Solved BSOD at idle

[Britton30]

Here I am again, I woke up from a nap to a BSOD, nothing was running. This is the 2nd one in two day but I used CCleaner which erased the first one.

system is overclocked but has been rock solid for months. I have installed only one program, UnChecky.
Unchecky - Keeps your checkboxes clear

Diag tool logs.

View attachment 310281

 

[derekimo]

I see no driver being flagged Gary,

It is a Bugcheck 7E,

Bug Check 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (Windows Debuggers)

BugCheck 1000007E, {ffffffff[COLOR="Red"]c0000005,[/COLOR] fffff80003a99710, fffff8800d3e84b8, fffff8800d3e7d10}

Probably caused by : ntkrnlmp.exe ( nt!ObpQueryNameString+127 )

Followup: MachineOwner

0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred.

Bugcheck 7's are usually disk related, so a chkdsk /r might be in order as well as Memtest86+

Maybe Arc or one of the other pro's can dig deeper and see something I don't.

 

[peebee]

This bugcheck was caused by a memory access violation during what looks like the system shutting down the I/O subsystem. The exact crash happened while the CPU was executing a locking instruction on a region of memory that didn't exist, which explains the crash. The call stack doesn't go back far enough but I believe shutting down I/O requires a number of calls to storage drivers, etc. so I would suspect this is caused by a faulty storage driver.

Looks like derekimo and I were replying at the same time. Glad we're on the same page.

Not a pro but I'll give enough insight to support my findings.

[FONT=Courier New][COLOR=#000000]0: kd> uf [/COLOR][COLOR=red]fffff80003a99710 [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Function call that generated the crash[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]nt! ?? ::FNODOBFM::`string'+0x19010:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc29 845f19          test    byte ptr [rdi+19h],bl[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc2c 0f84deba0700    je      nt!ObfReferenceObject+0x20 (fffff800`03a99710)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]nt! ?? ::FNODOBFM::`string'+0x19019:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc32 41b944666c74    mov     r9d,746C6644h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc38 448bc3          mov     r8d,ebx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc3b 0fb6d3          movzx   edx,bl[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc3e 488bcf          mov     rcx,rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc41 e87aa71300      call    nt!ObpPushStackInfo (fffff800`03b583c0)[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc46 90              nop[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a1dc47 e9c4ba0700      jmp     nt!ObfReferenceObject+0x20 (fffff800`03a99710)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]nt!ObfReferenceObject:[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a996f0 48895c2408      mov     qword ptr [rsp+8],rbx[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a996f5 57              push    rdi[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a996f6 4883ec20        sub     rsp,20h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a996fa 833d3f5f190000  cmp     dword ptr [nt!ObpTraceFlags (fffff800`03c2f640)],0[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a99701 488d79d0        lea     rdi,[rcx-30h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a99705 bb01000000      mov     ebx,1[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a9970a 0f851945f8ff    jne     nt! ?? ::FNODOBFM::`string'+0x19010 (fffff800`03a1dc29)[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000] [/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]nt!ObfReferenceObject+0x20:[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff800`03a99710 f0480fc11f      [/COLOR][COLOR=red]lock xadd qword ptr [rdi],rbx [/COLOR][/FONT][COLOR=red][FONT=Wingdings][FONT=Wingdings]ß[/FONT][/FONT][/COLOR][FONT=Courier New][COLOR=red]- Crash[/COLOR][/FONT]
[COLOR=#000000][FONT=Courier New]fffff800`03a99715 488d4301        lea     rax,[rbx+1][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a99719 488b5c2430      mov     rbx,qword ptr [rsp+30h][/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a9971e 4883c420        add     rsp,20h[/FONT][/COLOR]
[COLOR=#000000][FONT=Courier New]fffff800`03a99722 5f              pop     rdi[/FONT][/COLOR]
[FONT=Courier New][COLOR=#000000]fffff800`03a99723 c3              ret[/COLOR][/FONT]

 

[Britton30]

I see no driver being flagged Gary,

It is a Bugcheck 7E,

Bug Check 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (Windows Debuggers)

BugCheck 1000007E, {ffffffff[COLOR=red]c0000005,[/COLOR] fffff80003a99710, fffff8800d3e84b8, fffff8800d3e7d10}
 
Probably caused by : ntkrnlmp.exe ( nt!ObpQueryNameString+127 )
 
Followup: MachineOwner

0xC0000005: STATUS_ACCESS_VIOLATION indicates a memory access violation occurred.

Bugcheck 7's are usually disk related, so a chkdsk /r might be in order as well as Memtest86+

Maybe Arc or one of the other pro's can dig deeper and see something I don't.

OK, thanks Derek. I will do a chkdsk and let memtest run over night.

This bugcheck was caused by a memory access violation during what looks like the system shutting down the I/O subsystem. The exact crash happened while the CPU was executing a locking instruction on a region of memory that didn't exist, which explains the crash. The call stack doesn't go back far enough but I believe shutting down I/O requires a number of calls to storage drivers, etc. so I would suspect this is caused by a faulty storage driver.

English please.

 

[derekimo]

There you go Gary, I like peebee's answer, not sure which driver though.

 

[Britton30]

There you go Gary, I like peebee's answer, not sure which driver though.

If it's a SATA driver, I have 3 on this board, Intel, ASmedia and JMicron.

Here's the result of chkdsk /r, crappy picture but it looks like it was OK? Is there a log created, I looked in C\:Windows\Logs?

View attachment 310286

 

[derekimo]

Looks like Shawn has a tutorial for that,

http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

 

[Britton30]

Looks like Shawn has a tutorial for that,

http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html

Of course he does.
Here it is, it looks like nothing wrong to me.

TimeCreated : Thu  Mar 13  2014 10:21:08 PM
Message     : 
              
              Checking file system on C:
              The type of the file system is NTFS.
              Volume label is Seven SSD.
              
              A disk check has been scheduled.
              Windows will now check the disk.                         
              
              CHKDSK is verifying files (stage 1 of 5)...
                185344 file records processed.                                 
                      
              File verification completed.
                428 large file records processed.                              
                   
                0 bad file records processed.                                  
                 
                2 EA records processed.                                        
                 
                2349 reparse records processed.                                
                    
              CHKDSK is verifying indexes (stage 2 of 5)...
                240782 index entries processed.                                
                      
              Index verification completed.
                0 unindexed files scanned.                                     
                 
                0 unindexed files recovered.                                   
                 
              CHKDSK is verifying security descriptors (stage 3 of 5)...
                185344 file SDs/SIDs processed.                                
                      
              Cleaning up 1788 unused index entries from index $SII of file 0x9
              .
              Cleaning up 1788 unused index entries from index $SDH of file 0x9
              .
              Cleaning up 1788 unused security descriptors.
              Security descriptor verification completed.
                27720 data files processed.                                    
                     
              CHKDSK is verifying Usn Journal...
                35650920 USN bytes processed.                                  
                        
              Usn Journal verification completed.
              CHKDSK is verifying file data (stage 4 of 5)...
                185328 files processed.                                        
                      
              File data verification completed.
              CHKDSK is verifying free space (stage 5 of 5)...
                45099014 free clusters processed.                              
                        
              Free space verification is complete.
              Windows has checked the file system and found no problems.
              
               225045528 KB total disk space.
                44274772 KB in 123187 files.
                   79980 KB in 27721 indexes.
                       0 KB in bad sectors.
                  294720 KB in use by the system.
                   65536 KB occupied by the log file.
               180396056 KB available on disk.
              
                    4096 bytes in each allocation unit.
                56261382 total allocation units on disk.
                45099014 allocation units available on disk.
              
              Internal Info:
              00 d4 02 00 85 4d 02 00 74 3d 04 00 00 00 00 00  .....M..t=......
              62 02 00 00 2d 09 00 00 00 00 00 00 00 00 00 00  b...-...........
              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
              
              Windows has finished checking your disk.
              Please wait while your computer restarts.

 

[derekimo]

That looks alright to me too. I see about 5 drivers related to those names you mentioned earlier.

start             end                 module name
fffff880`01160000 fffff880`01181000   jraid      (deferred)             
    Image path: jraid.sys
    Image name: jraid.sys
    Timestamp:        Tue Aug 10 02:28:44 2010 (4C611BCC)
    CheckSum:         0001F0A6
    ImageSize:        00021000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm iastor
start             end                 module name
fffff880`01205000 fffff880`015a7000   iaStor     (deferred)             
    Image path: iaStor.sys
    Image name: iaStor.sys
    Timestamp:        Fri May 20 09:52:24 2011 (4DD69C48)
    CheckSum:         0008CA08
    ImageSize:        003A2000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm iastorv
start             end                 module name
0: kd> lmvm asmtxhci
start             end                 module name
fffff880`03200000 fffff880`03264000   asmtxhci   (deferred)             
    Image path: asmtxhci.sys
    Image name: asmtxhci.sys
    Timestamp:        Wed Sep 14 00:36:09 2011 (4E705969)
    CheckSum:         0006E608
    ImageSize:        00064000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
0: kd> lmvm asmthub3
start             end                 module name
fffff880`06f14000 fffff880`06f38000   asmthub3   (deferred)             
    Image path: asmthub3.sys
    Image name: asmthub3.sys
    Timestamp:        Wed Sep 14 00:36:19 2011 (4E705973)
    CheckSum:         00027BD1
    ImageSize:        00024000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

None of those jumped out in the dump though.

You could try running driver verifier to see which one Gary,

   Information

Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.
Driver Verifier - Enable and Disable

Driver Verifier will cause your computer to run very sluggishly - this is normal. What it is trying to do is force your system to BSOD and isolate the offending driver/s. When it does, reboot, disable driver verifier, reboot as normal and upload the new dmp file/s here.

I recommend creating a system restore point before turning on driver verifier:
System Restore Point - Create

If your system fails to boot to desktop once driver verifier is enabled, turn it off by booting into Safe Mode:
Safe Mode

 

[derekimo]

Here's what looks like the lead up to the crash, do you have a "K" drive or is that just a partition?

Event[14]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 102
Task: General
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine (6.01.7601.0000) started a new instance (0).

Event[15]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 300
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine is initiating recovery steps.

Event[16]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:45.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02330.log.

Event[17]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:47.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02331.log.

Event[18]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:47.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS02332.log.

Event[19]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:48.000
Event ID: 301
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has begun replaying logfile K:\Users\Search\Data\Applications\Windows\MSS.log.

Event[20]:
Log Name: Application
Source: ESENT
Date: 2014-03-13T20:15:48.000
Event ID: 302
Task: Logging/Recovery
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Windows (3276) Windows: The database engine has successfully completed recovery steps.

Event[21]:
Log Name: Application
Source: Microsoft-Windows-Search
Date: 2014-03-13T20:15:50.000
Event ID: 1003
Task: Search service
Level: Information
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
The Windows Search Service started.


Event[22]:
Log Name: Application
Source: Windows Error Reporting
Date: 2014-03-13T20:16:13.000
Event ID: 1001
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: DataTechV
Description:
Fault bucket X64_0x7E_nt!ObpQueryNameString+127, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1:
P2:
P3:
P4:
P5:
P6:
P7:
P8:
P9:
P10:

Attached files:
C:\Windows\Minidump\031314-8782-01.dmp
C:\Windows\Temp\WER-10311-0.sysdata.xml
C:\Windows\Temp\WER56D6.tmp.WERInternalMetadata.xml

These files may be available here:
C:\Users\GlBritton\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_093c9ba2

Analysis symbol: X64_0x7E_nt!ObpQueryNameString+127
Rechecking for solution: 0
Report Id: 031314-8782-01
Report Status: 0

 

[Britton30]

Ok Derek, thanks, verifier will run as soon as I reboot.
Verifier reminded me I have another storage driver, Marvell.

 

[derekimo]

Ok Derek, thanks, verifier will run as soon as I reboot.
Verifier reminded me I have another storage driver, Marvell.

That's this driver,

start             end                 module name
fffff880`01000000 fffff880`0108c000   mv91xx     (deferred)             
    Image path: mv91xx.sys
    Image name: mv91xx.sys
    Timestamp:        Fri Aug 27 02:49:22 2010 (4C778A22)
    CheckSum:         00050BB0
    ImageSize:        0008C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

That makes 6 drivers so it would probably be easier to run the verifier.

 

[Britton30]

Yeah, I have it running, 3 BSODs so far. One while browsing Newegg, again when restarting twice.

 

[derekimo]

Go ahead and turn it off and upload those dumps.

 

[Britton30]

Here's what looks like the lead up to the crash, do you have a "K" drive or is that just a partition?

Sorry, I missed that post, yes I have a K drive which has my User files and some other data on.

View attachment 310296

Go ahead and turn it off and upload those dumps.

Here it is, I only see one file, unless it has all the events listed.

View attachment 310295

 

[derekimo]

I don't see any other drivers getting flagged, maybe peebee can look deeper.

There is this,

BugCheck 3B, {c0000005, fffff80003a6e49a, fffff8800e6ff0a0, 0}

Unable to load image lsnfd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for lsnfd.sys
*** ERROR: Module load completed but symbols could not be loaded for lsnfd.sys
Probably caused by : lsnfd.sys ( lsnfd+2c35 )

Followup: MachineOwner

Everything I can find for that driver is pointing to adware,

Malware scan of lsnfd.sys (Linksicle Driver x64) 7862b59066d26d150733910d0621413cb2064606 - herdProtect

The bugcheck itself leans toward graphics drivers,

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION (Windows Debuggers)

 

[Britton30]

Thanks again Derek. I have searched and find no instance of lsnfd.sys nor is Linksicle in installed programs nor as an add-on if Fire Fox. Will run Eset and Emisoft online scanners, plus memtest when I go to bed.

I'll try a GPU driver update, I know mine is an older one.

 

[derekimo]

Your msinfo32.nfo shows that lsnfd.sys is in,

lsnfd	c:\windows\system32\drivers\lsnfd.sys

 

[Britton30]

Indeed it was, I deleted it with no trouble. It was dated from Oct 2013.
Eset scan only found ccleanersetup.exe, and a Wireless net work monitor, neither of which are bad.

Memtest was clean no errors, 8 passes in 19 hours.

 

[Gandalf]

As a blind suggestion, you said it was OC'ed? Turn off the OC. You can always turn it back on ofter the issue is solved.
Of course if you then don't get any more dumps, you'll know where the problem is at.