Windows 7: frequent random BSODs

thargas · 23 Jul 2010

Hi folks.

I've got a 6-month old OEM, original install of Windows 7 X64. Until a couple of weeks ago it was stable: no BSODs. Then there was one. Now I'm lucky if I can get through a session without one. They seem to be of random types, according to windbg, though there have been a number of ones pointing at amdppm.sys. They seem to be more frequent if the machine is busier.

I don't recall installing anything in particular around the time that it started.

I've tried uninstalling a bunch of unused programs, and my old scanner. I've uninstalled the anti-virus program I was using (avast free) and installing Microsoft Security Essentials instead. I've tried runing Malwarebytes Anti-Malware, with a clean report (when I don't get a random BSOD).

I'm getting to the point of considering re-installing Windows 7, but ideally I'd like to figure out what causes this so I can avoid it in future.

usasma · 23 Jul 2010

No memory dumps in this upload, please do the following:

Quote:

Upload Dump Files:
Please go to C:\Windows\Minidump and zip up the contents of the folder. Then upload/attach the .zip file with your next post.
Left click on the first minidump file.
Hold down the "Shift" key and left click on the last minidump file.
Right click on the blue highlighted area and select "Send to"
Select "Compressed (zipped) folder" and note where the folder is saved.
Upload that .zip file with your next post.

If you have issues with "Access Denied" errors, try copying the files to your desktop and zipping them up from there. If it still won't let you zip them up, post back for further advice.

If you don't have anything in that folder, please check in C:\Windows for a file named MEMORY.DMP. If you find it, zip it up and upload it to a free file hosting service . I recommend Windows Live SkyDrive - http://skydrive.live.com or another free, file-hosting service. Then post the link to it in your topic so that we can download it.

Then, follow the directions here to set your system for Minidumps (much smaller than the MEMORY.DMP file): Set MiniDump

The BSOD's noted in the MSINFO32 file aren't very helpful. I'd suggest trying Driver Verifier according to these instructions:

Quote:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:

Code:

Delete these registry keys (works in XP, Vista, Windows 7):
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

thargas · 23 Jul 2010

here are the minidumps.

zigzag3143 · 23 Jul 2010

Quote: Originally Posted by thargas

here are the minidumps.

The majority of these were caused by amdpp.sys, and the attempt to write to read only memory.

You also have some drivers that are old and need to be updated.

I would
1- update amdppm.sys which is a processor driver. It may be integral to BIOS, I am no sure.

2-update the old drivers

3- run a system file check. Type cmd in search>right click and run as admin>
sfc /scannow

Ken

Old drivers needing updating

Code:

SSPORT.sys        fffff880`06170000    fffff880`06178000    0x00008000    0x42fbda34    8/11/2005 19:07:32                        
secdrv.SYS        fffff880`06138000    fffff880`06143000    0x0000b000    0x4508052e    9/13/2006 09:18:38                        
AsIO.sys        fffff880`02bc4000    fffff880`02bcb000    0x00007000    0x47663d55    12/17/2007 05:11:49                        
DgiVecp.sys        fffff880`05223000    fffff880`05233000    0x00010000    0x490a7db5    10/30/2008 23:38:29                        
NuidFltr.sys        fffff880`03e83000    fffff880`03e8c000    0x00009000    0x4a03f30b    5/8/2009 04:53:31                        
spldr.sys        fffff880`014e5000    fffff880`014ed000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
amdxata.sys        fffff880`00d91000    fffff880`00d9c000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59

Analysis

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\072310-19250-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a64000 PsLoadedModuleList = 0xfffff800`02ca1e50
Debug session time: Fri Jul 23 17:25:32.275 2010 (GMT-4)
System Uptime: 0 days 1:49:05.836
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff880016fa354, 3ce1121, fffff88002d1b8b0, a}

Probably caused by : amdppm.sys ( amdppm!C1Halt+2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff880016fa354, Virtual address for the attempted write.
Arg2: 0000000003ce1121, PTE contents.
Arg3: fffff88002d1b8b0, (reserved)
Arg4: 000000000000000a, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xBE

PROCESS_NAME:  System

CURRENT_IRQL:  d

TRAP_FRAME:  fffff88002d1b8b0 -- (.trap 0xfffff88002d1b8b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000001f287 rbx=0000000000000000 rcx=000000000001f287
rdx=000000000002633a rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002adb258 rsp=fffff88002d1ba40 rbp=0000000000000001
 r8=000000000000761a  r9=0000000000000000 r10=0000000000005892
r11=fffff88007b0bc70 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KeAccumulateTicks+0xf8:
fffff800`02adb258 898bd4210000    mov     dword ptr [rbx+21D4h],ecx ds:00000000`000021d4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b53388 to fffff80002ad4600

STACK_TEXT:  
fffff880`02d1b748 fffff800`02b53388 : 00000000`000000be fffff880`016fa354 00000000`03ce1121 fffff880`02d1b8b0 : nt!KeBugCheckEx
fffff880`02d1b750 fffff800`02ad26ee : fffff880`02d1b938 fffff880`009e8180 00000000`00000010 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x409f4
fffff880`02d1b8b0 fffff800`02adb258 : fffff8a0`09629000 fffff8a0`07fc8000 fffff8a0`002cd000 fffff8a0`0f3c0000 : nt!KiPageFault+0x16e
fffff880`02d1ba40 fffff800`02ae1518 : fffff8a0`001df000 fffff880`04705cf0 00000000`00026160 fffffa80`05593d00 : nt!KeAccumulateTicks+0xf8
fffff880`02d1bad0 fffff800`02ae12a1 : 00000000`00000000 fffff880`02d1bb80 fffff880`009e8180 00000000`00000001 : nt!KeUpdateRunTime+0xb8
fffff880`02d1bb00 fffff880`02a037f2 : fffff800`02ae213a 00000000`0026da19 fffffa80`05593dd8 fffff880`009f2fc0 : nt!KiSecondaryClockInterrupt+0x131
fffff880`02d1bc98 fffff800`02ae213a : 00000000`0026da19 fffffa80`05593dd8 fffff880`009f2fc0 00000000`00000001 : amdppm!C1Halt+0x2
fffff880`02d1bca0 fffff800`02adcdcc : fffff880`009e8180 fffff880`00000000 00000000`00000000 fffff800`02bf4ce0 : nt!PoIdle+0x53a
fffff880`02d1bd80 00000000`00000000 : fffff880`02d1c000 fffff880`02d16000 fffff880`02d1bd40 00000000`00000000 : nt!KiIdleLoop+0x2c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
amdppm!C1Halt+2
fffff880`02a037f2 c3              ret

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  amdppm!C1Halt+2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: amdppm

IMAGE_NAME:  amdppm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc0fd

FAILURE_BUCKET_ID:  X64_0xBE_VRF_amdppm!C1Halt+2

BUCKET_ID:  X64_0xBE_VRF_amdppm!C1Halt+2

Followup: MachineOwner
---------

thargas · 24 Jul 2010

I've been able to work for an hour or two before getting a BSOD.

I've updated the asus chipset sw. Unfortunately, this seems not to have any effect on amdppm.sys.

I'm working my way through the old drivers you mentioned:
- replaced the samsung printer driver (ssport.sys) and now I have a non-functional printer

- disabled (renamed) secdrv.sys as it doesn't sound like anything I want/need
- found references connecting asio.sys with pc probe, which didn't sound interesting so I uninstalled it.

I've run "sfc /scannow" and it says the system is clean.

usasma · 24 Jul 2010

Posted before I read your post:
Update the chipset drivers for your motherboard from the Asus support website.
Uninstall the Asus PCProbe software from your system (the AsIO.sys driver).
Uninstall Microsoft Intellitype/IntelliPoint software (the NuidFltr.sys driver)
Uninstall Samsung Drivers (SSPORT.sys and DgiVecp.sys)

Posted after I read your post:
Did the Samsung driver update also update the DgiVecp.sys file?
Do not rename the secdrv.sys - it is a Windows file and doesn't need updating

thargas · 24 Jul 2010

yes, DgiVecp.sys was updated to 2009-03-02

thargas · 24 Jul 2010

One thing I've noticed is that I can "reliably" get a BSOD by attempting to create a DVD, and it will always happen before it starts to write to the DVD.

Thanks for all the detailed instructions. They really do help when one isn't a Windows 7 guru.

usasma · 24 Jul 2010

Generate a BSOD by trying to create a DVD and then upload the memory dump file - we'll have a shot at figuring it out.

thargas · 24 Jul 2010

but it's 66MB, so it won't fit in skydrive.

Here's the output of windbg:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*C:\Websymbols*Symbol information
Executable search path is: SRV*C:\Websymbols*Symbol information
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
Debug session time: Sat Jul 24 19:04:35.269 2010 (UTC - 3:00)
System Uptime: 0 days 0:03:29.220
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols

Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3, 2, 1, fffff80002a8a0e2}

Probably caused by : ntkrnlmp.exe ( nt!KiReadyThread+2 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000003, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002a8a0e2, address which referenced memory

Debugging Details:
------------------

OVERLAPPED_MODULE: Address regions for 'hidusb' and 'crashdmp.sys' overlap

WRITE_ADDRESS: 0000000000000003

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiReadyThread+2
fffff800`02a8a0e2 4883ec20 sub rsp,20h

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: fffff88002ffd440 -- (.trap 0xfffff88002ffd440)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=fffffa80066ca060
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a8a0e2 rsp=fffff88002ffd5d0 rbp=fffffa80066ca168
r8=fffff88002fd7301 r9=0000000000000002 r10=0000000000000063
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiReadyThread+0x2:
fffff800`02a8a0e2 4883ec20 sub rsp,20h
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002a7db69 to fffff80002a7e600

STACK_TEXT:
fffff880`02ffd2f8 fffff800`02a7db69 : 00000000`0000000a 00000000`00000003 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02ffd300 fffff800`02a7c7e0 : fffffa80`05c37418 fffffa80`066ca168 fffff980`01366ce0 fffff980`0e266c10 : nt!KiBugCheckDispatch+0x69
fffff880`02ffd440 fffff800`02a8a0e2 : fffffa80`066ca168 fffff800`02a89ab7 fffffa80`066ca120 fffffa80`066ee230 : nt!KiPageFault+0x260
fffff880`02ffd5d0 fffff800`02a89ab7 : fffffa80`066ca120 fffffa80`066ee230 fffffa80`066ee230 00000000`00000102 : nt!KiReadyThread+0x2
fffff880`02ffd5e0 fffff800`02a8a57e : 00000000`7cb479e8 fffff880`02ffdc58 00000000`00003463 fffff880`02fd81e8 : nt!KiProcessExpiredTimerList+0x157
fffff880`02ffdc30 fffff800`02a89d97 : 00000000`1fcfb1c1 00000000`00003463 00000000`1fcfb133 00000000`00000063 : nt!KiTimerExpiration+0x1be
fffff880`02ffdcd0 fffff800`02a86dfa : fffff880`02fd5180 fffff880`02fdffc0 00000000`00000000 fffff880`04e5f588 : nt!KiRetireDpcList+0x277
fffff880`02ffdd80 00000000`00000000 : fffff880`02ffe000 fffff880`02ff8000 fffff880`02ffdd40 00000000`00000000 : nt!KiIdleLoop+0x5a

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiReadyThread+2
fffff800`02a8a0e2 4883ec20 sub rsp,20h

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!KiReadyThread+2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

FAILURE_BUCKET_ID: X64_0xA_VRF_nt!KiReadyThread+2

BUCKET_ID: X64_0xA_VRF_nt!KiReadyThread+2

Followup: MachineOwner
---------

Windows 7: frequent random BSODs

frequent random BSODs problems?