Solved having random BSOD in a pretty new build

[Bluemoon9]

Hi All,

I build my computer a couple months back. Recently after windows update I am getting BSOD randomly. I suspect its rougue driver but can not identify it. Can anybody please help me out a bit?

Here is the DM log collector and SF Diag log

 

[matts6887]

according to the research from google i just looked up; you could have some bad sectors on your hard drive. Run a chkdsk /r /f by right clicking on command prompt and select run as administrator. It may tell you the disk is in use and has been locked. If that happens; schedule it for a disk check and reboot and let the disk check run.

 

[Arc]

Hi Bluemoon9.

The crash dumps are giving a hint about failing memory. It might be the physical RAM, or any driver passing bad info to the memory.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
____________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8022fa4010, 2, 1, fffff80002f3ecb6}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+86 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8022fa4010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f3ecb6, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b9100
GetUlongFromAddress: unable to read from fffff800030b91c0
 fffffa8022fa4010 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  GUI.exe

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

TRAP_FRAME:  fffff8800a21c2b0 -- (.trap 0xfffff8800a21c2b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8008ba4010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f3ecb6 rsp=fffff8800a21c440 rbp=00000000d2000000
 r8=fffff8800a21c470  r9=fffffa8009c75060 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`08ba4010=ffffffffffffffff
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e81169 to fffff80002e81bc0

STACK_TEXT:  
fffff880`0a21c168 fffff800`02e81169 : 00000000`0000000a fffffa80`22fa4010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0a21c170 fffff800`02e7fde0 : ffffd9d0`c10ad2d4 fffff800`02fb5e80 fffff880`0a21c490 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a21c2b0 fffff800`02f3ecb6 : 00000000`00000000 00000000`00000000 fffffa80`08b97230 fffffa80`08b97230 : nt!KiPageFault+0x260
fffff880`0a21c440 fffff800`02ef2bea : 00000000`000001e8 fffff800`02ffce80 00000000`07a71000 00000000`00000000 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`0a21c4c0 fffff800`02e6e3df : fffffa80`00000000 00000000`07b0ffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34f16
fffff880`0a21c680 fffff800`02e80e53 : ffffffff`ffffffff fffff880`0a21c950 fffff880`0a21c958 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`0a21c780 fffff800`02e7d410 : fffff800`030ff477 00000000`00000010 00000000`00000082 fffff880`0a21c948 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0a21c918 fffff800`030ff477 : 00000000`00000010 00000000`00000082 fffff880`0a21c948 00000000`00000001 : nt!KiServiceLinkage
fffff880`0a21c920 fffff800`031570cd : 00000000`07a10000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!RtlFreeUserStack+0x27
fffff880`0a21c950 fffff800`03157431 : fffff880`00000001 00000000`07a0e800 00000000`7efd5000 00000000`00000000 : nt!PspExitThread+0x5dd
fffff880`0a21ca50 fffff800`03157539 : fffffa80`06cdc060 00000000`00000001 fffffa80`06cdc060 00000000`0000008c : nt!PspTerminateThreadByPointer+0x4d
fffff880`0a21caa0 fffff800`02e80e53 : fffffa80`06cdc060 fffff880`0a21cb60 00000000`7efd5000 ffffffff`fffffffe : nt!NtTerminateThread+0x45
fffff880`0a21cae0 00000000`77dd01af : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07a0e728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77dd01af


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02f3ecb6 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

IMAGE_VERSION:  6.1.7601.18409

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xa_nt!mireleaseconfirmedpagefilespace+86

FAILURE_ID_HASH:  {60ecfce8-0ae8-e101-bee9-632596f9724b}

Followup: MachineOwner
---------

 

[Bluemoon9]

Thanks a lot Matts6887 and Arc. I will run chldsk, memtest and DV tonight and report back.

 

[Bluemoon9]

Wow! I started verifier and the computer won't boot. It shows the windows boot screen and then BSOD. I went to safe mode and disabled verifier and it booted again. Chkdsk shows no errors.

So What should I do now? I am thinking enabling one driver at a time and see if verifier works. But its a tedious process. Any better idea?
I will run memtest in the night.

I attach the dump files here. Any idea from these?

Thanks again for your very valuable help so far.

 

[matts6887]

Yes you could try enabling one driver at a time to try and identify which one(s) are causing the issues you are having.

 

[Bluemoon9]

I also see this error message in event viewer.

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c9 (0x000000000000023e, 0xfffff88000db4324, 0xfffff9800b64cee0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 072514-17191-01

 

[matts6887]

Did you post the dump from the above bug check?

 

[Bluemoon9]

Yes Here is it again. File name 072514-17191-01.dmp, its in Dump.rar compressed archive.

Thanks a lot for replying and helping me.

 

[Bluemoon9]

Hi All,

I ran a free tool called bluescreenview and I see twice it is crashed by ntoskrnl.exe and once bydtsoftbus01.sys

I ran the WD HDD check utility and it doesn't report an error. What should I do next? a clean win7 install?

 

[Arc]

Hi All,

I ran a free tool called bluescreenview and I see twice it is crashed by ntoskrnl.exe and once bydtsoftbus01.sys

I ran the WD HDD check utility and it doesn't report an error. What should I do next? a clean win7 install?

It is Daemon tools.

BugCheck C9, {23e, fffff88000db4324, fffff9800b64cee0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\dtsoftbus01.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dtsoftbus01.sys
*** ERROR: Module load completed but symbols could not be loaded for dtsoftbus01.sys
[COLOR=Red]Probably caused by : dtsoftbus01.sys[/COLOR] ( dtsoftbus01+1324 )

Followup: MachineOwner
---------

Daemon Tools, Alcohol 120% and Power Archiver Pro uses SCSI Pass Through Direct (SPTD), which is a well known BSOD causer. Uninstall Daemon Tools at first. Then download SPTD standalone installer from Disk-Tools.com, and execute the downloaded file as guided below :

• Double click to open it.
• Click this button only:
• 
• If it is grayed out, as in the picture, there is no more SPTD in your system, and you just close the window.

Then continue with driver verifier. I doubt that Daemon Tools is the soul cause of the issue.

Disc check or clean install is not a thing to consider at this stage of troubleshooting.

BTW, as per the suggestion, you should have enabled driver verifier only if the memtest is free from errors. So what is the result of memtest?

 

[Bluemoon9]

Hi Arc,

First, Thank you for helping me.

I forgot about memtest. I ran that for 5 passes yesterday night from a bootable CD, and it came out clean. I will try to run verifier now, and then I will run the memtest for a few passes again.

I will report the results after that.

And I will follow your instructions about Daemon tools before running verifier.

 

[Arc]

You are supposed to run memtest86+ for at least 8 consecutive passes in order to attain at a meaningful inference about the state of the RAM.

I am saying about it, because as it is a memory malfunction related issue, driver verifier might not be a feasible tool of troubleshooting before making it sure that the physical RAM is OK or not.

 

[Bluemoon9]

Okk.. I will run memtest overnight today. Hope it will complete 8 passes.

 

[Bluemoon9]

Hi All,

I removed Daemon tools and the SPDT drivers. And now I could log into windows with verifier on with all driver checked (except Microsoft one). I used the system normally today, ran the only system intensive game I have (Watch dogs) for a couple hours. played a HD movie etc etc.. Have not experienced any BSOD Yay..

happy too soon. Before I went out for some chores today afternoon I put the system on memtest for 8 passes. Now I came back and I see it has thrown 25 errors!!!! It says expected and actual values are different.

Ok, my memory is a single Corsair vengenance 1600 Mhz 8 Gb stick, just a couple months old. So are the 25 errors worth RMA ing the memory?

Thanks for all your help so far.

 

[Arc]

That is why I was forcing you to memtest.

As it is single stick, the best option is to change the RAM. If it is still within warranty, you should definitely RMA it.

Let us know how the computer is running with the replacement RAM.

Before you get the replacement, you may run memtest86+ again, applying the RAM in another DIMM slot.

 

[Bluemoon9]

Hi Arc,

Thank you for vary valuable help.

RAM is under warranty, its just a couple months old. I will try it in another Slot. If it is throws error again, definitely its time for RMA. If not, I guess my mobo has gone bad .

I do not have a replacement RAM stick, and Corsair takes around a week to RMA in my country. I work a lot in VM's, so I am thinking to get another stick before I RMA this. 16 GB will be good for a couple more VM's

 

[Arc]

I do not have a replacement RAM stick, and Corsair takes around a week to RMA in my country.

I am from your country, too.

 

[Bluemoon9]

I do not have a replacement RAM stick, and Corsair takes around a week to RMA in my country.

I am from your country, too.

Great to see a fellow Indian here . And again thanks for your help.

Any experiemce with Corssair RMA? I called up corsair support (Kaizen infotech) and they said 5 working days to replace it. This corresponds to the experience of my colleague, who RMA'd a SSD and it took a week.

 

[Arc]

Yes, RMA takes more or less a week. But if the vendor is close to you (my vendor is my friend), they may replace the part to you on sight, taking the load of RMA on him/them.