 | |
| |
| 01 Apr 2010 | #1 |
| | Win7 64bit pc rebooting, occasionally BSOD Hello, this machine has - Windows 7 64bit, totally up-to-date, mb/graph drivers not too old either - Asrock 939Dual-SATA2 mb - AMD 64x2 (model 6000+ or so cant check now) - 2048Mb DDR - SBLive! with kX drivers as Creative support was nonexistent - Sapphire Radeon HD4850 512Mb (10% underclocked to dare to reduce fan speed a bit) - Antec Sonata III case with its 500W PSU PC reboots randomly and so far only when playing some 3D game (like WoW, League of Legends). Nothing graphically intensive. I think this has happened only for 2-3 weeks now, earlier there was no problems. Today there was finally a BSOD too, so could get a minidump, attached here. I hope there is something useful to give a clue before I roll up my sleeves and start proper troubleshooting (I don't understand minidumps at all). Thank you very much if someone has the time to have a peek at this file! |
My System Specs | |
| 01 Apr 2010 | #2 |
| | The instruction pointer in register (rip) became misaligned. This pointer is used by the processor to keep track of the current innstruction and the next instruction and so forth. By adding the length of the current instruction to the prvious value of (rip) it calculates where the next instruction is in memory. This became misaligned somewhere during execution of the current instruction set. Determining where the misalignment occured is difficult if not impossible with the nformation we have before us.The misalignment happened in a kernel thread (nt!NtReadVirtualMemory+a9) but may have been caused by bad addresses being passed from somewhere else. MY best guess is that it happened during execution of (cchservice.exe). A goole search showed that this belongs to Salfeld Security Service. Please uninstall that service and see how it goes. You could also run a memory test to see if that may have contributed: http://www.memtest.org/. I have highlighted the important areas of the dump. Code: Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Nickle\AppData\Local\Temp\Rar$DI43.161\040110-35187-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03017000 PsLoadedModuleList = 0xfffff800`03254e50
Debug session time: Thu Apr 1 05:19:31.261 2010 (GMT-4)
System Uptime: 0 days 3:26:03.152
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80003330ce9, fffff88002eba140, 0}
Probably caused by : hardware ( nt!NtReadVirtualMemory+a9 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003330ce9, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88002eba140, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!NtReadVirtualMemory+a9
fffff800`03330ce9 2428 and al,28h
CONTEXT: fffff88002eba140 -- (.cxr 0xfffff88002eba140)
rax=fffff88002ebab70 rbx=0000000000000000 rcx=000007fffffefffe
rdx=000007fffffd27a8 rsi=000000000129e398 rdi=0000000000000000
rip=fffff80003330ce9 rsp=fffff88002ebab28 rbp=fffff88002ebaca0
r8=000000000129e490 r9=000000000129e4e8 r10=00000000000002e8
r11=fffff80003088138 r12=0000000000000058 r13=000007fffffd6fa8
r14=000000000129e490 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!NtReadVirtualMemory+0xa9:
fffff800`03330ce9 2428 and al,28h
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: cchservice.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
nt!NtReadVirtualMemory+a9
fffff800`03330ce9 2428 and al,28h
LAST_CONTROL_TRANSFER: from 000000000129e530 to fffff80003330ce9
STACK_TEXT:
fffff880`02ebab28 00000000`0129e530 : fffff800`03088153 fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 : nt!NtReadVirtualMemory+0xa9
fffff880`02ebaba8 fffff800`03088153 : fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 00000000`000002e8 : 0x129e530
fffff880`02ebabb0 00000000`76dc02aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0129e378 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dc02aa
FOLLOWUP_IP:
nt!NtReadVirtualMemory+a9
fffff800`03330ce9 2428 and al,28h
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!NtReadVirtualMemory+a9
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff88002eba140 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
1: kd> !thread
GetPointerFromAddress: unable to read from fffff800032bf000
THREAD fffffa800376db60 Cid 0708.0838 Teb: 000000007efad000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff800031fdb74
Owning Process fffffa8003861630 Image: cchservice.exe
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 791241
Context Switch Count 1296
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000004623f0
Stack Init fffff88002ebadb0 Current fffff88002eba3a0
Base fffff88002ebb000 Limit fffff88002eb5000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`02eb9878 fffff800`03088469 : 00000000`0000003b 00000000`c0000005 fffff800`03330ce9 fffff880`02eba140 : nt!KeBugCheckEx
fffff880`02eb9880 fffff800`03087dbc : fffff880`02eba8e8 fffff880`02eba140 00000000`00000000 fffff800`030b7450 : nt!KiBugCheckDispatch+0x69
fffff880`02eb99c0 fffff800`030aebed : fffff800`032a7858 00000000`00000000 fffff800`03017000 fffff880`02eba8e8 : nt!KiSystemServiceHandler+0x7c
fffff880`02eb9a00 fffff800`030b6250 : fffff800`031d71e8 fffff880`02eb9a78 fffff880`02eba8e8 fffff800`03017000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02eb9a30 fffff800`030c31b5 : fffff880`02eba8e8 fffff880`02eba140 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
fffff880`02eba110 fffff800`03088542 : fffff880`02eba8e8 00000000`00000000 fffff880`02eba990 00000000`0129e398 : nt!KiDispatchException+0x135
fffff880`02eba7b0 fffff800`03086e4a : 00000000`0129fd20 00000000`00000410 00000000`00000001 00000000`0129e7f8 : nt!KiExceptionDispatch+0xc2
fffff880`02eba990 fffff800`03330ce9 : 000007ff`fffd27a8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`02eba990)
fffff880`02ebab28 00000000`0129e530 : fffff800`03088153 fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 : nt!NtReadVirtualMemory+0xa9
fffff880`02ebaba8 fffff800`03088153 : fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 00000000`000002e8 : 0x129e530
fffff880`02ebabb0 00000000`76dc02aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02ebac20)
00000000`0129e378 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dc02aa
1: kd> .trap fffff880`02ebac20
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000027d0000 rbx=0000000000000000 rcx=0000000002bb0409
rdx=0000000002610094 rsi=0000000000000000 rdi=0000000000000000
rip=0000000076dc02aa rsp=000000000129e378 rbp=00000000c0000000
r8=000000000000002b r9=0000000076f6fa29 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv u pl nz na pe nc
p ei0033:00000000`76dc02aa ?? ??? <-----memory access error Last edited by nickle; 01 Apr 2010 at 07:43 AM.. |
| My System Specs |
| 01 Apr 2010 | #3 |
| | Thank you, wasn't even considering that as possible culprit. There is indeed Salfeld Child Control in that PC. I may not locate the problem with certainty as in lack of time I will try various fixes same time. But I will report here if relevant. |
| My System Specs |
| . |
| |
| 01 Apr 2010 | #4 |
| | 
Quote: Originally Posted by Torsti2003z  Hello, this machine has - Windows 7 64bit, totally up-to-date, mb/graph drivers not too old either - Asrock 939Dual-SATA2 mb - AMD 64x2 (model 6000+ or so cant check now) - 2048Mb DDR - SBLive! with kX drivers as Creative support was nonexistent - Sapphire Radeon HD4850 512Mb (10% underclocked to dare to reduce fan speed a bit) - Antec Sonata III case with its 500W PSU PC reboots randomly and so far only when playing some 3D game (like WoW, League of Legends). Nothing graphically intensive. I think this has happened only for 2-3 weeks now, earlier there was no problems. Today there was finally a BSOD too, so could get a minidump, attached here. I hope there is something useful to give a clue before I roll up my sleeves and start proper troubleshooting (I don't understand minidumps at all). Thank you very much if someone has the time to have a peek at this file! Your 500watt PSU came with your case is a low buck cheapy version. Those power supplies that come with the case are about 50 bucks and not would I call reliable. In fact, I've seen them cause similar problems many times. The sudden shut downs while gaming also point to a power supply issue. If you can borrow another PSU of higher output that would help determine if the problem is the PSU or not. |
| My System Specs |
| 01 Apr 2010 | #5 |
| | Over(under)clocking can affect the stability of the system and could be a contributing factor in this case. Try setting back to defaults. It does not help when analyzing the dump beacuse results are unpredictable. Somewhere the instruction pointer became misaligned and the processor could not continue execution. The information in the dump is not enough to determine exactly where. |
| My System Specs |
| 02 Apr 2010 | #6 |
| | I have not disabled Child Control (yet). Here is what I have done: - added paging file to C also (was earlier only on secondary IDE, i.e. D) - run error checking on C and D - changed back ATI fan control to auto - checked dust filter and air ventilation (they were ok, though the room is quite warm) - run Windows 7 Manager 1ClickFix - installed missing 6 updates to Windows 7, and updated JRE and Abode Air Curiously, the machine can run Crysis for 2 hours without problems I know of, but crashes often to BSOD in WoW or LoL (game). Maybe DirectX 9 related..? Another BSOD this morning, minidump attached. Seems different this time: Last edited by Torsti2003z; 02 Apr 2010 at 06:53 AM.. |
| My System Specs |
| 02 Apr 2010 | #7 |
| | Well this dump is telling us where the misalignment is occurring. It's the driver for your graphics card. I believe that changing the parmeters on the card brought this to light. See if there is an update to the driver. If not, then either the card is bad or the power supply to the card is faulty or insufficient or possibly a heating issue. You could try re-seating the card to see if that helps. Also your network driver (Ulilan.sys) should be updated it has a timestamp of 2005. I have highlighted the important areas of the dump. Code: Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Nickle\AppData\Local\Temp\Rar$DI07.023\040210-19578-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*Symbol information Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16385.amd64fre.win7_rtm.090713-1255 Machine Name: Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`03299e50 Debug session time: Fri Apr 2 02:28:51.781 2010 (GMT-4) System Uptime: 0 days 1:24:53.656 Loading Kernel Symbols ............................................................... ................................................................ ................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {ffffe4800d5b34c0, 2, 1, fffff880041f8981} Unable to load image \SystemRoot\system32\DRIVERS\atipmdag.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for atipmdag.sys *** ERROR: Module load completed but symbols could not be loaded for atipmdag.sys Unable to load image \SystemRoot\system32\DRIVERS\ULILAN.SYS, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ULILAN.SYS *** ERROR: Module load completed but symbols could not be loaded for ULILAN.SYS Probably caused by : hardware ( atipmdag+325981 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffffe4800d5b34c0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, value 0 = read operation, 1 = write operation Arg4: fffff880041f8981, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800033040e0 ffffe4800d5b34c0 CURRENT_IRQL: 2 FAULTING_IP: atipmdag+325981 fffff880`041f8981 d04c8d40 ror byte ptr [rbp+rcx*4+40h],1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: League of Lege TRAP_FRAME: fffff88002f22c80 -- (.trap 0xfffff88002f22c80) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff88002f22e18 rbx=0000000000000000 rcx=fffffa8002aa7000 rdx=fffffa8003302530 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880041f8981 rsp=fffff88002f22e10 rbp=fffffa8002b17480 r8=0000000000000029 r9=0000000000000000 r10=fffff8000305c000 r11=fffff88002f22d90 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc atipmdag+0x325981: fffff880`041f8981 d04c8d40 ror byte ptr [rbp+rcx*4+40h],1 ss:0018:ffffe480`0d5b34c0=?? Resetting default scope MISALIGNED_IP: atipmdag+325981 fffff880`041f8981 d04c8d40 ror byte ptr [rbp+rcx*4+40h],1 LAST_CONTROL_TRANSFER: from fffff800030cd469 to fffff800030cdf00 STACK_TEXT: fffff880`02f22b38 fffff800`030cd469 : 00000000`0000000a ffffe480`0d5b34c0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`02f22b40 fffff800`030cc0e0 : fffff880`02f22cb4 fffffa80`032e6000 fffffa80`032eef50 fffffa80`01cdb700 : nt!KiBugCheckDispatch+0x69 fffff880`02f22c80 fffff880`041f8981 : fffff880`02f22e18 fffff880`041f24cb fffffa80`02c81000 fffff880`04898410 : nt!KiPageFault+0x260 fffff880`02f22e10 fffff880`02f22e18 : fffff880`041f24cb fffffa80`02c81000 fffff880`04898410 fffffa80`02c81000 : atipmdag+0x325981 fffff880`02f22e18 fffff880`041f24cb : fffffa80`02c81000 fffff880`04898410 fffffa80`02c81000 fffffa80`02c81000 : 0xfffff880`02f22e18 fffff880`02f22e20 fffffa80`02c81000 : fffff880`04898410 fffffa80`02c81000 fffffa80`02c81000 fffffa80`02b175d0 : atipmdag+0x31f4cb fffff880`02f22e28 fffff880`04898410 : fffffa80`02c81000 fffffa80`02c81000 fffffa80`02b175d0 fffff880`03ef1344 : 0xfffffa80`02c81000 fffff880`02f22e30 fffffa80`02c81000 : fffffa80`02c81000 fffffa80`02b175d0 fffff880`03ef1344 fffff880`03e4f438 : ULILAN+0x2410 fffff880`02f22e38 fffffa80`02c81000 : fffffa80`02b175d0 fffff880`03ef1344 fffff880`03e4f438 00000000`74db2450 : 0xfffffa80`02c81000 fffff880`02f22e40 fffffa80`02b175d0 : fffff880`03ef1344 fffff880`03e4f438 00000000`74db2450 00000000`00000022 : 0xfffffa80`02c81000 fffff880`02f22e48 fffff880`03ef1344 : fffff880`03e4f438 00000000`74db2450 00000000`00000022 00000000`00000000 : 0xfffffa80`02b175d0 fffff880`02f22e50 fffff880`03e4f438 : 00000000`74db2450 00000000`00000022 00000000`00000000 00000000`00000000 : atipmdag+0x1e344 fffff880`02f22e58 00000000`74db2450 : 00000000`00000022 00000000`00000000 00000000`00000000 fffff880`02c41963 : i8042prt!ntoskrnl_NULL_THUNK_DATA+0x788 fffff880`02f22e60 00000000`00000022 : 00000000`00000000 00000000`00000000 fffff880`02c41963 00000000`00000000 : 0x74db2450 fffff880`02f22e68 00000000`00000000 : 00000000`00000000 fffff880`02c41963 00000000`00000000 fffff880`048984a0 : 0x22 STACK_COMMAND: kb FOLLOWUP_IP: atipmdag+325981 fffff880`041f8981 d04c8d40 ror byte ptr [rbp+rcx*4+40h],1 SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: atipmdag+325981 FOLLOWUP_NAME: MachineOwner MODULE_NAME: hardware IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAILURE_BUCKET_ID: X64_IP_MISALIGNED_atipmdag.sys BUCKET_ID: X64_IP_MISALIGNED_atipmdag.sys Followup: MachineOwner --------- 1: kd> lmvm atipmdag start end module name fffff880`03ed3000 fffff880`04537000 atipmdag T (no symbols) Loaded symbol image file: atipmdag.sys Image path: \SystemRoot\system32\DRIVERS\atipmdag.sys Image name: atipmdag.sys Timestamp: Tue Feb 02 23:21:24 2010 (4B68F9C4) CheckSum: 0061614B ImageSize: 00664000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 1: kd> lmvm ULILAN start end module name fffff880`04896000 fffff880`0489e680 ULILAN T (no symbols) Loaded symbol image file: ULILAN.SYS Image path: \SystemRoot\system32\DRIVERS\ULILAN.SYS Image name: ULILAN.SYS Timestamp: Tue Mar 22 08:36:31 2005 (4240114F) CheckSum: 0000C452 ImageSize: 00008680 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e |
| My System Specs |
| 02 Apr 2010 | #8 |
| | Thanks, I'll do some more tests soon when I have time. One more minidump: |
| My System Specs |
| 06 Apr 2010 | #9 |
| | Hello, looks like problem is solved. 1. Did the following in BIOS: - Cool'n'Quiet --> enabled (don't remember why it was disabled, some reason in last system where this mb was) - Flexibility Option --> enabled (better tolerance to different memory types) - Primary Graphics Controller --> PCI-E (was AGP, doesn't matter though propably as there are no two adapters enabled) - COM-, LPT-ports --> disabled 2. Temperatures tested, cores rarely heat more than to 55 C, GPU to 65 C 3. Removed Catalyst 10.2, run Guru3D DriverSweeper, installed Catalyst 10.3. Ati Overdrive set to default values. Most propable cause imo (and by your diagnostics): graphics driver faulty/broken. Thank you for your attention.  Last edited by Torsti2003z; 08 Apr 2010 at 01:55 AM.. |
| My System Specs |
 |
Win7 64bit pc rebooting, occasionally BSOD problems?
| Thread Tools | |
| Similar help and support threads for: Win7 64bit pc rebooting, occasionally BSOD | ||||
| Thread | Forum | |||
| getting BSOD win7 64bit | Hardware & Devices | |||
| BSOD win7 64bit - can someone tell me why? | BSOD Help and Support | |||
| BSOD on win7 64Bit | BSOD Help and Support | |||
| Win 7 64bit blue screening and rebooting | BSOD Help and Support | |||
| win7 64bit bsod | BSOD Help and Support | |||
All times are GMT -5. The time now is 11:48 PM.
