Asus G73SW Notebook BSODs

DeanP · 14 Apr 2011

AVG had been causing issues with Windows 7 lately... I have no idea why the dump says unknown error.

johnm123 · 14 Apr 2011

Ok, thanks Dean.

**cluberti** · 14 Apr 2011

The reason it says it's unknown is because your CPU is apparently in an invalid state:

Code:

3: kd> r
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=0000000000000000 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz na pe nc
cs=0000  ss=0000  ds=0000  es=0000  fs=0000  gs=0000             efl=00000000
00000000`00000000 ??              ???

It can't tell you what's wrong, because there's just no information on the CPU for it to disassemble. We know from the .bugcheck output that it was an attempted write by something to address 0x00000040, which is going to fail (it's within the first 64K of a process, in this case the kernel, and all VA in the first 64K is marked PAGE_NOACCESS). Other than that, though, without a *complete* memory dump there's no way to tell what's happening (and even with one, I can't guarantee 100% that it'll be found, but usually it can be done).

johnm123 · 14 Apr 2011

Thanks a lot cluberti, I'm not sure where to select "full" dumps, since the drop down menu only allows me to select between a minidump and a kernel dump (is that a full one?). I'll reproduce the BSOD with a kernel dump and post it here.

On that note, it is not a real BSOD, rather the screen turns black though all the fans are still running, lights still glowing and in that time it obviously creates a dump as well. Not sure if that helps or hints at something in particular. That black screen of death appears shortly after the windows symbol/animation, right before the login screen should appear.

Edit: This time the BSOD actually was blue again, not black. Not sure why the randomness...and I also couldn't sign in via "last known good configuration" anymore but had to get in via safemode to turn off verifier.exe. So it has 3 new dumps instead of one.

**cluberti** · 15 Apr 2011

Once you've selected Kernel Dump (hopefully that'll be enough - otherwise it's registry editing time) you will need to reboot for it to take effect. Once rebooted, additional crashes will create a file in \Windows called memory.dmp. That will be the file we will need.

**cluberti** · 16 Apr 2011

OK, I know why the context of the CPU is wrong - truecrypt. Not sure if that's the cause of the crash or not, but would it be possible for you to decrypt and remove this during troubleshooting? The reason I ask, is this is the last thing that was done before the box crashed. The originating IRP is pending in a truecrypt IRP, which seems to obfuscate everything (given what truecrypt does, I suppose this is expected):

Code:

16.2: kd> !thread fffffa80`0bbb5660
THREAD fffffa800bbb5660  Cid 023c.02d8  Teb: 000007fffffd4000 Win32Thread: fffff900c1b21c30 RUNNING on processor 5
IRP List:
    fffff98003ba6c10: (0006,03e8) Flags: 40000884  Mdl: 00000000
Not impersonating
DeviceMap                 fffff8a0014cd3f0
Owning Process            fffffa800bbadb30       Image:         svchost.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      1497           Ticks: 1 (0:00:00:00.015)
Context Switch Count      639                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.093
Win32 Start Address 0x000007fefd87a808
Stack Init fffff88003e8dc70 Current fffff88003e8c6e0
Base fffff88003e8e000 Limit fffff88003e85000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03e8c950 fffff800`0429708a : 00000000`00000000 fffff800`00000000 13200000`0520a860 00000000`00000008 : nt!ExfAcquirePushLockExclusive+0x150
fffff880`03e8c9d0 fffff800`0428676e : 00000000`00000008 fffff880`014c7080 00000000`00000000 fffffa80`090ab180 : nt!MmAccessFault+0x1a6a
fffff880`03e8cb30 fffff880`014c7080 : fffff880`014c8ff1 00000000`00000010 fffff880`014c8f50 00000000`00000010 : nt!KiPageFault+0x16e (TrapFrame @ fffff880`03e8cb30)
fffff880`03e8ccc8 fffff880`014c8ff1 : 00000000`00000010 fffff880`014c8f50 00000000`00000010 00000000`00010282 : Ntfs!NtfsQueryDirectory
fffff880`03e8ccd0 fffff880`014cb8ef : fffffa80`0b5cee40 00000000`00000000 00000000`00000002 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
fffff880`03e8cd10 fffff800`0472bc16 : fffff980`03aacc10 fffff980`03aacc10 fffffa80`0b5cee40 fffff880`03e8cd38 : Ntfs!NtfsFsdDirectoryControl+0x10f
fffff880`03e8cd80 fffff880`01218bcf : fffff980`03aacfb0 fffff880`03e8ce20 fffffa80`0bab2010 fffffa80`085e7e00 : nt!IovCallDriver+0x566
fffff880`03e8cde0 fffff880`0121baea : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0bab2010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`03e8ce70 fffff880`01239978 : fffffa80`0863cbc0 00000000`00000022 fffffa80`087e9010 fffffa80`0bab20c0 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`03e8cf10 fffff880`0616fd71 : 00000000`00000000 00000000`00000020 fffff880`03e8cfd0 fffff880`03e8d060 : fltmgr!FltQueryDirectoryFile+0x98
fffff880`03e8cf50 fffff880`012398c2 : 00000000`00000034 fffffa80`0863cab0 fffffa80`0bbf5770 00000000`00000000 : luafv!LuafvNormalizeNameComponentEx+0x145
fffff880`03e8d050 fffff880`01239afe : 00000000`00000001 00000000`00000034 00000000`00000010 00000000`000007ff : fltmgr!FltpCallNormalizeNameComponentHandler+0x82
fffff880`03e8d0b0 fffff880`0123af81 : 00000000`00000050 00000000`00000050 00000000`00000035 00000000`00000000 : fltmgr!FltpExpandShortNames+0x14e
fffff880`03e8d110 fffff880`0123ae1e : fffffa80`0863cab0 fffff6fc`00020000 00000000`00000000 fffffa80`0bb42010 : fltmgr!FltpGetNormalizedFileNameWorker+0xc1
fffff880`03e8d150 fffff880`01226b9d : c00000bb`00000000 00000000`00000000 fffffa80`0bb42b00 fffff880`03e8e000 : fltmgr!FltpCreateFileNameInformation+0xee
fffff880`03e8d1b0 fffff880`01220bf6 : fffffa80`08421200 fffffa80`0bb42010 fffffa80`087e9108 fffff800`0428687d : fltmgr!HandleStreamListNotSupported+0x15d
fffff880`03e8d1f0 fffff880`01227b44 : fffffa80`0bbf6200 00000000`00000000 fffffa80`0bb42010 00000000`00000101 : fltmgr! ?? ::FNODOBFM::`string'+0x30f3
fffff880`03e8d270 fffff880`0619587b : fffffa80`0863cab0 00000000`00000000 fffffa80`0bb4dec0 fffffa80`0bbdaac0 : fltmgr!FltGetFileNameInformation+0x184
fffff880`03e8d300 fffff880`01218067 : fffffa80`0bbdab70 fffff880`03e8d428 00000000`00000000 00000000`00000000 : avgntflt+0x1487b
fffff880`03e8d3b0 fffff880`0121a9aa : fffffa80`0bbf6200 fffffa80`0bbf6200 fffffa80`0858ed00 fffffa80`087e9000 : fltmgr!FltpPerformPreCallbacks+0x2f7
fffff880`03e8d4b0 fffff880`012382a3 : fffff980`03ba6c10 fffff980`03ba6c10 fffff980`03ba6c10 fffffa80`0bbf6220 : fltmgr!FltpPassThroughInternal+0x4a
fffff880`03e8d4e0 fffff800`0472bc16 : fffff980`03ba6c10 00000000`00000002 00000000`00000040 00000000`00000000 : fltmgr!FltpCreate+0x293
fffff880`03e8d590 fffff800`04586495 : 00000000`00000005 fffffa80`0bc0fcc8 fffffa80`0bc0f010 fffffa80`090c5da0 : nt!IovCallDriver+0x566
fffff880`03e8d5f0 fffff800`04582d38 : fffffa80`08577940 fffff800`00000000 fffffa80`0bc0fb10 00000000`00000001 : nt!IopParseDevice+0x5a5
fffff880`03e8d780 fffff800`04583f56 : 00000000`00000000 fffffa80`0bc0fb10 00000000`00000000 fffffa80`067418a0 : nt!ObpLookupObjectName+0x588
fffff880`03e8d870 fffff800`0458585c : 00000000`0000029b 00000000`00000000 fffff8a0`015a8701 00000000`000007ff : nt!ObOpenObjectByName+0x306
fffff880`03e8d940 fffff800`04590478 : 00000000`00b7e948 00000000`c0100080 00000000`00b7e998 00000000`00b7e958 : nt!IopCreateFile+0x2bc
fffff880`03e8d9e0 fffff800`042878d3 : fffffa80`0bbb5660 fffff880`03e8db60 fffffa80`0bbb5660 fffff800`0457fa34 : nt!NtCreateFile+0x78
fffff880`03e8da70 00000000`76f6186a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`03e8dae0)
00000000`00b7e8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f6186a

johnm123 · 16 Apr 2011

Thanks for the breakdown.

Interesting, so truecrypt encrypts the whole...erm...kernel or what does it do? Because I only use it to encrypt a handful of personal documents and I disabled it to automatically start up with the system so I'm not sure why it even does this stuff. I also updated to the newest version but that didn't seem to help either.

I'll get rid of that program then and run verifier.exe again to see if this time the system can start up without a BSOD. Thanks again!

**cluberti** · 19 Apr 2011

Please do, and post back your results.

**cluberti** · 19 Apr 2011

Johnm123, I got the dump from your last PM, and frankly it doesn't give any further insight. Also, some of the context is screwed up, so it's not all there. Honestly, at this point, we need you to configure the system for a complete memory dump, and manually configure your paging file to be both min and max RAM+50MB. To configure for a complete memory dump:

Open sysdm.cpl
Click the "Advanced" tab, and click the "Settings" button in the Performance section
Click the "Advanced" tab, and click the "Change" button
Click "Custom size", and enter (in MB) the same value for both the "Initial size" and "Maximum size" boxes - your system's RAM+50MB (so if you have 8GB of RAM, you would enter 8242 - 8192 is RAM, +50 = 8242).
Open regedit
Browse to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Change the value of the DWORD "CrashDumpEnabled" to 1
Reboot

Now, do NOT go back into the system control panel and touch anything - the moment you view the memory dump dropdown and then click OK (even if you change nothing), it'll change the CrashDumpEnabled value back to 2 (kernel dump only). If you do the above, in that order, and *only* the above, the next crash should be a *complete* memory dump, including all user and kernel-mode contexts (let's hope!).

johnm123 · 19 Apr 2011

Thanks a lot for this step-by-step tutorial. I did everything except the regedit part because that "CrashDumpEnabled" option just wasn't there. Any ideas? (screenshot attached)