Solved BSOD Windows blue-screens when 100% cpu, and some randoms

[Leon]

Hi Everyone.

First of all, don't bite me when i type with some errors, my english in writing is not very good.

I have built my pc 14 weeks ago. First i had a motherboard DOA, but was replaced in 2 day's. I'm not a beginner, have built a lot of custom computers, but with this problem i'm getting stuck. In the first weeks it runs perfectly, but when i was running quickpar for checking and reparing Blu-ray 3D Movies the cpu load runs to 100%, because i have a liqued cooled system the temp stay's in full load under 30 degrees. When i don't use quickpar the computer runs good until it stops, and then i get random BSOD. All driver are up to date. CPU tested with prime95 x64 for 48 hours and no problem, memtest oke. So i need a little help for narrow it down, where the problem is. I have used the diagnostic tool for the files needed, and make a rar of it.

I hope that you can give me some direction

 

[koolkat77]

Please post the following report before we proceed:

• Windows Genuine and Activation Issue Posting Instructions

 

[Leon]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-KVBFF-KDKKP-6CC9M
Windows Product Key Hash: P76o8zhNsuRMoNWPTa0DdRwD7G0=
Windows Product ID: 00426-956-1108927-85500
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {5A79F1CA-4788-4F57-9A2E-FD39D4DA2173}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5A79F1CA-4788-4F57-9A2E-FD39D4DA2173}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6CC9M</PKey><PID>00426-956-1108927-85500</PID><PIDType>5</PIDType><SID>S-1-5-21-4161907408-3347110270-905795766</SID><SYSTEM><Manufacturer>To Be Filled By O.E.M.</Manufacturer><Model>To Be Filled By O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P2.00</Version><SMBIOSVersion major="2" minor="6"/><Date>20120830000000.000000+000</Date></BIOS><HWID>A07B3D07018400FC</HWID><UserLCID>0413</UserLCID><SystemLCID>0413</SystemLCID><TimeZone>West-Europa (standaardtijd)(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 
Spsys.log Content: 0x80070002
Licensing Data-->
Versie van Software Licensing-service: 6.1.7601.17514
Naam: Windows(R) 7, Ultimate edition
Beschrijving: Windows Operating System - Windows(R) 7, RETAIL channel
Activerings-id: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Toepassings-id55c92734-d682-4d71-983e-d6ec3f16059f
Uitgebreide PID: 00426-00170-956-110892-00-1043-7601.0000-2782012
Installatie-id007653826165973716029112153675580573154286351401789110
URL van processorcertificaat: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
URL van computercertificaat: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
URL van gebruikte licentie: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
URL van productcodecertificaat: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Gedeeltelijke productcode: 6CC9M
Licentiestatus: licentie
Resterend aantal nieuwe Windows-activeringen: 3
Vertrouwde tijd: 21-1-2013 9:46:08
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:4:2013 04:15
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: OgAAAAIABAABAAEAAQACAAAAAwABAAEAln0mUXcWRHhU8sAIGkgQM2KQWMOy+06R6ILgcJ7Vn9XIYA==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
AAFT ALASKA OEMAAFT 
SSDT AMD POWERNOW

 

[koolkat77]

Report looks fine.
What antivirus do you use?

 

[Leon]

It CA Antivirus. My work is paying for it, because i have to login externaly into the system.

Hope it helps

 

[koolkat77]

Well is this a work PC or your personal one?

 

[Leon]

No, its a personal computer, but i have to login into the server at my work, so everyone who have to login externaly, are told to install CA antivirus, but my boss is paying for it.

This computer is made for gaming only, so big videocard and audio are the main thing for this computer. I can get the BSOD when running Spotnet ( a downloading program) and quickpar, the cpu load is 100% and memory about a 5 GB, it usualy takes 2 minutes for getting the BSOD. I personaly was thinking about the motherboard. When i run those programs all the information that was downloaded on my harddrive has to be checked and fixed, but in the backround the program is still downloading to that same hard disk drive. I think that the motherboard is not good enough for that kind of work. Besides that, the computer can run winamp for a 36 - 48 hours before the system is getting the same BSOD

Is it possible that it could be a to slow, (cheap) motherboard. I was checking on a high end bord the: ASUS Crosshair V Formula-Z, but that board costs about 210 euro's that about 280 US Dollar. But let me know what you think

Thanks

 

[Leon]

One other thing. When i bought this motherboard i did a bios update, en i did have changed some values in the bios. But that was for achi mode so windows was starting normaly.

I also have checked the option to show in the post screen the code information. The Values A3 and B4 can take up to 30 seconds to continie booting windows. I have checked the asrock website and thos errors are usb related. First i changed mouse and keyboard to the old ps2 ports, and no usb hardware was connected, but the long wait in the post info screen before booting to windows has not changed. And i also removed the usb3 drivers. But maby it helps you to help me find a problem

Thanks

 

[koolkat77]

I've actually run out of ideas so I've requested a friend to take a look at your thread.

Please wait for a reply and sorry again.

 

[Leon]

I've actually run out of ideas so I've requested a friend to take a look at your thread.

Please wait for a reply and sorry again.

Hi Koolcat77

Thanks anyway for looking into my problem, and i'm very happy with any help i can get. Don't be sorry you have done your best. I will wait for your friend, i hope he has an idea. Thank you so far.

 

[Vir Gnarus]

Your wifi driver (RTL8192su.sys;Realtek) was doing most of the workload for the thread that caused that single crash. While I can't tell anything beyond this tiny minidump, that's where we can start with. I saw the driver dated from Aug 2011, so you may wanna check for an update with it, also checking an update for your BIOS as well since that can interfere as well. I assume this is a USB wifi dongle given that I'm seeing USB activity in the stack as well, and I know from experience those wifi dongles can sometimes be a little iffy in stability when it comes to drivers.

If none of the previous recommendations fixes anything, I recommend you turn on Driver Verifier, let it crash the system some, and then send us the crashdumps.

Oh, and don't rule out the CA Antivirus here. I've seen it cause stability issues with people, so it wouldn't be any exception here. However, as of now it is not a prime suspect given the current (albeit sparse) data.

Analysts:

One of the first items to look at in a crashdump is the raw stack of the faulting thread. I'll forgo using Niemiro's tidy little extension he's made for Windbg for such an occasion and demonstrate how to do so without:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000100000023, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800033b624c, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExAllocatePoolWithTag+16c
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800311a640 -- (.trap 0xfffff8800311a640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=fffffa800afe9ed1
rdx=fffffa8007c937c1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033b624c rsp=fffff8800311a7d8 rbp=fffffa8000000000
 r8=0000000000000801  r9=fffff8000320c000 r10=fffff880009eab20
r11=fffff8800311a9b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x16c:
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h] ds:00000001`00000023=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000328a569 to fffff8000328afc0

STACK_TEXT:  
fffff880`0311a4f8 fffff800`0328a569 : 00000000`0000000a 00000001`00000023 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0311a500 fffff800`032891e0 : fffff880`0311a970 00000000`ee795b35 fffffa80`072f36d0 fffffa80`07c937b0 : nt!KiBugCheckDispatch+0x69
fffff880`0311a640 fffff800`033b624c : fffff880`026f20de fffffa80`08ecc7f0 fffff880`016c64e0 fffff880`0272d5c0 : nt!KiPageFault+0x260
fffff880`0311a7d8 00000000`00000000 : 00000000`00000000 00000000`37383138 fffff880`0747e0c7 fffff880`0747f340 : nt!ExAllocatePoolWithTag+0x16c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+16c
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+16c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0xC5_2_nt!ExAllocatePoolWithTag+16c

BUCKET_ID:  X64_0xC5_2_nt!ExAllocatePoolWithTag+16c

Followup: MachineOwner
---------

1: kd>[COLOR=Blue] !thread[/COLOR]
GetPointerFromAddress: unable to read from fffff800034ba000
THREAD fffff880009f50c0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff800033f9ba4
Owning Process            fffff8000340c180       Image:         <Unknown>
Attached Process          fffffa80066dd040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1022583      
Context Switch Count      1095647        IdealProcessor: 1             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80003282c70)
Stack Init fffff8800311bc70 Current fffff8800311bc00
[COLOR=Teal]Base fffff8800311c000[/COLOR] [COLOR=Purple]Limit fffff88003116000[/COLOR] Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0311a4f8 fffff800`0328a569 : 00000000`0000000a 00000001`00000023 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0311a500 fffff800`032891e0 : fffff880`0311a970 00000000`ee795b35 fffffa80`072f36d0 fffffa80`07c937b0 : nt!KiBugCheckDispatch+0x69
fffff880`0311a640 fffff800`033b624c : fffff880`026f20de fffffa80`08ecc7f0 fffff880`016c64e0 fffff880`0272d5c0 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`0311a640)
fffff880`0311a7d8 00000000`00000000 : 00000000`00000000 00000000`37383138 fffff880`0747e0c7 fffff880`0747f340 : nt!ExAllocatePoolWithTag+0x16c

1: kd> [COLOR=Blue]dps [/COLOR][COLOR=Purple]fffff88003116000 [/COLOR][COLOR=Teal]fffff8800311c000[/COLOR]     [COLOR=Green]//start of range is [I]Limit[/I], end of range is [I]Base[/I], since stacks grow backwards.[/COLOR]
fffff880`03116000  ????????`????????
fffff880`03116008  ????????`????????
fffff880`03116010  ????????`????????    [COLOR=Green]//Currently unused portion of stack[/COLOR]
fffff880`03116018  ????????`????????
fffff880`03116020  ????????`????????
fffff880`03116028  ????????`????????

...

fffff880`03119ff0  ????????`????????
fffff880`03119ff8  ????????`????????
fffff880`0311a000  00000000`00000000    [COLOR=Green] //Current top of stack[/COLOR]
fffff880`0311a008  00000000`00000000
fffff880`0311a010  00000000`37383138
fffff880`0311a018  fffff800`0328afc0 nt!KeBugCheckEx
fffff880`0311a020  00000000`00000000
fffff880`0311a028  00000000`00000000
fffff880`0311a030  00000000`00000000

...

fffff880`0311a938  fffffa80`0c4a6000
fffff880`0311a940  fffff880`0311a9c8
fffff880`0311a948  fffff880`0d2d0392 [COLOR=Red]RTL8192su+0xe392[/COLOR]
fffff880`0311a950  00000000`00000000
fffff880`0311a958  00000000`00000000

...

fffff880`0311b4d0  00000068`06938100
fffff880`0311b4d8  fffff880`0d338618 RTL8192su+0x76618
fffff880`0311b4e0  fffffa80`0c5c8000
fffff880`0311b4e8  fffff880`07d4cd8f [COLOR=DarkRed]usbhub!UsbhPdoInternalDeviceControl+[/COLOR]0x373
fffff880`0311b4f0  00000000`00000000     [COLOR=Green]//Current bottom of stack. Notice USB activity in stack.
[/COLOR]fffff880`0311b4f8  ????????`????????
fffff880`0311b500  ????????`????????

 

[Leon]

I just forced the BSOD, it was about 10 minuts ago, did run the diagnotic tool again, and i will post it here. There are a few files more her than in the first post. Hope this wll helps. By the way, The BSOD was something like driver irg not less or equal. and the first codeline was ending at 0002, but the time was to short to write it down all.

Thank you all.

 

[Leon]

Your wifi driver (RTL8192su.sys;Realtek) was doing most of the workload for the thread that caused that single crash. While I can't tell anything beyond this tiny minidump, that's where we can start with. I saw the driver dated from Aug 2011, so you may wanna check for an update with it, also checking an update for your BIOS as well since that can interfere as well. I assume this is a USB wifi dongle given that I'm seeing USB activity in the stack as well, and I know from experience those wifi dongles can sometimes be a little iffy in stability when it comes to drivers.

If none of the previous recommendations fixes anything, I recommend you turn on Driver Verifier, let it crash the system some, and then send us the crashdumps.

Oh, and don't rule out the CA Antivirus here. I've seen it cause stability issues with people, so it wouldn't be any exception here. However, as of now it is not a prime suspect given the current (albeit sparse) data.

Analysts:

One of the first items to look at in a crashdump is the raw stack of the faulting thread. I'll forgo using Niemiro's tidy little extension he's made for Windbg for such an occasion and demonstrate how to do so without:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000100000023, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff800033b624c, address which referenced memory
 
Debugging Details:
------------------
 
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
 
BUGCHECK_STR:  0xC5_2
 
CURRENT_IRQL:  2
 
FAULTING_IP: 
nt!ExAllocatePoolWithTag+16c
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h]
 
CUSTOMER_CRASH_COUNT:  1
 
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
 
PROCESS_NAME:  System
 
TRAP_FRAME:  fffff8800311a640 -- (.trap 0xfffff8800311a640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffffff rbx=0000000000000000 rcx=fffffa800afe9ed1
rdx=fffffa8007c937c1 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033b624c rsp=fffff8800311a7d8 rbp=fffffa8000000000
 r8=0000000000000801  r9=fffff8000320c000 r10=fffff880009eab20
r11=fffff8800311a9b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x16c:
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h] ds:00000001`00000023=????????
Resetting default scope
 
LAST_CONTROL_TRANSFER:  from fffff8000328a569 to fffff8000328afc0
 
STACK_TEXT:  
fffff880`0311a4f8 fffff800`0328a569 : 00000000`0000000a 00000001`00000023 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0311a500 fffff800`032891e0 : fffff880`0311a970 00000000`ee795b35 fffffa80`072f36d0 fffffa80`07c937b0 : nt!KiBugCheckDispatch+0x69
fffff880`0311a640 fffff800`033b624c : fffff880`026f20de fffffa80`08ecc7f0 fffff880`016c64e0 fffff880`0272d5c0 : nt!KiPageFault+0x260
fffff880`0311a7d8 00000000`00000000 : 00000000`00000000 00000000`37383138 fffff880`0747e0c7 fffff880`0747f340 : nt!ExAllocatePoolWithTag+0x16c
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+16c
fffff800`033b624c 8b4824          mov     ecx,dword ptr [rax+24h]
 
SYMBOL_STACK_INDEX:  3
 
SYMBOL_NAME:  nt!ExAllocatePoolWithTag+16c
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: nt
 
IMAGE_NAME:  ntkrnlmp.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be
 
FAILURE_BUCKET_ID:  X64_0xC5_2_nt!ExAllocatePoolWithTag+16c
 
BUCKET_ID:  X64_0xC5_2_nt!ExAllocatePoolWithTag+16c
 
Followup: MachineOwner
---------
 
1: kd>[COLOR=blue] !thread[/COLOR]
GetPointerFromAddress: unable to read from fffff800034ba000
THREAD fffff880009f50c0  Cid 0000.0000  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff800033f9ba4
Owning Process            fffff8000340c180       Image:         <Unknown>
Attached Process          fffffa80066dd040       Image:         System
fffff78000000000: Unable to get shared data
Wait Start TickCount      1022583      
Context Switch Count      1095647        IdealProcessor: 1             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address nt!KiIdleLoop (0xfffff80003282c70)
Stack Init fffff8800311bc70 Current fffff8800311bc00
[COLOR=teal]Base fffff8800311c000[/COLOR] [COLOR=purple]Limit fffff88003116000[/COLOR] Call 0
Priority 16 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 0 PagePriority 0
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0311a4f8 fffff800`0328a569 : 00000000`0000000a 00000001`00000023 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0311a500 fffff800`032891e0 : fffff880`0311a970 00000000`ee795b35 fffffa80`072f36d0 fffffa80`07c937b0 : nt!KiBugCheckDispatch+0x69
fffff880`0311a640 fffff800`033b624c : fffff880`026f20de fffffa80`08ecc7f0 fffff880`016c64e0 fffff880`0272d5c0 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`0311a640)
fffff880`0311a7d8 00000000`00000000 : 00000000`00000000 00000000`37383138 fffff880`0747e0c7 fffff880`0747f340 : nt!ExAllocatePoolWithTag+0x16c
 
1: kd> [COLOR=blue]dps [/COLOR][COLOR=purple]fffff88003116000 [/COLOR][COLOR=teal]fffff8800311c000[/COLOR]     [COLOR=green]//start of range is [I]Limit[/I], end of range is [I]Base[/I], since stacks grow backwards.[/COLOR]
fffff880`03116000  ????????`????????
fffff880`03116008  ????????`????????
fffff880`03116010  ????????`????????    [COLOR=green]//Currently unused portion of stack[/COLOR]
fffff880`03116018  ????????`????????
fffff880`03116020  ????????`????????
fffff880`03116028  ????????`????????
 
...
 
fffff880`03119ff0  ????????`????????
fffff880`03119ff8  ????????`????????
fffff880`0311a000  00000000`00000000    [COLOR=green] //Current top of stack[/COLOR]
fffff880`0311a008  00000000`00000000
fffff880`0311a010  00000000`37383138
fffff880`0311a018  fffff800`0328afc0 nt!KeBugCheckEx
fffff880`0311a020  00000000`00000000
fffff880`0311a028  00000000`00000000
fffff880`0311a030  00000000`00000000
 
...
 
fffff880`0311a938  fffffa80`0c4a6000
fffff880`0311a940  fffff880`0311a9c8
fffff880`0311a948  fffff880`0d2d0392 [COLOR=red]RTL8192su+0xe392[/COLOR]
fffff880`0311a950  00000000`00000000
fffff880`0311a958  00000000`00000000
 
...
 
fffff880`0311b4d0  00000068`06938100
fffff880`0311b4d8  fffff880`0d338618 RTL8192su+0x76618
fffff880`0311b4e0  fffffa80`0c5c8000
fffff880`0311b4e8  fffff880`07d4cd8f [COLOR=darkred]usbhub!UsbhPdoInternalDeviceControl+[/COLOR]0x373
fffff880`0311b4f0  00000000`00000000     [COLOR=green]//Current bottom of stack. Notice USB activity in stack.[/COLOR]
fffff880`0311b4f8  ????????`????????
fffff880`0311b500  ????????`????????

Hi. I will check for the realtec drivers, and will update them, and the bios to. I already downloaded the newest bios, I will install it on next restart. You are right about the USB WIFI Dongle for internet connection. I will disconnect this one and use a cable. When i was writing the previous post with the new sf tool data files i saw the message from you. So the sf tool log files are before i did anything that you advised me about.

I'll let you know very soon. Thanks so far

 

[Leon]

A little update. I did a bios update, and did run the latest driver for the RTL8192su But the latest drivers fot my usb wifi dongle are from march 2010, so it not been updated ever. As soon as possible i will install a cable for my internet connection using the onboard LAN port, and i will remove the usb dongle. Then i will run the driver verifier as told, and will try to force a BSOD again, so that you will have some more data. When it happens i post here again.

Thanks

 

[Leon]

Hi

Another little update. Pc has been running for 9 hours, and did just reboot for the uninstallation of CA Antivirus. You said that it was not the primary suspect, but i want to make it as easy as possible for you guys to id the problem. I installed MS security essentials, because i read something about that in another threat. Still using the USB wifi dongle, but its morning over here, so i will buy some utp cable and connect the pc with it, and i will start driver verifier as told, and will try to get BSOD.

Thanks so far

 

[Leon]

Here Again.

I did install a network cable for internet connection. I have done all the things said. But now i have a problem with driver verifier. I used the link shortcut to set the options right, but at step 6 wher jou have to select all the drivers that are not supported bij microsoft, there are 2 items in that list, but both are supported by microsoft. See image attached here. I tried to continiue, but i have to select at least one.

Thanks

 

[Vir Gnarus]

Are you trying to do this all in a diagnostic startup or safe mode? Either of those will greatly reduce the amount of drivers loaded during startup. Driver Verifier will only present drivers that it sees are currently loaded.

 

[Leon]

Just had a BSOD like 10 minuts ago. I was forcing the BSOD. Full downloading and was playing Far cry 3 for 1 hour and 6 minutes, see zip file attached. I checked for the startupmode in msconfig It's on the third on. You have normal mode, diagnostic and selective. Mine was on selective, but all boxes are checked. I have set it on normal mode, and will reboot system, than i will try driver verifier again.

 

[Leon]

Just had a BSOD like 10 minuts ago. I was forcing the BSOD. Full downloading and was playing Far cry 3 for 1 hour and 6 minutes, see zip file attached. I checked for the startupmode in msconfig It's on the third on. You have normal mode, diagnostic and selective. Mine was on selective, but all boxes are checked. I have set it on normal mode, and will reboot system, than i will try driver verifier again.

I did a normal mode restart, and have run driver verifier again, but it makes no difference in the outcome, still the same two results i can check. Or am i doing somthing wrong.

Thanks

 

[Vir Gnarus]

This is very unusual behavior. Either you incidentally omitted drivers from starting up, or something is causing Driver Verifier to not see the loaded module list properly, which I can't think of anything outside of malware doing that. Have you ran through any procedures to get your system scanned for malware?

I'm seeing hardware-related problems in some of the new crashdumps, especially stuff like IP misalignments which are commonly caused by hardware failure.

I'm curious, is your system stable without the wifi dongle connected, or are you waiting to get that cable first before you decide to test it that way?