Random BSOD then restart, believe it to be hardware but unsure

thezman007 · 13 Nov 2012

Hi everyone, and THANK YOU just for having these forums, let alone for helping me with this issue.

Let me start from the beginning. I was running XP on my old box. It was too slow, so I bought a new mobo, cpu, and memory. Oh, and a SATA optical drive since the new mobo wouldn't take an IDE. I downloaded a clean copy of Win7 Pro from Digital River, and installed on my hard drive. Then activated it with a key I purchased.

There seems to be no rhyme or reason to when the BSOD hits. Browsing the Internet, not browsing. Streaming music, not streaming music. Usually it's just sitting there. I am not even using it.

Things I have done:

Memtest - Checks clean
Chkdsk - Checks clean
Restore to earlier time - no effect
Updated the BIOS - no effect

I am hoping that the SWEET SFtool will help you guys help me.

koolkat77 · 14 Nov 2012

Welcome to SevenForums,

What antivirus are you using?

STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION
Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

Code:

1. *******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89b941859, b3b7465eee10e7af, fffff80002f5b0f0, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89b941859, Reserved
Arg2: b3b7465eee10e7af, Reserved
Arg3: fffff80002f5b0f0, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
nt!PspExitThread+0
fffff800`02f5b0f0 894c2408        mov     dword ptr [rsp+8],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0316a498 00000000`00000000 : 00000000`00000109 a3a039d8`9b941859 b3b7465e`ee10e7af fffff800`02f5b0f0 : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002f5b26c - nt!PspExitThread+17c
	[ ee:ce ]
1 error : !nt (fffff80002f5b26c)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

2. *******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89b87f546, b3b7465eee04c4ac, fffff80003047130, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89b87f546, Reserved
Arg2: b3b7465eee04c4ac, Reserved
Arg3: fffff80003047130, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
nt!PfSnLogPrefetchSectionsStop+0
fffff800`03047130 4885c9          test    rcx,rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0317f498 00000000`00000000 : 00000000`00000109 a3a039d8`9b87f546 b3b7465e`ee04c4ac fffff800`03047130 : nt!KeBugCheckEx


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff8000304726c - nt!PfSnLogPrefetchSectionsStop+13c
	[ 24:04 ]
1 error : !nt (fffff8000304726c)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

3. *******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d898cf6521, b3b7465eeb4c3477, fffff80002fcabc8, 1}

Probably caused by : ntkrnlmp.exe ( nt!PspAllocateThread+0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d898cf6521, Reserved
Arg2: b3b7465eeb4c3477, Reserved
Arg3: fffff80002fcabc8, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


FAULTING_IP: 
nt!PspAllocateThread+0
fffff800`02fcabc8 488bc4          mov     rax,rsp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x109

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`03194498 00000000`00000000 : 00000000`00000109 a3a039d8`98cf6521 b3b7465e`eb4c3477 fffff800`02fcabc8 : nt!KeBugCheckEx


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PspAllocateThread+0
fffff800`02fcabc8 488bc4          mov     rax,rsp

SYMBOL_NAME:  nt!PspAllocateThread+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x109_1_nt!PspAllocateThread+0

BUCKET_ID:  X64_0x109_1_nt!PspAllocateThread+0

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.
Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.
If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.
If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.
If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.
3. Test the next stick of RAM (stick #2) in the next motherboard slot.
If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.
If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.
4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

STOP 0x000000F7: DRIVER_OVERRAN_STACK_BUFFER
Usual causes: Device driver, Malware

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F7, {20000d3f4c8, f8800176802a, ffff077ffe897fd5, 0}

Probably caused by : tcpip.sys ( tcpip!_report_gsfailure+26 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 0000020000d3f4c8, Actual security check cookie from the stack
Arg2: 0000f8800176802a, Expected security check cookie
Arg3: ffff077ffe897fd5, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  GS_FALSE_POSITIVE_MISSING_GSFRAME

SECURITY_COOKIE:  Expected 0000f8800176802a found 0000020000d3f4c8

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0xF7

PROCESS_NAME:  HPNetworkCommu

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88001688fb2 to fffff80002cd7fc0

STACK_TEXT:  
fffff880`075d0630 fffff880`01688fb2 : 00000000`000000f7 00000200`00d3f4c8 0000f880`0176802a ffff077f`fe897fd5 : nt!KeBugCheckEx
fffff880`075d0638 fffff880`0167708f : fffffa80`07fc17f0 fffff880`075d0778 00000000`00000000 fffffa80`077be010 : tcpip!_report_gsfailure+0x26
fffff880`075d0678 fffffa80`07690010 : fffff880`016770c9 fffffa80`082389f0 00000000`00000000 00000000`00000000 : tcpip!TcpCloseEndpoint+0x9f
fffff880`075d06e8 fffff880`016770c9 : fffffa80`082389f0 00000000`00000000 00000000`00000000 fffffa80`07690110 : 0xfffffa80`07690010
fffff880`075d06f0 fffff880`0405ea30 : 00000000`00000000 00000000`ffffffff 00000000`00000000 fffffa80`07690110 : tcpip!TcpTlEndpointCloseEndpoint+0x9
fffff880`075d0720 fffff880`0405eef2 : 00000000`00000000 fffffa80`078a3740 fffffa80`07690010 fffff800`02cec056 : afd!AfdCleanupCore+0x410
fffff880`075d08a0 fffff800`02fdb5ef : fffffa80`07899870 fffffa80`06f27060 00000000`00000000 fffffa80`078a3740 : afd!AfdDispatch+0x42
fffff880`075d08f0 fffff800`02fcad14 : 00000000`00000000 fffffa80`06f27060 fffffa80`06f98570 00000000`002e002c : nt!IopCloseFile+0x11f
fffff880`075d0980 fffff800`02fcaad1 : fffffa80`06f27060 fffffa80`00000001 fffff8a0`025723e0 00000000`00000002 : nt!ObpDecrementHandleCount+0xb4
fffff880`075d0a00 fffff800`02fcb094 : 00000000`00001bdc fffffa80`06f27060 fffff8a0`025723e0 00000000`00001bdc : nt!ObpCloseHandleTableEntry+0xb1
fffff880`075d0a90 fffff800`02cd7253 : fffffa80`06fe0060 fffff880`075d0b60 00000000`00000000 fffffa80`06c26fc0 : nt!ObpCloseHandle+0x94
fffff880`075d0ae0 00000000`7759140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001eeff8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7759140a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tcpip!_report_gsfailure+26
fffff880`01688fb2 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  tcpip!_report_gsfailure+26

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5034f727

FAILURE_BUCKET_ID:  X64_0xF7_MISSING_GSFRAME_tcpip!_report_gsfailure+26

BUCKET_ID:  X64_0xF7_MISSING_GSFRAME_tcpip!_report_gsfailure+26

Followup: MachineOwner
---------

2: kd> !thread
GetPointerFromAddress: unable to read from fffff80002f07000
THREAD fffffa8006fe0060  Cid 04e0.0afc  Teb: 000007fffffde000 Win32Thread: fffff900c1ebe010 RUNNING on processor 2
IRP List:
    Unable to read nt!_IRP @ fffffa8007899870
Not impersonating
GetUlongFromAddress: unable to read from fffff80002e46ba4
Owning Process            fffffa8006f27060       Image:         HPNetworkCommu
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      873101       
Context Switch Count      32253          IdealProcessor: 0                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000000013fbfcae0
Stack Init fffff880075d0c70 Current fffff880075cfe80
Base fffff880075d1000 Limit fffff880075c9000 Call 0
Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`075d0630 fffff880`01688fb2 : 00000000`000000f7 00000200`00d3f4c8 0000f880`0176802a ffff077f`fe897fd5 : nt!KeBugCheckEx
fffff880`075d0638 fffff880`0167708f : fffffa80`07fc17f0 fffff880`075d0778 00000000`00000000 fffffa80`077be010 : tcpip!_report_gsfailure+0x26
fffff880`075d0678 fffffa80`07690010 : fffff880`016770c9 fffffa80`082389f0 00000000`00000000 00000000`00000000 : tcpip!TcpCloseEndpoint+0x9f
fffff880`075d06e8 fffff880`016770c9 : fffffa80`082389f0 00000000`00000000 00000000`00000000 fffffa80`07690110 : 0xfffffa80`07690010
fffff880`075d06f0 fffff880`0405ea30 : 00000000`00000000 00000000`ffffffff 00000000`00000000 fffffa80`07690110 : tcpip!TcpTlEndpointCloseEndpoint+0x9
fffff880`075d0720 fffff880`0405eef2 : 00000000`00000000 fffffa80`078a3740 fffffa80`07690010 fffff800`02cec056 : afd!AfdCleanupCore+0x410
fffff880`075d08a0 fffff800`02fdb5ef : fffffa80`07899870 fffffa80`06f27060 00000000`00000000 fffffa80`078a3740 : afd!AfdDispatch+0x42
fffff880`075d08f0 fffff800`02fcad14 : 00000000`00000000 fffffa80`06f27060 fffffa80`06f98570 00000000`002e002c : nt!IopCloseFile+0x11f
fffff880`075d0980 fffff800`02fcaad1 : fffffa80`06f27060 fffffa80`00000001 fffff8a0`025723e0 00000000`00000002 : nt!ObpDecrementHandleCount+0xb4
fffff880`075d0a00 fffff800`02fcb094 : 00000000`00001bdc fffffa80`06f27060 fffff8a0`025723e0 00000000`00001bdc : nt!ObpCloseHandleTableEntry+0xb1
fffff880`075d0a90 fffff800`02cd7253 : fffffa80`06fe0060 fffff880`075d0b60 00000000`00000000 fffffa80`06c26fc0 : nt!ObpCloseHandle+0x94
fffff880`075d0ae0 00000000`7759140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`075d0ae0)
00000000`001eeff8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7759140a

Run this tool and delete anything it finds:

Anti-rootkit utility TDSSKiller

ESET online scanner:

Free Online Virus Scanner | ESET

Recommended antivirus program for Windows 7 based on stability compared to others:-

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Let us know the results.

thezman007 · 14 Nov 2012

I am using Malwarebyte's AnitMalware Pro. Purchased and paid for. No piracy here :)

thezman007 · 14 Nov 2012

Ok, so TDSSkiller found nothing. ESET found a couple of files that were saved on a cloud drive from "hacking" my Android tablet or phone, I don't remember which. Will run Memtest overnight and post results tomorrow. Attached ESET file. Thanks koolkat77

koolkat77 · 14 Nov 2012

Thanks for the update.
Let us know how it went.

thezman007 · 15 Nov 2012

Good morning guys... I had each 4 GB stick in the "preferred" slots according to Gigabyte's mobo manual. 8 passes with Memtest found 0 errors. Of course it hasn't blue screened since I got on these forums. Maybe we have it scared :) I was having a thought though. There are reports of issues with the sound on this mobo, which I have. Crackly, snappy, etc. In the past couple weeks I tried a few times unsuccessfully to change the driver to an older one reported to work better, while Windows told me it knew best. Could that be the issue? And, more importantly how would I fix it? Install the driver manually?

Thanks

thezman007 · 15 Nov 2012

Ok, so I typed the words about it NOT blue screening, and it BSOD'd about 90 seconds later

I think HAL is watching me... Anyways, here are the SFtool's findings. Just wondering if anything has changed or not. Thanks

Vir Gnarus · 15 Nov 2012

Given the type of memory corruptions we're dealing with here, I'm afraid we may be running into the dread Trio of Trouble, aka CPU/PSU/Mobo failure. Such hardware is very difficult or nearly impossible to diagnose, especially since they don't really have any testing procedure at all outside of hardware swapping. The CPU is your best bet to start with, using Prime95 on Torture Test. Do a first 7+ hour run on Blend settings. Regardless if that run crashes or errors, follow up with another 7+ hour run but on Large FFT settings.

If the Blend run bugs out but the Large FFT doesn't, there's an issue with your CPU/RAM crosstalk, meaning most likely the Mobo/PSU is bad. If Blend is good but Large FFTs are bad, it's an internal CPU issue (primarily a cache problem). If both are bad OR they both end up good, then we may still very well be dealing with either of them having a problem that Prime95 cannot discover.

Britton30 · 15 Nov 2012

If you have obtained an older audio driver, in Device manager open the Sound Video and Game Controllers. For each Audio item, double click it, go to the Driver tab and choose Uninstall and check Delete driver.
After wards install the older driver you have.

thezman007 · 16 Nov 2012

Well a Prime95 torture test certainly took its toll. I don't know when the computer rebooted because it was run overnight. The problem being of course, did prime95 cause the reboot or the pre-existing problem? I came back to the login screen...How can I find out what happened? I don't see any event logs or anything with the prime95 application. I have run the SF tool again for you guys to peruse...