar 2012

Quote: Originally Posted by oofymo1

Hi, thanks for the response.

I tried using the Driver Verifier but when I re-booted, the computer just froze up. It didn't even give a BSOD.
I tried rebooting and going into safemode but none of the changes to DV were saved.
Should I just go to the next step with Prime and Memtest?

When in the boot process did it freeze (what was on the screen at the time)? Also, was this recurring, or was it just one time and you decided to switch to Safe Mode? Have you also followed the instructions to make sure not to select any Microsoft drivers in the list, nor did you select Low Resource Simulation, Force Pending I/O Requests or IRP Logging?

Again, Driver Verifier is just to help determine if this is a software bug that's causing this, even though these symptoms are more typical with hardware malfunctioning. So you can go ahead and run the hardware tests at a convenient time (since they will take several hours each).

Windows 7: BSOD 0x1000007e and 0x0000003b unexplained

BSOD 0x1000007e and 0x0000003b unexplained problems?