BSOD at idle

Britton30 · 13 Mar 2014

Here I am again, I woke up from a nap to a BSOD, nothing was running. This is the 2nd one in two day but I used CCleaner which erased the first one.

system is overclocked but has been rock solid for months. I have installed only one program, UnChecky.
Unchecky - Keeps your checkboxes clear

Diag tool logs.

Attachment 310281

derekimo · 13 Mar 2014

I see no driver being flagged Gary,

It is a Bugcheck 7E,

Bug Check 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (Windows Debuggers)

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff80003a99710, fffff8800d3e84b8, fffff8800d3e7d10}

Probably caused by : ntkrnlmp.exe ( nt!ObpQueryNameString+127 )

Followup: MachineOwner

0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred.

Bugcheck 7's are usually disk related, so a chkdsk /r might be in order as well as Memtest86+

Maybe Arc or one of the other pro's can dig deeper and see something I don't.

peebee · 13 Mar 2014

This bugcheck was caused by a memory access violation during what looks like the system shutting down the I/O subsystem. The exact crash happened while the CPU was executing a locking instruction on a region of memory that didn't exist, which explains the crash. The call stack doesn't go back far enough but I believe shutting down I/O requires a number of calls to storage drivers, etc. so I would suspect this is caused by a faulty storage driver.

Looks like derekimo and I were replying at the same time. Glad we're on the same page. :)

Not a pro but I'll give enough insight to support my findings.

Code:

0: kd> uf fffff80003a99710 ß- Function call that generated the crash
nt! ?? ::FNODOBFM::`string'+0x19010:
fffff800`03a1dc29 845f19          test    byte ptr [rdi+19h],bl
fffff800`03a1dc2c 0f84deba0700    je      nt!ObfReferenceObject+0x20 (fffff800`03a99710)

nt! ?? ::FNODOBFM::`string'+0x19019:
fffff800`03a1dc32 41b944666c74    mov     r9d,746C6644h
fffff800`03a1dc38 448bc3          mov     r8d,ebx
fffff800`03a1dc3b 0fb6d3          movzx   edx,bl
fffff800`03a1dc3e 488bcf          mov     rcx,rdi
fffff800`03a1dc41 e87aa71300      call    nt!ObpPushStackInfo (fffff800`03b583c0)
fffff800`03a1dc46 90              nop
fffff800`03a1dc47 e9c4ba0700      jmp     nt!ObfReferenceObject+0x20 (fffff800`03a99710)

nt!ObfReferenceObject:
fffff800`03a996f0 48895c2408      mov     qword ptr [rsp+8],rbx
fffff800`03a996f5 57              push    rdi
fffff800`03a996f6 4883ec20        sub     rsp,20h
fffff800`03a996fa 833d3f5f190000  cmp     dword ptr [nt!ObpTraceFlags (fffff800`03c2f640)],0
fffff800`03a99701 488d79d0        lea     rdi,[rcx-30h]
fffff800`03a99705 bb01000000      mov     ebx,1
fffff800`03a9970a 0f851945f8ff    jne     nt! ?? ::FNODOBFM::`string'+0x19010 (fffff800`03a1dc29)

nt!ObfReferenceObject+0x20:
fffff800`03a99710 f0480fc11f      lock xadd qword ptr [rdi],rbx ß- Crash
fffff800`03a99715 488d4301        lea     rax,[rbx+1]
fffff800`03a99719 488b5c2430      mov     rbx,qword ptr [rsp+30h]
fffff800`03a9971e 4883c420        add     rsp,20h
fffff800`03a99722 5f              pop     rdi
fffff800`03a99723 c3              ret

Britton30 · 13 Mar 2014

derekimo said:

I see no driver being flagged Gary,

It is a Bugcheck 7E,

Bug Check 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (Windows Debuggers)

Code:

BugCheck 1000007E, {ffffffffc0000005, fffff80003a99710, fffff8800d3e84b8, fffff8800d3e7d10}
 
Probably caused by : ntkrnlmp.exe ( nt!ObpQueryNameString+127 )
 
Followup: MachineOwner

0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred.

Bugcheck 7's are usually disk related, so a chkdsk /r might be in order as well as Memtest86+

Maybe Arc or one of the other pro's can dig deeper and see something I don't.

OK, thanks Derek. I will do a chkdsk and let memtest run over night.

peebee said:

This bugcheck was caused by a memory access violation during what looks like the system shutting down the I/O subsystem. The exact crash happened while the CPU was executing a locking instruction on a region of memory that didn't exist, which explains the crash. The call stack doesn't go back far enough but I believe shutting down I/O requires a number of calls to storage drivers, etc. so I would suspect this is caused by a faulty storage driver.

English please.

derekimo · 13 Mar 2014

There you go Gary, I like peebee's answer, not sure which driver though.

Britton30 · 13 Mar 2014

derekimo said:

There you go Gary, I like peebee's answer, not sure which driver though.

If it's a SATA driver, I have 3 on this board, Intel, ASmedia and JMicron.

Here's the result of chkdsk /r, crappy picture but it looks like it was OK? Is there a log created, I looked in C\:Windows\Logs?

Attachment 310286

derekimo · 13 Mar 2014

Looks like Shawn has a tutorial for that,

Check Disk (chkdsk) - Read Event Viewer Log

Britton30 · 13 Mar 2014

derekimo said:

Looks like Shawn has a tutorial for that,

Check Disk (chkdsk) - Read Event Viewer Log

Of course he does.
Here it is, it looks like nothing wrong to me.

Code:

TimeCreated : Thu  Mar 13  2014 10:21:08 PM
Message     : 
              
              Checking file system on C:
              The type of the file system is NTFS.
              Volume label is Seven SSD.
              
              A disk check has been scheduled.
              Windows will now check the disk.                         
              
              CHKDSK is verifying files (stage 1 of 5)...
                185344 file records processed.                                 
                      
              File verification completed.
                428 large file records processed.                              
                   
                0 bad file records processed.                                  
                 
                2 EA records processed.                                        
                 
                2349 reparse records processed.                                
                    
              CHKDSK is verifying indexes (stage 2 of 5)...
                240782 index entries processed.                                
                      
              Index verification completed.
                0 unindexed files scanned.                                     
                 
                0 unindexed files recovered.                                   
                 
              CHKDSK is verifying security descriptors (stage 3 of 5)...
                185344 file SDs/SIDs processed.                                
                      
              Cleaning up 1788 unused index entries from index $SII of file 0x9
              .
              Cleaning up 1788 unused index entries from index $SDH of file 0x9
              .
              Cleaning up 1788 unused security descriptors.
              Security descriptor verification completed.
                27720 data files processed.                                    
                     
              CHKDSK is verifying Usn Journal...
                35650920 USN bytes processed.                                  
                        
              Usn Journal verification completed.
              CHKDSK is verifying file data (stage 4 of 5)...
                185328 files processed.                                        
                      
              File data verification completed.
              CHKDSK is verifying free space (stage 5 of 5)...
                45099014 free clusters processed.                              
                        
              Free space verification is complete.
              Windows has checked the file system and found no problems.
              
               225045528 KB total disk space.
                44274772 KB in 123187 files.
                   79980 KB in 27721 indexes.
                       0 KB in bad sectors.
                  294720 KB in use by the system.
                   65536 KB occupied by the log file.
               180396056 KB available on disk.
              
                    4096 bytes in each allocation unit.
                56261382 total allocation units on disk.
                45099014 allocation units available on disk.
              
              Internal Info:
              00 d4 02 00 85 4d 02 00 74 3d 04 00 00 00 00 00  .....M..t=......
              62 02 00 00 2d 09 00 00 00 00 00 00 00 00 00 00  b...-...........
              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
              
              Windows has finished checking your disk.
              Please wait while your computer restarts.

derekimo · 13 Mar 2014

That looks alright to me too. I see about 5 drivers related to those names you mentioned earlier.

Code:

start             end                 module name
fffff880`01160000 fffff880`01181000   jraid      (deferred)             
    Image path: jraid.sys
    Image name: jraid.sys
    Timestamp:        Tue Aug 10 02:28:44 2010 (4C611BCC)
    CheckSum:         0001F0A6
    ImageSize:        00021000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm iastor
start             end                 module name
fffff880`01205000 fffff880`015a7000   iaStor     (deferred)             
    Image path: iaStor.sys
    Image name: iaStor.sys
    Timestamp:        Fri May 20 09:52:24 2011 (4DD69C48)
    CheckSum:         0008CA08
    ImageSize:        003A2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm iastorv
start             end                 module name
0: kd> lmvm asmtxhci
start             end                 module name
fffff880`03200000 fffff880`03264000   asmtxhci   (deferred)             
    Image path: asmtxhci.sys
    Image name: asmtxhci.sys
    Timestamp:        Wed Sep 14 00:36:09 2011 (4E705969)
    CheckSum:         0006E608
    ImageSize:        00064000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm asmthub3
start             end                 module name
fffff880`06f14000 fffff880`06f38000   asmthub3   (deferred)             
    Image path: asmthub3.sys
    Image name: asmthub3.sys
    Timestamp:        Wed Sep 14 00:36:19 2011 (4E705973)
    CheckSum:         00027BD1
    ImageSize:        00024000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

None of those jumped out in the dump though.

You could try running driver verifier to see which one Gary,

Information

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
Driver Verifier - Enable and Disable

Driver Verifier will cause your computer to run very sluggishly - this is normal. What it is trying to do is force your system to BSOD and isolate the offending driver/s. When it does, reboot, disable driver verifier, reboot as normal and upload the new dmp file/s here.

I recommend creating a system restore point before turning on driver verifier:
System Restore Point - Create

If your system fails to boot to desktop once driver verifier is enabled, turn it off by booting into Safe Mode:
Safe Mode

derekimo · 13 Mar 2014

Here's what looks like the lead up to the crash, do you have a "K" drive or is that just a partition?

Event[14]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 102
Task: General
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine (6.01.7601.0000) started a new instance (0).

Event[15]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 300
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine is initiating recovery steps.

Event[16]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02330.log.

Event[17]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:47.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02331.log.

Event[18]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:47.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02332.log.

Event[19]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:48.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS.log.

Event[20]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:48.000
Event ID: 302
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has successfully completed recovery steps.

Event[21]:
Log Name: Application
Source: Microsoft-Windows-Search
Date: 2014-03-13T20:15:50.000
Event ID: 1003
Task: Search service
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
The Windows Search Service started.

Event[22]:
Log Name: Application
Source: Windows Error Reporting
Date: 2014-03-13T20:16:13.000
Event ID: 1001
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Fault bucket X64_0x7E_nt!ObpQueryNameString+127, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1:
P2:
P3:
P4:
P5:
P6:
P7:
P8:
P9:
P10:

Attached files:
C:\Windows\Minidump\031314-8782-01.dmp
C:\Windows\Temp\WER-10311-0.sysdata.xml
C:\Windows\Temp\WER56D6.tmp.WERInternalMetadata.xml

These files may be available here:
C:\Users\GlBritton\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_093c9ba2

Analysis symbol: X64_0x7E_nt!ObpQueryNameString+127
Rechecking for solution: 0
Report Id: 031314-8782-01
Report Status: 0