Win7 32-bit Crashing Since Jan 2010

gedafe · 05 Jul 2010

Carl,

Just some updates:

I relabeled the GEARAspiWDM.sys to .bak, because I couldn't find the program that used it.

I also am having trouble finding an update to jraid.sys online.

I ordered a microsoft mouse and keyboard today--I should have them by the end of the week.

I'm not sure what to do about the MBfilt32.sys, due to the fact that the sound is embedded in the MOBO--I do not have a separate sound card.

As soon as I find an update to the jraid.sys, I'll redo the driver verifier and post the minidumps.

CarlTR6 · 05 Jul 2010

Good job on renaming GEARAspiWDM.sys to .bak. That takes care of that one.

I have been reading about a RAID and viewing other threads on different sites regarding RAID problems. I don't know much about RAID having never used it. I found out that RAID is notorious for causing BSOD's in Win 7 and updated drivers are critical. Did you follow this link to see if there is an updated jraid.sys, Driver? I have a suspicion that this may be a major source of your problem.

Did you check MSI and/or Intel for an update to MBfilt32.sys?

Glad you have a mouse and keyboard on the way.

Edited to add: Try this link for MSI: http://www.msi.com/index.php?func=downloadindex

gedafe · 05 Jul 2010

Carl,

I updated jraid.sys to the latest MSI update.

I also ran verifier.exe--amazingly, it got to the login screen and allowed me to login, but soon afterwards BSOD. I've attached the four minidumps. I think we may be getting along further than before--I never could get to the login screen, much less be able to login.

Still can't find an update for mbfilt32.sys though.

What's next?

CarlTR6 · 05 Jul 2010

I did notice jraid.sys was updated. Good work.

Only two of the dmps were good; the first and last ones had 0 bytes.

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL ]

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION

Usual causes: Device driver

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_Minidumps.zip\070510-23899-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e15000 PsLoadedModuleList = 0x82f5d810
Debug session time: Mon Jul  5 22:11:57.526 2010 (GMT-4)
System Uptime: 0 days 0:00:52.806
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
...........
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 98, ab7f2430, a340c6a3}

Unable to load image \SystemRoot\system32\DRIVERS\whfltr2k.sys, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for whfltr2k.sys
Probably caused by : whfltr2k.sys ( whfltr2k+6a3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 000000f6, Referencing user handle as KernelMode.
Arg2: 00000098, Handle value being referenced.
Arg3: ab7f2430, Address of the current process.
Arg4: a340c6a3, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  wh_exec.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 83149f03 to 82ef1d10

STACK_TEXT:  
b057da5c 83149f03 000000c4 000000f6 00000098 nt!KeBugCheckEx+0x1e
b057da7c 8314e766 00000098 ab7f2430 89aa6d48 nt!VerifierBugCheckIfAppropriate+0x30
b057db10 830392b4 00000098 af3b2fd8 00000000 nt!VfCheckUserHandle+0x14f
b057db44 8303916e 00000098 00000000 00000000 nt!ObReferenceObjectByHandleWithTag+0x13b
b057db68 83157736 00000098 00000000 00000000 nt!ObReferenceObjectByHandle+0x21
b057db90 a340c6a3 00000098 00000000 00000000 nt!VerifierObReferenceObjectByHandle+0x21
WARNING: Stack unwind information not available. Following frames may be wrong.
b057dbdc 831446c3 0eaecb28 003b2f68 89bf4a00 whfltr2k+0x6a3
b057dc00 82e51473 00000000 af3b2f68 88aecb28 nt!IovCallDriver+0x258
b057dc14 83052f2e 89bf4a00 af3b2f68 af3b2fd8 nt!IofCallDriver+0x1b
b057dc34 8306fd11 88aecb28 89bf4a00 00000000 nt!IopSynchronousServiceTail+0x1f8
b057dcd0 830724ec 88aecb28 af3b2f68 00000000 nt!IopXxxControlFile+0x6aa
b057dd04 82e5844a 00000060 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b057dd04 770664f4 00000060 00000000 00000000 nt!KiFastCallEntry+0x12a
016dff18 00000000 00000000 00000000 00000000 0x770664f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
whfltr2k+6a3
a340c6a3 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  whfltr2k+6a3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: whfltr2k

IMAGE_NAME:  whfltr2k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45b8d07d

FAILURE_BUCKET_ID:  0xc4_f6_VRF_whfltr2k+6a3

BUCKET_ID:  0xc4_f6_VRF_whfltr2k+6a3

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_Minidumps.zip\070510-22479-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e55000 PsLoadedModuleList = 0x82f9d810
Debug session time: Mon Jul  5 22:10:20.783 2010 (GMT-4)
System Uptime: 0 days 0:00:19.673
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 2, 0, 82e91a5b}

*** WARNING: Unable to verify timestamp for MBfilt32.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt32.sys
Probably caused by : MBfilt32.sys ( MBfilt32+1641 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82e91a5b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82fbd718
Unable to read MiSystemVaType memory at 82f9d160
 00000016 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiSignalNotificationObject+18
82e91a5b 807f1601        cmp     byte ptr [edi+16h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  881c6c44 -- (.trap 0xffffffff881c6c44)
ErrCode = 00000000
eax=82bc59bc ebx=00000000 ecx=2b9fdf02 edx=00000100 esi=82bc59c4 edi=00000000
eip=82e91a5b esp=881c6cb8 ebp=881c6cc4 iopl=0         nv up ei pl nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KiSignalNotificationObject+0x18:
82e91a5b 807f1601        cmp     byte ptr [edi+16h],1       ds:0023:00000016=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e91a5b to 82e9b82b

STACK_TEXT:  
881c6c44 82e91a5b badb0d00 00000100 00000000 nt!KiTrap0E+0x2cf
881c6cc4 82ebc75d 807c3120 933c4fdc 8affe1f8 nt!KiSignalNotificationObject+0x18
881c6ce8 8318ed4d 82bc59bc 00000008 00000000 nt!KeSetEvent+0x98
881c6d08 a4119641 82bc59bc 00000008 00000000 nt!VerifierKeSetEvent+0x58
WARNING: Stack unwind information not available. Following frames may be wrong.
881c6d1c 8318b16f 00000000 933c4f48 82bc59bc MBfilt32+0x1641
881c6d3c 8318b2d5 933c4f48 00000000 86199478 nt!ViPendingCompleteAfterWait+0x5d
881c6d50 830636bb 82f94ee0 a383b235 00000000 nt!ViPendingWorkerThread+0x27
881c6d90 82f150f9 8318b2ae 82f94ee0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt32+1641
a4119641 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt32+1641

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt32

IMAGE_NAME:  MBfilt32.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a72678e

FAILURE_BUCKET_ID:  0xA_VRF_MBfilt32+1641

BUCKET_ID:  0xA_VRF_MBfilt32+1641

Followup: MachineOwner
---------

The first dump with error code C4 points to whfltr2k.sys as the cause. That is one of your mouse drivers.

The second dump with error code points to MBfilt32.sys as the cause. That is your Realtek High Definition Audio Driver. I want to point out that the driver may not be at fault; it may be the chip itself. However, whfltr2k.sys is a 2007 driver and very obsolete.I have suspected this driver from the start.

I see two options: (1) update the drive; or (2) install a new sound card and disable the onboard sound.

Realtek or the MSI website. MSI would be better if you can find an update there.

Next, we wait for your new mouse and keyboard. You can turn off Driver Verifier.

gedafe · 09 Jul 2010

Carl,

Still waiting on the mouse and keyboard. They shipped on Tue and Wed, so I'm hoping to have them tomorrow. However, while I've been waiting, I had another BSOD (attached). Don't really think it's going to be any different than the ones we've been seeing.

-Fence

ttran · 09 Jul 2010

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

This time memory corruption is blamed. however, as you can see in the quote, this can be driver issue. And we have been discussing so far that this can be due to your mouse driver. So, let's wait for new mouse to come.

Have you followed the instruction about Audio driver that Carl suggest?

Also, in looking through your drivers, I see that you have this out of date drivers, I don't know if Carl ever mentioned this to you. But please update them if possible:

Code:

9a176000 9a180680   Alpham1  Alpham1.sys  Mon Jul 23 14:56:57 2007 (46A45F49)
9a1a6000 9a1aa800   Alpham2  Alpham2.sys  Tue Mar 20 16:49:51 2007 (45FFAE3F)

I guess they belong to Ideazon ZBoard??
http://www.steelseries.com/download
Regard,

Tuan

gedafe · 10 Jul 2010

Tuan,

I'm thinking it's got to be a driver thing. I ran memtest all day today: 13 passes clean with no errors.

Still no luck on the keyboard and mouse though--apparently, they are still en-route to me via USPS. Oh well, I guess I'll wait until Monday. If/when I get the new microsoft keyboard/mouse, I should be able to get rid of several of the older drivers: alpham 1 and 2 (steelseries keyboard),whfltr2k (gigabyte mouse).

The only ones left will be the HD audio driver.

I guess we'll see come Monday...

-Fence

Jonathan_King · 10 Jul 2010

Driver Verifier flagged your mouse drivers as the cause. It is therefore highly likely that either the mouse itself is faulty, or the drivers are buggy/incompatible.

CarlTR6 · 10 Jul 2010

I think Jonathan is spot on. Let's wait until you get your mouse and keyboard installed and see what happens.

gedafe · 15 Jul 2010

Carl/Tuan/Jonathan,

Just wanted to update you: I've had my new keyboard and mouse since Tuesday, and so far, no BSOD's. Knock on wood for no more. Thanks for all the help! Hopefully, I won't have to come back for more problem solving on this issue.

Thanks again!

-Fence