Win7 64bit pc rebooting, occasionally BSOD

[Torsti2003z]

Hello,
this machine has
- Windows 7 64bit, totally up-to-date, mb/graph drivers not too old either
- Asrock 939Dual-SATA2 mb
- AMD 64x2 (model 6000+ or so cant check now)
- 2048Mb DDR
- SBLive! with kX drivers as Creative support was nonexistent
- Sapphire Radeon HD4850 512Mb (10% underclocked to dare to reduce fan speed a bit)
- Antec Sonata III case with its 500W PSU

PC reboots randomly and so far only when playing some 3D game (like WoW, League of Legends). Nothing graphically intensive. I think this has happened only for 2-3 weeks now, earlier there was no problems.

Today there was finally a BSOD too, so could get a minidump, attached here. I hope there is something useful to give a clue before I roll up my sleeves and start proper troubleshooting (I don't understand minidumps at all).

Thank you very much if someone has the time to have a peek at this file!

 

[nickle]

The instruction pointer in register (rip) became misaligned. This pointer is used by the processor to keep track of the current innstruction and the next instruction and so forth.

By adding the length of the current instruction to the prvious value of (rip) it calculates where the next instruction is in memory. This became misaligned somewhere during execution of the current instruction set.

Determining where the misalignment occured is difficult if not impossible with the nformation we have before us.The misalignment happened in a kernel thread (nt!NtReadVirtualMemory+a9) but may have been caused by bad addresses being passed from somewhere else.

MY best guess is that it happened during execution of (cchservice.exe). A goole search showed that this belongs to Salfeld Security Service. Please uninstall that service and see how it goes.

You could also run a memory test to see if that may have contributed: http://www.memtest.org/.

I have highlighted the important areas of the dump.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Nickle\AppData\Local\Temp\Rar$DI43.161\040110-35187-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`03017000 PsLoadedModuleList = 0xfffff800`03254e50
Debug session time: Thu Apr  1 05:19:31.261 2010 (GMT-4)
System Uptime: 0 days 3:26:03.152
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003330ce9, fffff88002eba140, 0}

Probably caused by : hardware ( nt!NtReadVirtualMemory+a9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003330ce9, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88002eba140, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
[COLOR=Blue]nt!NtReadVirtualMemory+a9[/COLOR]
fffff800`03330ce9 2428            and     al,28h

CONTEXT:  fffff88002eba140 -- (.cxr 0xfffff88002eba140)
rax=fffff88002ebab70 rbx=0000000000000000 rcx=000007fffffefffe
rdx=000007fffffd27a8 rsi=000000000129e398 rdi=0000000000000000
rip=fffff80003330ce9 rsp=fffff88002ebab28 rbp=fffff88002ebaca0
 r8=000000000129e490  r9=000000000129e4e8 r10=00000000000002e8
r11=fffff80003088138 r12=0000000000000058 r13=000007fffffd6fa8
r14=000000000129e490 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!NtReadVirtualMemory+0xa9:
fffff800`03330ce9 2428            and     al,28h
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  [COLOR=Blue]cchservice.exe[/COLOR]

CURRENT_IRQL:  0

[COLOR=Blue]MISALIGNED_IP: 
nt!NtReadVirtualMemory+a9[/COLOR]
fffff800`03330ce9 2428            and     al,28h

LAST_CONTROL_TRANSFER:  from 000000000129e530 to fffff80003330ce9

STACK_TEXT:  
fffff880`02ebab28 00000000`0129e530 : fffff800`03088153 fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 : nt!NtReadVirtualMemory+0xa9
fffff880`02ebaba8 fffff800`03088153 : fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 00000000`000002e8 : 0x129e530
fffff880`02ebabb0 00000000`76dc02aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0129e378 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : [COLOR=Blue]0x76dc02aa[/COLOR]


FOLLOWUP_IP: 
nt!NtReadVirtualMemory+a9
fffff800`03330ce9 2428            and     al,28h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtReadVirtualMemory+a9

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff88002eba140 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

1: kd> !thread
GetPointerFromAddress: unable to read from fffff800032bf000
THREAD fffffa800376db60  Cid 0708.0838  Teb: 000000007efad000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
GetUlongFromAddress: unable to read from fffff800031fdb74
Owning Process            fffffa8003861630       Image:         cchservice.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      791241       
Context Switch Count      1296             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x00000000004623f0
Stack Init fffff88002ebadb0 Current fffff88002eba3a0
Base fffff88002ebb000 Limit fffff88002eb5000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`02eb9878 fffff800`03088469 : 00000000`0000003b 00000000`c0000005 fffff800`03330ce9 fffff880`02eba140 : nt!KeBugCheckEx
fffff880`02eb9880 fffff800`03087dbc : fffff880`02eba8e8 fffff880`02eba140 00000000`00000000 fffff800`030b7450 : nt!KiBugCheckDispatch+0x69
fffff880`02eb99c0 fffff800`030aebed : fffff800`032a7858 00000000`00000000 fffff800`03017000 fffff880`02eba8e8 : nt!KiSystemServiceHandler+0x7c
fffff880`02eb9a00 fffff800`030b6250 : fffff800`031d71e8 fffff880`02eb9a78 fffff880`02eba8e8 fffff800`03017000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02eb9a30 fffff800`030c31b5 : fffff880`02eba8e8 fffff880`02eba140 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
fffff880`02eba110 fffff800`03088542 : fffff880`02eba8e8 00000000`00000000 fffff880`02eba990 00000000`0129e398 : nt!KiDispatchException+0x135
fffff880`02eba7b0 fffff800`03086e4a : 00000000`0129fd20 00000000`00000410 00000000`00000001 00000000`0129e7f8 : nt!KiExceptionDispatch+0xc2
fffff880`02eba990 fffff800`03330ce9 : 000007ff`fffd27a8 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`02eba990)
fffff880`02ebab28 00000000`0129e530 : fffff800`03088153 fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 : nt!NtReadVirtualMemory+0xa9
fffff880`02ebaba8 fffff800`03088153 : fffffa80`0376db60 00000000`0129e398 fffff880`02ebabc8 00000000`000002e8 : 0x129e530
fffff880`02ebabb0 00000000`76dc02aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 ([COLOR=Blue]TrapFrame @ fffff880`02ebac20[/COLOR])
00000000`0129e378 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dc02aa

1: kd> .trap fffff880`02ebac20
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000027d0000 rbx=0000000000000000 rcx=0000000002bb0409
rdx=0000000002610094 rsi=0000000000000000 rdi=0000000000000000
[COLOR=Blue]rip=0000000076dc02aa[/COLOR] rsp=000000000129e378 rbp=00000000c0000000
 r8=000000000000002b  r9=0000000076f6fa29 r10=0000000000000000
r11=0000000000000246 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv u pl nz na pe nc
[COLOR=Blue]p ei0033:00000000`76dc02aa ??              ???[/COLOR]  [COLOR=Red]<-----memory access error[/COLOR]

 

[Torsti2003z]

Thank you, wasn't even considering that as possible culprit. There is indeed Salfeld Child Control in that PC.

I may not locate the problem with certainty as in lack of time I will try various fixes same time. But I will report here if relevant.

 

[chev65]

Hello,
this machine has
- Windows 7 64bit, totally up-to-date, mb/graph drivers not too old either
- Asrock 939Dual-SATA2 mb
- AMD 64x2 (model 6000+ or so cant check now)
- 2048Mb DDR
- SBLive! with kX drivers as Creative support was nonexistent
- Sapphire Radeon HD4850 512Mb (10% underclocked to dare to reduce fan speed a bit)
- Antec Sonata III case with its 500W PSU

PC reboots randomly and so far only when playing some 3D game (like WoW, League of Legends). Nothing graphically intensive. I think this has happened only for 2-3 weeks now, earlier there was no problems.

Today there was finally a BSOD too, so could get a minidump, attached here. I hope there is something useful to give a clue before I roll up my sleeves and start proper troubleshooting (I don't understand minidumps at all).

Thank you very much if someone has the time to have a peek at this file!

I would lean towards this being a power supply problem. Your HD4850 has minimum power supply requirement of 450 watts which is cutting it very close.

Your 500watt PSU came with your case is a low buck cheapy version. Those power supplies that come with the case are about 50 bucks and not would I call reliable. In fact, I've seen them cause similar problems many times. The sudden shut downs while gaming also point to a power supply issue.

If you can borrow another PSU of higher output that would help determine if the problem is the PSU or not.

 

[nickle]

Over(under)clocking can affect the stability of the system and could be a contributing factor in this case. Try setting back to defaults. It does not help when analyzing the dump beacuse results are unpredictable.

Somewhere the instruction pointer became misaligned and the processor could not continue execution. The information in the dump is not enough to determine exactly where.

 

[Torsti2003z]

I have not disabled Child Control (yet). Here is what I have done:
- added paging file to C also (was earlier only on secondary IDE, i.e. D)
- run error checking on C and D
- changed back ATI fan control to auto
- checked dust filter and air ventilation (they were ok, though the room is quite warm)
- run Windows 7 Manager 1ClickFix
- installed missing 6 updates to Win7, and updated JRE and Abode Air

Curiously, the machine can run Crysis for 2 hours without problems I know of, but crashes often to BSOD in WoW or LoL (game). Maybe DirectX 9 related..?

Another BSOD this morning, minidump attached. Seems different this time:

 

[nickle]

Well this dump is telling us where the misalignment is occurring. It's the driver for your graphics card. I believe that changing the parmeters on the card brought this to light.

See if there is an update to the driver. If not, then either the card is bad or the power supply to the card is faulty or insufficient or possibly a heating issue.

You could try re-seating the card to see if that helps.

Also your network driver (Ulilan.sys) should be updated it has a timestamp of 2005.

I have highlighted the important areas of the dump.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Nickle\AppData\Local\Temp\Rar$DI07.023\040210-19578-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`03299e50
Debug session time: Fri Apr  2 02:28:51.781 2010 (GMT-4)
System Uptime: 0 days 1:24:53.656
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {ffffe4800d5b34c0, 2, 1, fffff880041f8981}

Unable to load image \SystemRoot\system32\DRIVERS\atipmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atipmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atipmdag.sys
Unable to load image \SystemRoot\system32\DRIVERS\ULILAN.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ULILAN.SYS
*** ERROR: Module load completed but symbols could not be loaded for ULILAN.SYS
Probably caused by : hardware ( atipmdag+325981 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffe4800d5b34c0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880041f8981, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800033040e0
 ffffe4800d5b34c0 

CURRENT_IRQL:  2

FAULTING_IP: 
atipmdag+325981
fffff880`041f8981 d04c8d40        ror     byte ptr [rbp+rcx*4+40h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  League of Lege

TRAP_FRAME:  fffff88002f22c80 -- (.trap 0xfffff88002f22c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002f22e18 rbx=0000000000000000 rcx=fffffa8002aa7000
rdx=fffffa8003302530 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880041f8981 rsp=fffff88002f22e10 rbp=fffffa8002b17480
 r8=0000000000000029  r9=0000000000000000 r10=fffff8000305c000
r11=fffff88002f22d90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
atipmdag+0x325981:
fffff880`041f8981 d04c8d40        ror     byte ptr [rbp+rcx*4+40h],1 ss:0018:ffffe480`0d5b34c0=??
Resetting default scope

MISALIGNED_IP: 
atipmdag+325981
fffff880`041f8981 d04c8d40        ror     byte ptr [rbp+rcx*4+40h],1

LAST_CONTROL_TRANSFER:  from fffff800030cd469 to fffff800030cdf00

STACK_TEXT:  
fffff880`02f22b38 fffff800`030cd469 : 00000000`0000000a ffffe480`0d5b34c0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02f22b40 fffff800`030cc0e0 : fffff880`02f22cb4 fffffa80`032e6000 fffffa80`032eef50 fffffa80`01cdb700 : nt!KiBugCheckDispatch+0x69
fffff880`02f22c80 fffff880`041f8981 : fffff880`02f22e18 fffff880`041f24cb fffffa80`02c81000 fffff880`04898410 : nt!KiPageFault+0x260
fffff880`02f22e10 fffff880`02f22e18 : fffff880`041f24cb fffffa80`02c81000 fffff880`04898410 fffffa80`02c81000 : atipmdag+0x325981
fffff880`02f22e18 fffff880`041f24cb : fffffa80`02c81000 fffff880`04898410 fffffa80`02c81000 fffffa80`02c81000 : 0xfffff880`02f22e18
fffff880`02f22e20 fffffa80`02c81000 : fffff880`04898410 fffffa80`02c81000 fffffa80`02c81000 fffffa80`02b175d0 : atipmdag+0x31f4cb
fffff880`02f22e28 fffff880`04898410 : fffffa80`02c81000 fffffa80`02c81000 fffffa80`02b175d0 fffff880`03ef1344 : 0xfffffa80`02c81000
fffff880`02f22e30 fffffa80`02c81000 : fffffa80`02c81000 fffffa80`02b175d0 fffff880`03ef1344 fffff880`03e4f438 : ULILAN+0x2410
fffff880`02f22e38 fffffa80`02c81000 : fffffa80`02b175d0 fffff880`03ef1344 fffff880`03e4f438 00000000`74db2450 : 0xfffffa80`02c81000
fffff880`02f22e40 fffffa80`02b175d0 : fffff880`03ef1344 fffff880`03e4f438 00000000`74db2450 00000000`00000022 : 0xfffffa80`02c81000
fffff880`02f22e48 fffff880`03ef1344 : fffff880`03e4f438 00000000`74db2450 00000000`00000022 00000000`00000000 : 0xfffffa80`02b175d0
fffff880`02f22e50 fffff880`03e4f438 : 00000000`74db2450 00000000`00000022 00000000`00000000 00000000`00000000 : atipmdag+0x1e344
fffff880`02f22e58 00000000`74db2450 : 00000000`00000022 00000000`00000000 00000000`00000000 fffff880`02c41963 : i8042prt!ntoskrnl_NULL_THUNK_DATA+0x788
fffff880`02f22e60 00000000`00000022 : 00000000`00000000 00000000`00000000 fffff880`02c41963 00000000`00000000 : 0x74db2450
fffff880`02f22e68 00000000`00000000 : 00000000`00000000 fffff880`02c41963 00000000`00000000 fffff880`048984a0 : 0x22


STACK_COMMAND:  kb

FOLLOWUP_IP: 
atipmdag+325981
fffff880`041f8981 d04c8d40        ror     byte ptr [rbp+rcx*4+40h],1

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  atipmdag+325981

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: hardware

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  [COLOR=Blue]X64_IP_MISALIGNED_atipmdag.sys[/COLOR]

BUCKET_ID:  X64_IP_MISALIGNED_atipmdag.sys

Followup: MachineOwner
---------

1: kd> lmvm atipmdag
start             end                 module name
fffff880`03ed3000 fffff880`04537000   [COLOR=Blue]atipmdag [/COLOR]T (no symbols)           
    Loaded symbol image file: atipmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atipmdag.sys
    Image name: atipmdag.sys
    [COLOR=Blue]Timestamp:        Tue Feb 02 23:21:24 2010 (4B68F9C4)[/COLOR]
    CheckSum:         0061614B
    ImageSize:        00664000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> lmvm ULILAN
start             end                 module name
fffff880`04896000 fffff880`0489e680  [COLOR=Blue] ULILAN[/COLOR]   T (no symbols)           
    Loaded symbol image file: ULILAN.SYS
    Image path: \SystemRoot\system32\DRIVERS\ULILAN.SYS
    Image name: ULILAN.SYS
    [COLOR=Blue]Timestamp:        Tue Mar 22 08:36:31 2005 (4240114F)[/COLOR]
    CheckSum:         0000C452
    ImageSize:        00008680
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e

4

 

[Torsti2003z]

Thanks, I'll do some more tests soon when I have time.

One more minidump:

 

[Torsti2003z]

Hello, looks like problem is solved.

1. Did the following in BIOS:
- Cool'n'Quiet --> enabled (don't remember why it was disabled, some reason in last system where this mb was)
- Flexibility Option --> enabled (better tolerance to different memory types)
- Primary Graphics Controller --> PCI-E (was AGP, doesn't matter though propably as there are no two adapters enabled)
- COM-, LPT-ports --> disabled

2. Temperatures tested, cores rarely heat more than to 55 C, GPU to 65 C

3. Removed Catalyst 10.2, run Guru3D DriverSweeper, installed Catalyst 10.3. Ati Overdrive set to default values.


Most propable cause imo (and by your diagnostics): graphics driver faulty/broken.

Thank you for your attention.