BSOD on Windows 7 64-bit only when logoff/shutdown - PROFILE SPECIFIC

kuromi777 · Jul 8, 2015

Hi!

This is my first post, so please let me know if you need more information, or I'm missing something.

We've had about 8 HP workstations all have Blue Screens only when users log do a log off or shutdown.
This occurrence is profile specific, meaning if this happens for 1 user on a particular workstation, it will not happen if I log in to the same workstation and do a log off/shutdown. These are all HP desktops, different models, different RAM, CPU, etc. All 8 are running Windows 7 Enterprise 64-bit. We run SCCM 2013 to push out our updates and run Symantec Antivirus.

We've gotten around the issue by just recreating the affect user's profile. However, this is only a workaround and if there is better solution, we are open to suggestion.

These blue screens have all occurred after the latest Windows 7 Updates were applied (June 2015). NOTE - in our organization, we only install security patches or mandatory updates.

I've checked the dumps and the analysis is the same...

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c0119050, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600022283c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

READ_ADDRESS: fffff900c0119050 Paged session pool
FAULTING_IP:
win32k!SpNotifyLSurfaceRedirSurfAssoc+14
fffff960`0022283c 488b4940 mov rcx,qword ptr [rcx+40h]
MM_INTERNAL_CODE: 0
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 556356ff
MODULE_NAME: win32k
FAULTING_MODULE: fffff96000040000 win32k
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre
TRAP_FRAME: fffff88002d52630 -- (.trap 0xfffff88002d52630)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffff900c0119010
rdx=000000000512086e rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600022283c rsp=fffff88002d527c0 rbp=0000000000000000
r8=fffff900c215f5a8 r9=0000000000000000 r10=00000000000017c7
r11=fffff88002d52810 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32k!SpNotifyLSurfaceRedirSurfAssoc+0x14:
fffff960`0022283c 488b4940 mov rcx,qword ptr [rcx+40h] ds:fffff900`c0119050=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f43c07 to fffff80002ec7a40
STACK_TEXT:
fffff880`02d524c8 fffff800`02f43c07 : 00000000`00000050 fffff900`c0119050 00000000`00000000 fffff880`02d52630 : nt!KeBugCheckEx
fffff880`02d524d0 fffff800`02ec5b6e : 00000000`00000000 fffff900`c0119050 fffff900`c1c05c00 fffff900`c215f7a8 : nt! ?? ::FNODOBFM::`string'+0x41c2f
fffff880`02d52630 fffff960`0022283c : 000007ed`c021be38 fffff960`0010900b fffff900`c0772010 fffff960`001de820 : nt!KiPageFault+0x16e
fffff880`02d527c0 fffff960`002ce041 : fffff900`c0119010 fffff900`c215f7a8 fffff900`c215f5a8 fffff960`002ce670 : win32k!SpNotifyLSurfaceRedirSurfAssoc+0x14
fffff880`02d52810 fffff960`002cda41 : fffff900`c0772010 00000000`00000001 fffff900`c215f590 00000000`0512086e : win32k!SFMLOGICALSURFACE::SetShape+0xd1
fffff880`02d52860 fffff960`002cea77 : 00000000`00000000 00000000`0512086e fffff900`c0772010 00000000`00000002 : win32k!SFMLOGICALSURFACE:

eInitialize+0x71
fffff880`02d528a0 fffff960`001101b5 : 00000000`0512086e 00000000`00000001 00000000`00000268 00000000`00000000 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
fffff880`02d528e0 fffff960`00277f6d : 00000000`00000268 00000000`00000001 00000000`00000000 00000000`4d504f47 : win32k!NtGdiCloseProcess+0x6d
fffff880`02d52940 fffff960`00131fe5 : 00000000`00000000 fffff880`07419000 fffff8a0`06ac82a0 fffff880`0000028d : win32k!MultiUserNtGreCleanup+0x8d
fffff880`02d52980 fffff800`0311192c : 00000000`00000001 00000000`00000000 fffff880`07419000 fffffa80`0735cb50 : win32k!Win32KDriverUnload+0xa5
fffff880`02d529d0 fffff800`03211435 : fffff880`02d52a68 00000000`0000002a 00000000`00000000 fffff880`07419000 : nt!MiDereferenceSessionFinal+0xfc
fffff880`02d52a70 fffff800`02e99954 : fffff800`0305a940 fffff8a0`12d3c5e0 00000000`00000000 fffffa80`07108b30 : nt! ?? ::NNGAKEGL::`string'+0x2a3b5
fffff880`02d52aa0 fffff800`0319c156 : fffff8a0`12d3c5e0 00000000`00000000 fffffa80`0735cb50 fffffa80`0735cb50 : nt!MmCleanProcessAddressSpace+0x628
fffff880`02d52af0 fffff800`0319c52d : fffff8a0`00000000 fffff800`03161a01 00000000`00000000 fffffa80`08d3c3e0 : nt!PspExitThread+0x56a
fffff880`02d52bf0 fffff800`02eb9426 : fffff880`03172180 00000000`00000080 fffffa80`0735cb50 fffff880`02d52d40 : nt!PspTerminateThreadByPointer+0x4d
fffff880`02d52c40 00000000`00000000 : fffff880`02d53000 fffff880`02d4d000 fffff880`0c610740 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SpNotifyLSurfaceRedirSurfAssoc+14
fffff960`0022283c 488b4940 mov rcx,qword ptr [rcx+40h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!SpNotifyLSurfaceRedirSurfAssoc+14
FOLLOWUP_NAME: MachineOwner
IMAGE_VERSION: 6.1.7601.18869
FAILURE_BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14
BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_win32k!spnotifylsurfaceredirsurfassoc+14
FAILURE_ID_HASH: {f5333549-c6e4-fdbc-f193-fb7666686780}
Followup: MachineOwner
---------

Has anyone else experienced this? I can't seem to find any posts with this specific issue.
I'm thinking something somehow in the particular Windows profile has been corrupted but can't figure out what or how to resolve.

bd3D · Jul 9, 2015

kuromi777 said:
Hi!

Has anyone else experienced this? I can't seem to find any posts with this specific issue.
I'm thinking something somehow in the particular Windows profile has been corrupted but can't figure out what or how to resolve.

Me do did doesing...

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c00cb050, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600022283c, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003510100
 fffff900c00cb050 

FAULTING_IP: 
win32k!SpNotifyLSurfaceRedirSurfAssoc+14
fffff960`0022283c 488b4940        mov     rcx,qword ptr [rcx+40h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800741c770 -- (.trap 0xfffff8800741c770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffff900c00cb010
rdx=0000000007120710 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600022283c rsp=fffff8800741c900 rbp=0000000000000000
 r8=fffff900c1abdcd8  r9=0000000000000000 r10=0000000000000642
r11=fffff8800741c950 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
win32k!SpNotifyLSurfaceRedirSurfAssoc+0x14:
fffff960`0022283c 488b4940        mov     rcx,qword ptr [rcx+40h] ds:fffff900`c00cb050=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000334fc07 to fffff800032d3a40

STACK_TEXT:  
fffff880`0741c608 fffff800`0334fc07 : 00000000`00000050 fffff900`c00cb050 00000000`00000000 fffff880`0741c770 : nt!KeBugCheckEx
fffff880`0741c610 fffff800`032d1b6e : 00000000`00000000 fffff900`c00cb050 fffff900`c23bd700 fffff900`c1abded8 : nt! ?? ::FNODOBFM::`string'+0x41c2f
fffff880`0741c770 fffff960`0022283c : 00000216`c0213210 fffff960`0010900b fffff900`c1bfb880 fffff960`001de820 : nt!KiPageFault+0x16e
fffff880`0741c900 fffff960`002ce041 : fffff900`c00cb010 fffff900`c1abded8 fffff900`c1abdcd8 fffff960`002ce670 : win32k!SpNotifyLSurfaceRedirSurfAssoc+0x14
fffff880`0741c950 fffff960`002cda41 : fffff900`c1bfb880 00000000`00000001 fffff900`c1abdcc0 00000000`07120710 : win32k!SFMLOGICALSURFACE::SetShape+0xd1
fffff880`0741c9a0 fffff960`002cea77 : 00000000`00000000 00000000`07120710 fffff900`c1bfb880 00000000`00000002 : win32k!SFMLOGICALSURFACE::DeInitialize+0x71
fffff880`0741c9e0 fffff960`001101b5 : 00000000`07120710 00000000`00000001 00000000`000003e8 00000000`00000000 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
fffff880`0741ca20 fffff960`00277f6d : 00000000`000003e8 00000000`00000001 00000000`00000000 00000000`00010286 : win32k!NtGdiCloseProcess+0x6d
fffff880`0741ca80 fffff960`00131fe5 : 00000000`00000000 fffff880`02344000 fffff8a0`0282f770 fffff880`0741cad8 : win32k!MultiUserNtGreCleanup+0x8d
fffff880`0741cac0 fffff800`0351d92c : 00000000`00000001 00000000`00000000 fffff880`02344000 fffffa80`04ba0310 : win32k!Win32KDriverUnload+0xa5
fffff880`0741cb10 fffff800`0361d435 : fffff880`0741cba8 00000000`0000002a 00000000`00000000 fffff880`02344000 : nt!MiDereferenceSessionFinal+0xfc
fffff880`0741cbb0 fffff800`032a5954 : fffff800`03466940 fffff8a0`0283b060 00000000`00000000 fffffa80`055f1b30 : nt! ?? ::NNGAKEGL::`string'+0x2a3b5
fffff880`0741cbe0 fffff800`035a8156 : fffff8a0`0283b060 00000000`00000000 fffffa80`04ba0310 fffffa80`04ba0310 : nt!MmCleanProcessAddressSpace+0x628
fffff880`0741cc30 fffff800`035a852d : 00000000`00000000 fffff800`0356da01 00000000`00000000 fffffa80`04ba85a0 : nt!PspExitThread+0x56a
fffff880`0741cd30 fffff800`032c5426 : fffff800`03453e80 00000000`00000080 fffffa80`04ba0310 fffff880`01a2fd8e : nt!PspTerminateThreadByPointer+0x4d
fffff880`0741cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SpNotifyLSurfaceRedirSurfAssoc+14
fffff960`0022283c 488b4940        mov     rcx,qword ptr [rcx+40h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!SpNotifyLSurfaceRedirSurfAssoc+14

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  556356ff

FAILURE_BUCKET_ID:  X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

BUCKET_ID:  X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

Followup: MachineOwner
---------

kuromi777, I have had the same BSOD twice this week. (BOTH TIMES WHILE LOGGING OFF.)

Edit 1: The more I think of it, I do believe the first BSOD occurred during, for me, a rare shut-down. Just like u, kuromi777!

Yes, just remembered, the HTPC in question has a TV Tuning Adapter used along with a Quad High-Def TV Tuner. Both need to be Power cycled if the PC is shut down. Restarting is the best way to avoid Power cycling them. Shut down last Sunday was a safe measure taken to check room for the install of a USB 3.0 adapter card needed for external HDDs.

First of two times BSOD occurred was last Sunday: (While Shutting Down)

Less than two hours before the Women's 2015 World Cup Football Championship game OMG!....

When the BSOD occurred I immediately restored a Full Acronis Backup Image of C Drive. Took only nine minuets. Caught the game np. Was HAPPY as could be I didn't miss ANY, of the first 16 minuets!!!

HTPC was super AOK after ^^. HTPC has ROCKED PERFECTLY! UNTIL today...

Second of two times BSOD occurred was today [Edit: Thursday 2015-07-09 ]: (While Logging off)

A few minuets ago, after manually selecting a single Windows Update:

Code:

Definition Update for Windows Defender - KB915597 (Definition 1.201.1144.0)
Successful
Important
7/9/2015

Because said PC is an HTPC, Acronis backups are not made on a regular basis. No reason to make daily or weekly backups on a PC that never changes or stores Data other than Movies, right? (The WMC PlayReady files have been moved. I configured a 'Symbolic' Link... it's better than the 'Junction' Link that for example all "My Documents" folders use; and allows all recordings to pass Mustard no matter how old the OS is after restoring a Backup Image of it; versus how new or old the protected HD Recorded Movies are. They could be from way before the restored OS or from way after it was created and or restored. TheGreenButton Dot Com guys, ROCK! Couldn't have done it without them. Even though they said at first it couldn't be done and only theoretically was any discussion of it occurring; and I said but but I'm the Master Back-upper! Then they changed their tune to, it was not advisable to attempt, or nor recommended to try, in other words: *we think ur nuts, kind of song.lol But, flawless for 3 1/2 years now!

)

OH! strangely enough, date of the said backup image used was, "6/15/2015 12:02 PM".

My Recent Updates:

Code:

Definition Update for Windows Defender - KB915597 (Definition 1.201.1144.0)
SuccessfulImportant
7/9/2015

Definition Update for Windows Defender - KB915597 (Definition 1.201.836.0)
Successful
Important
7/5/2015

Definition Update for Windows Defender - KB915597 (Definition 1.199.2375.0)
Successful
Important
6/13/2015

Security Update for Windows 7 for x64-based Systems (KB3033890)
Successful
Important
6/10/2015

Security Update for Windows 7 for x64-based Systems (KB3059317)
Successful
Important
6/10/2015

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB3054891)
Successful
Important
6/10/2015

Security Update for Windows 7 for x64-based Systems (KB3057839)
Successful
Important
6/10/2015

Security Update for Windows 7 for x64-based Systems (KB3063858)
Successful
Important
6/10/2015

Windows Malicious Software Removal Tool x64 - June 2015 (KB890830)
Successful
Important
6/10/2015

Definition Update for Windows Defender - KB915597 (Definition 1.199.2103.0)
Successful
Important
6/10/2015

Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB3058515)
Successful
Important
6/10/2015

Definition Update for Windows Defender - KB915597 (Definition 1.199.1825.0)
Successful
Important
6/5/2015

Definition Update for Windows Defender - KB915597 (Definition 1.199.1468.0)
Successful
Important
6/4/2015

I have Windows Defender Service running for no reason. lol kuromi777, make sure that the one user you mentioned did not have it running.

The last two Updates:

1.

Definition Update for Windows Defender - KB915597 (Definition 1.201.836.0)
Successful
Important
7/5/2015

^^ was updated and installed last Sunday after Acronis Image Restoration. KB915597 [Edit: KB915597 (Definition 1.201.836.0)] did not cause a problem.

2.

Definition Update for Windows Defender - KB915597 (Definition 1.201.1144.0)
Successful
Important
7/9/2015

^^ was installed today [Edit: Thursday 2015-07-09 ] minuets ago. [Edit: KB915597 (Definition 1.201.1144.0) DID CAUSE A PROBLEM?!]

Result(s) of KB915597 [Edit: KB915597 (Definition 1.201.1144.0):

HTPC became unresponsive. Took forever for the Log-off to initiate. Then instant BSOD:

Code:

FAILURE_BUCKET_ID:  X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

BUCKET_ID:  X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

I will try Remedy:

A. Repeat restoring the same Backup as used last Sunday. (Originally created, "6/15/2015 12:02 PM")
B. Don't install ANY updates.
C. Disable the Windows Defender Service and Uninstall Windows Defender.
D. Test for a few days or jump to next step.
E. After a few days or don't even wait: Enable the Windows Defender Service and Install Windows Defender.
F. DL/ Install the same two Windows Defender Updates:

1.

[Edit: Windows Defender - KB915597 (Definition 1.201.836.0)]

2.

[Edit: Windows Defender - KB915597 (Definition 1.201.1144.0)]

~~Windows Defender - KB915597 (Definition 1.201.836.0)~~

~~Windows Defender - KB915597 (Definition 1.199.2375.0)~~

G. Will see if doing A-F will recreate:

"HTPC [becomes] unresponsive. [Takes] forever to for the Log-off to initiate. Then instant BSOD."

Note: the possible waits mentioned, are all because every time I want to tweak the HTPC, I can't. Can't risk it, because of something to be recorded can't be missed/ risked missing. (I've had a USB 3.0 card to install in it, sitting for months now. Amazon delivered it on an early Sunday Morning! in 23 hours after ordering it.lol Did a Drone deliver it!? lol) Recently got an HD-DVR from Cable TV ppl for contingencies.

All BSOD(s) in the entire life (2013-09-19) of the HTPC's current OS:

1. September ‎13, ‎2014, ‏‎9:37:42 PM,

FAILURE_BUCKET_ID: X64_0x3B_win32k!MulAssociateSharedSurface+15
BUCKET_ID: X64_0x3B_win32k!MulAssociateSharedSurface+15

(Accidentally allowed a Video driver to be updated by Windows or something. To fix it: Restored a Backup Image from before the BSOD; because it is faster than a clean Video driver uninstall/ install and all those Multiple re-boots in and out of windows and Safe-mode and back. That takes forever and if the phone rings, HELL! Only 9 minuets for a Backup Image restore!

)

2. ‎March ‎08, ‎2015, ‏‎8:39:26 AM,

FAILURE_BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14
BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

(Don't remember what I did to fix or what happened. But for a reason such as thinking an obvious human cause made it occur; no Backup Image was restored. An Incremental Backup went smoothly on ‎March ‎09, ‎2015. Followed by nine other Incremental Backups. The final incremental in the custom chain is said backup, from June 15.)

3. July ‎05, ‎2015,

‏‎Did not make backup of Minidump last Sunday's BSOD. Because, an Angel on my shoulder shouted, "GO! GO! GO! Restore the Backup Image ASAP forget all protocols! Or else risk missing the greatest Soccer Hat-trick that takes just 16 minuets and includes a forth goal!

But I'm positive #3 was the exact same as #4.

4. July ‎09, ‎2015, ‏‎2 hours ago,

FAILURE_BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14
BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

See: Remedy above.

Sry if i missed any mistakes.

GL

________________________________________________________________
__________________________________________________
______________________________________
________________________________
_________________________
__________________

Day 2 Update (2015-07-10):

(08:02 AM)

After 1st Restore today:

BSOD happened !

(Based on Remedy posted yesterday.)

STEPS:

A. Repeat restoring the same Backup as used last Sunday. (Originally created, "6/15/2015 12:02 PM")

B. Don't install ANY updates.

C. Disable the Windows Defender Service and Uninstall [Disable] Windows Defender: Specifically, Disabled from its own GUI (Options Settings/ Administrator/ Use this program/ Save ), which changed the Service from "Delayed Start" to "Manual Start".

D. Attempted Log-off and restart.

E. BSOD...

FAILURE_BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

BUCKET_ID: X64_0x50_win32k!SpNotifyLSurfaceRedirSurfAssoc+14

(approx 08:45 AM)
After 2nd Restore today

NO BSOD !

(Based on Remedy posted yesterday/ attempted once already today.)

STEPS:

A. Repeat restoring the same Backup as used last Sunday. (Originally created, "6/15/2015 12:02 PM")

B. Don't install ANY updates.

C. SKIPPED:

Disable the Windows Defender Service and Uninstall [Disable] Windows Defender: Specifically, Disabled from its own GUI (Options Settings/ Administrator/ Use this program/ Save ), which changed the Service from "Delayed Start" to "Manual Start".

D. INSTEAD: Opened Windows Defender; Clicked on Update option; Windows Defender Updated itself.

E. Attempted Log-off and restart.

F. NO BSOD

G. Booted back into Windows. All seems fine.

Note: So far... the following two are not present in Windows Update:

Windows Defender - KB915597 (Definition 1.201.836.0)

Windows Defender - KB915597 (Definition 1.201.1144.0)

But, there's also something new to note in Windows Update History:

Windows Defender - KB915597 (Definition 1.201.1399.0)

I'm pretty sure that it (Definition 1.201.1399.0) replaced:

Update for Windows Defender - KB915597 (Definition 1.201.1144.0).

And most likely fixed any problems with any other previous, too.

Because:

Windows Defender - KB915597 (Definition 1.199.2375.0);
has existed in all update history lists until now. Therefore, 1.201.1399.0 must have also fixed it. Not just "1.201.1144.0" (seemed the biggest instigator); but "1.199.2375.0" was just waiting to join it. lol

And last Sunday (2015-07-05), after thinking all was fine, just before (and after) the big 2015 Soccer Championship

, I started a new Full Backup. But deleted it after the BSOD yesterday (Thursday 2015-07-05). Can't wait for the "All Clear" to make a new Full Backup.

Also note that this HTPC has three WMC Extenders connected and running their DVRs from it. Total of 10 TB (soon to be 15 TB) of storage on 4 drives; 3 SATA and a 5 TB External USB. Will add a 2nd 5 TB Ext USB after a USB 3.0 Adapter is installed. And not before BSOD is proven to be gone for good.

Edit: In addition to, "1.199.2375.0" just waiting to join in the fun; it was also slowing down things to varying degrees over a matter of weeks; not noticeable because it was gradual... in other words messed-up from the get-go. It was installed 6/13/2015. And if need be I'll restore a backup from just before 6/13/2015 or way before that date.

________________________________________________________________
__________________________________________________
______________________________________
________________________________
_________________________
__________________

Day 2 Update (Cont.)
04:24 PM (2015-07-10):

Check-disk (Chkdisk) and Windows Defender are both at fault! And my intuition failed!

Code:

TimeCreated : 7/10/2015 12:19:33 PM
Message     : 
              
              Checking file system on C:
              The type of the file system is NTFS.
              Volume label is 080_WDC_P01.
              
              
              One of your disks needs to be checked for consistency. You
              may cancel the disk check, but it is strongly recommended
              that you continue.
              Windows will now check the disk. 
   
              CHKDSK is verifying files (stage 1 of 3)...[INDENT][INDENT]...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...

[/INDENT][/INDENT]CHKDSK is verifying indexes (stage 2 of 3)...[INDENT][INDENT]...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...
[/INDENT][/INDENT]CHKDSK is verifying security descriptors (stage 3 of 3)...
                281856 file SDs/SIDs processed.[INDENT][INDENT]...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...
                 
[/INDENT][/INDENT]CHKDSK is verifying Usn Journal...
                37308200 USN bytes processed.                                  
                        
              Usn Journal verification completed....[INDENT][INDENT] ...blah blah blah...
...blah blah blah...
...blah blah blah...
...blah blah blah...

[/INDENT][/INDENT]Windows has finished checking your disk. 
Please wait while your computer restarts.

I have to run Chkdisk once twice a year and always forget. lol

Oh well, time to finally install a USB 3.0 Adapter card (YAY!)

And enjoy USB 3.0@625 MBps versus old USB 2.0@60 MBps; Gb LAN (125 MBps); four 2.5 TB partitions, on two USB 3.0, 5 TB External Drives!

Only to wake-up tomorrow and hear, "USB 3.1 is HERE!!!!!!!"

*What!!??? LOL

__________________
_________________________
________________________________
______________________________________
__________________________________________________
________________________________________________________________

kuromi777 · Jul 13, 2015

So today I got the blue screen after I logged off my test box. I noticed something was weird since I wasn't able to click on any of the icons on my desktop.
Here's a copy of the two .dmp files.

The weird thing is after I powered off and back on, logged in with the account that had the blue screen, I didn't get it again with a log off or shutdown.
So now, I'm even more confused.
Anyone have any ideas -- I thought it would be the HP RC Mirror Driver issue -- but this driver isn't on this box either. HP and Compaq Desktop PCs - Blue Screen Error When Switching Users or Logging Off (Windows 7 and Vista) | HP® Support

bd3D · Jul 13, 2015

kuromi777 said:
So today I got the blue screen after I logged off my test box. I noticed something was weird since I wasn't able to click on any of the icons on my desktop.
Here's a copy of the two .dmp files.

The weird thing is after I powered off and back on, logged in with the account that had the blue screen, I didn't get it again with a log off or shutdown.
So now, I'm even more confused.
Anyone have any ideas -- I thought it would be the HP RC Mirror Driver issue -- but this driver isn't on this box either. HP and Compaq Desktop PCs - Blue Screen Error When Switching Users or Logging Off (Windows 7 and Vista) | HP® Support

did u run ~~"Chkdisk R" ?~~ "chkdsk /r" ?

kuromi777 · Jul 13, 2015

Hi!

Yes, I ran a checkdsk, sfc /scannow and a memory check.

bd3D · Jul 13, 2015

kuromi777 said:
Hi!

Yes, I ran a checkdsk, sfc /scannow and a memory check.

Used "Event Viewer" much?

dpeters11 · Jul 15, 2015

This is caused by 3057839. Microsoft says it's fixed in 3070102, the July kernel patch.

bd3D · Jul 15, 2015

dpeters11 said:
This is caused by 3057839. Microsoft says it's fixed in 3070102, the July kernel patch.

TY!!! dpeters11 :thumbsup:

M$ !?

Edit: DON'T INSTALL "3070102" WITHOUT A FULL BACKUP!!!!!
MY PROBLEM IS MUCH WORSE NOW!

Problem is WMC Channel Guide runs like it is installed on Win98 with 32 MB RAM. (Acts like there's a memory leak and practically freewzes.)

Edit: And Logging off is a nightmare.

right now, i'm restoring a backup made today; it was made just before DL/ Install Windows Security updates today that included "3070102 ". Everything should be normal after that.

Next, i'll uninstall "3057839" from CP, and check out stability. And especially, skip all updates for a week while M$ is told a billion more times,
"Fool us 15,837,327,059,128,630,632 times, shame on you, fool us 15,837,327,059,128,630,633 times, shame on us."

Is it something in the water M$ drinks?

TY AGAIN! dpeters11 :thumbsup:

BSOD on Windows 7 64-bit only when logoff/shutdown - PROFILE SPECIFIC

kuromi777

New member

My Computer

At a glance

bd3D

New member

My Computer

At a glance

kuromi777

New member

My Computer

At a glance

bd3D

New member

My Computer

At a glance

kuromi777

New member

My Computer

At a glance

bd3D

New member

My Computer

At a glance

dpeters11

New member

My Computer

At a glance

bd3D

New member

My Computer

At a glance

Similar threads

BSOD on Windows 7 64-bit only when logoff/shutdown - PROFILE SPECIFIC

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer