I have been getting random BSOD's

Zoidbort · 21 Nov 2012

So over the past 3 weeks I have been getting random BSOD's and at first my SABNDZB was having issues so I uninstalled it and all seemed stable but suddenly 3 days ago I started getting BSOD's again.
No issues for hours in Safe Mode (points to me that it is a driver more so than hardware but) but when in standard boot it seems to go to a BSOD at random times within 1-2 hours of boot up.
After enabling all the goodies and running verifier it posted, upon boot up, an error in the hidclass.sys file.
Now that seems generic after reading here so I have attached the zip for a peek.
Cheers in advance for the help!

Zoidbort · 21 Nov 2012

Sorry Mods for posting in a similar previous post.
Thanks for putting it into my own thread.

Arc · 21 Nov 2012

Dump Files - Configure Windows to Create on BSOD

Follow it manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump.

We need to see the crahsdumps.

Anyway, hidclass is USB related.

For the port, first, uninstall and reinstall the USB ports drivers.

Right click on Computer icon > manage. It will open the computer management window.
Click on "Device Manager" in the left pane, it will list all installed devices up.
Expand "USB Serial Bus Controllers" by clicking on the triangle in front of it.
Click on one item to select, then right click and uninstall.
Do the same for all.
Restart the computer.
At restart, windows will auto configure the appropriate drivers.

And, Disable USB Selective Suspense too.
USB Selective Suspend - Turn On or Off

For the devices, first, detach all the USB devices other than the keyboard and mouse.
Then, Update the drivers for them all, including the keyboard and mouse, if any third party drivers are installed for them.

Zoidbort · 21 Nov 2012

Woke up this morn and did the USB removal...no BSOD all day while I was at work.
I had my CCleaner clean out dump files so I haven't any to upload but I will as soon as a new BSOD appears.
Cheers for the reply and help mate!

Zoidbort · 22 Nov 2012

Well that was a nice 20 hours of peace but it came back overnight.
This time a new error...boot.ini issue from a little reading I did.
Will run a chkdsk /r now.
Dump included.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\Windows\Minidump\112212-13837-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0364a000 PsLoadedModuleList = 0xfffff800`0388e670
Debug session time: Thu Nov 22 05:02:33.559 2012 (UTC - 8:00)
System Uptime: 0 days 22:26:24.026
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa00036cbe7a, 2, 8, fffffa00036cbe7a}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7efc0 )

Followup: MachineOwner
---------

Arc · 22 Nov 2012

I have to analyze the dump myself, in my own way ..... to suggest anything.

Zoidbort · 22 Nov 2012

Cool, thanks very much for the help.
Check Disk was running when I left for work.

Zoidbort · 24 Nov 2012

Got another one...all was well for the past 35 hours or so...PC was asleep.
Memory Management

Code:

Loading Dump File [H:\Windows\Minidump\112412-18142-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0360b000 PsLoadedModuleList = 0xfffff800`0384f670
Debug session time: Fri Nov 23 23:00:30.784 2012 (UTC - 8:00)
System Uptime: 1 days 16:06:03.877
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8008dfbe80, ffff, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff8000360b000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800036f5b50 to fffff80003689fc0

STACK_TEXT:  
fffff880`0bd658d8 fffff800`036f5b50 : 00000000`0000001a 00000000`00041790 fffffa80`08dfbe80 00000000`0000ffff : nt+0x7efc0
fffff880`0bd658e0 00000000`0000001a : 00000000`00041790 fffffa80`08dfbe80 00000000`0000ffff 00000000`00000000 : nt+0xeab50
fffff880`0bd658e8 00000000`00041790 : fffffa80`08dfbe80 00000000`0000ffff 00000000`00000000 fffff800`037882c1 : 0x1a
fffff880`0bd658f0 fffffa80`08dfbe80 : 00000000`0000ffff 00000000`00000000 fffff800`037882c1 fffffa80`14aec2b0 : 0x41790
fffff880`0bd658f8 00000000`0000ffff : 00000000`00000000 fffff800`037882c1 fffffa80`14aec2b0 00000000`00000000 : 0xfffffa80`08dfbe80
fffff880`0bd65900 00000000`00000000 : fffff800`037882c1 fffffa80`14aec2b0 00000000`00000000 fffff680`003ffef8 : 0xffff


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+7efc0
fffff800`03689fc0 48894c2408      mov     qword ptr [rsp+8],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+7efc0

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner

Arc · 24 Nov 2012

If you dont supply the dump, how can I see it? I told you that I want to analyze it at my own to infer anything.

Blue Screen of Death (BSOD) Posting Instructions

Zoidbort · 24 Nov 2012

Ah sorry, dmp file zipped and added.