BSOD intermittently and seemingly unprovoked

Antivirus Software? Recommend either

Microsoft Security Essentials - Free Antivirus for Windows

or the

Good and Free system security combination.

Run a full scan of your system once the security software is installed.



Possible out of date drivers:

Code:

RTCore64	fffff880`099c2000	fffff880`099c8000	Wed May 25 00:39:12 2005 (42941d90)	0000adf0		RTCore64.sys
SSPORT	fffff880`08838000	fffff880`08840000	Thu Aug 11 17:07:32 2005 (42fbda34)	0000d894		SSPORT.sys
FNETURPX	fffff880`0193d000	fffff880`01946000	Fri Oct 03 20:27:02 2008 (48e6d476)	00010f39		FNETURPX.SYS
GEARAspiWDM	fffff880`070c2000	fffff880`070cf000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
LGPBTDD	fffff880`08925000	fffff880`08930000	Wed Jul 01 12:47:52 2009 (4a4baf58)	0001041c		LGPBTDD.sys

Remove RivaTuner/EVGA Precision/MSI Afterburner (known issues w/Win7)
SSPORT.sys
FNETURPX.SYS
GEARAspiWDM.sys
LGPBTDD.sys

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\hoshin\Seven Forums\031212-30919-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03810000 PsLoadedModuleList = 0xfffff800`03a55670
Debug session time: Sun Mar 11 23:08:32.881 2012 (UTC - 6:00)
System Uptime: 0 days 1:01:55.083
Loading Kernel Symbols
...............................................................
................................................................
.............................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800849bb30, fffffa800849be10, fffff80003b908b0}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800849bb30, Terminating object
Arg3: fffffa800849be10, Process image file name
Arg4: fffff80003b908b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa800849bb30

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_C0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0872fe38 fffff800`03c175e2 : 00000000`000000f4 00000000`00000003 fffffa80`0849bb30 fffffa80`0849be10 : nt!KeBugCheckEx
fffff880`0872fe40 fffff800`03bc499b : ffffffff`ffffffff fffffa80`092f3660 fffffa80`0849bb30 fffffa80`0849bb30 : nt!PspCatchCriticalBreak+0x92
fffff880`0872fe80 fffff800`03b44448 : ffffffff`ffffffff 00000000`00000001 fffffa80`0849bb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`0872fed0 fffff800`0388bed3 : fffffa80`0849bb30 fffff800`c0000005 fffffa80`092f3660 00000000`02630840 : nt!NtTerminateProcess+0xf4
fffff880`0872ff50 fffff800`03888470 : fffff800`038d867f fffff880`08730a38 fffff880`08730790 fffff880`08730ae0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`087300e8 fffff800`038d867f : fffff880`08730a38 fffff880`08730790 fffff880`08730ae0 00000000`02632350 : nt!KiServiceLinkage
fffff880`087300f0 fffff800`0388c2c2 : fffff880`08730a38 00000000`0000d828 fffff880`08730ae0 00000000`02631e28 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`08730900 fffff800`0388ae3a : 00000000`00000001 00000000`02630f58 00000000`00000001 00000000`0000d828 : nt!KiExceptionDispatch+0xc2
fffff880`08730ae0 00000000`76de8e3d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`02630f60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de8e3d


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\hoshin\Seven Forums\022112-30966-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03816000 PsLoadedModuleList = 0xfffff800`03a5b670
Debug session time: Tue Feb 21 15:07:04.538 2012 (UTC - 6:00)
System Uptime: 3 days 18:50:09.841
Loading Kernel Symbols
...............................................................
................................................................
...............................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa800b97fd00, fffffa800b97fd80, 4080008}

Unable to load image \SystemRoot\System32\Drivers\EtronHub3.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EtronHub3.sys
*** ERROR: Module load completed but symbols could not be loaded for EtronHub3.sys
Probably caused by : EtronHub3.sys ( EtronHub3+598e )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa800b97fd00, The pool entry we were looking for within the page.
Arg3: fffffa800b97fd80, The next pool entry.
Arg4: 0000000004080008, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ac5100
 fffffa800b97fd00 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  vpc.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  fffffa800b272f88

LAST_CONTROL_TRANSFER:  from fffff800039c0cae to fffff80003892c40

STACK_TEXT:  
fffff880`225bf138 fffff800`039c0cae : 00000000`00000019 00000000`00000020 fffffa80`0b97fd00 fffffa80`0b97fd80 : nt!KeBugCheckEx
fffff880`225bf140 fffff800`038a809e : 00000000`a0000003 00000000`00000000 00000000`20206f49 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`225bf1f0 fffff800`0389634a : fffffa80`0b273000 65706950`00000000 0000007f`ffffff01 fffff800`00000000 : nt!IopCompleteRequest+0x5ce
fffff880`225bf2c0 fffff880`05eba98e : fffffa80`0a411570 00000000`00000000 fffffa80`0b97fd40 00000000`00000000 : nt!IopfCompleteRequest+0x66a
fffff880`225bf3b0 fffffa80`0a411570 : 00000000`00000000 fffffa80`0b97fd40 00000000`00000000 fffff880`225bf420 : EtronHub3+0x598e
fffff880`225bf3b8 00000000`00000000 : fffffa80`0b97fd40 00000000`00000000 fffff880`225bf420 fffff800`03b775d4 : 0xfffffa80`0a411570


STACK_COMMAND:  kb

FOLLOWUP_IP: 
EtronHub3+598e
fffff880`05eba98e ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  EtronHub3+598e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: EtronHub3

IMAGE_NAME:  EtronHub3.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d433945

FAILURE_BUCKET_ID:  X64_0x19_20_EtronHub3+598e

BUCKET_ID:  X64_0x19_20_EtronHub3+598e

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\hoshin\Seven Forums\102411-28969-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03400000 PsLoadedModuleList = 0xfffff800`03645670
Debug session time: Mon Oct 24 14:08:20.958 2011 (UTC - 6:00)
System Uptime: 6 days 6:02:52.175
Loading Kernel Symbols
...............................................................
................................................................
.........................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa8c0ba64080, 2, 0, fffff88009e1551e}

Unable to load image \SystemRoot\System32\Drivers\EtronXHCI.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for EtronXHCI.sys
*** ERROR: Module load completed but symbols could not be loaded for EtronXHCI.sys
Probably caused by : EtronXHCI.sys ( EtronXHCI+451e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa8c0ba64080, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88009e1551e, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036af100
 fffffa8c0ba64080 

CURRENT_IRQL:  2

FAULTING_IP: 
EtronXHCI+451e
fffff880`09e1551e 418b8c818c000000 mov     ecx,dword ptr [r9+rax*4+8Ch]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  audiorepeater_

TRAP_FRAME:  fffff8800b271d10 -- (.trap 0xfffff8800b271d10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000002fffffffd rbx=0000000000000000 rcx=0000000000000024
rdx=00000000000000b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88009e1551e rsp=fffff8800b271ea0 rbp=fffffa80071a6940
 r8=0000000000000000  r9=fffffa800ba64000 r10=0000000000000000
r11=00000000000000b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
EtronXHCI+0x451e:
fffff880`09e1551e 418b8c818c000000 mov     ecx,dword ptr [r9+rax*4+8Ch] ds:5180:fffffa8c`0ba64080=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000347c1e9 to fffff8000347cc40

STACK_TEXT:  
fffff880`0b271bc8 fffff800`0347c1e9 : 00000000`0000000a fffffa8c`0ba64080 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0b271bd0 fffff800`0347ae60 : fffffa80`0923eb60 00000000`00000000 fffff880`0b271db0 fffffa80`071a6940 : nt!KiBugCheckDispatch+0x69
fffff880`0b271d10 fffff880`09e1551e : fffffa80`12948d30 fffffa80`12948d30 00000000`00000000 fffff800`03497c4b : nt!KiPageFault+0x260
fffff880`0b271ea0 fffffa80`12948d30 : fffffa80`12948d30 00000000`00000000 fffff800`03497c4b 00000000`00000000 : EtronXHCI+0x451e
fffff880`0b271ea8 fffffa80`12948d30 : 00000000`00000000 fffff800`03497c4b 00000000`00000000 fffffa80`128a4010 : 0xfffffa80`12948d30
fffff880`0b271eb0 00000000`00000000 : fffff800`03497c4b 00000000`00000000 fffffa80`128a4010 00000000`00000000 : 0xfffffa80`12948d30


STACK_COMMAND:  kb

FOLLOWUP_IP: 
EtronXHCI+451e
fffff880`09e1551e 418b8c818c000000 mov     ecx,dword ptr [r9+rax*4+8Ch]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  EtronXHCI+451e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: EtronXHCI

IMAGE_NAME:  EtronXHCI.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d433943

FAILURE_BUCKET_ID:  X64_0xD1_EtronXHCI+451e

BUCKET_ID:  X64_0xD1_EtronXHCI+451e

Followup: MachineOwner
---------

1. A windows system process was terminated unexpectedly. Possible causes are hard disk errors... System file corruption... Viruses... Lack of Windows updates... Drivers...
2. Caused by your Etron USB 3.0 Extensible Hub Driver. What USB devices do you have plugged in?
3. Caused by your Etron USB 3.0 Extensible Host Controller Driver. Same question as in 2.

Thanks to Dave76 for help understanding possible causes.



We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
  
  
• Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
  
  
• Scan for viruses with a full scan using the free version (do not start the trial) of Malwarebytes : Free anti-malware, anti-virus and spyware removal download and see the Good and Free system security combination. for better security steps and scanning tools.
  
  
• Install all Windows Updates.
  
  
• Start with USB Driver - General Fix for Problems to resolve the USB issues. Also, USB ports can sometimes enter a safe power state to protect the system from power surges due to USB devices. To reset the USB ports to a nominal power state, use a hard reset to resolve hardware and software issues which works for all computers, not just HP Pavilions (minus the HP driver update step).
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

Thank you so much for your help. I apologize for taking so long to get back to you here; between class, this BSOD and my in-laws in town, things are crazier than normal.

So here's an update:
Everything is running at stock, so I'm not overclocking.
I checked the drivers mentioned and they're all up to date. I saw something that was iTunes related (GEARAspiWDM.sys) so I temporarily uninstalled that as well as the EVGA Precision Utility.

I ran chkdsk /f and everything checked out okay.
I ran SFC /SCANNOW three times (rebooting in between each run) and I got "Windows Resource Protection did not find any integrity violations"
Windows Update has everything completely up to date including definitions for MS Security Essentials. Scans didn't reveal any threats.

I ran SUPERAntiSpyware and Anti-Malware. Everything checked out okay except for some tracking cookies and I took care of those.

The interesting part came with the suggestion of the USB drivers. I found a thread here that solved an issue by updating those Entron USB 3.0 drivers. I did that, rebooted, and I'm basically waiting with my fingers crossed and hope that took care of it. I think the Windows sound of a USB device disconnection was a helpful hint.

As for devices connected, I have my mouse, keyboard, and Logitech G930 headset receiver connected via USB and nothing is on any of my USB 3.0 ports. If the problem persists, my next step will be to run Driver Verifier.

Spotify just stopped playing music on me which is a good indication that I'm about to see my favorite screen. I just hit "post reply" so that I didn't lose anything. Windows doesn't seem to be locked up but I just heard the USB disconnection sound and I'm just waiting to see what happens. Windows Explorer actually just disappeared on me now.

Hey there,

Well, I've been getting more crashes unfortunately. I've got a few pieces of information that can hopefully help pinpoint the issue.

In class the other day, it turned out that a couple of the other guys were getting BSOD on their PCs as well and seemingly out of nowhere (one of them was getting a driver crash, nvlddmkm.sys). We finally determined that the only thing we really had in common was Nvidia cards. One of the guys was able to resolve his issue by underclocking his card a bit. In desperation I tried to underclock but it didn't help so I'm back at stock (as you can see from my logs, nvlddmkm.sys did cause issues for me a few times).

A few more pieces of interesting info:
Sometimes between BSODs/Windows Explorer crashes, my main drive (the SSD) was not detected in BIOS at all. Sometimes it would happen and sometimes it wouldn't. Rebooting a few times seemed to help get it recognized. I have two hard drives running on SATA3 (the SSD and my Samsung 1TB) and I've got my DVD drive and another hard drive (WD 1TB) on the SATA2.

Suspecting the SATA ports on my motherboard, I moved the SATA3 connections to the other ports (there are a total of four SATA3's on my motherboard) and that didn't make any difference regarding stability of the system, but one time when I booted and checked the BIOS, the SSD and Samsung 1TB (both on SATA3 ports) were undetected. I finally moved everything to SATA2 (so now I've got all four SATA ports filled and nothing on SATA3). I'm still experiencing BSODs.

I've got a few suspects:
-The motherboard (because of the issues with not detecting the the drives randomly).

-The SSD (I've run HDDScan but nothing looked out of the ordinary except for the speeds I was getting while running scans the first time on SATA3, which seemed to be the same speeds I receive while it's on SATA2; those logs are attached). Other than HDDScan, I'm not sure whether there are any better drive scanning tools or if I'm not running the correct tests to determine the health of the drive. I think the latter is the case.

I've got the latest Marvell drivers installed as well as the latest Etron USB 3.0 drivers. There was an Nvidia driver update yesterday and I grabbed that too. I'm really confused because the best conclusions I can make by examining the dump files is that it's primarily a driver issue, and that the driver causing the errors seems to be different. So is it possible that I have a bunch of corrupt drivers, or is Windows reporting the wrong root of the issue?

Attached are updated logs and the scans from HDDScan.

No new .dmp files generated... Thank you for the information and steps. Those may be helpful at some point. I am concerned that your drive is not always being detected. That suggests either bad cables, bad motherboard, or the BIOS version. Have you tried clearing the CMOS and resetting BIOS hardware/software connections?
How To Clear CMOS (Reset BIOS)
Use hard reset to resolve hardware and software issues (works for all computers, not just HP Pavilions, minus the HP drivers/updates step).

Oh weird... I'll have to make sure that the newer dump files are being included. I haven't done anything with the CMOS, but I'll do that right now and report back with my findings soon. Thanks again for you help; I really appreciate it. :)

You're very welcome. Let us know how the resets go. Also, make sure you do both resets (there are two links in my previous post, not just one; sometimes it is easy to miss this) :)

Okay so it's with great hesitation that I type this. I cleared the CMOS, did a hard reset, updated the BIOS, and I was still getting BSODs. So I decided to upgrade the firmware of my SSD and I'm happy (albeit cautiously) to report I've been about crash-free for about 12 hours now. This is the longest uptime I've had since the trouble began!

I'm going to let it play out for a few more days before I mark this as solved if that's okay. I want to thank you so much for your assistance! :)