Random BSOD in Windows 7 64 bit

kc7404 · 28 Dec 2009

To All,

I am new to this forum and I am hoping someone might be able to help me with an issue I have been facing for a few weeks now.

I recently updated my computer from Wndows Vista 64 bit Home Edition to Windows 7 64 Bit Home Edition.

For some reason, I get periodic crashes that can happen at any time or in any application it seems.

I managed to send someone a minidump file and they provided me with this bugcheck report but I do not know what it means:

============================================================

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031ae736, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88005cbea80, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!CmpAllocateKeyControlBlock+72
fffff800`031ae736 48895808 mov qword ptr [rax+8],rbx

CONTEXT: fffff88005cbea80 -- (.cxr 0xfffff88005cbea80)
rax=0000000001583da8 rbx=fffff800030d6040 rcx=fffff8a00b6082c0
rdx=fffff88005cbf4c8 rsi=fffff8a0024c8420 rdi=0000000000000001
rip=fffff800031ae736 rsp=fffff88005cbf460 rbp=00000000002d0448
r8=fffff8a002dec44c r9=fffff8a00b81e5d0 r10=fffff8a00d305016
r11=0000000000000000 r12=0000000000000000 r13=ffffffffffffffff
r14=fffff8a002dec44c r15=fffff8a00b81e5d0
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!CmpAllocateKeyControlBlock+0x72:
fffff800`031ae736 48895808 mov qword ptr [rax+8],rbx ds:002b:00000000`01583db0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: dllhost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800031ae297 to fffff800031ae736

STACK_TEXT:
fffff880`05cbf460 fffff800`031ae297 : 00000000`00000000 00000000`dd17255f fffff8a0`02653fcc fffff800`031b36b4 : nt!CmpAllocateKeyControlBlock+0x72
fffff880`05cbf490 fffff800`031acfd7 : fffff8a0`024c8420 00000000`002d0448 fffff8a0`02dec44c fffff8a0`0b81e5d0 : nt!CmpCreateKeyControlBlock+0xe8
fffff880`05cbf530 fffff800`031a8fb5 : fffff8a0`00000000 fffff8a0`002d0448 fffff8a0`024c8420 fffffa80`0713eb10 : nt!CmpDoOpen+0x387
fffff880`05cbf5f0 fffff800`031c8764 : fffff800`031a8ae0 00000000`00000001 fffffa80`0713eb10 00000000`00000801 : nt!CmpParseKey+0x4d5
fffff880`05cbf8c0 fffff800`031cd876 : fffffa80`0713eb10 fffff880`05cbfa40 00000000`00000040 fffffa80`06a483c0 : nt!ObpLookupObjectName+0x585
fffff880`05cbf9c0 fffff800`031acbec : 00000000`057b7f00 00000000`00000000 fffff8a0`057b7f01 fffff880`05cbfaa8 : nt!ObOpenObjectByName+0x306
fffff880`05cbfa90 fffff800`031aed3b : 00000000`0255b950 00000000`00020019 00000000`0255b9d8 00000000`00000000 : nt!CmOpenKey+0x28a
fffff880`05cbfbe0 fffff800`02ed1153 : fffffa80`0d301950 fffff880`05cbfca0 00000000`004c4160 fffffa80`0d395a10 : nt!NtOpenKeyEx+0xf
fffff880`05cbfc20 00000000`77b40e0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0255b8e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b40e0a

FOLLOWUP_IP:
nt!CmpAllocateKeyControlBlock+72
fffff800`031ae736 48895808 mov qword ptr [rax+8],rbx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CmpAllocateKeyControlBlock+72

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

STACK_COMMAND: .cxr 0xfffff88005cbea80 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!CmpAllocateKeyControlBlock+72

BUCKET_ID: X64_0x3B_nt!CmpAllocateKeyControlBlock+72

Followup: MachineOwner

============================================================

Can anyone help?

Thank you for your time.

Sincerely,

KC

usasma · 28 Dec 2009

The report doesn't contain everything that we need.
https://www.sevenforums.com/crash-loc...d-problem.html

kc7404 · 29 Dec 2009

Dear usasma,

Thank you for helping me and I am sorry I did not initially post correctly.

Attached please find the original minidump file.

I will look forward to your (or someone else's) response.

Sincerely,

KC

usasma · 30 Dec 2009

Not a problem. Analyzing memory dump files is a bit complicated if the cause isn't spelled out immediately.
We've got a few extra commands that sometimes pull out a bit more info.

Please update these older drivers that were loaded at the time of the crash. Don't use Windows Update or the Update drivers function of Device Manager. Please use the following instructions to locate the most current drivers:

How To Find Updated Drivers:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

Here's the older drivers:

Code:

000.fcl      Fri Sep 26 09:11:22 2008
npusbio_x64.sys Wed Apr 11 07:44:53 2007
OA002Afx.sys Fri Jun 08 04:00:36 2007
OA002Ufd.sys Tue Jun 03 05:30:37 2008
OA002Vid.sys Fri Aug 01 05:34:52 2008
pcouffin.sys Tue Dec 05 09:39:30 2006
PxHlpa64.sys Wed Oct 17 14:25:02 2007
RtNdPt60.sys Mon Dec 10 21:49:52 2007
secdrv.SYS   Wed Sep 13 09:18:38 2006
tifsfilt.sys Wed Aug 29 08:37:29 2007
timntr.sys   Wed Aug 29 08:38:23 2007

Here's a summary of the BSOD:

Code:

Debug session time: Sat Dec 26 21:38:28.549 2009 (GMT-5)
System Uptime: 0 days 1:16:01.141
BugCheck 3B, {c0000005, fffff800031ae736, fffff88005cbea80, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmpAllocateKeyControlBlock+72 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  dllhost.exe

If the BSOD's keep occurring after you've updated everything, then we'll run further tests.

kc7404 · 04 Jan 2010

Dear usasma,

Thank you for the advice below and this is what I have discovered:

000.fcl = Cyberlink Power DVD
npusbio_x64.sys = Track IR
OA002Afx.sys = Creative Camera
OA002Ufd.sys = Creative Camera
OA002Vid.sys = Creative Camera
pcouffin.sys = Patin-Couffin VSO Software
PxHlpa64.sys = Roxio
RtNdPt60.sys = Realtek
secdrv.SYS = Macrovision Safedisc
tifsfilt.sys = Acronis Disk Backup Software
timntr.sys = Acronis Disk Backup Software

A few of these programs I had installed on my machine at one time but have long been since uninstalled.

For those programs that remain, am I to reach out to the company's website and search for Windows 7 64bit driver updates and what do I do about those programs that are either no longer running on my pc or I am unsure what they are?

Cyberlink Power DVD - Currently on my pc
Track IR - Currently on my pc
Creative Camera - Unsure what it is, might be default software
Creative Camera - Unsure what it is, might be default software
Creative Camera - Unsure what it is, might be default software
Patin-Couffin VSO Software - Unsure what it is, might be default software
Roxio - Currently on my pc
Realtek - Currently on my pc
Macrovision Safedisc - No longer on my pc
Acronis Disk Backup Software - No longer on my pc
Acronis Disk Backup Software - No longer on my pc

Thank you and I'll await your response.

Sincerely,

KC

**Pauly** · 04 Jan 2010

Yes any drivers you want to update go to manufacturers website to get lastest, dont use windows update or update driver option in device manager.

Any progs you have uninstalled that have left drivers behind your sure you dont need anymore just change file ext to .bak, if they do cause a problem then there still there and can be changed back if required, if not they will happily sit there doing nothing

Also some you prob wont be able to update eg secdrv.sys as this is part of software install for cd copy protection so prob wont be a standalone driver update available

usasma · 05 Jan 2010

kc7404 - that's mighty impressive work finding all of those drivers!

The Creative camera stuff is for a webcam. If you don't use it, uninstall it.

The Patin-Couffin VSO Softwareis related to CD/DVD burning software - so it's most likely associated with your Cyberlink or your Roxio stuff. To tell, update them and see if it updates. (FWIW - you can also download a trial of each, and then extract all the files from the installer to see if that file is in there).

To stop drivers from loading, you can use the free Autoruns software: Autoruns for Windows

To remove the drivers (if the program is uninstalled) just rename them from .sys to .BAK
This way you'll still have them if something goes wrong.
If nothing goes wrong, then you can delete them at your leisure.

kc7404 · 12 Jan 2010

To Pauly and usasma,

Thank you both for your assistance and I wanted to give you all an update.

Usasma, I appreciate the compliment you gave me concerning my homework in discovering what those files were associated with, but regrettably not all of them lead to a positive outcome in finding an implementable solution.

Cyberlink Power DVD There were no Windows 7 64 bit drivers for my program (Version 8.3.5424)
Track IR The drivers that I had (Version 4.1 build 37) are Windows 7 compatible
Creative Camera There are drivers from Creative Labs but camera specific and Dell has not
been able to tell me which model I have (It is built into the monitor itself,
software Version 1.40.05)
Patin-Couffin VSO Software I used CleanVSO.exe to remove this from my system
Roxio There were no Windows 7 64 bit drivers for my program (Version 10.1)
Realtek I downloaded the newest audio and network drivers from Dell for
Windows 7 64 (I was unsure if it was audio or network card protocol)
Macrovision Safedisc Untouched at the moment
Acronis Disk Backup Software Untouched at the moment

After I ran the CleanVSO.exe, my system did crash and some how the settings had reverted back to not saving the minidump information so I have nothing to post at the moment.

I have since changed them back to saving this information and will await a new crash to post.

My current questions are:

1) Any ideas how I might have inadvertently changed the settings back to NOT saving the crash information?
2) Do I use AutoRuns to stop those drivers that are related to programs I no longer have (Macrovision Safedisc and Acronis Disk Backup) or simply wait for the next crash to see what new information is recorded?

Thank you for your time and your assistance.

Sincerely,

KC

usasma · 12 Jan 2010

Why did it change? I have absolutely no idea! Heck, I can't even figure out why my cell phone changes like that! :) Seriously, there's a lot of different things going on in the background - so it's very difficult to even start to figure out "why".

Let's wait for the next BSOD - that way we can stop the things that are left over without having to hunt for everything.

Good luck!

kc7404 · 13 Jan 2010

Update:

I used Autoruns to stop the following:

secdrv.SYS = Macrovision Safedisc
tifsfilt.sys = Acronis Disk Backup Software
timntr.sys = Acronis Disk Backup Software

I will check today to make sure the changes are indeed in effect.

I will post again at the next BSOD.