System Service Exception 0x3B c0000005

shoitz · 02 Mar 2011

OK, sounds good. I'm hoping NcRemotePci.sys was the culprit, but I've enabled Driver Verifier in case it's not (or the new version didn't help). Will report back.

shoitz · 02 Mar 2011

Bad news is, once I enabled Driver Verify, I get BSOD before getting to the logon screen. Good news is, that means it found something right? I'm in safe mode now, disabling Driver Verify so I can reboot.

*Edit* just disabled Driver Verifier and rebooted. Attached dumpfiles3. Need anything else from the Driver Verify side? It looks like there's no dump from the failed boot. I guess it was set to reboot immediately instead of dumping memory first? I can re-enable Driver Verifier, hit F8 on startup to disable immediate reboot on BSOD, if that's what it takes to get a good dump.

CarlTR6 · 02 Mar 2011

You did not get a dump on that that restart with Verifier enabled. When Verifier triggers a BSOD that quickly it usually means that it is a hardware problem rather than a third party driver problem. It appears that you are running two graphics cards, an ATI Radeon HD 5450 and an NVIDIA GeForce GTX 470. Is this correct?

What version is your Catalyst Control Center? Your dumps are blaming atikmdag.sys. There is a known problem with Catalyst 10.12 Preview. If your version is 10.12, wait till 11 whql and for now use 10.3 - 10.11. Another option is uninstall CCC completely and install only the video driver.

shoitz · 02 Mar 2011

I'm not running Catalyst Control Center at all -- I suspected this program at first from some other research I had done (and from the atikmdag.sys message), so I removed CCC entirely. At this point it should be just the driver installed, although there's ATI drivers for both the 5450 and the TV Tuner.

I can re-test my theory, but as I mentioned previously I'm pretty sure that this BSOD will go away if I remove the video card (as it did in the past).

I should probably check these Driver Verifier-induced BSOD's more closely anyway, seeing as companies tend to not believe you when you need another RMA. But from my perspective, if the RMA didn't fix it last time then it's probably a waste of shipping costs on another (potentially) bad/incompatible/whatever card.

CarlTR6 · 02 Mar 2011

Four dumps blame atikmdag.sys and it shows up in the dumps' stacks. I agree with you, your crashes will go away if you pull the ATI card or the nVidia card.

shoitz · 04 Mar 2011

Well, I have to do some research here and will report back. I finally got around to disabling automatic restart and re-enabling Driver Verifier. The BSOD that was causing immediate reboot during startup is a 0xC9 faulty driver BSOD, pointing to mounthlp.sys.

DeanP · 04 Mar 2011

There is a new version of ATI Catalyst (11.2) - ATI Radeon

shoitz · 04 Mar 2011

I actually just updated the ATI display drivers (but still didn't install CCC). I tried renaming away mounthlp.sys, which seems to be part of the HFS+ Paragon software that lets you read Mac drives in Windows. I had this installed at one point but it seems to no longer be installed. Wonder if I can use Revo to clean up after it... (probably too late at this point). Once I renamed away mounthlp.sys it caused a cascade of other BSOD's that prevented bootup of any kind. So I booted to a win7 setup flash drive and renamed mounthlp.sys back... then booted to safe mode to disable driver verifier and now I'm back in Windows.

Hopefully I can find a way to clean this up, but I may have to do a repair install of Win7. I wish Win7 SP1 were slipstreamable but I'm assuming that it's not truly slipstream-able, just like Vista is not.

shoitz · 04 Mar 2011

So, anybody have any advice for removing this rogue driver? I tried installing the latest Paragon HFS+ 8 and uninstalling it... sure enough it updated the date on mounthlp.sys, but when I uninstalled it it just went back to the old version instead of removing it entirely. Deleting/renaming results in BSOD on startup.

I think at this point I've probably gotta do a repair install of Win7 x64 Enterprise... but I'll wait a little bit to see if anybody's got any other suggestions. TIA!

shoitz · 05 Mar 2011

Well, oddly enough... the Realtek HD Audio driver that I just installed turned out to be bad (the new one). I disabled automagic-reboot in order to catch the BSOD when using Driver Verifier. First culprit:
Faulty driver message 0xC9 (0x228) STOP referencing mounthlp.sys, as mentioned before. Tracked down to Paragon HFS+ 7.5. Never did find a way to remove the driver, but I extracted mounthlp.sys (newer version) from the HFS+ 8.0 trial. So, after removing the 8.0 trial (system restore to a previous point actually) I updated mounthlp.sys. That BSOD fixed! On to the next...

RTKVHD64.sys -- This driver is attempting to access memory after it has been freed -- STOP 0XD5.
Yeah, that's a pretty big no-no. That's the Realtek audio driver I just installed. But they seem to update fairly frequently, so I uninstalled the old one... after reboot got the classic PAGE FAULT IN NONPAGED AREA, 0x50 but no reference to a specific driver. So I finished updating the Realtek audio drivers. *edit* it looks like my messing around trying to get a SoftPhone to work is breaking the sound driver. So I'm in the process of removing then re-installing the latest driver (and removing the faulty softphone). This problem didn't exist before, well, today when I was messing around with softphone, so I think the real problem is back to Paragon.

Once I did all that, the computer rebooted fine with Driver Verifier enabled. I booted it in that mode a total of 4 times I think, all successfully, so I disabled Driver Verifier so I can get back up to speed.

So after all this, it looks like I've made some progress (although still can't say definitively that I've solved the original BSOD). I'll report back as to whether the 0x3B returns. However, I'm still pretty peeved that Paragon managed to leave mounthlp.sys and hotcore3.sys on my system and in active use for Generic Storage Volumes. So if anybody's got any bright ideas or had the same issue in the past, I'd be happy to hear about it. In the meantime, hopefully Paragon answers my support ticket.