frequent random BSODs

Page 1 of 8 123 ... LastLast

  1. Posts : 42
    win7
       #1

    frequent random BSODs


    Hi folks.

    I've got a 6-month old OEM, original install of Win7 X64. Until a couple of weeks ago it was stable: no BSODs. Then there was one. Now I'm lucky if I can get through a session without one. They seem to be of random types, according to windbg, though there have been a number of ones pointing at amdppm.sys. They seem to be more frequent if the machine is busier.

    I don't recall installing anything in particular around the time that it started.

    I've tried uninstalling a bunch of unused programs, and my old scanner. I've uninstalled the anti-virus program I was using (avast free) and installing Microsoft Security Essentials instead. I've tried runing Malwarebytes Anti-Malware, with a clean report (when I don't get a random BSOD).

    I'm getting to the point of considering re-installing Win7, but ideally I'd like to figure out what causes this so I can avoid it in future.
      My Computer


  2. Posts : 5,705
    Win7 x64 + x86
       #2

    No memory dumps in this upload, please do the following:
    Upload Dump Files:
    Please go to C:\Windows\Minidump and zip up the contents of the folder. Then upload/attach the .zip file with your next post.
    Left click on the first minidump file.
    Hold down the "Shift" key and left click on the last minidump file.
    Right click on the blue highlighted area and select "Send to"
    Select "Compressed (zipped) folder" and note where the folder is saved.
    Upload that .zip file with your next post.

    If you have issues with "Access Denied" errors, try copying the files to your desktop and zipping them up from there. If it still won't let you zip them up, post back for further advice.

    If you don't have anything in that folder, please check in C:\Windows for a file named MEMORY.DMP. If you find it, zip it up and upload it to a free file hosting service . I recommend Windows Live SkyDrive - http://skydrive.live.com or another free, file-hosting service. Then post the link to it in your topic so that we can download it.

    Then, follow the directions here to set your system for Minidumps (much smaller than the MEMORY.DMP file): Set MiniDump
    The BSOD's noted in the MSINFO32 file aren't very helpful. I'd suggest trying Driver Verifier according to these instructions:
    Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

    So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

    Then, here's the procedure:
    - Go to Start and type in "verifier" (without the quotes) and press Enter
    - Select "Create custom settings (for code developers)" and click "Next"
    - Select "Select individual settings from a full list" and click "Next"
    - Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
    NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
    - Select "Select driver names from a list" and click "Next"
    Then select all drivers NOT provided by Microsoft and click "Next"
    - Select "Finish" on the next page.

    Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

    Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

    If you can't get into Windows because it crashes too soon, try it in Safe Mode.
    If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

    If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:
    Code:
    Delete these registry keys (works in XP, Vista, Win7):
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel
    More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users
      My Computer


  3. Posts : 42
    win7
    Thread Starter
       #3

    minidumps


    here are the minidumps.
      My Computer


  4. Posts : 28,845
    Win 8 Release candidate 8400
       #4

    thargas said:
    here are the minidumps.

    The majority of these were caused by amdpp.sys, and the attempt to write to read only memory.

    You also have some drivers that are old and need to be updated.

    I would
    1- update amdppm.sys which is a processor driver. It may be integral to BIOS, I am no sure.

    2-update the old drivers

    3- run a system file check. Type cmd in search>right click and run as admin>
    sfc /scannow

    Ken




    Old drivers needing updating
    Code:
    SSPORT.sys        fffff880`06170000    fffff880`06178000    0x00008000    0x42fbda34    8/11/2005 19:07:32                        
    secdrv.SYS        fffff880`06138000    fffff880`06143000    0x0000b000    0x4508052e    9/13/2006 09:18:38                        
    AsIO.sys        fffff880`02bc4000    fffff880`02bcb000    0x00007000    0x47663d55    12/17/2007 05:11:49                        
    DgiVecp.sys        fffff880`05223000    fffff880`05233000    0x00010000    0x490a7db5    10/30/2008 23:38:29                        
    NuidFltr.sys        fffff880`03e83000    fffff880`03e8c000    0x00009000    0x4a03f30b    5/8/2009 04:53:31                        
    spldr.sys        fffff880`014e5000    fffff880`014ed000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
    amdxata.sys        fffff880`00d91000    fffff880`00d9c000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59

    Analysis
    Code:
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\K\Desktop\072310-19250-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
    *http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`02a64000 PsLoadedModuleList = 0xfffff800`02ca1e50
    Debug session time: Fri Jul 23 17:25:32.275 2010 (GMT-4)
    System Uptime: 0 days 1:49:05.836
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck BE, {fffff880016fa354, 3ce1121, fffff88002d1b8b0, a}
    
    Probably caused by : amdppm.sys ( amdppm!C1Halt+2 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
    An attempt was made to write to readonly memory.  The guilty driver is on the
    stack trace (and is typically the current instruction pointer).
    When possible, the guilty driver's name (Unicode string) is printed on
    the bugcheck screen and saved in KiBugCheckDriver.
    Arguments:
    Arg1: fffff880016fa354, Virtual address for the attempted write.
    Arg2: 0000000003ce1121, PTE contents.
    Arg3: fffff88002d1b8b0, (reserved)
    Arg4: 000000000000000a, (reserved)
    
    Debugging Details:
    ------------------
    
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xBE
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  d
    
    TRAP_FRAME:  fffff88002d1b8b0 -- (.trap 0xfffff88002d1b8b0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000001f287 rbx=0000000000000000 rcx=000000000001f287
    rdx=000000000002633a rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002adb258 rsp=fffff88002d1ba40 rbp=0000000000000001
     r8=000000000000761a  r9=0000000000000000 r10=0000000000005892
    r11=fffff88007b0bc70 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    nt!KeAccumulateTicks+0xf8:
    fffff800`02adb258 898bd4210000    mov     dword ptr [rbx+21D4h],ecx ds:00000000`000021d4=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002b53388 to fffff80002ad4600
    
    STACK_TEXT:  
    fffff880`02d1b748 fffff800`02b53388 : 00000000`000000be fffff880`016fa354 00000000`03ce1121 fffff880`02d1b8b0 : nt!KeBugCheckEx
    fffff880`02d1b750 fffff800`02ad26ee : fffff880`02d1b938 fffff880`009e8180 00000000`00000010 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x409f4
    fffff880`02d1b8b0 fffff800`02adb258 : fffff8a0`09629000 fffff8a0`07fc8000 fffff8a0`002cd000 fffff8a0`0f3c0000 : nt!KiPageFault+0x16e
    fffff880`02d1ba40 fffff800`02ae1518 : fffff8a0`001df000 fffff880`04705cf0 00000000`00026160 fffffa80`05593d00 : nt!KeAccumulateTicks+0xf8
    fffff880`02d1bad0 fffff800`02ae12a1 : 00000000`00000000 fffff880`02d1bb80 fffff880`009e8180 00000000`00000001 : nt!KeUpdateRunTime+0xb8
    fffff880`02d1bb00 fffff880`02a037f2 : fffff800`02ae213a 00000000`0026da19 fffffa80`05593dd8 fffff880`009f2fc0 : nt!KiSecondaryClockInterrupt+0x131
    fffff880`02d1bc98 fffff800`02ae213a : 00000000`0026da19 fffffa80`05593dd8 fffff880`009f2fc0 00000000`00000001 : amdppm!C1Halt+0x2
    fffff880`02d1bca0 fffff800`02adcdcc : fffff880`009e8180 fffff880`00000000 00000000`00000000 fffff800`02bf4ce0 : nt!PoIdle+0x53a
    fffff880`02d1bd80 00000000`00000000 : fffff880`02d1c000 fffff880`02d16000 fffff880`02d1bd40 00000000`00000000 : nt!KiIdleLoop+0x2c
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    amdppm!C1Halt+2
    fffff880`02a037f2 c3              ret
    
    SYMBOL_STACK_INDEX:  6
    
    SYMBOL_NAME:  amdppm!C1Halt+2
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: amdppm
    
    IMAGE_NAME:  amdppm.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc0fd
    
    FAILURE_BUCKET_ID:  X64_0xBE_VRF_amdppm!C1Halt+2
    
    BUCKET_ID:  X64_0xBE_VRF_amdppm!C1Halt+2
    
    Followup: MachineOwner
    ---------
      My Computer


  5. Posts : 42
    win7
    Thread Starter
       #5

    better but not fixed


    I've been able to work for an hour or two before getting a BSOD. :)

    I've updated the asus chipset sw. Unfortunately, this seems not to have any effect on amdppm.sys.

    I'm working my way through the old drivers you mentioned:
    - replaced the samsung printer driver (ssport.sys) and now I have a non-functional printer
    - disabled (renamed) secdrv.sys as it doesn't sound like anything I want/need
    - found references connecting asio.sys with pc probe, which didn't sound interesting so I uninstalled it.

    I've run "sfc /scannow" and it says the system is clean.
      My Computer


  6. Posts : 5,705
    Win7 x64 + x86
       #6

    Posted before I read your post:
    Update the chipset drivers for your motherboard from the Asus support website.
    Uninstall the Asus PCProbe software from your system (the AsIO.sys driver).
    Uninstall Microsoft Intellitype/IntelliPoint software (the NuidFltr.sys driver)
    Uninstall Samsung Drivers (SSPORT.sys and DgiVecp.sys)

    Posted after I read your post:
    Did the Samsung driver update also update the DgiVecp.sys file?
    Do not rename the secdrv.sys - it is a Windows file and doesn't need updating
      My Computer


  7. Posts : 42
    win7
    Thread Starter
       #7

    DgiVecp.sys


    yes, DgiVecp.sys was updated to 2009-03-02
      My Computer


  8. Posts : 42
    win7
    Thread Starter
       #8

    windows DVD creator


    One thing I've noticed is that I can "reliably" get a BSOD by attempting to create a DVD, and it will always happen before it starts to write to the DVD.

    Thanks for all the detailed instructions. They really do help when one isn't a win7 guru.
      My Computer


  9. Posts : 5,705
    Win7 x64 + x86
       #9

    Generate a BSOD by trying to create a DVD and then upload the memory dump file - we'll have a shot at figuring it out.
      My Computer


  10. Posts : 42
    win7
    Thread Starter
       #10

    I've got a dump...


    but it's 66MB, so it won't fit in skydrive.

    Here's the output of windbg:


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*C:\Websymbols*Symbol information
    Executable search path is: SRV*C:\Websymbols*Symbol information
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
    Machine Name:
    Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
    Debug session time: Sat Jul 24 19:04:35.269 2010 (UTC - 3:00)
    System Uptime: 0 days 0:03:29.220
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........................
    Loading User Symbols

    Loading unloaded module list
    ....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {3, 2, 1, fffff80002a8a0e2}

    Probably caused by : ntkrnlmp.exe ( nt!KiReadyThread+2 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000003, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002a8a0e2, address which referenced memory

    Debugging Details:
    ------------------


    OVERLAPPED_MODULE: Address regions for 'hidusb' and 'crashdmp.sys' overlap

    WRITE_ADDRESS: 0000000000000003

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!KiReadyThread+2
    fffff800`02a8a0e2 4883ec20 sub rsp,20h

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: System

    TRAP_FRAME: fffff88002ffd440 -- (.trap 0xfffff88002ffd440)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000003 rbx=0000000000000000 rcx=fffffa80066ca060
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002a8a0e2 rsp=fffff88002ffd5d0 rbp=fffffa80066ca168
    r8=fffff88002fd7301 r9=0000000000000002 r10=0000000000000063
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!KiReadyThread+0x2:
    fffff800`02a8a0e2 4883ec20 sub rsp,20h
    Resetting default scope

    LAST_CONTROL_TRANSFER: from fffff80002a7db69 to fffff80002a7e600

    STACK_TEXT:
    fffff880`02ffd2f8 fffff800`02a7db69 : 00000000`0000000a 00000000`00000003 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`02ffd300 fffff800`02a7c7e0 : fffffa80`05c37418 fffffa80`066ca168 fffff980`01366ce0 fffff980`0e266c10 : nt!KiBugCheckDispatch+0x69
    fffff880`02ffd440 fffff800`02a8a0e2 : fffffa80`066ca168 fffff800`02a89ab7 fffffa80`066ca120 fffffa80`066ee230 : nt!KiPageFault+0x260
    fffff880`02ffd5d0 fffff800`02a89ab7 : fffffa80`066ca120 fffffa80`066ee230 fffffa80`066ee230 00000000`00000102 : nt!KiReadyThread+0x2
    fffff880`02ffd5e0 fffff800`02a8a57e : 00000000`7cb479e8 fffff880`02ffdc58 00000000`00003463 fffff880`02fd81e8 : nt!KiProcessExpiredTimerList+0x157
    fffff880`02ffdc30 fffff800`02a89d97 : 00000000`1fcfb1c1 00000000`00003463 00000000`1fcfb133 00000000`00000063 : nt!KiTimerExpiration+0x1be
    fffff880`02ffdcd0 fffff800`02a86dfa : fffff880`02fd5180 fffff880`02fdffc0 00000000`00000000 fffff880`04e5f588 : nt!KiRetireDpcList+0x277
    fffff880`02ffdd80 00000000`00000000 : fffff880`02ffe000 fffff880`02ff8000 fffff880`02ffdd40 00000000`00000000 : nt!KiIdleLoop+0x5a


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!KiReadyThread+2
    fffff800`02a8a0e2 4883ec20 sub rsp,20h

    SYMBOL_STACK_INDEX: 3

    SYMBOL_NAME: nt!KiReadyThread+2

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb

    FAILURE_BUCKET_ID: X64_0xA_VRF_nt!KiReadyThread+2

    BUCKET_ID: X64_0xA_VRF_nt!KiReadyThread+2

    Followup: MachineOwner
    ---------
      My Computer


 
Page 1 of 8 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 14:01.
Find Us