Windows 7: BSOD - Windows rebooted from bugcheck

PuterUser · 24 May 2014

Custom built PC under two months old. This is the 6th BSOD!

The maintenance report is as follows:

Description
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x0000000000041790, 0xfffffa8005fff850, 0x000000000000ffff, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052314-6318-01.

Arc · 24 May 2014

Hi PuterUser.

The crash dumps are not very specific about the probable causes. Though it gives a hint of memory corruption. It may be either a failure from the part of physical RAM, or any driver is passing bad information to the memory.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

Tip

If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
____________________________________

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8005fff850, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8005fff850
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80002ef3d50 to fffff80002e82bc0

STACK_TEXT:  
fffff880`0bfe5ff8 fffff800`02ef3d50 : 00000000`0000001a 00000000`00041790 fffffa80`05fff850 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0bfe6000 fffff800`02eb57d9 : 00000000`00000000 00000000`0b073fff 00000000`00000000 fffff8a0`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0bfe61c0 fffff800`0319c0f1 : fffffa80`13d03890 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0bfe62e0 fffff800`0319c4f3 : fffff880`00000000 00000000`0ac10000 fffffa80`00000001 fffff960`000d6300 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0bfe63a0 fffff800`02e81e53 : fffff900`c2552ef8 00000000`00000000 fffffa80`0d035240 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0bfe63f0 fffff800`02e7e410 : fffff960`000d73de 00000000`00000001 00000000`00000000 fffff900`c2c84cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0bfe6588 fffff960`000d73de : 00000000`00000001 00000000`00000000 fffff900`c2c84cc0 00000000`00000001 : nt!KiServiceLinkage
fffff880`0bfe6590 fffff960`000df6a9 : 00000000`00000000 fffff880`00000001 fffff900`c2c84cc0 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`0bfe66e0 fffff960`000d6c40 : 00000000`000017ac fffff880`0bfe6a00 fffff900`c2560ce0 fffff880`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`0bfe6740 fffff960`000d637f : 00000000`00000000 fffff880`0bfe6ae0 fffffa80`134e3060 00000000`00000000 : win32k!GdiProcessCallout+0x200
fffff880`0bfe67c0 fffff800`03157fc1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`134e3000 : win32k!W32pProcessCallout+0x6b
fffff880`0bfe67f0 fffff800`0313cb7d : 00000000`c0000005 00000000`c0000001 fffffa80`78457300 fffffa80`19755b50 : nt!PspExitThread+0x4d1
fffff880`0bfe68f0 fffff800`02e756fa : 00000000`00000100 fffffa80`134e3120 00000000`00000001 fffff800`02e787fd : nt!PsExitSpecialApc+0x1d
fffff880`0bfe6920 fffff800`02e75a40 : 00000000`00000246 fffff880`0bfe69a0 fffff800`0313caf0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0bfe69a0 fffff800`02e81ef7 : fffffa80`134e3060 00000000`00000264 00000000`00000000 fffffa80`13d1aa60 : nt!KiInitiateUserApc+0x70
fffff880`0bfe6ae0 00000000`75092e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0314ed48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75092e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3a2
fffff960`000d73de e9d6010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000d75b9)

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3a2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52f4357b

IMAGE_VERSION:  6.1.7601.18388

FAILURE_BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3a2

BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3a2

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1a_41790_win32k!surface::bdeletesurface+3a2

FAILURE_ID_HASH:  {ea9c0e2b-5706-e8a0-1810-55febb26c328}

Followup: MachineOwner
---------

PuterUser · 24 May 2014

Thanks Arc, especially for your quick reply. Will be back with the results soon.

PuterUser · 26 May 2014

Hi Arc,

I ran Memtest for 7 passes over 17 hours, no errors reported.

I have been trying to run the Driver Verifier with no success. Am able to input all the settings according to the instructions, but when I restart the PC it fails to open Windows 7 and goes into BSOD (Error message mentions Memory failure, code ...01c). I have tried twice with same result. Each time I had to reboot into Safemode then disable DV and reboot to get Windows to open normally.

Just wondering if there is some other way to get DV to work or should I try NOT selecting some of the non-Microsoft drivers and see how that goes?

I have noticed that sometimes the BSOD occurs when I am accessing internet through a wireless onboard modem (TP Link 450MBPS Wireless N adaptor which has two drivers (Microsoft and Atheros). Could this be the source of the dramas?

Cheers PuterUser

PuterUser · 26 May 2014

Have tried selecting non of the driver with DV and it still crashes W7, even with standard settings only.

Went to TP link site and downloaded latest driver, Justin Case...

Have not had BSOD since but usually it occurred about once a week.

Any other suggestions to stress the drivers currently installed or get DV working, without crashing on startup?

Arc · 26 May 2014

Disable Driver verifier in safemode.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

Click on the Start button
Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
Select the “Startup” tab.
Deselect all items other than the antivirus.
Apply > OK
Accept then restart.

Now enable driver verifier again. Does it work this time?

PuterUser · 26 May 2014

Thank you, yep, worked. Ok so I just use the PC as normal and hopefully it will wig out somewhere or after 24hours of continuous running then I generate the zipped crash report file and post again?

Arc · 26 May 2014

Post again whenever it crash, if it is within this 24 hours.

PuterUser · 29 May 2014

Hi Arc,

Just had another BSOD. Seems it is driver related, something to do with a Win7 driver fault (isctd64.sys).

Cheers PuterUser

Arc · 29 May 2014

Disable Driver verifier now. And then disable Intel Smart Connect.

Code:

BugCheck C9, {6, 103, fffff9807ec9adc0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\ISCTD64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ISCTD64.sys
*** ERROR: Module load completed but symbols could not be loaded for ISCTD64.sys
Probably caused by : ntkrnlmp.exe ( nt!IovCompleteRequest+c2 )

Followup: MachineOwner
---------