BSOD with no event viewer records, improper shutdowns involved

MarkCleveland · 13 Jun 2014

I possibly have multiple sources of crashes going on. Nothing is generating event records in the Event Viewer except for application fails (Bonjour, and Google Update, but the timestamps declare these to be unrelated to these crashes). Since I have had issues occurring for almost a year, I have collected a series of dmp files already, and this is attached. Included is as much information as I could glean from the computer.

EDIT: The text at the top of the blue screens either says "IRQL NOT LESS THAN OR EQUAL" (from non-induced blue screens) or "SPECIAL POOL DETECTED MEMORY CORRUPTION" (from Verifier)

I believe these crash issues stem (at least partially) from improper shutdowns that have been performed probably once a day for the better part of a year. Sounds like a lot, and it is. I will attempt to explain. what had happened was: a family member was shutting the computer down at night to save power when I walked away. When I noticed the crashes, I confirmed she understood how to shut the computer down properly, because it seemed awful fishy. Turns out, I asked again, and suddenly she realized "Oh, wait: yea I HAVE been shutting down the computer that way!" and so I discovered that for about a year, every shutdown she did was done improperly. I am referring to the kind where the power button is held down for several seconds until the computer is forced to shutdown.

Crashes galore now. For what it's worth, several things seem to reproduce the crashes, but never with 100% reproduction rate (more like 1% of the time, hence the thought that it is random):

when selecting another task while video is playing
when moving the mouse from one monitor to the other
when not in use, monitors off

Other Information:
As I said, the issues go back almost a year. Roughly 90% of the time I can reproduce one particular crash, but now that I changed one thing it happens far less. This is why I think multiple crashes are going on. I will get notification of recovery from serious errors when starting up my computer after putting the computer into hibernation between uses. When I shut it down it seemed to choke as it was creating the hibernate files. I have since changed the power settings such that the power button puts the computer to sleep instead of hibernation. The computer still occasionally crashes, but the reproduction rate during shutdown has dropped to probably 10%.

When I do get a Safe Mode prompt during start-up, I usually select Normal boot these days, since it is so routine to see it. I long ago had been checking the Administrative Event Viewer in Windows for records of the crashes, but nothing is ever generated. Note: the computer has even crashed while soaking overnight.

Then I discovered Verifier could be used to push the computer into crashing. The computer crashed as soon as it displayed the Windows GUI, such that I had time to see it was loading the login screen, but had no time to enter my user name before it crashed. I rebooted to enter Safe Mode and try something else, but I encountered stability issues during Safe Mode initialization as well (computer locked before Windows' GUI was loaded). I retried it, and it worked just fine.

There are such serious instability issues, I suspected hardware failure. And after seeing the BSOD generated by Verifier, I checked my RAM using Memtest 86+ for 3 passes. No errors were found. Now I wonder if the mobo isn't just flat-out screwed from the improper shutdowns. I hope someone can help; I have followed many of the steps that I saw in other similar threads, so hopefully someone here with more knowledge than myself can tell me what to do short of throw it in the scrap heap!

Cheers

Keywords: IRQL_NOT_LESS_THAN_OR_EQUAL SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION

Golden · 13 Jun 2014

I'll have a look at this when I get home in an hour. In the meantime please run MemTest86 + for a minimum of 8 passes....3 passes is insufficient to thoroughly test RAM.

MarkCleveland · 13 Jun 2014

Thanks. I will get started on that tonight.

Made edits to the above to ensure all the information I have is made available.

Re: Memtest
I would have run Memtest longer, but my CPU temperature was running 90 degrees Celsius by the end of the first minute, and 97-101 degrees Celsius steady after the first pass. Is this normal?

Is it also normal to take 2-3 hours per pass? (if so, I will need about 20 hours to do that many passes)

Golden · 13 Jun 2014

Yes, those times for MemTest86 + are normal. The high CPU temperature is not however....have you checked that the thermal paste between the CPU and cooler is still good and that the cooler is free of dirt and dust?

I would reapply new thermal paste anyway.

Golden · 13 Jun 2014

OK, I've checked all the .dmp files for June and you have a lot of different conflicts here.

I recommend the following in this order:

1. Reapply new thermal paste between the CPU and cooler, and check that the cooler is free of dirt & dust
Follow this tutorial to check that Step 1 has been done correctly, and upload a screen capture image of the result:
CPU - Stress Test Using IntelBurnTest

2. Run MemTest86+ for a minimum of 8 passes

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c3ac9cf0, 0, fffff960002e260d, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d )

Followup: MachineOwner
---------

3. Uninstall Daemon Tools - it is a well known cause of BSOD's

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, fffff880040e9324, fffff9800b41ae10, 0}

*** WARNING: Unable to verify timestamp for PxHlpa64.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHlpa64.sys
Unable to load image \SystemRoot\system32\DRIVERS\dtsoftbus01.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dtsoftbus01.sys
*** ERROR: Module load completed but symbols could not be loaded for dtsoftbus01.sys
Probably caused by : dtsoftbus01.sys ( dtsoftbus01+1324 )

Followup: MachineOwner
---------

4. Run Windows Update, and check the optional updates for a newer video card driver

Code:

2: kd> lmvm atikmpag
start             end                 module name
fffff880`048da000 fffff880`0497a000   atikmpag T (no symbols)           
    Loaded symbol image file: atikmpag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmpag.sys
    Image name: atikmpag.sys
    Timestamp:        Sat Dec 07 06:51:45 2013 (52A231D9)
    CheckSum:         0009FEFF
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

5. Check for updates to Avid Pro Tools audio software here : Avid | Pro Tools Family

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {fffff98003e70f90, fffff98003e70ffc, 4b4074, 24}

*** WARNING: Unable to verify timestamp for diginet.sys
*** ERROR: Module load completed but symbols could not be loaded for diginet.sys
Probably caused by : diginet.sys ( diginet+1525 )

Followup: MachineOwner
---------
4: kd> lmvm diginet
start             end                 module name
fffff880`06636000 fffff880`0663e000   diginet  T (no symbols)           
    Loaded symbol image file: diginet.sys
    Image path: \SystemRoot\system32\DRIVERS\diginet.sys
    Image name: diginet.sys
    Timestamp:        Wed Aug 07 15:16:48 2013 (5201DF48)
    CheckSum:         00009CE1
    ImageSize:        00008000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050033, 6f8, fffff8000330dfc0}

*** WARNING: Unable to verify timestamp for MAudioMobilePre.sys
*** ERROR: Module load completed but symbols could not be loaded for MAudioMobilePre.sys
Probably caused by : MAudioMobilePre.sys ( MAudioMobilePre+138f8 )

Followup: MachineOwner
---------

5: kd> lmvm MAudioMobilePre
start             end                 module name
fffff880`09c00000 fffff880`09c30000   MAudioMobilePre T (no symbols)           
    Loaded symbol image file: MAudioMobilePre.sys
    Image path: \SystemRoot\system32\DRIVERS\MAudioMobilePre.sys
    Image name: MAudioMobilePre.sys
    Timestamp:        Thu Sep 03 06:58:00 2009 (4A9EE360)
    CheckSum:         00030319
    ImageSize:        00030000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Lastly, run Windows Update regularly and ensure you install the important updates offered. Check the Optional Updates and always install any updates for your devices.

If you get a new BSOD after having done the above, upload them here again, and I'll look at them.

MarkCleveland · 16 Jun 2014

Thank you so much for the analysis.

You were right about the thermal paste, and the drivers do seem like ones I haven't touched in awhile. thanks for the direction. I also feel better confirming I had tested the RAM properly per your suggestion as well. I ended up doing 10 passes; no errors. So that just leaves me to fixing those driver issues which I had no idea could be found in those files I sent -

Thanks again, and I guess it withstood the constant sudden power failures after all

Golden · 16 Jun 2014

No worries. Get all of that done and see if the system stays stable.

MarkCleveland · 20 Jun 2014

1. Changed thermal paste as suggested; as I said before it was badly needed.

Burntest failed on the 10th time despite having consistent values. I decided to retry it immediately after checking the logs (which had no details except the fact it failed out). After failing, burntest made it through 20 times successfully with consistent results. I ran the test with HWINFO on at the same time; this time it also ran successfully (10 times) without error. The results of the initial failed test, and the screenshot for the latest one that passed are attached. Temperatures certainly appear too high.

2. Performed 10 passes on MemTest86+ successfully without error.

3. Uninstalled DaemonTools per your suggestion. I recall this producing errors in the past anyways.

4. Windows Update found nothing. I updated the video drivers myself the way I always do lol.. (Windows Update fail)

5. Avid Protools has had all kinds of issues since I got it. Everything from playback issues, to not recognizing devices. Unfortunately, there is no update to the program available at this time. The drivers for the M-Audio device itself also has no updates at this time, which I discovered is because the peripheral that uses them (a first generation M-Box) is no longer supported/drivers are no longer provided.

Also, I have been very diligent about installing optional Windows updates (anything that isn't in reference to localization pretty much gets installed). To be sure, I did go ahead and double-check and found there were no updates critical or optional ones which had not yet received my attention.

Added Info
While technically I have not gotten another BSOD yet, the computer is still experiencing the same issue when shutting down: the computer returned the message that it had recovered from an unexpected shutdown when I started it up today. This doesn't make sense since the computer was shut down by me using the proper Start Menu command, Shut Down. Again, there is no error in the event viewer, or I would have provided that information along with this reply. The issue did produce a dump though (See attached DM log zip file).

Also of note, I receive notice of an error upon startup that appears consistently, which I know to be related to the M-Audio device drivers. It simply says "TBIA" "The data is invalid" and has a button which says OK. Selecting OK will dismiss the pop-up and cause it to reappear two to three times before it will finally dismiss completely. The research I have found leads me to believe that (short of uninstallation and stopping all use of the M-Audio device) there is no way to rid the computer of this error. I don't look forward to it, but if the device (or its driver) is the cause of any crashes I will promptly uninstall it (and upgrade to a newer, better-supported device).

Golden · 20 Jun 2014

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, fffff800032d1aec}

*** WARNING: Unable to verify timestamp for scmndisp.sys
*** ERROR: Module load completed but symbols could not be loaded for scmndisp.sys
Probably caused by : scmndisp.sys ( scmndisp+16d1 )

Followup: MachineOwner
---------
3: kd> lmvm scmndisp
start             end                 module name
fffff880`01719000 fffff880`01723000   scmndisp T (no symbols)           
    Loaded symbol image file: scmndisp.sys
    Image path: \SystemRoot\system32\DRIVERS\scmndisp.sys
    Image name: scmndisp.sys
    Timestamp:        Fri May 27 20:00:22 2011 (4DDF7D3E)
    CheckSum:         00009C0C
    ImageSize:        0000A000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The latest .dmp flags the Netgear wireless driver as a problem. Check for updates here:
Welcome to NETGEAR Support

Alternatively, run all Windows Update....you still do not have Service Pack 1 installed, and there are many updates post SP1 that may address many of the issues.

Code:

Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17273.amd64fre.win7_gdr.130318-1532
Machine Name:

The CPU temperatures are still very high...examine the possibility of installing an after-market cooler for better cooling performance.