Random BSOD faulting module ntoskrnl.exe

joeytempest · 12 Nov 2009

Had this happen a few times and I'm having a tough time identifying the real culprit.
I've had some USB problems in the past with the board i'm on but that was running under XP.

Again, these crashes seem completely random and are fairly far in between.

Ran WhoCrashed on the dump file and got the following info:

On Thu 11/12/2009 11:55:42 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002CC5DFE, 0xFFFFF88006D01DF0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\111209-21496-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit may be another driver on your system which cannot be identified at this time.

On Fri 10/9/2009 8:45:34 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002879DFE, 0xFFFFF880061545F0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\100909-25646-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit may be another driver on your system which cannot be identified at this time.

torrentg · 12 Nov 2009

Hi. It's a 0x3B error caused by MediaServer.exe

Try to update Tversity software. I use it and it's great.

Update your chipset drivers and bios etc...Standard advice for bsod.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI00.531\100909-25646-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02802000 PsLoadedModuleList = 0xfffff800`02a3fe50
Debug session time: Fri Oct  9 03:43:31.807 2009 (GMT-5)
System Uptime: 3 days 18:31:46.446
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002879dfe, fffff880061545f0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiSwapContext+9e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002879dfe, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880061545f0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiSwapContext+9e
fffff800`02879dfe 440f285980      movaps  xmm11,xmmword ptr [rcx-80h]

CONTEXT:  fffff880061545f0 -- (.cxr 0xfffff880061545f0)
rax=000000007ef89000 rbx=fffff800029ece80 rcx=00000000c0000102
rdx=0000000000000000 rsi=fffffa8008bbcb60 rdi=fffff800029fac40
rip=fffff80002879dfe rsp=fffff88006154fd0 rbp=fffffa8008bbcb60
 r8=fffffa80056307d8  r9=0000000000000000 r10=fffffffffffffffe
r11=00000000002f6e00 r12=0000000000000000 r13=0000000000000000
r14=fffffa8005630750 r15=fffff80003d3b080
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!KiSwapContext+0x9e:
fffff800`02879dfe 440f285980      movaps  xmm11,xmmword ptr [rcx-80h] ds:002b:00000000`c0000082=????????????????????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  MediaServer.ex

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002879dfe

STACK_TEXT:  
fffff880`06154fd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapContext+0x9e


FOLLOWUP_IP: 
nt!KiSwapContext+9e
fffff800`02879dfe 440f285980      movaps  xmm11,xmmword ptr [rcx-80h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiSwapContext+9e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff880061545f0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiSwapContext+9e

BUCKET_ID:  X64_0x3B_nt!KiSwapContext+9e

Followup: MachineOwner
---------

chev65 · 12 Nov 2009

You wouldn't by chance be using the 191.07's would you? They tend to install by default with Windows 7. If you are using those drivers, try a clean uninstall using driver sweeper than go to the 190.62 or the newer 195.39 Nvidia display drivers. So many problems reported with the 191.07 it's getting rediculous. http://downloads.guru3d.com/Forcewar...load-2419.html

The link that Torrentg posted also says this....

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

Which tends to coincide with my post so hopefully that will solve the problem.

joeytempest · 12 Nov 2009

Thanks for the quick responses!!

Running the latest tversity release 1.7 but one of the crashes actually happened while i was streaming with media center. Maybe the 2 of them don't play nice together?
(New media center/player seems to have gotten a lot better and works just as well as far as I've seen)
Maybe I'll uninstall tversity for a while and see what happens.

Have the latest BIOS and pretty sure the chipset drivers are up to snuff but I will check to make sure.

For my graphics I'm running whatever driver Windows installed. The driver version is 8.15.11.8593. Ran the NVidia 191.07 drivers for a few minutes the other week but the system behaved really funny so I just reverted to the original version.

torrentg · 12 Nov 2009

Yeah, try to sort it out with video drivers as Chev is saying. Personally, I always run the latest and greatest, sometimes beta when I find them for both ATI and NVIDIA and never have the slightest of problems.

I don't think it would be a bad idea to run Memtest overnight to see if it picks up any errors in this case. Could be something to do with RAM, especially because of how you said bsod happens with XP too.

joeytempest · 12 Nov 2009

Cleaned up the drivers and installed NVidias 190.62. Uninstalled TVersity.
Running the memtest tonite (Though the XP BSODs only happened when i would plug in a usb device)
Now we'll just have to wait and see.

Thanks for all the input :)

zigzag3143 · 12 Nov 2009

joeytempest said:

Cleaned up the drivers and installed NVidias 190.62. Uninstalled TVersity.
Running the memtest tonite (Though the XP BSODs only happened when i would plug in a usb device)
Now we'll just have to wait and see.

Thanks for all the input :)

in addition to what TG said. Your raid driver is from 2006. the jraid file was included in both crashes

Ken J