Random BSOD

luis1906 · 04 Apr 2011

Hey everybody!

I got random BSOD and i don't now what to do. Sometimes the PC runs a few hours without any problems and then it crashes every 10 minutes. Most it crashes in Idle i guess...
I've already ran Memtestx86+ and it found two errors. Then i removed all RAMs and checked every RAM at single - no error found. Finally i found one RAM that occured the errors (i hope it was this one) in Dual Channel mode. But the BSOD continues...
I've attached a few Minidumps and i hope that someone can help me.
The PC is about 4 month old and had this Crashes from beginning. I've already reeinstalled Windows with no success.
My hardware: Foxconn H55M Mainboard, Intel i7 870, Nvidia GTX470, Windows 7 Home Premium 64bit, 4x2GB Kingmax DD3-1333

Thank you in advance for your help!
BR

yowanvista · 04 Apr 2011

Finally i found one RAM that occured the errors (i hope it was this one) in Dual Channel mode. But the BSOD continues...

Remove that RAM stick and monitor for more BSODs
Basically dumps all point to a hardware error

Since your graphic drivers were also involved I strongly recommend to update to the latest version, yours is dated 02/04/2010
http://www.nvidia.com/object/win7-wi...ql-driver.html

Code:

nvlddmkm.sys        fffff880`0f28c000    fffff880`0ffc0c80    0x00d34c80    0x4bb62f68    02/04/2010 21:54:48

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff880045d844a, fffff880042d38a8, fffff880042d3100}

Probably caused by : hardware ( dxgmms1!VidSchiSubmitRenderCommand+2e )

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880045d844a, The address that the exception occurred at
Arg3: fffff880042d38a8, Exception Record Address
Arg4: fffff880042d3100, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
dxgmms1!VidSchiSubmitRenderCommand+2e
fffff880`045d844a 0000            add     byte ptr [rax],al

EXCEPTION_RECORD:  fffff880042d38a8 -- (.exr 0xfffff880042d38a8)
ExceptionAddress: fffff880045d844a (dxgmms1!VidSchiSubmitRenderCommand+0x000000000000002e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000c881ae
Attempt to write to address 0000000000c881ae

CONTEXT:  fffff880042d3100 -- (.cxr 0xfffff880042d3100)
rax=0000000000c881ae rbx=fffffa8004802010 rcx=fffffa8004676ec0
rdx=fffffa800489c590 rsi=0000000000000000 rdi=fffffa8005f1b010
rip=fffff880045d844a rsp=fffff880042d3ae0 rbp=0000000000000080
 r8=0000000000000001  r9=0000000000000000 r10=fffffa8005f1b7e0
r11=fffffa8004676ec0 r12=fffffa8005f1b010 r13=fffff880045d7dc0
r14=0000000000000000 r15=fffffa8004802010
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
dxgmms1!VidSchiSubmitRenderCommand+0x2e:
fffff880`045d844a 0000            add     byte ptr [rax],al ds:002b:00000000`00c881ae=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000c881ae

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b50e8
 0000000000c881ae 

FOLLOWUP_IP: 
dxgmms1!VidSchiSubmitRenderCommand+2e
fffff880`045d844a 0000            add     byte ptr [rax],al

BUGCHECK_STR:  0x7E

MISALIGNED_IP: 
dxgmms1!VidSchiSubmitRenderCommand+2e
fffff880`045d844a 0000            add     byte ptr [rax],al

LAST_CONTROL_TRANSFER:  from fffff880045d8398 to fffff880045d844a

STACK_TEXT:  
fffff880`042d3ae0 fffff880`045d8398 : fffff800`043ec080 fffff880`045d7dc0 fffffa80`05f1b010 fffffa80`05f1b010 : dxgmms1!VidSchiSubmitRenderCommand+0x2e
fffff880`042d3cd0 fffff880`045d7e96 : 00000000`00000000 fffffa80`04802010 00000000`00000080 fffffa80`05f1b010 : dxgmms1!VidSchiSubmitQueueCommand+0x50
fffff880`042d3d00 fffff800`03321cce : 00000000`02126498 fffffa80`05f37060 fffffa80`03c71840 fffffa80`05f37060 : dxgmms1!VidSchiWorkerThread+0xd6
fffff880`042d3d40 fffff800`03075fe6 : fffff800`031f6e80 fffffa80`05f37060 fffff800`03204cc0 fffff880`0123d384 : nt!PspSystemThreadStartup+0x5a
fffff880`042d3d80 00000000`00000000 : fffff880`042d4000 fffff880`042ce000 fffff880`042d3680 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  dxgmms1!VidSchiSubmitRenderCommand+2e

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff880042d3100 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED_dxgmms1.sys

BUCKET_ID:  X64_IP_MISALIGNED_dxgmms1.sys

Followup: MachineOwner
---------

luis1906 · 04 Apr 2011

Yes i have removed the RAM stick that i think is the defect one but BSOD's continues (Without this RAM stick Memtest have no error).

yowanvista · 04 Apr 2011

luis1906 said:

Yes i have removed the RAM stick that i think is the defect one but BSOD's continues (Without this RAM stick Memtest have no error).

Bad RAM slots on the mobo may also be the cause, put the other RAM stick in another slot

luis1906 · 04 Apr 2011

Ok then i try this an let memtest run overnight to see if there is an error yet. Is there something i should do to figure out what the BSOD causes?

yowanvista · 04 Apr 2011

luis1906 said:

Ok then i try this an let memtest run overnight to see if there is an error yet. Is there something i should do to figure out what the BSOD causes?

See my first post for the nvidia driver

luis1906 · 04 Apr 2011

Ok then i try this two tips and come back to tell what happend.
Thank you

luis1906 · 04 Apr 2011

Now I've updated the Nvidia Driver and as the Installer attendet to restart the PC i got a BSOD "IRQL not less or equal". Minidump attached.
I had to start Windows in safe mode to remove the corrupted driver and then reeinstall it. And i recognized that of the 6GB of RAM installed only 4GB are displayed - in Windows and at booting up the PC...
What's goin on with this machine?

yowanvista · 04 Apr 2011

luis1906 said:

Now I've updated the Nvidia Driver and as the Installer attendet to restart the PC i got a BSOD "IRQL not less or equal". Minidump attached.
I had to start Windows in safe mode to remove the corrupted driver and then reeinstall it. And i recognized that of the 6GB of RAM installed only 4GB are displayed - in Windows and at booting up the PC...
What's goin on with this machine?

The fact that Windows only detects 4GB may be due to a defective RAM slot on the mobo itself, it may be the cause of the BSODs

Run SFC SFC /SCANNOW Command - System File Checker

Attempt to reinstall the Nvidia driver in safe mode

This crash was caused by cng.sys. I would be extremely concerned as the only references I could find to it show it as a virus.
Run a scan of Malwarebytes in safe mode with networking

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffc8004ace980, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030a7442, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033020e8
 fffffc8004ace980 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExpGetLookasideInformation+1c6
fffff800`030a7442 0fb741c0        movzx   eax,word ptr [rcx-40h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800337e070 -- (.trap 0xfffff8800337e070)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000c0d0 rbx=0000000000000000 rcx=fffffc8004ace9c0
rdx=fffff8800e167270 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030a7442 rsp=fffff8800337e200 rbp=0000000000000288
 r8=0000000000000ff4  r9=fffff8000326e7c0 r10=0000000000000000
r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!ExpGetLookasideInformation+0x1c6:
fffff800`030a7442 0fb741c0        movzx   eax,word ptr [rcx-40h] ds:05d0:fffffc80`04ace980=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d0be9 to fffff800030d1640

STACK_TEXT:  
fffff880`0337df28 fffff800`030d0be9 : 00000000`0000000a fffffc80`04ace980 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0337df30 fffff800`030cf860 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`0326e7b0 : nt!KiBugCheckDispatch+0x69
fffff880`0337e070 fffff800`030a7442 : 00000000`00000ff4 00000000`00000000 fffff8a0`01e3e170 fffff880`0337e2d0 : nt!KiPageFault+0x260
fffff880`0337e200 fffff800`033db528 : 00000000`00000000 00000000`00000ff4 fffff880`0337e2d0 00000000`00000000 : nt!ExpGetLookasideInformation+0x1c6
fffff880`0337e290 fffff800`033db949 : fffff8a0`01e3e170 00000000`00000000 00000000`00000004 00000000`00000000 : nt!ExpQuerySystemInformation+0x15e8
fffff880`0337e640 fffff800`030d08d3 : fffff8a0`01e50000 fffff800`030cf87d 00000000`00000041 fffff8a0`01e3e000 : nt!NtQuerySystemInformation+0x4d
fffff880`0337e680 fffff800`030cce70 : fffff880`010ceef4 00000000`00020000 fffff880`0337e844 fffff8a0`01e3e148 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0337e818 fffff880`010ceef4 : 00000000`00020000 fffff880`0337e844 fffff8a0`01e3e148 00000000`00000006 : nt!KiServiceLinkage
fffff880`0337e820 fffff880`010cf3ed : fffffa80`03ced060 fffff800`030d99f3 00000000`20206f49 fffff800`033244ee : cng!GatherRandomKey+0x294
fffff880`0337ebe0 fffff800`033c7f4d : 00000000`00000001 00000000`00000001 fffffa80`065bc800 fffffa80`03ce4040 : cng!scavengingWorkItemRoutine+0x3d
fffff880`0337ec80 fffff800`030dba21 : fffff800`0326e600 fffff800`033c7f01 fffffa80`03ce4000 00000000`00000000 : nt!IopProcessWorkItem+0x3d
fffff880`0337ecb0 fffff800`0336ecce : a7858501`abf37472 fffffa80`03ce4040 00000000`00000080 fffffa80`03c71890 : nt!ExpWorkerThread+0x111
fffff880`0337ed40 fffff800`030c2fe6 : fffff880`03183180 fffffa80`03ce4040 fffff880`0318e0c0 79a9754d`9d75b60c : nt!PspSystemThreadStartup+0x5a
fffff880`0337ed80 00000000`00000000 : fffff880`0337f000 fffff880`03379000 fffff880`0337dfa0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
cng!GatherRandomKey+294
fffff880`010ceef4 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  cng!GatherRandomKey+294

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cng

IMAGE_NAME:  cng.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79e2d

FAILURE_BUCKET_ID:  X64_0xA_cng!GatherRandomKey+294

BUCKET_ID:  X64_0xA_cng!GatherRandomKey+294

Followup: MachineOwner
---------

luis1906 · 04 Apr 2011

Ok, SFC got no issue and Malwarebytes found no infections but at the first run Windows (in Safe mode) crashed, without BSOD just restarted.
So it seems not to be a virus!?
Tomorrow i check the RAM Slots to figure out why just 2 of the 3 installed sticks are recognized. Maybe it's just a defect slot - hopefully
Do you have any other idea what could be the issue?