BSOD happening at Random Times - possibly Video Driver or Malware?

ICIT2LOL · 10 Jul 2015

Ok mate something is very amiss

Code:

*******************************************************************************
*                                                                            *
*                       BugcheckAnalysis                                   *
*                                                                            *
*******************************************************************************

Code:

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected bytry-except,
it must be protected by a Probe.  Typically the address is just plain bador it
is pointing at freed memory.
Arguments:
Arg1: fffff6fb7e203f28, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002cd4bc1, If non-zero, the instruction address which referencedthe bad memory
 address.
Arg4: 0000000000000009, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffff6fb7e203f28 Nonpaged pool

FAULTING_IP: 
nt!MmBuildMdlForNonPagedPool+81
fffff800`02cd4bc1 488b4500       mov     rax,qword ptr [rbp]

MM_INTERNAL_CODE:  9

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17298(debuggers(dbg).141024-1500) amd64fre

TRAP_FRAME:  fffff8800b54a610 -- (.trap0xfffff8800b54a610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000c0 rbx=0000000000000000 rcx=0000000000000780
rdx=000000000000183f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cd4bc1 rsp=fffff8800b54a7a8 rbp=fffff6fb7e203f28
 r8=0000000000000000  r9=0000007c407e5888 r10=fffffa800990fd30
r11=fffff880fcb11000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MmBuildMdlForNonPagedPool+0x81:
fffff800`02cd4bc1 488b4500       mov     rax,qword ptr [rbp]ss:0018:fffff6fb`7e203f28=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c8e265to fffff80002ce61c0

STACK_TEXT:  
fffff880`0b54a4a8 fffff800`02c8e265 : 00000000`00000050 fffff6fb`7e203f2800000000`00000000 fffff880`0b54a610 : nt!KeBugCheckEx
fffff880`0b54a4b0 fffff800`02ce42ee : 00000000`00000000 fffff6fb`7e203f28fffffa80`0823dd00 fffffa80`0990fd60 : nt! ?? ::FNODOBFM::`string'+0x4539d
fffff880`0b54a610 fffff800`02cd4bc1 : fffffa80`09c06180 fffffa80`0823d050fffff880`0593128e 00000000`c000000d : nt!KiPageFault+0x16e
fffff880`0b54a7a8 fffff880`0593128e : 00000000`c000000d fffffa80`06e77a00fffffa80`06eacdf0 00000000`00000000 : nt!MmBuildMdlForNonPagedPool+0x81
fffff880`0b54a7c0 fffff880`05939e74 : fffffa80`06df5d30 fffffa80`085d0009fffffa80`06df5d30 fffffa80`09c06180 : USBPORT!USBPORT_ProcessURB+0x91a
fffff880`0b54a870 fffff880`05913af4 : 00000000`00000000 fffffa80`085d9050fffffa80`096c8c60 fffffa80`06df5d30 :USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x138
fffff880`0b54a8b0 fffff880`062c5566 : fffffa80`085db050 fffffa80`06f14060fffffa80`06df5d30 fffffa80`085db1a0 : USBPORT!USBPORT_Dispatch+0x1dc
fffff880`0b54a8f0 fffff880`062f5d8f : 00000000`00000000 00000000`00000000fffffa80`06f14060 00000000`00000801 : usbhub!UsbhFdoUrbPdoFilter+0xde
fffff880`0b54a920 fffff880`062c3fb7 : fffffa80`06e961b8 00000000`00000000fffffa80`06df5d30 fffffa80`06f481b8 : usbhub!UsbhPdoInternalDeviceControl+0x373
fffff880`0b54a970 fffff880`06219ec4 : 00000000`00000000 fffffa80`06f482b800000000`00000000 fffffa80`06f481b8 : usbhub!UsbhGenDispatch+0x57
fffff880`0b54a9a0 fffff880`06216812 : fffffa80`06e961b8 fffffa80`06df5d3000000000`00000324 fffffa80`06df5d30 : usbccgp!UsbcForwardIrp+0x30
fffff880`0b54a9d0 fffff880`06216aba : fffffa80`06f481b8 00000000`00220003fffffa80`06df5d30 fffffa80`06e961b8 : usbccgp!DispatchPdoUrb+0xfa
fffff880`0b54aa10 fffff880`0621472e : 00000000`0000000f fffffa80`06e961b0fffffa80`06e961b8 fffffa80`06df5d30 :usbccgp!DispatchPdoInternalDeviceControl+0x17a
fffff880`0b54aa40 fffff880`0a176b05 : fffffa80`06e96060 fffffa80`06e9600100000000`00000000 00000000`00000000 : usbccgp!USBC_Dispatch+0x2de
fffff880`0b54aac0 fffffa80`06e96060 : fffffa80`06e96001 00000000`0000000000000000`00000000 00000000`00000000 : RTS5121+0x7b05
fffff880`0b54aac8 fffffa80`06e96001 : 00000000`00000000 00000000`0000000000000000`00000000 00000000`00000000 : 0xfffffa80`06e96060
fffff880`0b54aad0 00000000`00000000 : 00000000`00000000 00000000`0000000000000000`00000000 00000000`00000001 : 0xfffffa80`06e96001


STACK_COMMAND:  kb

FOLLOWUP_IP: 
RTS5121+7b05
fffff880`0a176b05??             ???

SYMBOL_STACK_INDEX:  e

SYMBOL_NAME:  RTS5121+7b05

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: RTS5121

IMAGE_NAME:  RTS5121.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  484630fc

FAILURE_BUCKET_ID:  X64_0x50_RTS5121+7b05

BUCKET_ID:  X64_0x50_RTS5121+7b05

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING: km:x64_0x50_rts5121+7b05

FAILURE_ID_HASH: {39668f1d-2e60-d622-1e8a-d61d8e2a4cd9}

Followup: MachineOwner

This is an issue with Realtek USB mass storage(Card reader) namely drivers

In addition going on the age of the machine Iwould suggest you run these too

http://www.seagate.com/au/en/support/downloads/item/seatools-win-master/ forthe drive but first run my ditty too as I am interested to see what thePSU comes up with

Using HW Info

You can test the volts on the PSU with HWInfo HWiNFO, HWiNFO32/64 -Download < download the right bit version andclose the right hand window select Sensors and scroll down to the power sectionwhere you will see what the volts are doing see my pic.

The original right hand window shows themachine running and is handy for that but for looking at the components in some detail close it and use themain left hand side panel

FOR OTHER COMPONENTS

Open each + down into the componentitself and then click on it - in theright hand side will appear all sorts of details including brands speeds andother essential info that device. See pic for example.

austin1313 · 10 Jul 2015

Thanks again for the advice, even if some of it is a bit over my head.... especially the log report.
So I ran that hardware program and I think the voltages are fine since they were close to yours.
I've copied a screen shot of it here so you can confirm I'm reading it correctly since it looks a little different than your screen shot being that its a different version.

I also ran the SeaTools and while my OS & Data drive passed the short DST and short generic, my XiMeta Diskdisk NDAS drive failed. This is a net drive that all computers on the network access.
That said, I've been running it as a USB attached drive for the last 2 months (local and not networked) since its performance was spotty and the BSOD errors keep coming even w it not on the LAN, so I don't think it's that drive taking things down. Most likely just a future problem (I'll order a new drive tonight to prevent a problem later)

In the interim, I'm updating all my drivers tonight.
That TweakBit program that was linked to the word drivers in your page let me scan my system but not update. Since the reviews for it were hit or miss w respect to it dling the right drivers, I'm going to use a different program called SlimDrivers where I can manually DL each driver.
This way if something fails, I know which driver is DLed in error since I'll do a restart after each driver install.

Other than that, did any of the recent dump logs give us a primary culprit??
I've already updated the realteck drivers and I think it controls the card reader built into this case.
I don't use it too often, but maybe it also controls the external front USB ports, which I do use.

Let me know what you recommend doing next and I'll also let you know once the drivers are all updated.

And thanks again for all your help!

ICIT2LOL · 11 Jul 2015

Ok mate you are right the volts are ok see pic.

Now I much prefer getting drivers for machine from the manufacturers. Having said that I see the Gateway site is a bit of a sows ear Drivers & Downloads perhaps you might have more luck then me by using the auto detedt form that link.

Now I have used Slim Drivers and they are not bad but if you want my advice - then as soon as you have finished with it uninstall it because it is a nagging site for one thing and for another will put up drivers that need not be updated.

Your board of course is getting on now and I think it would not be a bad idea to run a test on the RAM to be honest see this

MEMTEST

The memtest you will need to make a bootable disk / stick andset the BIOS to boot from the optical or USBand it will take a fair time torun- some leave it overnight.

This is the current version Memtest86+ - Advanced Memory Diagnostic Tool please use this as any other test is useless - the Windows one sadly is not worth even a thought about.

But one thing is very important you must let the test run for at least 8passes any less and the findings are no good. Now if errors come upstraight away then you can stop it - see my pics. Now if there are errors andyou have more than one stick of RAM in then you will need to test each stick ieremove the sticks and replace stick 1 in slot 1 and test no errors do thesame in slot 2 with stick 1 no errors then repeat the process with stick 2 -that will show up the faulty stick - the other thing is it could be a faultyslot but most unusual. With more than two sticks the process is even longer asone may realize.

It is a very lengthy and tedious process but worth it if youhave errors.

austin1313 · 14 Jul 2015

Good afternoon.
You weren't kidding that Memtest takes a long time.
I ran it 10 hours last night and it was only on the 5th pass this morning.
Since I had to work today, I had to stop the program so I could use the computer.
That said, there were no errors found.
I think I ran it as a single thread on one core, so next time I'll run as multi-thread/core tonight and hope the full 8 passes takes less than 12 hours.

I've updated all of my drivers w SlimDrivers and also w DriverBooster2.
What's interesting is that SlimDrivers says everything is up to date, DriveBooster says everything is up to date but there are 3 drivers that can only be updated w the full (Paid) version of the software (and it doesn't tell me what these are), and tweakbit driver updater says there are 14 drivers that need updates (this is the original number so it's almost like that program hasn't noticed the updates since the scan)
Any thoughts if I should run another program to reconfirm the driver updates.

One thing I've noticed is that my screen will sometimes turn black and then instead of crashing it'll say NVidia graphics process crashed but has successfully restarted.
Not sure if this helps w diagnostic, but wanted to advise.
Also we were going to get rid of the ATI remnants in the registry, but we never did that since I'm not sure how. We backed up the registry w a restore point, but that's it.
So please let me know if I should remove those 3 or 4 entries and if there's anything else I should do before tonight.

And thanks!!
The BSOD frequency seems to have decreased somewhat and I appreciate your time and expertise w this.

austin1313 · 14 Jul 2015

Also a lot of times when I'm using Chrome to watch youtube or watching videos it says "Aw, snap. Something went wrong while displaying this webpage" and shows the crashed plugin icon.

This happens frequently.

Just wanted to add that in case it clarifies.

ICIT2LOL · 14 Jul 2015

Yes well Austin mate this is a very odd dump as I have no real references for it that we usually use.

The memory mate it will take a long time but needs to be done to rule out that possibility.

austin1313 · 14 Jul 2015

Thanks for the prompt reply and your help.
It is strange and intermittent problems are also more difficult to tech than consistent ones.

That said, my Nvdia display driver erros: "Display has stopped responding and recovered" are VERY Frequent. In fact, I feel that instead of BSODs happening all the time when I'm watching something, now I'm getting these messages all the time-- but at least everything comes back without the system restarting.

I'll let you know the result of the ram tomorrow morning when that finishes.
But if you get any other ideas, please advise.

ICIT2LOL · 15 Jul 2015

Ok you have given me an idea - run these two ditty's of mine and post back what you find and what happens. Do the slot cleaning first as it is the most simple and the HW Info after if you have any problems in finding the PSU rail volts as in the ditty the give away is the Vbatt in the section you scroll down to.

Anyhting that comes out of either could explain the intermittent behaviour.

SLOT CLEANING

Now as for the slots to clean themuse a strip of old credit card about 1/2 inch wide nip the corners off one end- preferably round them offhold a piece of thin lintfree cloth over the end dab on some form of alcohol - isopropyl alcohol (whatwe swab the skin with before an injection) is good and GENTLY swipe along the slots.

This can also be done for the GPUslot/s and also the contacts of the sticks or cards - not the stick but somelint free cloth of course. See my pic for the sick but please be very gentledoing it if you are in any doubt - please ask before doing it but I use thisall the time and have yet to damage anything.

Using HW Info

You can test the volts on the PSU with HWInfo HWiNFO, HWiNFO32/64 -Download < download the right bit version andclose the right hand window select Sensors and scroll down to the power sectionwhere you will see what the volts are doing see my pic.

The original right hand window shows themachine running and is handy for that but for looking at the components in some detail close it and use themain left hand side panel

FOR OTHER COMPONENTS

Open each + down into the componentitself and then click on it - in theright hand side will appear all sorts of details including brands speeds andother essential info that device. See pic for example.