Windows 7: Random BSOD 0x3B

digocampos · 16 Apr 2012

While playing Dota2, but also happens randomly.

Output from WhoCrashed:

On Tue 17/04/2012 01:30:07 GMT your computer crashed
crash dump file: C:\Windows\Minidump\041612-21918-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x705C0)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80003365CA9, 0xFFFFF880046E5C40, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time.

Link to .dmp:

http://dl.dropbox.com/u/42235240/041612-21918-01.dmp

zigzag3143 · 16 Apr 2012

Link is broken, please try again.

digocampos · 16 Apr 2012

Weird, works for me and a random friend.

Anyways, mediafire now: 041612-21918-01.dmp

zigzag3143 · 16 Apr 2012

Quote: Originally Posted by digocampos

Weird, works for me and a random friend.

Anyways, mediafire now: 041612-21918-01.dmp

Asacpi.sys and old drivers

Asacpi.sys

The pre 2009 version of this driver is a known BSOD cause.

Quote:

Please visit this link: Asus tek computer inc. -support- drivers and download p7p55d le

ASUSTeK Computer Inc. -Support- Drivers and Download P7P55D LE
ASUSTeK Computer Inc. - Motherboards- ASUS P5K-VM

Scroll down to the utilities category, then scroll down to the "atk0110 driver for windowsxp/vista/windows 7 32&64-bit" (it's about the 12th item down).

Download and install it.

Go to c:\windows\system32\drivers to check and make sure that the asacpi.sys file is date stamped from 2009 or 2010 (not before).

Old drivers

Code:

ASACPI.sys    3/27/2005 10:30:36 PM        fffff880`04235000    fffff880`0423d000    0x00008000    0x42476c4c                        
LHidFilt.Sys    7/17/2007 8:35:22 PM        fffff880`06972000    fffff880`06984000    0x00012000    0x469d604a                        
LMouFilt.Sys    7/17/2007 8:35:26 PM         
adfs.SYS    6/26/2008 4:52:37 PM             
cmudax3.sys    5/19/2009 4:26:33 AM                             
amdxata.sys    5/19/2009 1:56:59 PM

How To Find Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference "http://www.carrona.org/dvrref.php"]Driver Reference

- - Driver manufacturer links are on this page: "http://www.carrona.org/drvrdown.html"]Drivers and Downloads

digocampos · 16 Apr 2012

Still going through that list, anyway, got another BSOD before updating some drivers.

Those drivers will probably solve this, but just in case, here is trace

On Tue 17/04/2012 02:49:24 GMT your computer crashed
crash dump file: C:\Windows\Minidump\041612-22573-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5DD80)
Bugcheck code: 0xFC (0xFFFFF8800127ED80, 0x8000000003D9F963, 0xFFFFF8800AC8A3B0, 0x2)
Error: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that an attempt was made to execute non-executable memory.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. There is a possibility this problem was caused by a virus or other malware.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time.

Link (same file for both):
http://dl.dropbox.com/u/42235240/041612-22573-01.dmp
041612-22573-01.dmp

writhziden · 24 Apr 2012

Possible out of date drivers:

Code:

ASACPI	fffff880`04235000	fffff880`0423d000	Sun Mar 27 20:30:36 2005 (42476c4c)	00003c77		ASACPI.sys
LHidFilt	fffff880`02871000	fffff880`02883000	Tue Jul 17 18:35:22 2007 (469d604a)	0001366d		LHidFilt.Sys
LMouFilt	fffff880`02883000	fffff880`02896000	Tue Jul 17 18:35:26 2007 (469d604e)	00018e72		LMouFilt.Sys
adfs	fffff880`06f61000	fffff880`06f79000	Thu Jun 26 14:52:37 2008 (48640195)	00024203		adfs.SYS
cmudax3	fffff880`0425b000	fffff880`043c1000	Tue May 19 02:26:33 2009 (4a126d39)	00128270		cmudax3.sys
amdxata	fffff880`00e5d000	fffff880`00e68000	Tue May 19 11:56:59 2009 (4a12f2eb)	00011b8c		amdxata.sys

Older versions of ASACPI.SYS are a known BSOD problem on Windows 7. Update the driver by:

Going to the Asus motherboard support site
When you reach the website:
Scroll down the page and click Utilities
Hold Ctrl and press f (ctrl+f) to enter the browser's find feature
Search for "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit" (without quotes)
Download and install the driver.
After installation is complete, verify that it installed correctly.
- Click Start Menu
- Click My Computer
- Go to C:\WIndows\System32\drivers\
- Verify that the ASACPI.SYS file is dated 2009 or newer (2010,etc.)

Thanks to JMH and zigzag3143 for the above information.

LHidFilt.Sys
LMouFilt.Sys
adfs.SYS
cmudax3.sys
amdxata.sys

Install all Windows Updates.

Please remove any CD/DVD virtualization software, such as Daemon Tools/Alcohol 120%, as they use a driver called sptd.sys that is known to cause BSODs. Use add/remove programs to remove the software. After removing the software, use the sptd.sys uninstaller to remove sptd.sys from the system.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\digocampos\041612-22573-01 (1).dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`03001000 PsLoadedModuleList = 0xfffff800`0323ee70
Debug session time: Mon Apr 16 20:49:24.766 2012 (UTC - 6:00)
System Uptime: 0 days 1:18:06.701
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FC, {fffff8800127ed80, 8000000003d9f963, fffff8800ac8a3b0, 2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42357 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8800127ed80, Virtual address for the attempted execute.
Arg2: 8000000003d9f963, PTE contents.
Arg3: fffff8800ac8a3b0, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xFC

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ac8a3b0 -- (.trap 0xfffff8800ac8a3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8005046200 rbx=0000000000000000 rcx=fffff8800ac8a580
rdx=fffff8800ac8a5e8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800127ed80 rsp=fffff8800ac8a548 rbp=fffffa8004b0d001
 r8=fffff88000d8c080  r9=fffff8800ac8a550 r10=fffffa80047d4a00
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe nc
Ntfs!NtfsFastIoDispatch:
fffff880`0127ed80 e000            loopne  Ntfs!NtfsFastIoDispatch+0x2 (fffff880`0127ed82) [br=1]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030f1aaf to fffff800030715c0

STACK_TEXT:  
fffff880`0ac8a248 fffff800`030f1aaf : 00000000`000000fc fffff880`0127ed80 80000000`03d9f963 fffff880`0ac8a3b0 : nt!KeBugCheckEx
fffff880`0ac8a250 fffff800`0306f6ae : 00000000`00000008 fffff800`033605c8 fffff8a0`015b6b00 fffff8a0`015b6bb8 : nt! ?? ::FNODOBFM::`string'+0x42357
fffff880`0ac8a3b0 fffff880`0127ed80 : fffff800`033605c8 fffff880`00d8c710 00000000`00000000 fffffa80`04b0d030 : nt!KiPageFault+0x16e
fffff880`0ac8a548 fffff800`033605c8 : fffff880`00d8c710 00000000`00000000 fffffa80`04b0d030 fffff880`00d8c080 : Ntfs!NtfsFastIoDispatch
fffff880`0ac8a550 fffff800`0305d7e3 : fffff880`0ac8a8e0 fffff880`0ac8a800 fffffa80`04f20400 fffff880`02fd3180 : nt!FsRtlAcquireFileForCcFlushEx+0xd0
fffff880`0ac8a7f0 fffff800`0305435c : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmFlushSection+0x1c3
fffff880`0ac8a8b0 fffff800`033694ca : 00000000`00000000 00000000`00000006 00000000`01000000 00000000`00000000 : nt!MiFlushDataSection+0x190
fffff880`0ac8a920 fffff800`0335ed03 : fffff880`0ac8ab80 00000000`00000000 00000000`00000000 fffff880`0ac8ab78 : nt!MmCreateSection+0x2ce
fffff880`0ac8ab30 fffff800`03070813 : fffffa80`05ea0060 00000000`0010e768 fffff880`0ac8abc8 00000000`0010e938 : nt!NtCreateSection+0x162
fffff880`0ac8abb0 00000000`7794fb5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0010e748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7794fb5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+42357
fffff800`030f1aaf cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+42357

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+42357

BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+42357

Followup: MachineOwner
---------

The above crash indicates hard disk errors/corruption or hard disk controller errors/corruption.

Start by checking your hard disk.

If you are overclocking any hardware, please stop.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.

Please fill in your system specs in your profile (not in a post in this thread). Use System Info - See Your System Specs to help fill in the specs. If you have a vendor who made your desktop/laptop, provide the manufacturer and model of the system.

Windows 7: Random BSOD 0x3B

Random BSOD 0x3B problems?