BSOD - System Service Exception when shutting down

Louiscar · 15 Jul 2015

Hi,

I've recently had 3 occasions when a BSOD occurred when shutting down which is curious.
Two of these were System Service Exception but the middle one was Page Fault in Non-Paged area.

Bluescreen view doesn't really help me as the only thing common which is highlighted is ntoskrnl, so in each one there are different sys files mentioned.

I kind of suspect the graphics driver but why now I don't know although each of these occasions I had played Farcry 4 for a while. I have not updated or done anything to the graphics drivers which have been rock solid for many moons.

This situation occurs pretty much at the point of clicking the shutdown button.

It started 6th July.

Any ideas would be appreciated. I've attached the DM Log Collector files.

ICIT2LOL · 17 Jul 2015

Hello Louis sorry for the wait and from the dump files I have seen it seems the system is a bit out of whack as in the highlighted part of the dump.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c071fcf0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960002ac1cd, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800037100e0
GetUlongFromAddress: unable to read from fffff80003710198
 fffff900c071fcf0 
FAULTING_IP: 
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
fffff960`002ac1cd 488b4f20        mov     rcx,qword ptr [rdi+20h]
MM_INTERNAL_CODE:  0
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  dwm.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME:  fffff88004986920 -- (.trap 0xfffff88004986920)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000031 rbx=0000000000000000 rcx=fffff900c0c88b80
rdx=000000006512109b rsi=0000000000000000 rdi=0000000000000000
rip=fffff960002ac1cd rsp=fffff88004986ab0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000410 r10=fffff80003468000
r11=0000000000000022 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d:
fffff960`002ac1cd 488b4f20        mov     rcx,qword ptr [rdi+20h] ds:00000000`00000020=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80003559024 to fffff800034d8700
STACK_TEXT:  
fffff880`049867b8 fffff800`03559024 : 00000000`00000050 fffff900`c071fcf0 00000000`00000000 fffff880`04986920 : nt!KeBugCheckEx
fffff880`049867c0 fffff800`034d67ee : 00000000`00000000 fffff900`c0c88b80 fffffa80`35616c00 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x427f7
fffff880`04986920 fffff960`002ac1cd : 00000000`0000001b 00000000`6512109b 00000000`6512109b 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`04986ab0 fffff960`002ab6de : fffff900`c0c88b80 00000000`00000000 0000109b`624d4653 00000000`0000001d : win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d
fffff880`04986ae0 fffff960`002ac5e3 : 00000000`00000000 00000000`6512109b fffff900`c0c88b80 00000000`07e60c3c : win32k!SFMLOGICALSURFACE::DeInitialize+0x4e
fffff880`04986b20 fffff960`00207c9f : 00000000`00000000 fffff900`c00c4010 fffff900`c0c88b80 00000000`00000020 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
fffff880`04986b60 fffff960`00229278 : 00000000`00000001 00000000`00000001 fffff880`04986ca0 00000000`00000000 : win32k!GreSfmCloseCompositorRef+0x10f
fffff880`04986ba0 fffff800`034d7953 : fffffa80`0d382b60 fffff880`04986ca0 00000000`0029fc70 fffffa80`0a1c3e80 : win32k!NtGdiHLSurfSetInformation+0x1a8
fffff880`04986c20 000007fe`fecb4efa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01eaf648 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fecb4efa

STACK_COMMAND:  kb
FOLLOWUP_IP: 
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
fffff960`002ac1cd 488b4f20        mov     rcx,qword ptr [rdi+20h]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: win32k
IMAGE_NAME:  win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  54163648
IMAGE_VERSION:  6.1.7600.17633
FAILURE_BUCKET_ID:  X64_0x50_win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
BUCKET_ID:  X64_0x50_win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x50_win32k!sfmlogicalsurface::ownssurfacecleanup+2d
FAILURE_ID_HASH:  {422c0597-aeb5-515f-65d6-15149510f84c}
Followup: MachineOwne

Suggest you run these for starters

https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

https://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2

then these for good measure

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

ADW download from bleeping computerdelete any rubbish found with the malware scans

(with ADW ifyou are running Kaspersky it will throw it up as malware just overrideKaspersky by ignoring it or disabling it for the duration of the scan)

(By the by am an ex pat Brit - last home Portland Road Hove

)

Louiscar · 17 Jul 2015

Thanks for that although I am not sure what extent the 'out of whack' means even looking at the log.
Unfortunately I can't repeat this problem and I've not had another occurrence since posting.

Anyway, I'll go through your list one by one to see if anything turns up. One of them is not necessary as I've run Malwarebytes and that's currently installed.

Something that bothered me btw when I looked at the processlist.txt was this:

SearchProtocolHost.exe "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe9_ Global\UsGthrCtrlFltPipeMssGthrPipe9 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

But I the contents of the folder usgthrsvc has nothing in it and I've since deleted it but I don't know where the data for these parameters are coming from as there's nothing in the registry. I doubt it bears any relation to the cause other than a flag to say something suspicious happened at some point.

Glad to see you are from these parts btw. I know Portland road well, I used to live off it in Glebe Villas .

I'll report back when I've done those things.

Louiscar · 17 Jul 2015

Well SFC and chkdsk have come up with nothing.

Adware remover had a few entries to do mainly with Zonealarm which I allowed it to remove.

And I just got another BSOd today. So no luck so far tracking this down.

ICIT2LOL · 17 Jul 2015

Ok out of whack means basically a bit corrupted / not absolutely correct / something amiss etc etc The highlighted red parts are the bits of the system that have faults - it is just the way that we all let folks know where the problem lies.

So are you able to read those dump files? because if you are interested you can load software from a tutorial here along a with site that gives the errant codes. Then it is just a matter of tracking them down.

If you are I can link you to those but in them meantime send the latest dumps.

ICIT2LOL · 17 Jul 2015

Look I have just had another look at the dumps previously sent and maybe I should have though of this earlier. Read my little ditty and let me know what the readings are.

UsingHW Info

PART A:

You can test the volts on the PSU with HW Info HWiNFO, HWiNFO32/64 - Download <download the right bit version and close the right hand window select Sensorsand scroll down to the power section where you will see what the volts aredoing see my pic. In my pic the section (Nuvoton)with VBATT is a dead give away you are in the section for the rail voltages.There are other section titles and one that pops up often is ITE

Now the voltage on the different rails have to be within 5% =+/-of what is required or the machine will not work properly if at all.

See this for the rail voltage info

http://www.tomshardware.com/reviews/power-supply-specifications-atx-reference,3061.html (Section 2.)

The original right hand window shows the machine running and ishandy for that but for looking at the components in some detail close it anduse the main left hand side panel

FOR OTHERCOMPONENTS

PART B:

Open each small square with + in it on the section thecomponents are in and then click on the individual component/s (it will highlight in blue) - in the righthand side will appear all sorts of details including brands speeds and otheressential info that particular device. See pic for example.
Use PART A:

NB If you want you can use PART B: to check out very in depth detail of the other components see pic

Louiscar · 17 Jul 2015

ICIT2LOL said:

So are you able to read those dump files? because if you are interested you can load software from a tutorial here along a with site that gives the errant codes. Then it is just a matter of tracking them down.

If you are I can link you to those but in them meantime send the latest dumps.

I've only used bluescreenview to look at the dumps. This is a bit simple and highlights ntoskrnl every time and some other file which varies each time. Todays crash it only shows ntoskrnl highlighted.

I used to have MS debugging tools on my Winxp machine some years back but haven't got that installed nor can I remember how to use it. I'd have to go through some kind of refresher.

What I seem to keep finding is this quote for SYSTEM SERVICE EXCEPTION :

"This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code"

... and as I have only started to have this problem because I've re-visited Farcry 4 for a bit of relaxation (if you can call it that) it may be the cause. Each BSOD can be teamed up with an occurrence of running the game. All but the last BSOD happened when shutting the machine down, the last was an exception. I was switching tabs on Firefox when this happened.

I've attached the Bluescreenview reports and the DM log collector files.

I will do the voltage stuff tomorrow (later today) as it's 5 am and I need to hit the sack.

Louiscar · 18 Jul 2015

I've had a look at the voltages which appear ok although I don't know what some are supposed to be.
eg. Vin5 and Vin6 are 4v and in fact too stable all at a non-variable 4.064v which makes me think it's false data.

I can see one min voltage on the second 3.3v rail that drops a smidgin under that 5% threshold at 3.12 otherwise they are all within the 5%. I still have some years left of my 7 year warranty on the psu so I could send it back if these are not good enough. All 3.3v fall on the lower side.

Also not relevant but I note that cpu and motherboard temperature appear to be reversed but it's not relevant to this.

Other than that I don't see too much that jumps out at me although I have to spend more time to peruse through it in a bit more detail later

ICIT2LOL · 19 Jul 2015

Yes the volts look ok the Tjunction temps look a tad on the high side and in the dumps there are still issues with the dmw.exe so can you open the Task Manager and go to processes and see how much memory that dwm.exe is using - see my pic

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000176923, Address of the instruction which caused the bugcheck
Arg3: fffff88003dc3070, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
win32k!HmgLockEx+a3
fffff960`00176923 0fb7430c        movzx   eax,word ptr [rbx+0Ch]
CONTEXT:  fffff88003dc3070 -- (.cxr 0xfffff88003dc3070;r)
rax=fffff900c0210000 rbx=0000000000000000 rcx=fffffa800bb96b60
rdx=fffff900c0210000 rsi=0000004d00410000 rdi=fffff900c0210000
rip=fffff96000176923 rsp=fffff88003dc3a40 rbp=0000000000000000
 r8=0000000000000001  r9=0000000000000000 r10=0000000000000000
r11=fffff88003dc3aa8 r12=0000000003908900 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k!HmgLockEx+0xa3:
fffff960`00176923 0fb7430c        movzx   eax,word ptr [rbx+0Ch] ds:002b:00000000`0000000c=????
Last set context:
rax=fffff900c0210000 rbx=0000000000000000 rcx=fffffa800bb96b60
rdx=fffff900c0210000 rsi=0000004d00410000 rdi=fffff900c0210000
rip=fffff96000176923 rsp=fffff88003dc3a40 rbp=0000000000000000
 r8=0000000000000001  r9=0000000000000000 r10=0000000000000000
r11=fffff88003dc3aa8 r12=0000000003908900 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k!HmgLockEx+0xa3:
fffff960`00176923 0fb7430c        movzx   eax,word ptr [rbx+0Ch] ds:002b:00000000`0000000c=????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  dwm.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER:  from fffff9600033c1e0 to fffff96000176923
STACK_TEXT:  
fffff880`03dc3a40 fffff960`0033c1e0 : fffff900`c0bfb9f0 00000000`00000001 ffffffff`c41216ee fffff900`c48fa380 : win32k!HmgLockEx+0xa3
fffff880`03dc3ab0 fffff960`0033b6de : fffff900`c0bfb9f0 00000000`00000000 000016ee`624d4653 00000000`0000001d : win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x40
fffff880`03dc3ae0 fffff960`0033c5e3 : 00000000`00000000 ffffffff`c41216ee fffff900`c0bfb9f0 00000000`03908970 : win32k!SFMLOGICALSURFACE::DeInitialize+0x4e
fffff880`03dc3b20 fffff960`00297c9f : 00000000`00000000 fffff900`c00c4010 fffff900`c0bfb9f0 00000000`00000000 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
fffff880`03dc3b60 fffff960`002b9278 : 00000000`00000001 00000000`00000001 fffff880`03dc3ca0 fffff960`002b90d0 : win32k!GreSfmCloseCompositorRef+0x10f
fffff880`03dc3ba0 fffff800`034bd953 : fffffa80`0bb96b60 fffff880`03dc3ca0 00000000`00000000 00000000`00000000 : win32k!NtGdiHLSurfSetInformation+0x1a8
fffff880`03dc3c20 000007fe`fe954efa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0276f368 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fe954efa

FOLLOWUP_IP: 
win32k!HmgLockEx+a3
fffff960`00176923 0fb7430c        movzx   eax,word ptr [rbx+0Ch]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  win32k!HmgLockEx+a3
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: win32k
IMAGE_NAME:  win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  54163648
IMAGE_VERSION:  6.1.7600.17633
STACK_COMMAND:  .cxr 0xfffff88003dc3070 ; kb
FAILURE_BUCKET_ID:  X64_0x3B_win32k!HmgLockEx+a3
BUCKET_ID:  X64_0x3B_win32k!HmgLockEx+a3
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x3b_win32k!hmglockex+a3
FAILURE_ID_HASH:  {8f81bb6a-de67-bc4d-99db-3f117a68551c}
Followup: MachineOwner

If you haven't already run these in safe mode as well just check out for problems in the system

https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

https://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2

Now I am getting the feeling that something might even be wrong with the memory itself but lest do these first before we go down that track.

ICIT2LOL · 19 Jul 2015

Louis I did mean to ask have you run any malware scans yet?

If not then try these for starters

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

ADW download frombleeping computer and delete any rubbish found with the malware scans

(NB If one is runningKaspersky security it may rant about ADW - just ignore it or disable Kasperskywhile the ADW is being used)