Windows 7: BSOD at random intervals, primarily 0x1e, 0x3b and 0x7e

Amiculi · 20 Mar 2012

Windows 7 Enterprise 64-bit Retail

GA-MA770T-UD3P Motherboard
2 2x2gb CM3X2G1333C9 Corsair DDR3
AMD Phenom II X4 B50 (4 cores at 3.1ghz stock speeds, 1.4v)
NVIDIA Geforce GTX 260 768mb

Fresh install of windows, roughly 1 month ago
2-3 years old hardware, 4 year old harddisks

Verbose Background Information:

The computer was acquired from a friend in exchange for a good deal of work over time, he has claimed to have never seen a BSOD over the 2 years that he had it. It has seen no hardware changes between us except harddrives and I added an aftermarket heatsink.

Originally he had designed the system via newegg and had it in his shopping cart, he asked me to critique it and swap out any hardware that needed changed, I replaced his 2 sets of 2x2gb ram with a single set of 4x2gb ram and bumped up the PSU. The parts arrived and he assembled the system and installed, unbeknownst to me at the time, Windows 7 Home 32bit.

The cpu ordered was an AMD Phenom II X4 of some description, I forget the model but apparently he switched it to an X2 at some point, though, it has proven to unlock to an X4 B50 since I received it and shows full stability under extensive Prime95 testing after installing a Corsair A50 heatsink and fan to ensure cool running. This occurred on saturday, march 17th. I'm not honestly sure if it is an actual stock X4 or unlocked X2 being that information in differentiating the two is difficult to find. Between X2 and X4 modes the crashes occur at the same frequency and with the same codes.

The BSOD's started within a couple days of getting the system and installing Windows 7 Enterprise x64. I originally theorized it may be the ram being that he had been running 32bit previously and not been using all of it, however, a Memtest86 run overnight succeeded 13 passes without error before having an Unexpected Interrupt, the room was very hot and I attributed it to the heat, the ram was tending to get much warmer to the touch than I was comfortable with, the addition of the A50 seems to have solved this as it is barely warm under load now.

I later tested each stick individually and they all passed 3 passes without issue. This is when I noticed they are two sets of 2x2gb once again, presumably switched for the cost.

Anyway, everything has been running cool with cpu throttling disabled, the cpu cores had previously run roughly 2-8 degrees cooler than the CPU reading in CPUID Hardware Monitor and now never goes about 49 degrees celsius running Prime95 and never above 44 degrees celsius in normal usage suggesting the cores themselves are running no higher than 41-47 degrees celsius under prime95 and 36-42 degrees celsius under normal usage. The cpu reading would usually have a larger spread the higher it ran and at its most extreme before adding the cooler I had seen it at 54c under cpu reading and 46c under cores. This occurred only once, I'm fairly obsessive over keeping the system running cool.

The video hardware has never gone over 79c and is rated to 105c, usually going no higher than 38c idle and 49c while in use.

I've updated all drivers to the most recent I can find. I've uninstalled Daemon Tools and switched to the recommended MagicIso for using image files.

I'm using MSE for antivirus and have been for many years.

The Enterprise Edition install disc of Windows used is the same as on my work computer which has never BSOD'd and leads me to believe it is most likely a hardware issue.

I personally believe the problem is the unpaired ram having exceptionally rare conflicts which usually occur no more than once every two days but have occurred as close as within an hour or two of one another.

After going over many pages of google, digging through every crash dump in Windbg numerous times, cleanly updating any drivers I can and running numerous successful stresstests and stability tests in Prime95, Memtest86 and generally putting the system through great deals of gaming rigor without issue, I'm finally turning to the experts in hopes of finding a solution that may not be dumping down to 4gb ram. The existing sticks while not sold as a package, and I know it can't be guaranteed they will function together, are identical models with identical lot numbers. However, I will drop down in Ram if need be.

Many of the bluescreens earlier on I was able to source and solve the cause of, be it incompatibilities or my own stupidity, the 0x1e, 0x3b and 0x7e crashes, however, remain present.

In summary:
System built roughly 2 years ago.

Installed to windows 7 x86, no BSOD's reported (supposedly)

New install of x64 in February of this year

Crashes occurring within days

Ram is not 100% matching set and was not fully utilized before but same model and same lot (I'm going to pull one set after posting this and see how it behaves)

Sometimes goes hours between crashes, has gone over two weeks, system usage habits have not changed.

Receive no crashes with verifier enabled now

Prime95 runs stable and cool

Memtest86 reports no errors directly, one time had unexpected interrupt error after 13 passes but have not been able to reproduce

Crashes have no connection between activities, usually occur when I am away from the system, have disabled all sleep modes and power saving features with no changes, have mostly occurred in general usage with minimal software running, have occurred rarely with games or other high demand software running but only I think 4 times in total weeks apart

Thank you for your time and patience with my Verbose Background Information(™) and I look forward to insightful response.

Will report back with additional crashes after pulling 2 sticks of ram if they should occur.

writhziden · 20 Mar 2012

First: Thank you for the very informative post.

Problem Devices:

Code:

Xbox 360 Controller for Windows	USB\VID_045E&PID_028E\2CEEBE8	This device is disabled.

Security Software:

Code:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	892	8	200	1380	3/20/2012 8:45 AM	3.0.8402.0	12.48 KB (12,784 bytes)	4/27/2011 6:21 PM
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2488	8	200	1380	3/20/2012 8:45 AM	3.0.8402.0	281.52 KB (288,272 bytes)	4/27/2011 6:21 PM
msseces.exe	c:\program files\microsoft security client\msseces.exe	2772	8	200	1380	3/20/2012 8:45 AM	2.1.1116.0	1.37 MB (1,436,736 bytes)	6/15/2011 3:35 PM

Possible out of date drivers:

Code:

usbfilter	fffff880`03e56000	fffff880`03e62000	Fri Apr 03 05:39:51 2009 (49d5f587)	000128e6		usbfilter.sys
AtiPcie	fffff880`01600000	fffff880`01608000	Tue May 05 09:00:22 2009 (4a005486)	000134c7		AtiPcie.sys

The above usbfilter.sys driver being out of date suggests your chipset drivers may be out of date.
usbfilter.sys
AtiPcie.sys

Code:


Loading Dump File [D:\Kingston\BSODDmpFiles\Amiculi\032012-18220-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02c63000 PsLoadedModuleList = 0xfffff800`02ea7650
Debug session time: Tue Mar 20 09:44:27.600 2012 (UTC - 6:00)
System Uptime: 0 days 0:47:28.771
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff88002f20600, 0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\Rt64win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt64win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
Probably caused by : NETIO.SYS ( NETIO!memmove+bd )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88002f20600, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+3862376630306162
fffff880`02f20600 2815f20280f8    sub     byte ptr [fffff87f`fb7208f8],dl

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f11100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88002f21528 -- (.exr 0xfffff88002f21528)
ExceptionAddress: fffff88001401f0d (NETIO!memmove+0x00000000000000bd)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002f215d0 -- (.trap 0xfffff88002f215d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=b74900054adb251f rbx=0000000000000000 rcx=f7fffa80072ee060
rdx=07fffdfffe47ac08 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001401f0d rsp=fffff88002f21768 rbp=0000000000000204
 r8=0000000000000204  r9=0000000000000010 r10=32ee783559cebe60
r11=f7fffa80072ee040 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
NETIO!memmove+0xbd:
fffff880`01401f0d 488941e0        mov     qword ptr [rcx-20h],rax ds:f7fffa80`072ee040=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d6a97b to fffff80002cdfd40

STACK_TEXT:  
fffff880`02f20548 fffff800`02d6a97b : 00000000`0000001e ffffffff`c0000005 fffff880`02f20600 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f20550 fffff800`02d32e2c : 00000000`00000001 fffff800`02cf1688 00000000`00000001 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`02f20590 fffff800`02d0afec : fffffa80`00000000 fffff880`02f20de0 fffffa80`00000000 fffff800`02c1f401 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`02f205d0 fffff800`02d0aa6d : fffff800`02e259d0 fffff880`02f224e0 00000000`00000000 fffff800`02c63000 : nt!_C_specific_handler+0x8c
fffff880`02f20640 fffff800`02d09845 : fffff800`02e259d0 fffff880`02f206b8 fffff880`02f21528 fffff800`02c63000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02f20670 fffff800`02d1a7c1 : fffff880`02f21528 fffff880`02f20d80 fffff880`00000000 f7fffa80`00000005 : nt!RtlDispatchException+0x415
fffff880`02f20d50 fffff800`02cdf3c2 : fffff880`02f21528 00000000`00000392 fffff880`02f215d0 fffff880`02f218e8 : nt!KiDispatchException+0x135
fffff880`02f213f0 fffff800`02cddcca : fffffa80`00000596 00000000`00000000 00000000`00000000 fffffa80`0772d030 : nt!KiExceptionDispatch+0xc2
fffff880`02f215d0 fffff880`01401f0d : fffff880`01409b0d fffffa80`09850b90 00000000`00000000 fffffa80`0772d030 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f21768 fffff880`01409b0d : fffffa80`09850b90 00000000`00000000 fffffa80`0772d030 00000000`00000001 : NETIO!memmove+0xbd
fffff880`02f21770 fffff880`01685bc7 : fffff880`02f21898 fffff880`02f21870 fffff880`02f21880 fffff880`02f218e8 : NETIO!RtlCopyMdlToMdlIndirect+0xfd
fffff880`02f21810 fffff880`016ce8b8 : fffffa80`09850b90 00000000`00000000 00000000`00000001 fffffa80`08429d50 : tcpip!TcpCovetNetBufferListAndEnqueueInput+0x137
fffff880`02f218e0 fffff880`016cbd58 : 00000000`a9d32953 fffff880`02f21c80 fffffa80`085bb000 fffffa80`09850b90 : tcpip!TcpDeliverReceive+0x128
fffff880`02f219e0 fffff880`016cc8b5 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff880`041553fc : tcpip!TcpTcbFastDatagram+0x208
fffff880`02f21ba0 fffff880`016cb67a : fffffa80`06b51de0 fffff880`016c3b00 fffffa80`06b15401 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5
fffff880`02f21d50 fffff880`016cd2ab : fffff880`057688a2 fffffa80`075e4000 00000000`00000000 00000000`00000000 : tcpip!TcpMatchReceive+0x1fa
fffff880`02f21ea0 fffff880`016c41c7 : fffffa80`06b51de0 fffffa80`075fb380 fffffa80`00008fc0 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x36b
fffff880`02f21f70 fffff880`016c3d3a : 00000000`00000000 fffff880`017e39a0 fffff880`02f22130 fffffa80`08422610 : tcpip!IppDeliverListToProtocol+0x97
fffff880`02f22030 fffff880`016c3339 : fffff880`017e39a0 fffffa80`08422700 fffff880`02f220a0 fffff880`02f22120 : tcpip!IppProcessDeliverList+0x5a
fffff880`02f220d0 fffff880`016c10af : 00000000`6701a8c0 fffffa80`075e4000 fffff880`017e39a0 00000000`082f9001 : tcpip!IppReceiveHeaderBatch+0x23a
fffff880`02f221b0 fffff880`016c06a2 : fffffa80`085c3230 00000000`00000000 fffffa80`082f9001 fffffa80`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff880`02f223b0 fffff880`016bfb3a : fffffa80`082f9010 fffff880`02f224e0 fffffa80`082f9010 fffff880`03e00000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`02f22490 fffff800`02ceba88 : fffffa80`08429d50 00000000`00004800 fffffa80`07921b60 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`02f224e0 fffff880`016c0202 : fffff880`016bfa60 fffff880`016ee368 fffffa80`06b29d02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`02f225c0 fffff880`015820eb : fffffa80`082788d0 00000000`00000000 fffffa80`07fc41a0 fffff880`016ef3ef : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`02f22630 fffff880`0154bad6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`02f226a0 fffff880`014c4cc1 : fffffa80`07fc41a0 00000000`00000002 00000000`00000001 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`02f22b20 fffff880`04165ce8 : fffffa80`08273000 00000000`00000001 fffffa80`08273618 00000000`00000000 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1
fffff880`02f22b70 fffffa80`08273000 : 00000000`00000001 fffffa80`08273618 00000000`00000000 fffffa80`00000001 : Rt64win7+0x16ce8
fffff880`02f22b78 00000000`00000001 : fffffa80`08273618 00000000`00000000 fffffa80`00000001 fffff880`02f22c10 : 0xfffffa80`08273000
fffff880`02f22b80 fffffa80`08273618 : 00000000`00000000 fffffa80`00000001 fffff880`02f22c10 00000001`07fc8000 : 0x1
fffff880`02f22b88 00000000`00000000 : fffffa80`00000001 fffff880`02f22c10 00000001`07fc8000 00000000`00000001 : 0xfffffa80`08273618


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!memmove+bd
fffff880`01401f0d 488941e0        mov     qword ptr [rcx-20h],rax

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  NETIO!memmove+bd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_NETIO!memmove+bd

BUCKET_ID:  X64_0x1E_c0000005_NETIO!memmove+bd

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\Amiculi\031812-16426-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e9b650
Debug session time: Sun Mar 18 17:38:41.840 2012 (UTC - 6:00)
System Uptime: 1 days 1:55:43.386
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002cdef0b, fffff8800a3d2dc0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+13b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cdef0b, Address of the instruction which caused the bugcheck
Arg3: fffff8800a3d2dc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiInsertTimerTable+13b
fffff800`02cdef0b 488b42f8        mov     rax,qword ptr [rdx-8]

CONTEXT:  fffff8800a3d2dc0 -- (.cxr 0xfffff8800a3d2dc0)
rax=0000000000000000 rbx=fffffa800793d9b0 rcx=0000000000000000
rdx=f7fff80002e4b5e8 rsi=0000000000000560 rdi=fffff80002e48e80
rip=fffff80002cdef0b rsp=fffff8800a3d37a0 rbp=fffff80002e4b5e8
 r8=fffffa800793d970  r9=000000000000001b r10=fffff80002e48e80
r11=fffffa8006e0a000 r12=fffff80002e4b5e8 r13=0000000000000001
r14=fffffa800793d900 r15=000000d955060186
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!KiInsertTimerTable+0x13b:
fffff800`02cdef0b 488b42f8        mov     rax,qword ptr [rdx-8] ds:002b:f7fff800`02e4b5e0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  EQVoiceService

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002cdef0b

STACK_TEXT:  
fffff880`0a3d37a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInsertTimerTable+0x13b


FOLLOWUP_IP: 
nt!KiInsertTimerTable+13b
fffff800`02cdef0b 488b42f8        mov     rax,qword ptr [rdx-8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiInsertTimerTable+13b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

STACK_COMMAND:  .cxr 0xfffff8800a3d2dc0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiInsertTimerTable+13b

BUCKET_ID:  X64_0x3B_nt!KiInsertTimerTable+13b

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\Amiculi\031712-16458-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e4d650
Debug session time: Sat Mar 17 09:46:02.504 2012 (UTC - 6:00)
System Uptime: 0 days 12:58:56.800
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002c42e40, fffff880031408e8, fffff88003140140}

Probably caused by : ntkrnlmp.exe ( nt!KeEnumerateKernelStackSegments+28 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c42e40, The address that the exception occurred at
Arg3: fffff880031408e8, Exception Record Address
Arg4: fffff88003140140, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeEnumerateKernelStackSegments+28
fffff800`02c42e40 48894508        mov     qword ptr [rbp+8],rax

EXCEPTION_RECORD:  fffff880031408e8 -- (.exr 0xfffff880031408e8)
ExceptionAddress: fffff80002c42e40 (nt!KeEnumerateKernelStackSegments+0x0000000000000028)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: ffffffffffffffff
   Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000

CONTEXT:  fffff88003140140 -- (.cxr 0xfffff88003140140)
rax=fffff8800a07b000 rbx=0000000000000000 rcx=fffffa800a446470
rdx=fffff80002c427e0 rsi=fffff88003140cb0 rdi=fffffa800a446470
rip=fffff80002c42e40 rsp=fffff88003140b20 rbp=f7fff8800a080db0
 r8=fffff88003140bd0  r9=0000000000000001 r10=0000000000000000
r11=fffff80002c94930 r12=fffff88003140bd0 r13=0000000000000000
r14=0000000000000000 r15=fffff80000b96080
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!KeEnumerateKernelStackSegments+0x28:
fffff800`02c42e40 48894508        mov     qword ptr [rbp+8],rax ss:0018:f7fff880`0a080db8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  ffffffffffffffff

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb7100
 0000000000000000 

FOLLOWUP_IP: 
nt!KeEnumerateKernelStackSegments+28
fffff800`02c42e40 48894508        mov     qword ptr [rbp+8],rax

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002c42de8 to fffff80002c42e40

STACK_TEXT:  
fffff880`03140b20 fffff800`02c42de8 : 00000000`00000000 00000000`00000000 fffff880`03140cb0 fffffa80`0a446470 : nt!KeEnumerateKernelStackSegments+0x28
fffff880`03140bb0 fffff800`02c42d8c : 00000000`00000000 00000000`00000020 00000000`00000000 fffff800`02c29bf3 : nt!MmOutPageKernelStack+0x34
fffff880`03140c90 fffff800`02cb9878 : 00000000`00000000 00000000`00000080 fffffa80`06a25040 fffffa80`06a25000 : nt!KiOutSwapKernelStacks+0x11c
fffff880`03140d00 fffff800`02f1ff7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSwapProcessOrStack+0x48
fffff880`03140d40 fffff800`02c769c6 : fffff800`02dfae80 fffffa80`06af0b60 fffff800`02e08cc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03140d80 00000000`00000000 : fffff880`03141000 fffff880`0313b000 fffff880`03140a50 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeEnumerateKernelStackSegments+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

STACK_COMMAND:  .cxr 0xfffff88003140140 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!KeEnumerateKernelStackSegments+28

BUCKET_ID:  X64_0x7E_nt!KeEnumerateKernelStackSegments+28

Followup: MachineOwner
---------

Seems to be an out of date or corrupted Realtek Ethernet Driver. Rt64win7.sys. Other possible causes include Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash.
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...

Thanks to Dave76 for help understanding possible causes.

I suspect a possible corrupted driver for your network adapter. Re-install the latest Realtek driver using the link above to find the driver, or better yet, from the motherboard downloads page. When you re-install, use the following general steps:

1. Click Start Menu
2. Right Click My Computer/Computer
3. Click Manage
4. Click Device Manager from the list on the left
5. Find the device you are trying to uninstall by expanding the appropriate set of devices
6. Right click the device
7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
8. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer
10. Install the latest driver for the device once Windows starts.
Alternatively:
1. Login as an adminstrative user.
2. Click Start Menu
3. Click Control Panel
4. Click Hardware and Sound
5. Click Device Manager (the last link under Devices and Printers)
6. Find the device you are trying to uninstall by expanding the appropriate set of devices
7. Right click the device
8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
10. Restart your computer
11. Install the latest driver for the device once Windows starts.

Let's check out your RAM configuration:

Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

Amiculi · 21 Mar 2012

Thanks for the new information!

I have updated the drivers recommended, I couldn't previously find new versions of any of them but they all had easy to acquire updates here except for AtiPcie.sys, the chipset drivers refuse to update it and everything I've read seems to suggest that some low level drivers such as that are often older and simply built up from. However, if you have any suggestions of how to find updated versions of it outside of the ATI Catalyst Manager, I'm all ears.

The Xbox 360 Wired controller is disabled by choice. I enable it when I want to use it and disable it when I don't, far easier than crawling behind the system to unplug it being that my front USB ports have other more constant uses (Specifically for my keyboard's wireless adapter, it tends to get a poor signal plugged in the back of the system, and my headphones' power connector which is always in use in situations where I desire the controller). I've tried unplugging it and all non-essential USB devices other than mouse and keyboard and I get the same crashes regardless of what was plugged in. I'll leave them in for the time being and see if I get any new crashes.

The system ran without error from the time of my initial post til now with 2 of 4 sticks of ram installed, however, it's known to go many days without a crash without any obvious reason so it hasn't been telling yet. I've reinstalled the other two sticks to take the requested screenshots of CPU-Z so as to keep hardware consistent in the diagnostic process.

I've also attached a fresh run of the jcgriff diagnostic tool's output that should hopefully show the usbfilter.sys and Rt64win7.sys updated, there are no new crashes for it to report. I'm still unsure of what I can do about the AtiPcie.sys. The Catalyst Manager doesn't update it and windows itself states that the drivers are up to date but we know that is a highly unreliable method. NirSoft's DriverView still shows it as being modified 5/4/2009.

At any rate, hopefully we're a couple steps closer, I do know that the majority of crashes were pointing to USB devices and the network drivers, I'd just been unable to find any updates for it and come to the conclusion that they just had extremely old drivers. Finding specific drivers via the filename is often difficult in my experience.

[EDIT: I forgot to mention that the CPU-Z information remains largely identical with 2 sticks vs 4 sticks installed. None of the information changes beyond the total volume, and there being 4 slots listed in SPD instead of 2, obviously.]

Amiculi · 23 Mar 2012

It has taken awhile but another crash finally popped up. Fresh minidump attached.

The system hadn't seen very much use the past day or two compared to usual, it occurred this morning simply switching between tabs with a mouse click in Chrome. It's notable that this seems to be kind of a trend, they occur precisely with a mouse click, usually on my browser but not always. This particular crash just seems to like to coincide with my clicking on something.

However, my ability to interpret minidumps with Windbg are very limited so I'm unable to glean anything fresh from this crash.

writhziden · 23 Mar 2012

Quote: Originally Posted by Amiculi

I have updated the drivers recommended, I couldn't previously find new versions of any of them but they all had easy to acquire updates here except for AtiPcie.sys, the chipset drivers refuse to update it and everything I've read seems to suggest that some low level drivers such as that are often older and simply built up from. However, if you have any suggestions of how to find updated versions of it outside of the ATI Catalyst Manager, I'm all ears.

That's alright, you're drivers all appear to be up to date.

Code:

BIOS Version/Date	Award Software International, Inc. F5, 11/18/2009

You might try a BIOS update. Your BIOS is a couple years outdated. Backup any important data first, just to be safe.

Amiculi · 23 Mar 2012

Hrm, well, this is a bit embarrassing.

Upon looking up and downloading the bios for the GA-MA770-UD3 Revision 1.0 motherboard I believed I had, and attempting to flash it, Q-Flash informed me that this wasn't the right version.

Further research resulted in the discovery that I'm running the GA-MA770T-UD3 Revision 1.1.

I'd previously found the revision and model via a combination of hardware scans and Gigabytes own page landing me on the 1.0 of MA770. This was erroneous. So now I've updated chipset, audio and network drivers via this page: GIGABYTE - Motherboard - Socket AM3 - GA-MA770T-UD3 (rev. 1.1)

I'm going to hold off on updating my bios until I see another crash. Hopefully this proves to be the lynchpin of all the problems and everything will go swimmingly. However, if it doesn't I'll give the Bios update a shot, it's downloaded, ready and sitting on a USB stick.

Regardless of my own error I can't thank you enough for your expertise and time. I'll be sure to report back should problems arise again and continue to report my actions. I"ll also make sure to report back if things are fine and mark the thread as solved should I go a week or two without troubles.

Wish me luck!

writhziden · 23 Mar 2012

Best of luck!

Glad you determined which board you have. Sometimes these things happen with various revisions of different boards, so don't feel too embarrassed.

Amiculi · 24 Mar 2012

Frustrating isn't quite the word.

After updating the drivers via the above link, the motherboard started reporting as a GA-MA770T-UD3P instead of simply UD3. Further drivers were downloaded and the bios update was acquired yet again.

Upon updating the drivers and rebooting the third time in sequence with the final updating being chipset, the system refused to boot into windows. It loaded, the screen went black as it always does before the login screen comes up, then nothing for a long time. Finally I hardbooted.

Upon rebooting it reached loading windows and informed me that there was an error and I should repair windows, I told it to go ahead and it sat for a very long time scanning for problems. I finally canceled the process, I attempted to run the install disc to repair windows from there but it simply sat on a blank, windows background with no prompts for the better part of an hour.

I rebooted again, this time I updated the bios with the new one acquired for the supposed proper motherboard, it updated successfully without complaint, rebooted, then failed to post. Another boot and it told me there was a problem with the bios which it promptly repaired and it booted to post after this.

The windows repair prompt returned and eyed me furtively through its windows 95 style teal menubar and I allowed it to continue again. This time it successfully identified but didn't inform me of what the problem was, here it restarted, posted and booted into windows successfully.

At this point I discovered that the bios update had reset my processor to function as a dual core, that being a story in and of itself, the bios contains no options now to switch to quadcore mode. Further, windows loaded as a kind of wispy ghost of itself with many icons in the system tray displaying as blank and non-interactive, everything was sluggish and folders don't update activity without a manual refresh. The date had changed but I missed to what exactly, it auto-updated time before I could see how far back I was set.

I rebooted again, this time my tray icons display correctly but many programs refuse to load and everything is functioning oddly.

I'm currently backing up all pertinent data from my windows drive with intent to give a full 0'd out format and reinstall windows. Things feel completely unrecoverable at this point. This will be the first windows install I was completely unable to salvage in my entire computer using life.

I intend also to rollback to my old bios as not only did it offer more options and precision, it posted roughly 5-10 times faster, the current boot time is nearly 3 minutes compared to no more than 40 seconds before.

At some point in this process the motherboard is getting a more thorough inspections to determine the exact make and model, what it says is what I will use without question being that Speccy has been flip-flopping its opinion of the model repeatedly as drivers change.

HOPEFULLY this will finally result in a stable system but at this point my hopes aren't high. The hardware may simply be a lemon, and is unfortunately too old to RMA even if I could identify the specific problem.

So, a lesson learned here is to never again accept used hardware without at least the accompanying discs and documentation. I've never had so many issues before and I've cobbled functioning systems out of numerous dead computers in the past, parts 5+ years apart in manufacture and use.

But I digress, at this point it is more complaint than solution or constructive brainstorming. If a fresh install can't fix it I really don't know where to go in the diagnosis process, but, if I can at least rule out my own error of driver versions, I might manage to make some headway.

This time, no luck, only success, we jinxed it last time ;D

writhziden · 24 Mar 2012

I am really sorry to see that things went so badly.

I thought we were on the right track, too. There should be a sticker on the motherboard somewhere with the revision number. Usually the sticker is on one of the PCI-E slots, RAM slots, or between them. It can sometimes be near the power connections or the expansion slots, as well.

Hopefully once the revision is known, you can get things up and running again and re-install Windows with the correct drivers to get it working properly.

Amiculi · 24 Mar 2012

Letting the system sit on the windows themed background of the installer for a solid hour finally resulting in it starting up the install process.

Windows was reinstalled without remarkable event. I've updated to the latest video drivers and allowed windows update to deal with any other drivers for the time being. Eventually I'll be updating them but for now I'm back to the waiting game to see if I get any fresh crashes.

Shortly after updating my video drivers I did get yet another crash, it points to memory corruption, a bugcheck 109, essentially identical to any others listed here, but from what I've read on these forums, it can be a case of bad ram, or in other cases, a one-off crash that may never happen again, I'm hoping the latter.

Otherwise, everything appears to be nominal, but then, the crashes have been so completely unpredictable and I've been wholly unable to reproduce them, so it's anyone's guess.

I'm going to give it a day or two to generate crashes, if it runs alright and throws nothing I can't deal with, I'll be looking into driver updates, then more waiting and observing.

At this point I'm inclined to believe that it was either a horrible series of mismatched drivers from too many updates from disparate sources, or it's the ram. So giving the system some easy time and taking everything slow, one step at a time, will hopefully result in the solution.

I wasn't going to bother posting the new minidump until I had more to compare it to, but just in case it's simply requested of me afterwards, I've attached it.

Windows 7: BSOD at random intervals, primarily 0x1e, 0x3b and 0x7e

BSOD at random intervals, primarily 0x1e, 0x3b and 0x7e problems?