BSOD, possibly while using DVBViewer to record

BobFX · Jan 6, 2013

Hi,

I'm getting regular reboots on a Win 7 x64 ultimate system.

It may or may not be related to recording with DVBViewer, I'm not 100% sure. Other computers that also record this are not crashing.

Also, I always work with this computer using RDP from another W7 PC.

Anyway, here is the SFD generated file. This was with a mini-dump configuration, I'll upload a full dump report if necessary the next time I have a crash.

Any help would be greatly appreciated.

koolkat77 · Jan 7, 2013

Welcome to SevenForums.

Please uninstall Comodo Internet Security and Acronis. They are contributing to your crashes.

Code:

Start Menu\Programs\Acronis	Public:Start Menu\Programs\Acronis	Public
Start Menu\Programs\Acronis\Acronis True Image Home 2011	Public:Start Menu\Programs\Acronis\Acronis True Image Home 2011	Public
Start Menu\Programs\Acronis\Acronis True Image Home 2011\Tools and Utilities	Public:Start Menu\Programs\Acronis\Acronis True Image Home 2011\Tools and Utilities	Public
Start Menu\Programs\Acronis\Plus Pack for Acronis True Image Home 2011	Public:Start Menu\Programs\Acronis\Plus Pack for Acronis True Image Home 2011	Public
Start Menu\Programs\COMODO	Public:Start Menu\Programs\COMODO	Public
Start Menu\Programs\COMODO\COMODO Internet Security	Public:Start Menu\Programs\COMODO\COMODO Internet Security	Public

Code:

fffff880`0244cfc8  fffff880`01a500f2Unable to load image \SystemRoot\system32\DRIVERS\[URL="http://carrona.org/drivers/search.php?id=tdrpm273.sys"]tdrpm273.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://carrona.org/drivers/search.php?id=tdrpm273.sys"]tdrpm273.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://carrona.org/drivers/search.php?id=tdrpm273.sys"]tdrpm273.sys[/URL]
 tdrpm273+0x4c0f2
...................................................................................................................
fffff880`0244c818  fffff880`02e62617Unable to load image \SystemRoot\System32\DRIVERS\[URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL], Win32 error 0n2
*** WARNING: Unable to verify timestamp for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
*** ERROR: Module load completed but symbols could not be loaded for [URL="http://www.carrona.org/drivers/driver.php?id=cmdguard.sys"]cmdguard.sys[/URL]
 cmdguard+0x2f617

Uninstall using Revo uninstaller in Advanced Mode. (Gives you the option to remove registry leftovers)

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Update your video drivers.

METHOD:

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to "AMD/ATI" and reboot the system. Delete remnants of its drivers/older drivers using Driver Sweeper.

:ar: http://www.sevenforums.com/tutorial...over-files-after-uninstalling.html#post726559

Link for update: AMD Driver Autodetect

Code:

fffff880`0350f168  fffff880`04a76288Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
 atikmdag+0x3c288

Code:

lmvm atikmdag
start             end                 module name
fffff880`04a3a000 fffff880`04f5c000   atikmdag T (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Fri Apr 24 16:51:57 2009[/COLOR] (49F199CD)
    CheckSum:         004CC863
    ImageSize:        00522000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Perform a System File Check:

Click on the start rb:
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Disk Check on your hard drive for file system errors and bad sectors on it:

http://www.sevenforums.com/tutorials/433-disk-check.html

Reduce items at start-up. Nothing except anti-virus is required:

Go to this link: Intel® Driver Update Utility. Check the system for latest updates. Download and install them one by one.

Let us know if this has helped.

BobFX · Jan 7, 2013

Thank you for a very quick and comprehensive answer! Plenty of very useful links here.

I performed all the steps, except removing Acronis. I find indispensable to be able to make an image backup of my system, this saved countless hours of re-install.

I did disable the Acronis automatic startup program though.

To be noted that Revo was not able to even list the Comodo program, so I had to use the Windows uninstaller instead.

I'll run the system a while to see if the problem is cured, and get back to you in a few days to confirm if it is.

If not, I'll get back sooner!

BobFX · Jan 8, 2013

Well, Windows is still crashing.

Here is a new report.

Does it still look like Acronis is the culprit?

koolkat77 · Jan 8, 2013

Well yes.

Anyway.

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

BobFX · Jan 9, 2013

I had already run Memtest86+ overnight, without errors.

I'll remove Acronis, and get back to you with the results.

Thanks.

koolkat77 · Jan 9, 2013

Good luck

BobFX · Jan 9, 2013

Here is a new dump crash that happened after Acronis removal.

koolkat77 · Jan 9, 2013

Will take a look at it and report what I find.

Please proceed with memtest if you haven't already.

Code:

[FONT=Courier New][SIZE=3]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880099d10b8, fffff880099d0910, fffff80002ab39a6}

Probably caused by : memory_corruption ( nt!MmMapViewInSystemCache+226 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880099d10b8
Arg3: fffff880099d0910
Arg4: fffff80002ab39a6

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880099d10b8 -- (.exr 0xfffff880099d10b8)
ExceptionAddress: fffff80002ab39a6 (nt!MmMapViewInSystemCache+0x0000000000000226)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880099d0910 -- (.cxr 0xfffff880099d0910)
rax=0000000000000000 rbx=fffff6fcc00da800 rcx=0000000000000014
rdx=0000000000000040 rsi=fffff8a0034377f0 rdi=fffff8a0034373f0
rip=fffff80002ab39a6 rsp=fffff880099d12f0 rbp=fffff6fcc00daa00
 r8=fffffa8000000020  r9=fffff880099d1360 r10=0000000000000000
r11=0000000000000000 r12=fffffa8007348d00 r13=ff51474eff544af1
r14=fffffa800374cc70 r15=fffffa8007348d80
iopl=0         nv up ei pl nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010212
nt!MmMapViewInSystemCache+0x226:
fffff800`02ab39a6 4d897d18        mov     qword ptr [r13+18h],r15 ds:002b:ff51474e`ff544b09=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  wmpnetwk.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cce100
GetUlongFromAddress: unable to read from fffff80002cce1c0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!MmMapViewInSystemCache+226
fffff800`02ab39a6 4d897d18        mov     qword ptr [r13+18h],r15

FAULTING_IP: 
nt!MmMapViewInSystemCache+226
fffff800`02ab39a6 4d897d18        mov     qword ptr [r13+18h],r15

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002ab2b87 to fffff80002ab39a6

STACK_TEXT:  
fffff880`099d12f0 fffff800`02ab2b87 : fffff8a0`035c8600 fffff880`02f63830 fffff880`099d1498 fffff8a0`03419c30 : nt!MmMapViewInSystemCache+0x226
fffff880`099d1460 fffff800`02ab1aef : fffff880`00000000 00000000`00000000 fffffa80`0466fc80 fffffa80`00000000 : nt!CcGetVacbMiss+0x177
fffff880`099d1520 fffff800`02d85dc2 : fffffa80`00000000 00000000`00000000 fffff880`099d15f0 fffff880`099d1680 : nt!CcGetVirtualAddress+0x2e0
fffff880`099d15b0 fffff880`0120a730 : fffff8a0`00000000 fffff880`00000005 fffffa80`06d23500 fffff880`0125d001 : nt!CcCopyRead+0x132
fffff880`099d1670 fffff880`0120ada3 : 00000000`00000000 fffff8a0`03202bb0 fffff880`099d18a0 fffff880`099d1798 : Ntfs!NtfsCachedRead+0x180
fffff880`099d16d0 fffff880`0120ca68 : fffffa80`06d23500 fffffa80`045edc10 fffff880`099d1801 fffffa80`069f6a00 : Ntfs!NtfsCommonRead+0x583
fffff880`099d1870 fffff880`010d2bcf : fffffa80`045edfb0 fffffa80`045edc10 fffffa80`069f6ae0 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`099d1920 fffff880`010d16df : fffffa80`046378e0 00000000`00000001 fffffa80`04637800 fffffa80`045edc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`099d19b0 fffff800`02da421b : 00000000`00000000 fffffa80`06885070 00000000`00000001 fffffa80`045edc10 : fltmgr!FltpDispatch+0xcf
fffff880`099d1a10 fffff800`02d85b63 : fffffa80`06885070 fffffa80`06885070 fffffa80`06885070 fffff880`02f63180 : nt!IopSynchronousServiceTail+0xfb
fffff880`099d1a80 fffff800`02a9aed3 : 00000000`000004d8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`099d1b70 00000000`77b0137a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`031bdca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b0137a


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmMapViewInSystemCache+226

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff880099d0910 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x24_nt!MmMapViewInSystemCache+226

BUCKET_ID:  X64_0x24_nt!MmMapViewInSystemCache+226

Followup: MachineOwner
---------[/SIZE][/FONT]

Edit:

I see you have a SSD:

Code:

[FONT=Courier New][SIZE=3]Model    SAMSUNG SSD 830 Series ATA Device[/SIZE][/FONT]

Please follow this:

writhziden said:
If you have an SSD, make sure the following are up to date:

SSD firmware

BIOS Version

Chipset Drivers

Hard disk controller drivers/SATA drivers

If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Look forward to the results from memtest.

BobFX · Jan 9, 2013

I had already run memtest, before posting here in fact.

The test ran about 12 hours, without any error.

The crashes seemed to happen only when I'm recording something with DVBViewer.

I'm trying something more drastic: I restaured a system image which is 4 months old, well before my troubles began. And before I switched to an SSD. Note though that I don't think that the crashes started with the SSD.

I noticed something different with this older version of my system. Before restauring, when I start a recording, Explorer shows only a 0 sized file, and the file becomes large only when the recording is done.

If the crash happens before the end of the recording, all I get at reboot is a zero-sized file, everything recorded has been lost.

But now, the file size is continously updated.

I wonder if some Windows cache file mechanism has gone haywire, the file being stored in some buffer that ends up overflowing?

BobFX · Jan 10, 2013

Well, still crashing.

I even tried to install the old Windows image on a regular HDD to rule out the SSD, it did not help.

This must be some hardware failure, I'm going to start swapping components...

koolkat77 · Jan 10, 2013

Please upload latest crash files.

BobFX · Jan 10, 2013

koolkat77 said:
Please upload latest crash files.

Here. I also added the dump of the crash when not using the SSD.

I swapped the satellite Techotrend card that I use for recording, and running some tests now.

If it still crashes, I'll swap the memory modules.

koolkat77 · Jan 10, 2013

BobFX said:
koolkat77 said:

Please upload latest crash files.

Click to expand...

Here. I also added the dump of the crash when not using the SSD.

I swapped the satellite Techotrend card that I use for recording, and running some tests now.

If it still crashes, I'll swap the memory modules.

Did you install any security app after comodo removal?
are you using any except comodo?

BobFX · Jan 10, 2013

I only have Microsoft Security Essential. I need at least that!

koolkat77 · Jan 10, 2013

Oh well

I asked cause the BSOD-s indicated lot of network errors.

When did you last reinstall windows?

BobFX · Jan 10, 2013

koolkat77 said:
When did you last reinstall windows?

I never actually re-installed Windows from scratch.

When I get what seems like a non recuperable system corruption, I go back to the last Acronis image, dating from a time when the system was stable.

That saves a lot of time.

The dumps above come from an image reload I did yesterday, the image itself being maybe 5 months old, dating before my SSD and Comodo installs.

koolkat77 · Jan 10, 2013

Do you get BSOD-s in safe mode?

If you do, then they're drivers.

If not it's hardware.

BobFX · Jan 10, 2013

I'll try in safe mode, and get back to you.

Thanks!

koolkat77 · Jan 10, 2013

Let me clarify:

If you don't get blue screens or any other issues in safe mode, there are issues with third party drivers which are loaded in the normal mode. (Because safe mode does not load any drivers.)

If you get blue screens in safe mode, the problem lies within hardware.

Use the system for a couple of hours. - Like 10 to 12 hours and report if there were any BSOD-s.

BSOD, possibly while using DVBViewer to record

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer