Another Windows 7 BSOD case

[saik0]

Hi,
I came to this forum to try to fix my BSOD related problems.
It's mostly the 0x3B (SYSTEM_SERVICE_EXCEPTION) bugcheck related to either win32k.sys or ntoskrnl.exe.
At first i thought it was my audio card since whenever i played something in foobar2000 player the system would BSOD. This was happening with the latest realtek drivers v R2.36. After downgrading to R2.34 i thought the problem was gone since it all behaved normally for a while.
But it started to happen again.
Actually last few times it happened while viewing youtube/flash content.

I have a dual boot with Linux currently.
No problems on linux whatsoever.
I'm thinking driver problems but cant really pin point at something...

Any advice would be greatly appreciated.

 

[torrentg]

Hey.

Please see this link about how to post a crash dump file.

 

[saik0]

I was 100% positive i added the attachment earlier...
Oh well edited.

 

[torrentg]

Update your network adapter driver(s) for wireless and/or wired and the problem should go away.

See this link about b57nd60a.sys

Also, make sure your running the latest NVIDIA driver for your graphics card, from their site.

If you installed any TCP/IP patches or hacks, undo them.

 

[saik0]

How did you conclude this one? XD
I'll try and report

thanks

 

[torrentg]

How did you conclude this one? XD
I'll try and report

thanks

You're welcome. (Scroll to bottom.)

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Rar$DI00.953\111409-24812-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c4ae50
Debug session time: Fri Nov 13 18:25:44.428 2009 (GMT-5)
System Uptime: 0 days 2:31:11.022
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff88004879e30, 0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\b57nd60a.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for b57nd60a.sys
*** ERROR: Module load completed but symbols could not be loaded for b57nd60a.sys
Probably caused by : b57nd60a.sys ( b57nd60a+2f4ff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004879e30, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'nvlddmkm' and 'nvlddmkm.sys' overlap

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+666e952f0157d874
fffff880`04879e30 58              pop     rax

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb50e0
 0000000000000000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800487ad58 -- (.exr 0xfffff8800487ad58)
ExceptionAddress: fffff8800187bf7c (tcpip!TcpMatchReceive+0x00000000000000ac)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800487ae00 -- (.trap 0xfffff8800487ae00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8003a3ba00 rbx=0000000000000000 rcx=fffffa80023e7900
rdx=fffffa8002413008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800187bf7c rsp=fffff8800487af90 rbp=fffffa8002354530
 r8=0000000000000000  r9=fffffa80023a3bf0 r10=0000000000000000
r11=fffff8800487b19a r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
tcpip!TcpMatchReceive+0xac:
fffff880`0187bf7c f083042b01      lock add dword ptr [rbx+rbp],1 ds:fffffa80`02354530=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b0fb2b to fffff80002a7ef00

STACK_TEXT:  
fffff880`04879d78 fffff800`02b0fb2b : 00000000`0000001e ffffffff`c0000005 fffff880`04879e30 00000000`00000000 : nt!KeBugCheckEx
fffff880`04879d80 fffff800`02ad2390 : fffffa80`03a4c000 00000000`00000000 fffffa80`03b112c0 00000000`00000001 : nt!KipFatalFilter+0x1b
fffff880`04879dc0 fffff800`02aad4dc : 00000000`7e2b2eae ffff0000`008a9fdb 00000000`00000000 fffffa80`03a4da30 : nt! ?? ::FNODOBFM::`string'+0x95d
fffff880`04879e00 fffff800`02aa4bed : fffff800`02bc5470 fffff880`0487b340 00000000`00000000 fffff800`02a0d000 : nt!_C_specific_handler+0x8c
fffff880`04879e70 fffff800`02aac250 : fffff800`02bc5470 fffff880`04879ee8 fffff880`0487ad58 fffff800`02a0d000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`04879ea0 fffff800`02ab91b5 : fffff880`0487ad58 fffff880`0487a5b0 fffff880`00000000 fffffa80`023e7900 : nt!RtlDispatchException+0x410
fffff880`0487a580 fffff800`02a7e542 : fffff880`0487ad58 c0000000`00000040 fffff880`0487ae00 fffffa80`023aae98 : nt!KiDispatchException+0x135
fffff880`0487ac20 fffff800`02a7ce4a : 00000000`00000000 00000000`00008000 00000000`00000078 fffffa80`034d5280 : nt!KiExceptionDispatch+0xc2
fffff880`0487ae00 fffff880`0187bf7c : 00000000`00000002 fffffa80`043cd100 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`0487af90 fffff880`0187bc17 : fffffa80`03b4922c fffffa80`02413008 00000000`00000000 fffff880`056baa00 : tcpip!TcpMatchReceive+0xac
fffff880`0487b0e0 fffff880`0187d9f1 : 00000000`00008f07 00000000`0000c3ec fffff880`04878f07 00000000`00000002 : tcpip!TcpPreValidatedReceive+0x177
fffff880`0487b190 fffff880`01875682 : fffffa80`034ade40 fffffa80`034fb360 fffffa80`04390006 00000000`00000000 : tcpip!IpFlcReceivePreValidatedPackets+0x4a1
fffff880`0487b2f0 fffff800`02a8e64a : 00000000`00000000 fffff880`04876000 00000000`00004800 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xa2
fffff880`0487b340 fffff880`018750e2 : fffff880`018755e0 fffff880`0487b450 fffff880`0487b502 00000000`00000008 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`0487b420 fffff880`0172d0eb : fffffa80`0372d8d0 00000000`00000000 fffffa80`037461a0 00000000`00040004 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`0487b490 fffff880`016f6fc6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`0487b500 fffff880`01670ef1 : fffffa80`037461a0 00000000`00000002 00000000`00000001 fffff800`02a851a2 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`0487b980 fffff880`040c74ff : fffffa80`03a4c000 00000000`00000000 00000000`00000001 00000000`00000001 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1
fffff880`0487b9d0 fffffa80`03a4c000 : 00000000`00000000 00000000`00000001 00000000`00000001 00000000`00000001 : b57nd60a+0x2f4ff
fffff880`0487b9d8 00000000`00000000 : 00000000`00000001 00000000`00000001 00000000`00000001 fffff800`02a851a2 : 0xfffffa80`03a4c000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
b57nd60a+2f4ff
fffff880`040c74ff ??              ???

SYMBOL_STACK_INDEX:  12

SYMBOL_NAME:  b57nd60a+2f4ff

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: b57nd60a

IMAGE_NAME:  b57nd60a.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49f4422f

FAILURE_BUCKET_ID:  X64_0x1E_b57nd60a+2f4ff

BUCKET_ID:  X64_0x1E_b57nd60a+2f4ff

Followup: MachineOwner
---------

 

[saik0]

one curious question...

Is it somehow possible that bad NIC drivers cause some improper behavior in such a way that it affects the physical layer of networking?
Namely few days ago i had serious problems with my ADSL modem which it seems died later under strange circumstances.
My desktop pc stayed on through the night. In the morning a BSOD awaited me (I set it so that it doesn't restart the system). After rebooting, my network problems started... ADSL was the problem, LAN worked without problems.
After messing around for 2 days i figured my ADSL modem was the problem... got a new one and it works all properly now.
What is even more strange is that there's a switch and a router between the win7 bsod affected pc and the modem itself.
It's all highly unlikely but considering the PC was in BSOD state for the whole night... who knows what the NIC was doing

 

[torrentg]

It really isn't possible for the nic to harm a router. It could be flooding like crazy in an endless loop and the worst thing technically possible is for the router to lock up. A simple reboot would fix that.

But ya, let us know how it goes for ya once a new driver is installed.

And I just noticed you have OCZ ram. Find out the exact model number and visit their site about it. Then set your bios to the exact timings and Vdimm (Ram voltage) it says. OCZ needs higher voltages mostly. I have mine set at 2.9v. Unfortunately for me, my motherboard doesn't allow for dual channel to operate and automatically uses that type of memory as single channel.

You can use CPU-Z's SPD tab to find your exact memory.

 

[saik0]

no luck...
Installed the latest broadcom drivers. Was hoping it's allright since the system managed to stay up the whole night
Just browsed trough a lot of youtube movies and the system crashed.

Here's that last dump

Ran trough the debugging... apparently it's the ntkrnlmp.exe

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\111609-18984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a07000 PsLoadedModuleList = 0xfffff800`02c44e50
Debug session time: Mon Nov 16 00:46:18.366 2009 (GMT+1)
System Uptime: 0 days 16:18:38.409
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002bac183, fffff880069cbfd0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+d3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bac183, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880069cbfd0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExFreePoolWithTag+d3
fffff800`02bac183 0fb601          movzx   eax,byte ptr [rcx]

CONTEXT:  fffff880069cbfd0 -- (.cxr 0xfffff880069cbfd0)
rax=0000000000000005 rbx=fffff8a00252fbf0 rcx=ffeff8a00252fc40
rdx=0000000000000005 rsi=0000000000000003 rdi=0000000000000001
rip=fffff80002bac183 rsp=fffff880069cc9b0 rbp=0000000020206553
 r8=0000000000000000  r9=0000000000000000 r10=fffff880009e7780
r11=fffffa8004b5db60 r12=0000000000000005 r13=fffff8a00252fc00
r14=0000000000000001 r15=000000000270efb0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExFreePoolWithTag+0xd3:
fffff800`02bac183 0fb601          movzx   eax,byte ptr [rcx] ds:002b:ffeff8a0`0252fc40=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002bac183

STACK_TEXT:  
fffff880`069cc9b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExFreePoolWithTag+0xd3


FOLLOWUP_IP: 
nt!ExFreePoolWithTag+d3
fffff800`02bac183 0fb601          movzx   eax,byte ptr [rcx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExFreePoolWithTag+d3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff880069cbfd0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExFreePoolWithTag+d3

BUCKET_ID:  X64_0x3B_nt!ExFreePoolWithTag+d3

Followup: MachineOwner
---------

 

[saik0]

Now i had a rather interesting event...
I was listening to music in foobar2000 and suddenly after a short time playing the sound went something like static noise and my monitor went black for a while. The sound went back to normal and the picture returned and there was a popup saying that the nvidia video driver recovered succesfully. Few seconds later exactly the same happened and also the video driver recovered and sound continued to work properly.
I have the latest video drivers.

Video/Audio drivers??

C'mon what's happening

 

[torrentg]

That's a 0x116 tdr timeout you just described.

You could probably search my user name on here for 0x116 and see a lot I've said about it lately.

 

[saik0]

Well this is the first time it happened like this.
It happened like this on my earlier BSODs with only one difference - instead of recovery i got BSOD.

 

[saik0]

I checked the logs and noticed there are constant "Session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D" errors. It happens even a dozen times a day (tho i didn't notice anything like computer crashing or something).



Detail:

 [URL="http://www.sevenforums.com/#"]-[/URL] <System>
     <Provider Name="[B]Microsoft-Windows-Kernel-EventTracing[/B]" Guid="[B]{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}[/B]" /> 

    <EventID>3</EventID> 

    <Version>0</Version> 

    <Level>2</Level> 

    <Task>2</Task> 

    <Opcode>14</Opcode> 

    <Keywords>0x8000000000000010</Keywords> 

    <TimeCreated SystemTime="[B]2009-11-20T10:08:40.250000000Z[/B]" /> 

    <EventRecordID>33</EventRecordID> 

    <Correlation />  

    <Execution ProcessID="[B]4[/B]" ThreadID="[B]148[/B]" />  

    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>  

    <Computer>yamato</Computer> 

    <Security UserID="[B]S-1-5-18[/B]" /> 

   </System>


  [URL="http://www.sevenforums.com/#"]-[/URL] <EventData>
     <Data Name="[B]SessionName[/B]">Microsoft-Windows-Setup</Data>  

    <Data Name="[B]FileName[/B]">C:\Windows\Panther\setup.etl</Data>  

    <Data Name="[B]ErrorCode[/B]">3221225485</Data>  

    <Data Name="[B]LoggingMode[/B]">5</Data> 

   </EventData>

I am pretty sure this all is somehow connected :\
SO FAR no BSODs after i messed with Vdimm and some other bios settings...

What's could be causing this one?


edit: Ok i noticed this: somewhere on the 16th of this month I changed those bios settings.
In the logs that 0xC000000D errors were appearing a dozen times a day..
After the 16th when i changed the bios settings (also no more BSODs) I'm getting only one 0xC000000D error per day. So it's definitely related.

 

[torrentg]

Not sure. You can click the link at the bottom of it to bring you to Microsoft's explanation of it.

Yeah, glad to hear about no more bsod.

 

[saik0]

You mean the "event log online help" ?
I'm getting no results for that one :\

And yes no BSODs for now.

I'll report if there's any changes...

 

[saik0]

Again nvidia driver restarted when i started foobar2000.

WHY?
would it help if i started windows in debugging mode?
What more info can i provide?