Bsod system_service_exception

kyris · 13 Mar 2013

Hi. I am working for a company that provides us with laptops with preinstalled versions of Windows (including their own software and automatic connections to corporate domain, etc). I was working with windows 7 (32-bit) with no problems until I bought an SSD (OCZ Vertex4 256 GB) and I had to install windows again. I installed windows 7 64-bit (with 8 GB ram) and I also partitioned the SSD so I could install anorther version of windows 7 (64-bit) for my own private use.

I've been having BSOD issues since the first day that I installed the OS on my SSD but ONLY on the partition that I use at work. Never on the "personal" partition. I remember when installing windows that there was some kind of error or delay and I had to interrupt it and restart the machine, and then continue with the installation. I'm thinking that something might have gone wrong during the installation but reinstalling (or formating) is not an option at the moment mainly because it will automatically format both partitions (that's how it works).

BSODs error is most of the times about SYSTEM_SERVICE_EXCEPTION (with a few other cases as well). I searched the web for solutions but I realised that this problem is not limited to one particular error but it could be several things. I am guessing that it might be a driver issue and not a hardware one since my personal partition is working like a charm. I also did memory tests using MemTest86+ with no errors. I updated my graphics card driver a few weeks ago and the problems stopped for a week or so but then they started again. I haven't noticed any specific behavior that causes these BSODs. It can happenat ANY time and this makes it even more annoying!!

I am attaching a .zip with dumps from the last 2 days (3 BSODs yesterday, 1 until this time today) and the rest of the files that you require in the instructions. If I remember correctly, the 3 out of 4 BSODs gave the error SYSTEM_SERVICE_EXCEPTION and the other 1 something to do with the Cache.

Any help would be greatly appreciated.

Kyriacos

Saurabh A · 13 Mar 2013

Hi kyris,

Please find below analysis of the crash dumps:

Code:

******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88004efe778, fffff88009961df0, 0}

Probably caused by : ksthunk.sys ( ksthunk!CKernelFilterDevice::DispatchIrp+70 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88004efe778, Address of the instruction which caused the bugcheck
Arg3: fffff88009961df0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Please try the folloing steps to see if they work:
- Remove 'Advanced PC Tweaker, CCleaner' & 'Trend Micro Office Scan Client' for troubleshooting purposes
- Install 'Microsoft Security Essentials'
- Run 'Chkdsk from Command Prompt' using the following tutorial: Disk Check

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff880042756b1, fffff88008a9fc20, 0}

*** WARNING: Unable to verify timestamp for stwrt64.sys
*** ERROR: Module load completed but symbols could not be loaded for stwrt64.sys
Probably caused by : ks.sys ( ks!KspEnableEvent+349 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880042756b1, Address of the instruction which caused the bugcheck
Arg3: fffff88008a9fc20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
ks!KspEnableEvent+349
fffff880`042756b1 4c3b10          cmp     r10,qword ptr [rax]

CONTEXT:  fffff88008a9fc20 -- (.cxr 0xfffff88008a9fc20)
rax=4349406741434967 rbx=fffffa800dc2a6f0 rcx=0000000000000001
rdx=0000000000000200 rsi=fffffa800e806c10 rdi=0000000000000001
rip=fffff880042756b1 rsp=fffff88008aa0600 rbp=fffffa800a0eb9b0
 r8=00000000ffffffff  r9=0000000000000028 r10=11d1fa2fe85e9698
r11=fffffa800dc2a6f0 r12=0000000000000000 r13=0000000000000000
r14=fffffa80094a44c0 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
ks!KspEnableEvent+0x349:
fffff880`042756b1 4c3b10          cmp     r10,qword ptr [rax] ds:002b:43494067`41434967=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  audiodg.exe

This crash, along with another one, points at 'stwrt64.sys' driver as the root cause. 'stwrt64.sys' relates to 'SigmaTel High Definition Audio Codec'.
Please try updating the 'Audio drivers' from here: Driver Details | Dell US

Another crash dump:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50853, fffff88001f8c6b8, fffff88001f8bf10, fffff80002fab147}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050853
Arg2: fffff88001f8c6b8
Arg3: fffff88001f8bf10
Arg4: fffff80002fab147

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88001f8c6b8 -- (.exr 0xfffff88001f8c6b8)
ExceptionAddress: fffff80002fab147 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88001f8bf10 -- (.cxr 0xfffff88001f8bf10)
rax=92639bd6f23eb91a rbx=fffff800030066e0 rcx=fffffa80094b44c0
rdx=0000000000000000 rsi=0000000000000003 rdi=0000000000000000
rip=fffff80002fab147 rsp=fffff88001f8c8f0 rbp=0000000000001000
 r8=0000000000000000  r9=fffff800030066e0 r10=fffff80003006588
r11=0000000000000002 r12=fffff80003006580 r13=0000000000000000
r14=0000000000000000 r15=000000006b576343
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`02fab147 48895808        mov     qword ptr [rax+8],rbx ds:002b:92639bd6`f23eb922=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ae100
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02fab147 48895808        mov     qword ptr [rax+8],rbx

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02fab147 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff80002ebb23f to fffff80002fab147

STACK_TEXT:  
fffff880`01f8c8f0 fffff800`02ebb23f : 00000000`00000000 00000000`00000000 fffff800`0301c280 fffffa80`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`01f8c9e0 fffff800`02ebabe9 : fffff880`00000000 fffffa80`00000000 00000000`00000068 fffffa80`0c0eb110 : nt!CcLazyWriteScan+0x2eb
fffff880`01f8cac0 fffff800`02e7eca9 : fffffa80`06a51be0 fffff800`0316fc01 fffff800`0307d8c0 fffffa80`00000002 : nt!CcWorkerThread+0x1f9
fffff880`01f8cb70 fffff800`0311634a : 00000000`00000000 fffffa80`06a31b50 00000000`00000080 fffffa80`06a023d0 : nt!ExpWorkerThread+0x111
fffff880`01f8cc00 fffff800`02e66946 : fffff880`031f3180 fffffa80`06a31b50 fffff880`031fdfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`01f8cc40 00000000`00000000 : fffff880`01f8d000 fffff880`01f87000 fffff880`01f8c8a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  50e79935

STACK_COMMAND:  .cxr 0xfffff88001f8bf10 ; kb

FAILURE_BUCKET_ID:  X64_0x34_nt!ExAllocatePoolWithTag+537

BUCKET_ID:  X64_0x34_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner

This crash points at 'ntkrnlmp.exe' driver (NT Kernel & System)

One possible cause of this bug check is disk corruption. Corruption in the file system or bad blocks (sectors) on the disk can induce this error. Corrupted drivers can also adversely affect the system's ability to read and write to the disk, thus causing the error.
Another possible cause is depletion of non paged pool memory. If the non paged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available non paged pool memory is very low, another kernel-mode driver requiring non paged pool memory can also trigger this error.

To resolve a disk corruption problem:
Try disabling any virus scanners, backup programs, or disk derangement tools that continually monitor the system (Have suggested that above)

Please try the folloing steps to see if they work:
- Remove 'Advanced PC Tweaker, CCleaner' & 'Trend Micro Office Scan Client' for troubleshooting purposes
- Install 'Microsoft Security Essentials'
- Run 'Chkdsk from Command Prompt' using the following tutorial: Disk Check

-Also install 'Windows Updates' and check results

You should also run hardware diagnostics. Please run 'Hardware Diagnostics' to check 'hardware functionality':
- Power off the notebook > Power it back on > Repeated tap 'F 12 key' at the 'Dell splash screen' > Highlight 'Diagnostics' > Tap 'Enter' > Capture and share 'errors' is any. (Alternatively, you may launch the diagnostics by 'powering on' the system with the 'function key' held down.

Hope this helps. Do reply with the findings; will take it forward from there.

kyris · 13 Mar 2013

Hi Saurabh A and thanks for your reply. Unfortunately there is a problem with the suggestions that you've made. As I explained, the version of the OS that is installed on this partition includes preinstalled software that I cannot uninstall. One of this is the antivirus (Trend Micro OfficeScan).

Advanced PC Tweaker is not installed on my pc (I may have downloaded and installed it but then removed it, if I remember correctly).

I installed CCCleaner when I was trying to find a solution for these BSODs, I used it once to clean the registry and never used it again.

I downloaded and installed the audio driver from the link you gave me. I then selected to restart windows for the changes to take effect and at that moment, the system gave a blue screen with the same error (i am attaching the .dmp from that time). I restarted, reinstalled the driver and rebooted successfully.

I haven't installed Microsoft Security Essentials since it will be in conflict with the antivirus (that I can't uninstall).

I did try to run checkdisk before with no errors but I will give it another go.

I can't manually check for windows updates as they are set to automatically update by the system administrator (which I don't have the password). However, I do have administrator privileges and can download updates manually and install them.

I don't have a Hardware Diagnostics option when booting (F12 is the Boot Options) and under Tools there is only a "Windows Memory Diagnostics".

I hope I am not limiting you to tell me "Please contact your system administrator" because I am sure he is going to tell me "Reinstall windows!" :)

Thanks,

Kyriacos

Saurabh A · 14 Mar 2013

Hi kyris,

Thank you for the reply.

Was not aware that you could not make changes to the notebook; apologies.

The 'Diagnsotics' I suggested are on the 'system board' and should be accessible; have also verified that the system is being used with the 'factory installed' motherboard.

Please try releasing the 'residual power' and try running the diagnostics again. Unplug the 'AC Adapter cable' > Remove the battery > Press & hold down the power button for 10 - 12 seconds > Plug the 'Battery & Adapter cable' back in > Start the notebook and repeatedly tap 'F12' key again at 'Dell Logo' to see if you can now access the 'Diagnostics' (Refer to the image below)

Code:

0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.6, DMIVersion 38, Size=3735]
BiosMajorRelease = 4
BiosMinorRelease = 6
BiosVendor = Dell Inc.
BiosVersion = A05
BiosReleaseDate = 11/30/2011
SystemManufacturer = Dell Inc.
SystemProductName = Latitude E5420
SystemVersion = 01
BaseBoardManufacturer = Dell Inc.
BaseBoardProduct = 0H5TG2
BaseBoardVersion = A03

Not sure, if your 'IT permits', you may update the 'BIOS version' (From A05 to A11):
Before flashing the BIOS please check the following:-
- Battery should have 10% or greater charge; Adapter should be connected; No external devices should be connected; All other programs should be closed and documents saved.
- Click Driver Details | Dell US to download BIOS file > Follow the on-screen instructions to complete installation.

A look at the system log files:

Code:

Event[20969]:
  Log Name: System
  Source: NETLOGON
  Date: 2013-03-12T12:49:37.000
  Event ID: 5719
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: WCYKA250107-Y2O.corp.ncr.com
  Description: 
This computer was not able to set up a secure session with a domain controller in domain CORP due to the following: 
There are currently no logon servers available to service the logon request. 
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.  

ADDITIONAL INFO 
If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.




Event[21090]:
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2013-03-12T12:51:10.000
  Event ID: 10016
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: WCYKA250107-Y2O.corp.ncr.com
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
{24FF4FDC-1D9F-4195-8C79-0DA39248FF48}
 and APPID 
{B292921D-AF50-400C-9B75-0C57A7F29BA1}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Either of these two errors are continuously leading to 'Blue screen errors'.
It appears to be an 'authentication problem' with your network. You may need to check this with your domain administrator.

'Source: Microsoft-Windows-DistributedCOM' points at 'machine-default permission settings' for the 'COM Server application'. The following 'Microsoft Fixit' may help: Event ID 10 is logged in the Application log after you install Service Pack 1 for Windows 7 or Windows Server 2008 R2

Other 'Application Errors' that were observed while the system crashed:

Code:

Event[12785]:
  Log Name: Application
  Source: SideBySide
  Date: 2013-03-12T13:37:33.000
  Event ID: 59
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: WCYKA250107-Y2O.corp.ncr.com
  Description: 
Activation context generation failed for "C:\Program Files (x86)\Sparx Systems\EA\SSInvoke.exe".Error in manifest or policy file "C:\Program Files (x86)\Sparx Systems\EA\SSInvoke.exe" on line 21. Invalid Xml syntax.


Event[12417]:
  Log Name: Application
  Source: SQLAgent$SQL1
  Date: 2013-03-12T08:49:31.000
  Event ID: 103
  Task: Service Control
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: WCYKA250107-Y2O.corp.ncr.com
  Description: 
SQLServerAgent could not be started (reason: Error creating a new session).

Points at a possible issue with 'SQLAgent'
You may also have a look at the following webpage; seems like many users have found this fix useful (reinstalling the 2008 Visual C++ redistributable from Microsoft): Event ID: 59 Source: SideBySide

You may also try the 'SFC Scannow' tool to check the integrity of 'Windows files'; may also repair files: SFC /SCANNOW Command - System File Checker

The inability to remove/install software in the system may be a hazard to troubleshooting. From the crash dump, it appears that the recommended 'software changes' would be necessary to isolate the root cause. Not sure, if we have too many options at our disposal.

Do attempt to run the 'Diagnostics'and run the 'sfc scannow' tool to see if we get something that is conclusive. Hope this helps.

kyris · 14 Mar 2013

Hi Saurabh. Thanks for replying. I tried chkdsk and scf /scannow with no errors. I upgraded the BIOS and applied the HOTFIX. I could not find Performance Log Users to give them permissions to those folders that are mentioned about the SQL Agent error.

I managed to run Diagnostics and it returned an error for the Hard Disk (which I remind you is an SSD):

Fail PSA V4208 Error 2000:0145. Hard Drive 0 - S/N OCz-....., self test did not complete.

I tried it twice and it gave the same error. I don't know if it might be because it's an SSD and not an HDD and the test perhaps is incompatible? I hope so! All the other tests passed successfully.

I still believe (from all I understand) that it's not a hardware issue since I only get BSODs on the one partition so a problem with my SSD or the BIOS shouldn't be the case.

I will try and contact the administrator for the network login errors. Anything else you think I should try?

Thanks a lot anyway.

kyris · 14 Mar 2013

Following my previous post, I searched the error code on the web and found that other users facing the same issue with SSDs contacted Dell Support and they were told that the specific diagnostic check was designed for HDDs and therefore it's normal to fail on SSDs..

Saurabh A · 14 Mar 2013

Hi kyris,

Thank you for the reply.

'Error 2000-0145' indicates that the 'Drive Self Test' could not complete. ePSA (Enhanced Pre-Boot System Assessment) also offers 'Thorough test' (advanced test) on 'custom components'. Please check if it lists 'SSD device' as an option for this test. If yes, you may specifically select 'SSD' and perform the test on it. If that option is not available, you may also want to temporarily use the 'original drive' for testing purposes.

it's not a hardware issue since I only get BSODs on the one partition so a problem with my SSD or the BIOS shouldn't be the case.

I agree with what you stated. It appears to be related to 'software'. However, 'hardware tests' usually eliminate the possibility of a hardware failure.

I shared the 'system errors' that have repeatedly surfaced at around the same time as the 'Blue screens'. With majority of them related to the 'network'; they may be responsible for the issues. 'Anti-virus' may also be causing the issue. Installing 'Windows Updates' may also help. Please check with the 'administrator' in regards to the 'network errors' and share results.