Windows 7: Intermittent ntoskrnl.exe+7c229 BSOD

xandermac05 · 23 Apr 2012

Retail Win 7 Pro x64 (clean install, but was doing the same thing before reinstall)
Hardware about a year old, except for relatively recent RAM addition - but Memtest checks out with 0 errors.

The BSOD seems to happen at random; I can't find any sort of pattern here.

In addition to the attached files requested in the sticky, Bluescreenview outputs the following:

==================================================
Filename : ntoskrnl.exe
Address In Stack : ntoskrnl.exe+7c229
From Address : fffff800`02c0d000
To Address : fffff800`031f5000
Size : 0x005e8000
Time Stamp : 0x4f558b55
Time String : 06/03/2012 04:58:13
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 6.1.7601.17790 (win7sp1_gdr.120305-1505)
Company : Microsoft Corporation
Full Path : C:\Windows\system32\ntoskrnl.exe
==================================================

All drivers are up to date except for NVIDIA HD Audio, which I didn't bother installing since I don't use it (hence disabled devices). However, this WAS installed prior to fresh OS install, and the BSOD was happening then too.

Any ideas would be greatly appreciated.

usasma · 23 Apr 2012

Cisco AnyConnect device is disabled in perfmon /report. Please uninstall it. In most cases Windows loads the drivers for the device before it disables it. If you don't wish to uninstall it, then enable it and ensure that it's updated to the latest available version that's compatible with your OS, then disable it again.

Same thing goes for your disabled Audio device.

Only 1 memory dump in the uploaded files. Please don't use any disk cleaning utilities until we're done troubleshooting.

Please run Driver Verifier according to these instructions: Driver Verifier Settings

Further info on BSOD error messages available at: http://www.carrona.org/bsodindx.html

The following info is just FYI, I've already addressed the issues that I saw in the above paragraphs
3RD PARTY DRIVERS PRESENT IN THE DUMP FILES

Code:


iaStor.sys   Thu Jun 04 21:53:40 2009 (4A287AA4)
amdxata.sys  Fri Mar 19 12:18:18 2010 (4BA3A3CA)
ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
MpFilter.sys Wed Apr 06 16:07:29 2011 (4D9CC801)
nx6000.sys   Wed Jan 27 18:36:09 2010 (4B60CDE9)
viahduaa.sys Tue Oct 20 23:30:30 2009 (4ADE8056)
atksgt.sys   Sun May 17 09:36:34 2009 (4A1012E2)
lirsgt.sys   Sun May 17 09:06:57 2009 (4A100BF1)
MpNWMon.sys  Wed Apr 06 16:07:23 2011 (4D9CC7FB)
nvlddmkm.sys Wed Feb 29 13:04:52 2012 (4F4E68C4)
Rt64win7.sys Fri Jun 10 02:33:15 2011 (4DF1BAAB)

Code:


Loading Dump File [C:\Users\FUBAR\_jcgriff2_\dbug\__Kernel__\042312-21980-01.dmp]
Built by: 7601.17790.amd64fre.win7sp1_gdr.120305-1505
Debug session time: Mon Apr 23 10:29:02.664 2012 (UTC - 4:00)
System Uptime: 0 days 0:07:49.803
Probably caused by : ntkrnlmp.exe ( nt!ExpInterlockedPopEntrySListFault16+0 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0x3B_nt!ExpInterlockedPopEntrySListFault16+0
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`02c81b85 fffff880`053e5ea0 00000000`00000000
BiosVersion = 0905   
BiosReleaseDate = 07/15/2010
CPUID:        "Intel(R) Core(TM) i3 CPU         540  @ 3.07GHz"
MaxSpeed:     3070
CurrentSpeed: 3066
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

xandermac05 · 23 Apr 2012

Quote: Originally Posted by usasma

Cisco AnyConnect device is disabled in perfmon /report. Please uninstall it. In most cases Windows loads the drivers for the device before it disables it. If you don't wish to uninstall it, then enable it and ensure that it's updated to the latest available version that's compatible with your OS, then disable it again.

Same thing goes for your disabled Audio device.

Wouldn't uninstalling/updating disabled drivers only have any effect if the BSOD happened at boot? It never has, it seems to occur at random (not even after a consistent amount of uptime or anything). Nonetheless, I've uninstalled the NVIDIA audio drivers since I don't need them. The VPN is up to date, but I need that to use my university's network off-campus. I've been using that program/driver for years without any problems, so it'd be weird for it to suddenly start acting up... EDIT: To clarify, it's disabled because the VPN client only enables it when it's required, then disables it again when you disconnect.

For the time being, I've tried switching my RAM about on the off-chance that's anything to do with it (though I don't see why it would be). I've also reset Windows' boot settings to defaults, just in case that's involved - when I upgraded my RAM the max memory allocation dropped to 0 and the system wouldn't use more than 3.49 GB of the 8 GB installed. I had updated that setting to use the full 8 GB, and it seemed to be working (unless it's what's been causing the BSOD).

I'll have a look at Driver Verifier, too...

usasma · 23 Apr 2012

No, once the drivers are loaded, they're fully working. Although they're not a likely cause, we don't know the exact details of how these devices interact with other drivers/devices. It's your system - you do what you want with these devices - I only offer suggestions.

As for "random" occurences - it's my opinion that there isn't any such thing as a random BSOD. Rather it's responding to something that we can't see and is crashing because of that. It's our job to dive in deep enough to find this cause (and use that information to fix the system).

If you've been using the device for years without problems, what's the guarantee that it'll continue to work without any problems. It's sorta like the tires on your car - they've worked without problem for 50,000 miles, why shouldn't they last another 50,000 without problems?

Driver Verifier is the tool that's most likely to give us info at this point. We don't know if this is a 3rd party driver issue, a hardware problem, or a Windows issue. With only one memory dump we're not even able to establish a pattern that would suggest a hardware problem (that takes 5 or more memory dumps on average).

Then, if hardware is indicated, we have to wonder if it's:
- hardware problems
- overclocking
- compatibility issues
- low-level driver problems
- malware

Driver Verifier according to the instructions that I wrote will tell us if it's a 3rd party driver or not.
If it doesn't point out a 3rd party driver, then it's most likely to be a hardware issue (see the list above for the different types of issues that are suggested by the hardware error pattern) - although Windows is also possible.

xandermac05 · 25 Apr 2012

I thought I'd replied, sorry; I must've somehow forgotten to send it.

I know drivers load whether disabled or not, I just meant it'd seem weird for that to be a cause when the crashes never occur until long after boot (just how long though, seems to be variable). Nonetheless, I've fully uninstalled the unnecessary GPU sound drivers as well as the considerably more useful VPN, partly because the latter was throwing up a huge number of errors in Event Viewer (despite otherwise functioning correctly, as it has for years).

I completely agree about the non-random nature of BSOD, by the way... what I said was that it seems random, i.e. I can't see any kind of pattern yet myself. That's not to say there isn't one; I just haven't found it. I had no further crashes til this evening, and verifier doesn't appear to have dumped anything to help with diagnosis. I'll continue to run it and hope it picks up something, I suppose.

I just ran another memtest, because it's the only hardware change that occurred recently before the crashes began and I'm therefore suspicious. It once again reported 0 errors. However, I understand that ntoskrnl.exe (the NT kernel specified in the crash info) contains the memory manager, amongst other things... so perhaps it does relate to the RAM in some other way I don't comprehend?

WRT the list of potential culprits:

the only hardware change, as I said, is the addition of 4GB of identical RAM...
no overclocking whatsoever; I accidentally bought a locked SI mobo (it was incredibly cheap, so I just kept it)
again, drivers have functioned perfectly for ages; there were no changes to any before the BSOD started happening

I'm a bit stumped, really... I don't see how it can be anything to do with Windows or drivers since the BSOD persists after a complete reformat and clean installation, but the hardware hasn't been touched aside from RAM. I suppose there might be some intermittent fault which suddenly developed somewhere (CPU/mobo?) but otherwise I'm pretty much baffled at this point.

usasma · 25 Apr 2012

It may sound weird, but the more we can remove the less we have to troubleshoot.

I understand about the randomness - but once we find the pattern we're almost at the point of solving it.

Even if Driver Verifier doesn't blame a 3rd party driver - it still gives us information.
Running Driver Verifier for 36 hours without a 3rd party driver being blamed says to me that it isn't a 3rd party driver - so that leaves hardware (most likely) or Windows (less likely)

If you're concerned about the RAM, run the Blend test in Prime95. Sometimes this will spit out errors when MemTest86+ doesn't see any. There's a link and instructions here: Additional Hardware Diagnostics

If it's still BSOD'ing, the next step is to update all of the 2009 and earlier drivers. This includes updating the antivirus software (no matter how old) and the video drivers (not matter how old).
You probably won't find an update for ASACPI.sys - as I believe the 2009 version is the newest version available from Asus

Once all drivers are updated/replaced we've pretty much eliminated 3rd party drivers as a cause.
Then we move on to either hardware or Windows troubleshooting.

xandermac05 · 27 Apr 2012

I could be wrong but I think/hope it's a problem with the AHCI driver (iastor.sys, I believe?)

I forgot this, but I changed from IDE to AHCI mode around the same time as the issues started (I think) and apparently ASUS boards can have issues with this. I also chose AHCI mode when reinstalling Windows. Infuriatingly, the ASUS site doesn't have any newer than the 2009 drivers so I thought they were the newest. I have now, however, found a 2010 version and installed that. Time will tell, I suppose. I also uninstalled TAGES because it was only needed for The Witcher in an old version (they removed the TAGES check in an update) but I had TAGES running fine before.

Thanks for all your help. I'm not really sure if I should mark this as solved yet, but you can if you reckon it's the best course of action.

EDIT: Forgot to mention, the reason I think it's this is I found a whole bunch of hard disk errors in event viewer despite checkdisk finding no issues. So I figured it was probably the controller.

usasma · 27 Apr 2012

FWIW - techs at work fiddle with the AHCI settings to make hard drive tests run (that wouldn't otherwise run) - so I presume that there's an impact on how it address' the hard drive (but haven't done any research about it).

iastor.sys is an Intel driver. The latest Intel drivers are available from http://downloadcenter.intel.com

Run Seagate Seatools on ALL drives (there's a link to it in this page of mine here: Hard Drive Diagnostic Procedure ) The error that I saw was on Hard Drive 3.

Seatools has (as I recall) a good controller test built into the Long/Extended test. That'll tell you if you need to worry about the Event Viewer errors.

Gotta run or I'm gonna miss my plane. I'll be back by Sunday evening (going to Panama City, FL for my nephew's wedding!).

xandermac05 · 29 Apr 2012

Right, that definitely appears to have fixed it. No controller errors in Event Viewer since upgrading the AHCI/SATA controller past the version available on the ASUS (chipset) site. SeaTools found nothing wrong either.

Thanks for your help with this, I really appreciate it. Hope the wedding went awright!

xandermac05 · 29 Apr 2012

... Apparently I spoke too soon. Different cause according to BlueScreenView this time: fltmgr.sys. Can't see a thing in Event Viewer that helps me.

I've switched back to IDE mode and uninstalled the AHCI controller to see if that changes anything. I've also stuck Driver Verifier on again just in case that shows up anything.

Otherwise? Stumped.

Windows 7: Intermittent ntoskrnl.exe+7c229 BSOD

Intermittent ntoskrnl.exe+7c229 BSOD problems?