After two returns for factory repairs due to a high dpc latency problem, which involved several hardware fixes and a complete system reinstall, I find that the BSOD problem is recurring, although at a much longer interval (10 days). It has never happened when I have been working on the computer, only when it is idle.
Can you turn on Driver Verifier and let it produce more crashes, then send us the resulting crashdumps? Thanks.
- Isaac
Turning on the driver verifier resulted in no bsod's. I am uploading the most recent dumps.
One problem that did occur: the diagnostic tool kept hanging with an "unhandled exception." I had to run it several times to get a complete set of logs. Here is the error message:
See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.
************** Exception Text **************
System.IO.IOException: The process cannot access the file 'C:\windows\EventSys.txt' because it is being used by another process.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.Delete(String path)
at Microsoft.VisualBasic.FileIO.FileSystem.DeleteFileInternal(String file, UIOptionInternal showUI, RecycleOption recycle, UICancelOption onUserCancel)
at Microsoft.VisualBasic.MyServices.FileSystemProxy.DeleteFile(String file)
at WindowsApplication2.Form1.Button1_Click(Object sender, EventArgs e)
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
************** Loaded Assemblies **************
mscorlib
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5466 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
----------------------------------------
SF Diagnostic Tool
Assembly Version: 1.0.0.0
Win32 Version: 5.0.0.3
CodeBase: file:///C:/Users/samsung/Documents/Computer/SF_Diagnostic_Tool.exe
----------------------------------------
Microsoft.VisualBasic
Assembly Version: 8.0.0.0
Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
----------------------------------------
System
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Runtime.Remoting
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------
************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.
For example:
<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>
When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.
Leave Driver Verifier on until you happen to experience a BSOD. If for some reason your system stabilizes with DV enabled, then you'll have to turn it off.
Driver Verifier has produced no bsod's since I started it yesterday. I have turned it off.
I noticed from the EventApp.txt that I uploaded yesterday that there is a repeated error: "Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{17390d74-3f34-11e2-92ee-c485081f3884}\." I have checked the administrator permissions and everything seems in order. Could that be the problem?
The system crashed again this morning. I am attaching the dumps. I ran the driver verifier over the week-end, as I indicated in the previous post, without effect, so I turned it off. I am turning it back on.
These bsod's never occur when I am at the computer--only when the system is idle and the screen on standby. I don't know if that is relevant.
In a good majority of your crashdumps, the pattern I find is it involves drawing window elements (buttons, window frame, etc.) through the win32k window manager. They are also responsible for handling input devices like keyboard and mouse. This correlates with another crash (0x1A) that - while not showing involvement with win32k - did come up with the running process as the Synaptic touchpad process. If you haven't already, try the following:
- Update BIOS
- Update graphics & input device drivers and software, especially the touchpad drivers.
- Uninstall the Synaptic touchpad drivers/software if previous options don't fix symptoms. Make sure a mouse is available in case touchpad stops working (shouldn't).
- Uninstall all software that came pre-installed with the system (bloatware). Better yet, if you have a copy of a clean version of Windows (non-OEM version), install that.
I really can't discern beyond these what's going on. They are simple minidumps, and without Driver Verifier doing the BSODs they are only showing the aftermath of a problem that has occurred in the past, not the actual problem. The only hint I see is that a symbolic link object has gone missing, but without a kernel dump (MEMORY.DMP in Windows directory) I can't dive further, and even then I'm not 100% guaranteed that I will find the answers I'll seek because the system is crashing too late. I will say, though, that often times when I've had people struggling with similar issues with their touchpad, it's because of an internal hardware failure of either the keyboard/touchpad area or the motherboard itself (motherboard most often likely). I'm not sure what parts Samsung or whoever your OEM is said they fixed, but it's best to ask them for a complete, 100% system replacement next time because previous sendovers have not fixed the problem.
I will try to work with you as much as I can, but without solid data on this I - and others here at SF - can only go so far. The rest is just grasping at straws.
Analysts:
Crashdumps for 0x3B crashes are very consistent, dealing with the win32k kernel-mode subsystem driver attempting to perform window managing for dwm.exe (desktop window manager). c0000034 (object name not found) error is discovered in all of them, and usually resides during an attempt to locate a symbolic link object, perhaps pointing to some window object or something, can't tell from minidumps. I do see an IPI request in the raw stack, which means some of the work has been transferred over to another logical processor, but without a kernel dump one can't see any running thread but the crashing one. Though despite this lack of info, win32k also governs human input through input devices and translates it to activity on the desktop, so that makes me curious about the 0x1A crash that showed Synaptic touchpad process as running at the time.
Code:3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff96000311bd7, Address of the instruction which caused the bugcheck Arg3: fffff8800af6fea0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2 EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!SFMLOGICALSURFACE::SetShape+157 fffff960`00311bd7 488b5508 mov rdx,qword ptr [rbp+8] CONTEXT: fffff8800af6fea0 -- (.cxr 0xfffff8800af6fea0) rax=fffff8800af708c8 rbx=0000000000000000 rcx=fffff900c1ff7d40 rdx=fffff900c00c0010 rsi=0000000000000000 rdi=fffff900c1ff7d40 rip=fffff96000311bd7 rsp=fffff8800af70880 rbp=0000000000000018 r8=000000000212ff6b r9=000000000000ff6c r10=000000000002fe44 r11=fffff8800af708b0 r12=0000000000000001 r13=fffff900c00c0010 r14=fffff900c00c0010 r15=8000000000001000 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 win32k!SFMLOGICALSURFACE::SetShape+0x157: fffff960`00311bd7 488b5508 mov rdx,qword ptr [rbp+8] ss:0018:00000000`00000020=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: dwm.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff96000311bd7 STACK_TEXT: fffff880`0af70880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SFMLOGICALSURFACE::SetShape+0x157 FOLLOWUP_IP: win32k!SFMLOGICALSURFACE::SetShape+157 fffff960`00311bd7 488b5508 mov rdx,qword ptr [rbp+8] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!SFMLOGICALSURFACE::SetShape+157 FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 50aeecc6 STACK_COMMAND: .cxr 0xfffff8800af6fea0 ; kb FAILURE_BUCKET_ID: X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157 BUCKET_ID: X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157 Followup: MachineOwner --------- 3: kd> !niemiro.rawstack dps fffff8800af6f000 fffff8800af705d0 fffff880`0af6f000 00000000`00000000 fffff880`0af6f008 00000000`00000000 fffff880`0af6f010 00000000`00000000 fffff880`0af6f018 00000000`00000000 fffff880`0af6f020 00000000`00000000 ... fffff880`0af6f840 00000000`00000000 fffff880`0af6f848 fffff880`0af6f870 fffff880`0af6f850 fffff800`02ee5e40 nt!KiSystemServiceHandler fffff880`0af6f858 fffff800`0302e638 nt!_imp_NtOpenSymbolicLinkObject+0x9130 fffff880`0af6f860 fffff880`0af6fd40 fffff880`0af6f868 00000000`00000000 fffff880`0af6f870 00000000`69634d00 fffff880`0af6f878 fffff8a0`023345d0 fffff880`0af6f880 fffff880`0af6f990 fffff880`0af6f888 fffffa80`05b45060 fffff880`0af6f890 fffff8a0`02ef7d10 fffff880`0af6f898 fffffa80`05b45060 fffff880`0af6f8a0 00001f80`00000010 fffff880`0af6f8a8 00000000`000f0010 fffff880`0af6f8b0 00010202`00180000 fffff880`0af6f8b8 00000000`00000002 fffff880`0af6f8c0 00000000`c0000034 fffff880`0af6f8c8 fffff880`0af6fe90 fffff880`0af6f8d0 fffff8a0`000103f0 fffff880`0af6f8d8 00000000`28386cf4 fffff880`0af6f8e0 fffff880`0af6fe58 fffff880`0af6f8e8 fffff800`031b2009 nt!CmpParseCacheLookup+0x21d fffff880`0af6f8f0 00000000`00000000 ... fffff880`0af6fb28 fffff900`c207b618 fffff880`0af6fb30 fffff900`c78c3030 fffff880`0af6fb38 fffff800`02e32552 hal!HalpRequestIpiSpecifyVector+0x41 fffff880`0af6fb40 00000001`00000018 fffff880`0af6fb48 00001558`0000007c fffff880`0af6fb50 00000017`00000000 fffff880`0af6fb58 00000212`000003b1 fffff880`0af6fb60 00000000`00000206 fffff880`0af6fb68 fffff800`02f05be3 nt!KiIpiSendRequest+0x2d3 fffff880`0af6fb70 fffff880`00000000 fffff880`0af6fb78 00000000`00000000
0x1A crash:
Code:3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000041287, The subtype of the bugcheck. Arg2: 0000000000000000 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2 BUGCHECK_STR: 0x1a_41287 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT PROCESS_NAME: SynTPHelper.ex CURRENT_IRQL: 0 TRAP_FRAME: fffff8800a8867f0 -- (.trap 0xfffff8800a8867f0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffff8a00232fb68 rdx=000000007fefaa23 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ee8e89 rsp=fffff8800a886980 rbp=fffff8800a886a00 r8=0000000000000000 r9=fffff8a00232fb60 r10=fffffa800956bca0 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!MmAccessFault+0x1c99: fffff800`02ee8e89 488b10 mov rdx,qword ptr [rax] ds:00000000`00000000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002e6ad2e to fffff80002edafc0 STACK_TEXT: fffff880`0a886688 fffff800`02e6ad2e : 00000000`0000001a 00000000`00041287 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx fffff880`0a886690 fffff800`02ed90ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x454b5 fffff880`0a8867f0 fffff800`02ee8e89 : 00000000`00000000 000007fe`faa2300c ffffffff`ffffffff fffff800`00000000 : nt!KiPageFault+0x16e fffff880`0a886980 fffff800`02ed90ee : 00000000`00000000 000007fe`faa2300c 00000000`76ff2501 000007fe`faa10000 : nt!MmAccessFault+0x1c99 fffff880`0a886ae0 00000000`76eedd9c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e 00000000`0012ede0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76eedd9c STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+454b5 fffff800`02e6ad2e cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+454b5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be FAILURE_BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454b5 BUCKET_ID: X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454b5 Followup: MachineOwner ---------
Thank you for all your efforts. I will try your suggestions and let you know if anything works.
I typically turn the touchpad off, since I use an external mouse. I have updated the mouse driver. Would it make sense to disable the Synaptic touchpad driver?
Try disabling it altogether, yes, as well as uninstall that Synaptic software. However, if there is indeed a problem with the touchpad, it often means there's an issue with the mobo.
The computer has run for a month now without a crash. I ininstalled the Synaptic software (but have not disabled the driver). I have also avoided leaving the computer idle for long periods--crashes seemed only to occur when the screen had blanked after a period of inactivity. Thanks again for your help. I'm going to tentatively mark this thread as "solved" (fingers crossed).
Quote