BSOD working with 3dsmax, UDK and Unity3D opened.

vikti · 12 Mar 2012

Hi,

I had a new serie of BSOD last week (4 in one hour...) while I was working on a 3d project. I had :
- 3DSmax 2012
- Unity3d 3.5
- UDK editor

So a big load on memory access.

My configuration :
- 4 years old
- Windows 7 ultimate x64
- ASUSTeK P5K (Intel P35 Express)
- Intel Q6600 2.4ghz non overclocked
- 4go Kingston HyperX DDR2-SDRAM PC8500 CL5 - KHX8500D2K2/2G
- RADEON HD5700

I have built it on my own.

I ran :

- SFC /SCANNOW Command - System File Checker up to three times to fix all errors.
- Memtest86+
- Windows Memory Diagnostics Tool all week-end (at least 30 passes...)

No error for those tests.

I also ran Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs.

Result for my C: (ssd)

Code:

Nom du journal*:Application
Source*:       Microsoft-Windows-Wininit
Date*:         12/03/2012 10:11:16
ID de l’événement*:1001
Catégorie de la tâche*:Aucun
Niveau*:       Information
Mots clés*:    Classique
Utilisateur*:  N/A
Ordinateur*:   Hurlevent
Description*:


Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

WARNING!  I parameter specified.
Your drive may still be corrupt even after running CHKDSK.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  480512 file records processed.                                         

File verification completed.
  1152 large file records processed.                                   

  0 bad file records processed.                                     

  4 EA records processed.                                           

  138 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  928492 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  480512 file SDs/SIDs processed.                                        

Cleaning up 6415 unused index entries from index $SII of file 0x9.
Cleaning up 6415 unused index entries from index $SDH of file 0x9.
Cleaning up 6415 unused security descriptors.
CHKDSK is compacting the security descriptor stream
  68831 data files processed.                                           

CHKDSK is verifying Usn Journal...
  79656168 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  480496 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  5363241 free clusters processed.                                        

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

 125033860 KB total disk space.
 102737672 KB in 410115 files.
    213912 KB in 68834 indexes.
         0 KB in bad sectors.
    629308 KB in use by the system.
     65536 KB occupied by the log file.
  21452968 KB available on disk.

      4096 bytes in each allocation unit.
  31258465 total allocation units on disk.
   5363242 allocation units available on disk.

Internal Info:
00 55 07 00 e1 4e 07 00 0e 1e 0d 00 00 00 00 00  .U...N..........
19 05 00 00 8a 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

XML de l’événement*:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-03-12T09:11:16.000000000Z" />
    <EventRecordID>33631</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Hurlevent</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

WARNING!  I parameter specified.
Your drive may still be corrupt even after running CHKDSK.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  480512 file records processed.                                         

File verification completed.
  1152 large file records processed.                                   

  0 bad file records processed.                                     

  4 EA records processed.                                           

  138 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  928492 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  480512 file SDs/SIDs processed.                                        

Cleaning up 6415 unused index entries from index $SII of file 0x9.
Cleaning up 6415 unused index entries from index $SDH of file 0x9.
Cleaning up 6415 unused security descriptors.
CHKDSK is compacting the security descriptor stream
  68831 data files processed.                                           

CHKDSK is verifying Usn Journal...
  79656168 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  480496 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  5363241 free clusters processed.                                        

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

 125033860 KB total disk space.
 102737672 KB in 410115 files.
    213912 KB in 68834 indexes.
         0 KB in bad sectors.
    629308 KB in use by the system.
     65536 KB occupied by the log file.
  21452968 KB available on disk.

      4096 bytes in each allocation unit.
  31258465 total allocation units on disk.
   5363242 allocation units available on disk.

Internal Info:
00 55 07 00 e1 4e 07 00 0e 1e 0d 00 00 00 00 00  .U...N..........
19 05 00 00 8a 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

Result for my D: (hdd)

Code:

Chkdsk a été exécuté en mode lecture-seule sur une capture instantanée de volume.  

Vérification du système de fichiers sur D:
Le nom de volume est Data.

CHKDSK est en train de vérifier les fichiers (étape 1 sur 3)...
  311808 enregistrements de fichier traités.                              La vérification des fichiers est terminée.
  66 enregistrements de grand fichier traités.                          0 enregistrements de fichier incorrect traités.                      0 enregistrements EA traités.                                        0 enregistrements d’analyse traités.                               CHKDSK est en train de vérifier les index (étape 2 sur 3)...
La bitmap d’index $SII dans le fichier 0x9 est incorrecte.
Erreur détectée dans l’index $SII du fichier 9.
  414788 entrées d’index traitées.                                         La vérification des index est terminée.

Erreurs trouvées. CHKDSK ne peut pas continuer en mode lecture seule.

It is ok for c: but I can't repair errors on d: because chkdsk doesn't respond anymore after a while.

Any help wold be appreciated, thanks.

zigzag3143 · 12 Mar 2012

Please remove any CD visualization programs such as Daemon Tools and Alcohol 120%.

They use a driver, found in your dmp, called sptd.sys, that is notorious for causing BSODs.

Use this SPTD uninstaller DuplexSecure - Downloads DuplexSecure - FAQ

when you're done you can use this Freeware:

MagicISO Virtual CD/DVD-ROM (MagicDisc) in its place

Using MagicISO to create ISO image files

vikti · 12 Mar 2012

Ok, done.

I will restart working tomorrow on the project and see if it is solved.

vikti · 06 Apr 2012

Ok,

since my last post : no problem until... 5 minutes ago...

I was working into UDK and I had a BSOD.

Do you want the mini dmp file or the whole test folder ?

writhziden · 06 Apr 2012

Please upload the full test folder. I imagine since it has been a few weeks, some things may have changed on your system in that time.

vikti · 06 Apr 2012

Ok

so there are two report, one without running UDK and the other running it.

thx a lot

writhziden · 06 Apr 2012

Possible out of date drivers:

Code:

sncduvc	fffff880`07feb000	fffff880`07ff3c00	Tue Jul 15 20:59:31 2008 (487d6413)	0001070d		sncduvc.SYS
hxctlflt	fffff880`07c00000	fffff880`07c21000	Mon Feb 09 00:43:09 2009 (498fde8d)	0001baad		hxctlflt.sys
snp2uvc	fffff880`07c76000	fffff880`07fd9480	Wed Apr 22 01:46:04 2009 (49eecb3c)	0036b112		snp2uvc.sys

sncduvc.SYS
hxctlflt.sys
snp2uvc.sys
See if you can find updated drivers for your webcam. If not, I wouldn't worry about it too much. Webcam drivers are often out of date and still work fine in most cases.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\vikti\report with udk running\report with udk running\Windows_NT6_BSOD_jcgriff2\040612-8751-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0320f000 PsLoadedModuleList = 0xfffff800`03453650
Debug session time: Fri Apr  6 06:09:21.363 2012 (UTC - 6:00)
System Uptime: 0 days 4:57:21.189
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000108e38, ce700000814f0867, fffff68000108ef2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+3266c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000108e38
Arg3: ce700000814f0867
Arg4: fffff68000108ef2

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  UDKMobile.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003233c56 to fffff8000328bd40

STACK_TEXT:  
fffff880`0b5537a8 fffff800`03233c56 : 00000000`0000001a 00000000`00000403 fffff680`00108e38 ce700000`814f0867 : nt!KeBugCheckEx
fffff880`0b5537b0 fffff800`032bd137 : 00000000`00000000 fffff680`00108f00 fffffa80`047b4290 00000000`0000003f : nt! ?? ::FNODOBFM::`string'+0x3266c
fffff880`0b553960 fffff800`032784bf : fffffa80`00000000 00000000`211e0fff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0b553b20 fffff800`0328afd3 : ffffffff`ffffffff 00000000`2ec6f780 00000000`2ec6f748 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0b553c20 00000000`76fc14fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`2ec6f6b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fc14fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+3266c
fffff800`03233c56 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+3266c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+3266c

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+3266c

Followup: MachineOwner
---------

This crash is usually caused by memory problems or underlying driver conflicts.

If you are overclocking any hardware, please stop.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. In Windows 7:
- Click the Start Menu
- Type verifier in Search programs and files (do not hit enter)
- Right click verifier and click Run as administrator
- Put a tick in Create custom settings (for code developers) and click next
- Put a tick in Select individual settings from a full list and click next
- Set up the individual settings as in the image and click next
  Attachment 206062
- Put a tick in Select driver names from a list
- Put a tick next to all non-Microsoft drivers.
- Click Finish.
- Restart your computer.
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

vikti · 10 Apr 2012

Hi,

1) Memtest : no memory or disk problem. (running all week end)

2) Verifier : Here are two minidump files that I get when I have started Seven in normal mode. Windows didn't start (BSOD) but it created the dmp.
Have I to find a group that runs in normal mode ?

writhziden · 10 Apr 2012

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\vikti\041012-15818-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0324a000 PsLoadedModuleList = 0xfffff800`0348e650
Debug session time: Tue Apr 10 03:04:40.008 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:15.849
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 198, fffffa8006105b30, fffff88004841d86}

Unable to load image \??\C:\Program Files\NetLimiter 3\nltdi.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nltdi.sys
*** ERROR: Module load completed but symbols could not be loaded for nltdi.sys
Probably caused by : nltdi.sys ( nltdi+1d86 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000198, Handle value being referenced.
Arg3: fffffa8006105b30, Address of the current process.
Arg4: fffff88004841d86, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000374f3dc to fffff800032c6d40

STACK_TEXT:  
fffff880`067ba698 fffff800`0374f3dc : 00000000`000000c4 00000000`000000f6 00000000`00000198 fffffa80`06105b30 : nt!KeBugCheckEx
fffff880`067ba6a0 fffff800`03764ae4 : 00000000`00000198 fffffa80`06105b30 00000000`00000004 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`067ba6e0 fffff800`0351d1e0 : fffff8a0`017f3450 fffff880`067ba950 fffff880`067bab00 fffff880`067bacb8 : nt!VfCheckUserHandle+0x1b4
fffff880`067ba7c0 fffff800`0358bec5 : fffff8a0`017f3400 fffff800`00000008 fffffa80`039e8ed0 fffff8a0`017f3400 : nt! ?? ::NNGAKEGL::`string'+0x212ce
fffff880`067ba890 fffff800`032c5fd3 : 00000000`00000198 fffffa80`06cc0b60 fffff880`067bacb8 fffff8a0`017f34a0 : nt!NtQueryInformationToken+0x1f3
fffff880`067baa90 fffff800`032c2570 : fffff800`03754083 fffffa80`06d8c6d0 fffff980`03a78fb8 00000000`7617c963 : nt!KiSystemServiceCopyEnd+0x13
fffff880`067bac98 fffff800`03754083 : fffffa80`06d8c6d0 fffff980`03a78fb8 00000000`7617c963 fffff800`032c2570 : nt!KiServiceLinkage
fffff880`067baca0 fffff880`04841d86 : fffff880`067baf10 fffff980`03a78fb8 fffffa80`06d8c6d0 00000000`032f1da0 : nt!VfZwQueryInformationToken+0x63
fffff880`067bacf0 fffff880`067baf10 : fffff980`03a78fb8 fffffa80`06d8c6d0 00000000`032f1da0 fffff880`067bad28 : nltdi+0x1d86
fffff880`067bacf8 fffff980`03a78fb8 : fffffa80`06d8c6d0 00000000`032f1da0 fffff880`067bad28 00000000`00000000 : 0xfffff880`067baf10
fffff880`067bad00 fffffa80`06d8c6d0 : 00000000`032f1da0 fffff880`067bad28 00000000`00000000 00000000`00000198 : 0xfffff980`03a78fb8
fffff880`067bad08 00000000`032f1da0 : fffff880`067bad28 00000000`00000000 00000000`00000198 fffff880`067bae10 : 0xfffffa80`06d8c6d0
fffff880`067bad10 fffff880`067bad28 : 00000000`00000000 00000000`00000198 fffff880`067bae10 3a300000`03571860 : 0x32f1da0
fffff880`067bad18 00000000`00000000 : 00000000`00000198 fffff880`067bae10 3a300000`03571860 fffff800`035711c0 : 0xfffff880`067bad28


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nltdi+1d86
fffff880`04841d86 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  nltdi+1d86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nltdi

IMAGE_NAME:  nltdi.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c779fae

FAILURE_BUCKET_ID:  X64_0xc4_f6_VRF_nltdi+1d86

BUCKET_ID:  X64_0xc4_f6_VRF_nltdi+1d86

Followup: MachineOwner
---------

You do not need to find a group that runs in normal mode. The fact that it is crashing on startup means you have an incompatible driver. It appears to be your NetLimiter software that is causing the crash on startup. Remove the software and see how the system responds. You may need to disable Verifier, remove the driver, and then re-enable Verifier using the steps in my previous post.

When you are ready to disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Type the following command and then Enter:

verifier /reset

-> Restart your computer.

vikti · 18 Apr 2012

Hi,

since a few days and after Nelimiter was removed I haven't got any crash until yestarday.
I was on rendez-vous when I heard my computer restarted. I had only gmail (chrome) running and the usual background tasks (the same as my old post)

So for now I got only one *.dmp and I am waiting for few next.

I have uploaded it just in case.