having random BSOD in a pretty new build

Bluemoon9 · 24 Jul 2014

Hi All,

I build my computer a couple months back. Recently after windows update I am getting BSOD randomly. I suspect its rougue driver but can not identify it. Can anybody please help me out a bit?

Here is the DM log collector and SF Diag log

matts6887 · 24 Jul 2014

according to the research from google i just looked up; you could have some bad sectors on your hard drive. Run a chkdsk /r /f by right clicking on command prompt and select run as administrator. It may tell you the disk is in use and has been locked. If that happens; schedule it for a disk check and reboot and let the disk check run.

Arc · 24 Jul 2014

Hi Bluemoon9.

The crash dumps are giving a hint about failing memory. It might be the physical RAM, or any driver passing bad info to the memory.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
____________________________________

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8022fa4010, 2, 1, fffff80002f3ecb6}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+86 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8022fa4010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f3ecb6, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b9100
GetUlongFromAddress: unable to read from fffff800030b91c0
 fffffa8022fa4010 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  GUI.exe

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff8800a21c2b0 -- (.trap 0xfffff8800a21c2b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8008ba4010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f3ecb6 rsp=fffff8800a21c440 rbp=00000000d2000000
 r8=fffff8800a21c470  r9=fffffa8009c75060 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`08ba4010=ffffffffffffffff
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e81169 to fffff80002e81bc0

STACK_TEXT:  
fffff880`0a21c168 fffff800`02e81169 : 00000000`0000000a fffffa80`22fa4010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0a21c170 fffff800`02e7fde0 : ffffd9d0`c10ad2d4 fffff800`02fb5e80 fffff880`0a21c490 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a21c2b0 fffff800`02f3ecb6 : 00000000`00000000 00000000`00000000 fffffa80`08b97230 fffffa80`08b97230 : nt!KiPageFault+0x260
fffff880`0a21c440 fffff800`02ef2bea : 00000000`000001e8 fffff800`02ffce80 00000000`07a71000 00000000`00000000 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`0a21c4c0 fffff800`02e6e3df : fffffa80`00000000 00000000`07b0ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34f16
fffff880`0a21c680 fffff800`02e80e53 : ffffffff`ffffffff fffff880`0a21c950 fffff880`0a21c958 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0a21c780 fffff800`02e7d410 : fffff800`030ff477 00000000`00000010 00000000`00000082 fffff880`0a21c948 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a21c918 fffff800`030ff477 : 00000000`00000010 00000000`00000082 fffff880`0a21c948 00000000`00000001 : nt!KiServiceLinkage
fffff880`0a21c920 fffff800`031570cd : 00000000`07a10000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!RtlFreeUserStack+0x27
fffff880`0a21c950 fffff800`03157431 : fffff880`00000001 00000000`07a0e800 00000000`7efd5000 00000000`00000000 : nt!PspExitThread+0x5dd
fffff880`0a21ca50 fffff800`03157539 : fffffa80`06cdc060 00000000`00000001 fffffa80`06cdc060 00000000`0000008c : nt!PspTerminateThreadByPointer+0x4d
fffff880`0a21caa0 fffff800`02e80e53 : fffffa80`06cdc060 fffff880`0a21cb60 00000000`7efd5000 ffffffff`fffffffe : nt!NtTerminateThread+0x45
fffff880`0a21cae0 00000000`77dd01af : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07a0e728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77dd01af


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

IMAGE_VERSION:  6.1.7601.18409

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xa_nt!mireleaseconfirmedpagefilespace+86

FAILURE_ID_HASH:  {60ecfce8-0ae8-e101-bee9-632596f9724b}

Followup: MachineOwner
---------

Bluemoon9 · 24 Jul 2014

Thanks a lot Matts6887 and Arc. I will run chldsk, memtest and DV tonight and report back.

Bluemoon9 · 24 Jul 2014

Wow! I started verifier and the computer won't boot. It shows the windows boot screen and then BSOD. I went to safe mode and disabled verifier and it booted again. Chkdsk shows no errors.

So What should I do now? I am thinking enabling one driver at a time and see if verifier works. But its a tedious process. Any better idea:)?
I will run memtest in the night.

I attach the dump files here. Any idea from these?

Thanks again for your very valuable help so far.

matts6887 · 24 Jul 2014

Yes you could try enabling one driver at a time to try and identify which one(s) are causing the issues you are having.

Bluemoon9 · 24 Jul 2014

I also see this error message in event viewer.

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c9 (0x000000000000023e, 0xfffff88000db4324, 0xfffff9800b64cee0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072514-17191-01

matts6887 · 24 Jul 2014

Did you post the dump from the above bug check?

Bluemoon9 · 24 Jul 2014

Yes :) Here is it again. File name 072514-17191-01.dmp, its in Dump.rar compressed archive.

Thanks a lot for replying and helping me.

Bluemoon9 · 24 Jul 2014

Hi All,

I ran a free tool called bluescreenview and I see twice it is crashed by ntoskrnl.exe and once bydtsoftbus01.sys

I ran the WD HDD check utility and it doesn't report an error. What should I do next? a clean win7 install?