Random BSODs

ristiisa · 06 Jul 2010

Hello,

I upgraded my system recently from vista to win7 64 bit and from day one i started having BSOD. I noticed when Aero is disabled i get a day or so without BSOD. But when Aero is enabled the system does not quite recover from BSOD, after restart windows has another BSOD during boot time.

Only difference that my previous vista installation and win7 installation has is that i have now enabled my motherboards raid controller.

I have tried reinstalling win7 several times with newer, older drivers or default drivers but no luck so far.

My system specs:
Intel Q9650
Gigabyte GA-EP45-DS5
900w PSU
Ati Radeon HD4890
4GB DDR2 Crucial Ballistix

I have attached a zip consisting of 19 dumps and a summary txt from BlueScreenView of those dumps.

So if anyone could be of assistance I would appreciate it a lot...

ttran · 07 Jul 2010

Hi and Welcome to SF

STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory
STOP 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY

Usual causes: Device driver, Memory
STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

Usual causes: System service, Device driver, graphics driver, ?memory
STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel
STOP 0x00000024: NTFS_FILE_SYSTEM

Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure
STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,
STOP 0x00000019: BAD_POOL_HEADER

Usual causes: Device driver

Different stop codes with different things blame, this can be sign for hardware issue. However, let's try something first before we getting to hardware.

Please remove Deamon tool or Alcohol 120%, they use sptd.sys, which I found in your loaded drivers, well-known for causing BSOD, then use this tool to remove sptd.sys:
http://www.duplexsecure.com/en/downloads

Next, memory corruption was blamed in some of dmp file, as well as some exception codes suggest that
==> please download third party called memtestx86, burn it to CD using Iso recorder: ISO Recorder v3 , and let it run for at least 7 passes
Instruction:--> Memory Diagnostics

Next, ntfs.sys was blamed in one of the dmp with stop code 24, this usually mean hard drive issue, please run these 2 check:
Disk Check
and HD diagnostic:
HD Diagnostic <-- (Instruction)

Directx was blamed in one of the dmp file, please download and reinstall new version of it:
Download details: DirectX End-User Runtime

Code:

BugCheck BE, {fffff8a0042b3383, ed2000011657f121, fffff8800c4f4760, b}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4244e )

Followup: MachineOwner
---------
BugCheck 19, {3, fffff8a00dd30820, fffff8a00bfff820, fffff8a00dd30820}

Probably caused by : Pool_Corruption ( nt!ExFreePool+75b )

Followup: Pool_corruption
---------
BugCheck 3B, {c0000005, fffff80002aafa87, fffff88007a059f0, 0}

Probably caused by : memory_corruption ( nt!MmCopyToCachedPage+227 )

Followup: MachineOwner
---------
BugCheck 50, {fffff70330882a88, 0, fffff80002af3133, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiLocateWsle+103 )

Followup: MachineOwner
---------
BugCheck 1A, {41790, fffffa8000deba90, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339d6 )

Followup: MachineOwner
---------

BugCheck 24, {1904fb, fffff8800599f228, fffff8800599ea80, fffff80002c0590d}

Probably caused by : Ntfs.sys ( Ntfs!NtfsQueryDirectory+18d5 )

Followup: MachineOwner
---------
BugCheck 1A, {403, fffff6800003cb88, ed0000004e129867, fffff6fc5003f8d0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------
BugCheck 1000007E, {ffffffffc0000005, fffff8800301ea5c, fffff880025bd698, fffff880025bcef0}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::PrepareDmaBuffer+fc8 )

Followup: MachineOwner
---------
BugCheck 19, {20, fffff8a011534700, fffff8a0115347c0, 50c0403}

GetPointerFromAddress: unable to read from fffff80002cc70e0
Probably caused by : fltmgr.sys ( fltmgr!DeleteNameCacheNodes+143 )

Followup: MachineOwner
---------
BugCheck 4E, {99, 117e3c, 2, 600fb}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

BugCheck 1A, {41790, fffffa8000e3bf20, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------
BugCheck 1A, {41284, 1462001, 1c00, fffff70001080000}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_PROCESS_HEAP::Rotate+2d0 )

Followup: MachineOwner
---------
BugCheck 4E, {99, 2d7cf, 2, 2ddca}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

I doubt the video card, run this free video stress test:
FurMark

Let us know if you need further help

Tuan

ristiisa · 07 Jul 2010

I ran memtest for a day and no errors were found.
Removed sptd.sys, reinstalled DX, updated graphics driver.

Now this is interesting i ran Disk Check for all my drives few days ago... now today i had few BSOD more and windows did diskchk itself and found some errors in filesystem and deleted some index entries and files... now this is frightening...

Running FurMark next.

CarlTR6 · 07 Jul 2010

Go to your hard drive manufacturer's website, download and run their diagnostic tool.

ristiisa · 08 Jul 2010

FurMark ran whole night without problems... But just now when i was just googling around i got STOP 0x00000109 BSOD. Dump attached.

Tested harddrives and ran raid integrity check all passed.

I found a few threads that complain incompatibility between crucial and gigabyte having same symptoms as i am having that were cured with replacing crucial with some other brand. I can't test the claim that gigabyte and crucial do not match but i can replace my memory with no-name-china ones and see if i have more stable system.

ttran · 08 Jul 2010

STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION

Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

Did you use memtestx86 to check memory. I said that because usually we don't trust built in memory diagnostic. The dump file still point to memory corruption, and the stop code show it as potential cause. Please use memtestx86 if you haven't done it.

Also, do system file check please:
SFC /SCANNOW Command - System File Checker

If all of the above doesn't work for you, I would suggest to turn on Driver Verifier:
Using Driver Verifier to identify issues with Drivers

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.666\070810-47502-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5f000 PsLoadedModuleList = 0xfffff800`02c9ce50
Debug session time: Thu Jul  8 16:52:55.281 2010 (UTC + 7:00)
System Uptime: 0 days 16:00:22.811
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89c43057a, b3b7465eeebfd7a8, fffff80002efc9d0, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

ristiisa · 08 Jul 2010

ttran said:

STOP 0x00000109: CRITICAL_STRUCTURE_CORRUPTION

Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

Did you use memtestx86 to check memory. I said that because usually we don't trust built in memory diagnostic. The dump file still point to memory corruption, and the stop code show it as potential cause. Please use memtestx86 if you haven't done it.

Also, do system file check please:
SFC /SCANNOW Command - System File Checker

If all of the above doesn't work for you, I would suggest to turn on Driver Verifier:
Using Driver Verifier to identify issues with Drivers

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\TUANTR~1\AppData\Local\Temp\Rar$DI00.666\070810-47502-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5f000 PsLoadedModuleList = 0xfffff800`02c9ce50
Debug session time: Thu Jul  8 16:52:55.281 2010 (UTC + 7:00)
System Uptime: 0 days 16:00:22.811
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89c43057a, b3b7465eeebfd7a8, fffff80002efc9d0, 1}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

Yeah, i ran memtest for a day without any errors. I talked to crucial rep and she recommended that i'd set my dram voltage and timings manually so i did that. So i'm gonna see what happens.

ristiisa · 09 Jul 2010

Well no luck... System ran ok for a day and then boom after system restart several bsod in a row... I tried driver verifier option but it just restarted the pc without any bsod or dumps.

I also noticed in the event viewer that some entries from JRAID contain "The device, \Device\Scsi\JRAID1, is not ready for access yet." error message. Also two of the bsod mentioned jraid.sys.

Dumps attached.

ttran · 09 Jul 2010

STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL

Usual causes: Device driver
STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel
STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

jraid.sys was blamed in one of the dmp, it is your JMicron RAID Driver, please download and install fresh copy of it
USBport.sys was blamed as well. In case it is your USBport issue, generic way to solve it is to go to device manager, uninstall all usb device driver under the list of USB then restart your machine

Again, memory corruption was blamed with stop code 1A, which you can see in the quote above, related to memory management. I'm not a hardware guy, but usually I see many time overclocking cause problem...so please set it to normal if it can fix problem

Code:

BugCheck D1, {28, b, 0, fffff88000c70396}

Unable to load image \SystemRoot\system32\DRIVERS\jraid.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for jraid.sys
*** ERROR: Module load completed but symbols could not be loaded for jraid.sys
Probably caused by : jraid.sys ( jraid+4396 )

Followup: MachineOwner
---------
BugCheck A, {200, 2, 1, fffff80002addb75}

Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_Core_DecIoRequestCount+31 )

Followup: MachineOwner
---------
BugCheck 1A, {8884, fffffa8003708030, fffffa8003708060, 400}

Probably caused by : memory_corruption ( nt!MiRelinkStandbyPage+c6 )

Followup: MachineOwner
---------

Let us know how it goes

Tuan

ristiisa · 09 Jul 2010

ttran said:

jraid.sys was blamed in one of the dmp, it is your JMicron RAID Driver, please download and install fresh copy of it
USBport.sys was blamed as well. In case it is your USBport issue, generic way to solve it is to go to device manager, uninstall all usb device driver under the list of USB then restart your machine

This question seems kinda silly... but i'll ask anyways. Why is there a JMicron RAID driver loaded in my system? My main raid on intel controller and the gigabyte raid controller is disabled in bios.