BSOD Keeps Happening Every Night.

Arc · 24 Oct 2012

Well, here is your crash report.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80cbc8dc98, 0, fffff80002c51b3b, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+27f )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80cbc8dc98, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002c51b3b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb1100
 fffffa80cbc8dc98 

FAULTING_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  minirosetta_gr

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ce3ecf0 -- (.trap 0xfffff8800ce3ecf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffffa80cbc8dc70
rdx=0000000003279009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c51b3b rsp=fffff8800ce3ee80 rbp=fffff7000108de80
 r8=fffffa8012ba6768  r9=0000000000000000 r10=0000000000000d9c
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiDeleteAddressesInWorkingSet+0x27f:
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h] ds:fffffa80`cbc8dc98=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c288af to fffff80002c81fc0

STACK_TEXT:  
fffff880`0ce3eb88 fffff800`02c288af : 00000000`00000050 fffffa80`cbc8dc98 00000000`00000000 fffff880`0ce3ecf0 : nt!KeBugCheckEx
fffff880`0ce3eb90 fffff800`02c800ee : 00000000`00000000 fffffa80`cbc8dc98 000f01ff`00020000 b3f00043`ed9ed867 : nt! ?? ::FNODOBFM::`string'+0x437c1
fffff880`0ce3ecf0 fffff800`02c51b3b : fffffa80`0cac50a8 fffff880`0ce3ef00 fffff880`0ce3f3b8 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0ce3ee80 fffff800`02c52c9e : fffffa80`12ba63d0 fffffa80`00000008 fffff880`00000d9c fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x27f
fffff880`0ce3f730 fffff800`02f5365a : fffff8a0`160af060 fffff880`0ce3fae0 00000000`00000000 fffffa80`139da060 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0ce3f780 fffff800`02f36b7d : 00000000`00000000 00000000`00000001 00000000`7efd8000 fffffa80`12b98b50 : nt!PspExitThread+0x56a
fffff880`0ce3f880 fffff800`02c74b3a : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`02c7d810 : nt!PsExitSpecialApc+0x1d
fffff880`0ce3f8b0 fffff800`02c74e80 : 00000000`00000246 fffff880`0ce3f930 fffff800`02f36af0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0ce3f930 fffff800`02c812f7 : 00000000`00000000 fffff800`02f666ac fffff880`0ce3fb60 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`0ce3fa70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+27f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

Followup: MachineOwner
---------

According to Carrona.org, STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

► For Memory,
RAM - Test with Memtest86+
Run it, for at least eight passes, preferably overnight.

► For Faulty sysem service.
SFC /SCANNOW Command - System File Checker

► For Antivirus,
Uninstall MSE.
How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item
Then reinstall it again, and all the updates.

► For Device Driver,
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

► For NTFS corruption,

Update your SSD,s firmware.
Re-seat the sata and power.
Run chkdsk /f/r, following the option two of the tutorial Disk Check
Seatool for dos: SeaTools | Seagate download
Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

► You may leave the BIOS alone, IMHO.

Code:

BIOS Version/Date    American Megatrends Inc. P1.30, 7/13/2012

Do these and let us know the results :)

IsLNdbOi · 24 Oct 2012

This is a new system build I did myself. After putting it together, the first thing I did even before installing Windows was to run Memtest 86+. I ran it for over 24 hours and it did not find any errors.

I haven't run chkdsk c:/f/r since I finished installing all of my software and I ran chkdsk on all three of my drives (C, D, and E). It didn't show any major issues. Just something about repairing a USN Journal. I still have to try SFC /Scannow.

My only antivirus is Microsoft Security Essentials and I just installed it a few days ago along with all of the latest updates for it through Windows Update.

My SSDs all have the latest firmware and I even ran HDDErase (their internal secure erase command) on each one of them before installing Windows.

I still have to try Driver Verifier.

IsLNdbOi · 24 Oct 2012

Oh, I also disabled the page file on C and created a static 2GB page file on a separate SSD (my E drive). Would that cause any issues?

centaur78 · 24 Oct 2012

Hi

Please use the SF diagnostic tool to post all the files in one shot.

Then use this to update your system profile..

IsLNdbOi · 25 Oct 2012

Ok, I've filled in my info. from the System Info. tool and have attached everything from the SF diagnostic tool.

Driver Verifier has also been running for around 24 hours now. Was something supposed to happen with that?

Vir Gnarus · 25 Oct 2012

First verify (punny) that Driver Verifier is indeed active. You can do this by either going to command line and typing verifier /query and it'll give list of drivers being verified and checks that are on. Or you can go back into Driver Verifier GUI as you did to set it up, but instead select the option "Display existing settings". If you do not see a list of drivers at least, then Driver Verifier is not on.

If you've determined DV is in fact on, keep it on. Use your computer normally, or if there's anything you know that will specifically BSOD your system, do that, and let it BSOD. Any crashes that occur should provide more accurate crashdumps when DV is active, which we can use to better ascertain cause.

Btw, I notice you don't have any dump files in the latest zip. It's preferred that you go to the C:/Windows/Minidump directory and stuff a zip file full of em and send it over. If you do not see any dump files at all, then you probably are using some system cleaner app like CCleaner. It is advised you do not use these applications in the future, especially since we are troubleshooting your BSODs right now and they love to prune diagnostic files like these crashdumps.

IsLNdbOi · 25 Oct 2012

Yes, it looks like Driver Verifier is active. I do use CCleaner. Didn't know that it erases the dump files. That's why there are no dump files in the IsLNdbOi.zip file?

Vir Gnarus · 25 Oct 2012

Correct. Let your system crash a couple more times with DV on and provide the crashdumps for those.

IsLNdbOi · 31 Oct 2012

Strange... Ever since I turned on Driver Verifier, I haven't had any BSODs. It's been on now for 5 days.

It has slowed my system down a little though. Takes longer for it to fully startup.

Vir Gnarus · 31 Oct 2012

That's typical, as drivers have to fulfill extra checks when doing stuff.

Try turning DV off and then test again in normal environment. If it destabilizes, then perhaps we're looking at what's called a race condition, where two threads are competing for some resource and while usually one happens to mess with something at the wrong time, having DV in place slowed it down enough to put it in check. That's just speculation though.