Random BSOD Usually with System Idle/Unattended

Randall G · 06 Jun 2015

The computer has been experiencing random freezing/BSOD since new, May of 2011. Has gotten much worse lately (BSOD every day or every few days). The BSOD primarily occur while the system is idle/unattended.
I’ve performed 6(+) memtest passes, and chkdsk of the hard-drive (no issues noted).

Thanks so much!

koolkat77 · 07 Jun 2015

Welcome to the forum.

Clean boot

Troubleshoot Application Conflicts by Performing a Clean Startup

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

Click on the
Type CMD on Search
Left click and Run as Administrator
Type SFC /scannow

Full tutorial here:

SFC /SCANNOW Command - System File Checker

Please update this driver: Driver Reference Table

See if that stops the bsod.

Sometimes drivers remain and do not get completely uninstalled.

Driver Removal Process:

Download Driver Sweeper to the desired location.
Extract the files from the zip.
Uninstall the driver Program & Features - Control Panel.
Run Driver Sweeper, check the drivers you want to uninstall or clean registry leftovers of.

Link to full tutorial: Drivers - Clean Left over Files after Uninstalling

Code:

Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSSIKAT\Downloads\RANDALL_S-VM-Sat_06_06_2015_195959_50\060615-20295-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`0321e000 PsLoadedModuleList = 0xfffff800`03465730
Debug session time: Sun Jun  7 07:57:59.582 2015 (UTC + 6:00)
System Uptime: 1 days 7:47:29.784
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8019e66178, 2, 1, fffff8000329ca15}

*** WARNING: Unable to verify timestamp for npf.sys
*** ERROR: Module load completed but symbols could not be loaded for npf.sys
Probably caused by : npf.sys ( npf+2bb2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8019e66178, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000329ca15, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034cf100
GetUlongFromAddress: unable to read from fffff800034cf1c0
 fffffa8019e66178 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeAcquireSpinLockRaiseToDpc+55
fffff800`0329ca15 f0480fba2900    lock bts qword ptr [rcx],0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff880009e0590 -- (.trap 0xfffff880009e0590)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa8019e66178
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000329ca15 rsp=fffff880009e0720 rbp=fffffa8019e66178
 r8=fffffa8006ca38f8  r9=0000000000000000 r10=fffffffffffffffe
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KeAcquireSpinLockRaiseToDpc+0x55:
fffff800`0329ca15 f0480fba2900    lock bts qword ptr [rcx],0 ds:fffffa80`19e66178=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003291e69 to fffff800032928c0

STACK_TEXT:  
fffff880`009e0448 fffff800`03291e69 : 00000000`0000000a fffffa80`19e66178 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009e0450 fffff800`03290ae0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009e0590 fffff800`0329ca15 : 00000000`00000000 fffff880`0166e5b2 fffff880`00000000 fffffa80`00000000 : nt!KiPageFault+0x260
fffff880`009e0720 fffff880`0616abb2 : 00000000`00000001 fffffa80`089a71a0 fffffa80`06e3f460 fffffa80`19e63000 : nt!KeAcquireSpinLockRaiseToDpc+0x55
fffff880`009e0770 00000000`00000001 : fffffa80`089a71a0 fffffa80`06e3f460 fffffa80`19e63000 00000000`00060000 : npf+0x2bb2
fffff880`009e0778 fffffa80`089a71a0 : fffffa80`06e3f460 fffffa80`19e63000 00000000`00060000 fffff880`009e0798 : 0x1
fffff880`009e0780 fffffa80`06e3f460 : fffffa80`19e63000 00000000`00060000 fffff880`009e0798 fffff880`009e0798 : 0xfffffa80`089a71a0
fffff880`009e0788 fffffa80`19e63000 : 00000000`00060000 fffff880`009e0798 fffff880`009e0798 00000000`00000000 : 0xfffffa80`06e3f460
fffff880`009e0790 00000000`00060000 : fffff880`009e0798 fffff880`009e0798 00000000`00000000 fffffa80`06e3f460 : 0xfffffa80`19e63000
fffff880`009e0798 fffff880`009e0798 : fffff880`009e0798 00000000`00000000 fffffa80`06e3f460 fffff880`0170938b : 0x60000
fffff880`009e07a0 fffff880`009e0798 : 00000000`00000000 fffffa80`06e3f460 fffff880`0170938b fffffa80`19c13780 : 0xfffff880`009e0798
fffff880`009e07a8 00000000`00000000 : fffffa80`06e3f460 fffff880`0170938b fffffa80`19c13780 fffffa80`19c13780 : 0xfffff880`009e0798


STACK_COMMAND:  kb

FOLLOWUP_IP: 
npf+2bb2
fffff880`0616abb2 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  npf+2bb2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: npf

IMAGE_NAME:  npf.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c24de72

FAILURE_BUCKET_ID:  X64_0xA_npf+2bb2

BUCKET_ID:  X64_0xA_npf+2bb2

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xa_npf+2bb2

FAILURE_ID_HASH:  {5f20b508-1aab-ff9b-98bc-ef920917c6aa}

Followup: MachineOwner
---------

0: kd> lmvm npf
start             end                 module name
fffff880`06168000 fffff880`06174000   npf      T (no symbols)           
    Loaded symbol image file: npf.sys
    Image path: \??\C:\Windows\system32\drivers\npf.sys
    Image name: npf.sys
    Timestamp:        Fri Jun 25 22:50:58 2010 (4C24DE72)
    CheckSum:         00011844
    ImageSize:        0000C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Randall G · 07 Jun 2015

Hello,
So far I have:

1. Ran sfc /scannow from within windows multiple times--unable to fix all corrupt files.
2. Download and ran the "System Readiness Tool."
3. Repeated sfc /scannow--still have corrupt files.
4. Ran sfc /scannow from boot command (see attached pic)--still corrupt files.
5. Performed chkdsk /R of hard-drive. No issues noted (see attached pic).
6. Generated sfcdetails.txt (attached).

System restore is not the best option for me, considering the BSODs have been occurring for a long time now (albeit, not nearly as often...used to be around monthly, now close to daily). That is, any restore point may be corrupt.

Any thoughts on the sfc.details.txt file?

Thanks in advance!

Randall G · 07 Jun 2015

Looks like Windows systems files aren't corrupt, as I only see these files identified as being unrepairable in the sfcdetails.txt file:

• telemetry.ASM-WindowsDefault.json
• utc.app.json

Which, according to this link, are incorrectly being flagged as corrupt:

https://support.microsoft.com/en-us/kb/3022345

"This update contains the following files that are occasionally updated by the Diagnostic Tracking Service:

telemetry.ASM-WindowsDefault.json
utc.app.json

The two files are marked as static files in the update. When an advanced user runs the System File Checker Tool (sfc.exe), the files are unintentionally flagged as corrupted. There is no impact or actual corruption on a device running this update, and a later service update will resolve this issue."

I'll move on to updating drivers.

NoelDP · 08 Jun 2015

KB3022345 strikes again

The problem here is that the KB (contrary to MS statements) does appear to cause problems in a few machines - or at least problems disappear when the update is uninstalled.
I would recommend uninstalling it, and then doing a Check for Udpdates, and Hiding the update if/when it reappears.

Randall G · 08 Jun 2015

Alas, KB3022345 was installed 5/13/15, which is about 2 months after the BSODs became frequent. On the other hand, I did install Netgear’s Netgenie on 3/13/15: the BSOD’s started occurring frequently 3 days later. Netgenie is associated with npf.sys, which koolkat77 suggested updating in his post above.

BSOD Since Dec MS OS Patch - Microsoft Community
Stuttering or jerky mouse leading to a system crash!

Version 2.3.1.57 is installed on my PC—Netgear doesn’t let on to which version is available at their website, nor do they provide any details (that I can find) on what’s supposed to be fixed:

genie Landing Page | Apps | Discover | Home | NETGEAR

Guess you have to download it to find out which version it is? Regardless, I’ve uninstalled the program, which isn’t necessary to access router settings. I’ll be sure to post back here if this corrects the BSOD problem.

Thanks!

Randall G · 04 Jul 2015

It's been four weeks now, and no new BSODs. One of two things corrected the problem:

1) SFC /scannow
2) Uninstalling Netgear’s Netgenie.

Note I did not uninstall KB3022345.

Cheers!

Randall