Blue screen/memory dump

LJThorburn · 28 Feb 2011

Hi,
I have recently installed Windows 7 Ultimate x64 and I am having the same problem over and over. It started about 24 hours after initial installation. I closed my laptop, which was set to sleep and obtain a password on opening. When I did open it some odd hours later I got a blue screen with a fair amount of writing that I didn't have to read all of...but the top title said "IRQL not less or equal" then there was some random 0's and numbers then a memory dump at the bottom before the laptop rebooted. Upon reboot it gave me some info which I shall post shortly. I have tried system restores, manually installing windows updates one at a time, closing the laptop, opening the laptop, etc, i even took the obtain password off so that when it was opened it would wake up straight into windows. This seemed to work for a while, I then changed my update settings to asking me before installing anything and the next thing I know it's installing things all by itself, and this happened several times.
So, last night, no problems with the blue screen. Switched on this morning, shut the laptop, opened it.....blue screen with the same info. When I finally booted into Windows I opened the info on the problems and this was what it said.....
Additional information about the problem:
BCCode: a
BCP1: 000000000057A40B
BCP2: 0000000000000002
BCP3: 0000000000000001
BCP4: FFFFF80002A973F2
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\022811-53071-01.dmp
C:\Users\Lindz\AppData\Local\Temp\WER-103771-0.sysdata.xml
Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

Now I attempted to look for the second file mentioned, i clicked C drive, clicked Users, clicked Lindz....and then could not see "AppData" anywhere?!
Any help on this subject would be greatly appreciated as the laptop is close to bein dismantled with force!!!!!!

zigzag3143 · 28 Feb 2011

LJThorburn said:

Hi,
I have recently installed Windows 7 Ultimate x64 and I am having the same problem over and over. It started about 24 hours after initial installation. I closed my laptop, which was set to sleep and obtain a password on opening. When I did open it some odd hours later I got a blue screen with a fair amount of writing that I didn't have to read all of...but the top title said "IRQL not less or equal" then there was some random 0's and numbers then a memory dump at the bottom before the laptop rebooted. Upon reboot it gave me some info which I shall post shortly. I have tried system restores, manually installing windows updates one at a time, closing the laptop, opening the laptop, etc, i even took the obtain password off so that when it was opened it would wake up straight into windows. This seemed to work for a while, I then changed my update settings to asking me before installing anything and the next thing I know it's installing things all by itself, and this happened several times.
So, last night, no problems with the blue screen. Switched on this morning, shut the laptop, opened it.....blue screen with the same info. When I finally booted into Windows I opened the info on the problems and this was what it said.....
Additional information about the problem:
BCCode: a
BCP1: 000000000057A40B
BCP2: 0000000000000002
BCP3: 0000000000000001
BCP4: FFFFF80002A973F2
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\022811-53071-01.dmp
C:\Users\Lindz\AppData\Local\Temp\WER-103771-0.sysdata.xml
Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

Now I attempted to look for the second file mentioned, i clicked C drive, clicked Users, clicked Lindz....and then could not see "AppData" anywhere?!
Any help on this subject would be greatly appreciated as the laptop is close to bein dismantled with force!!!!!!

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.

To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.

LJThorburn · 28 Feb 2011

Right, I did have to alter my settings in sysdm.cpl and then I rebooted.
Hopefully Ive zipped up the minidump file correctly and its attached....

LJThorburn · 01 Mar 2011

Its happened again to me today.....

Additional information about the problem:
BCCode: d1
BCP1: FFFFF880048100B8
BCP2: 0000000000000002
BCP3: 0000000000000008
BCP4: FFFFF880048100B8
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Files that help describe the problem:
C:\Windows\Minidump\030111-53243-01.dmp
C:\Users\Lindz\AppData\Local\Temp\WER-85082-0.sysdata.xml
Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

ickymay · 01 Mar 2011

for the .dmp files you uploaded I can see three different reasons so I suggest burn to CD (using an ISO burner) & run from boot memtest86+ for at least 5 passes, please move the sticks singly and together between slots to verify motherboard ram slots work as well as the ram sticks.

also temporarily remove AVG as this has been known to casue bluescreen crashes and replace with MSE for now ?

also unninstall your LSI SoftModem Driver from device manager, then reboot and disable in your bios ?

your ati driver is old

Code:

atikmdag.sys	atikmdag.sys+12d9c	fffff880`03e2e000	fffff880`04350000	0x00522000	0x49f199cd	24/04/2009 10:51:57

please update it from AMD's website ?

can you also please fill out your system specs on this forum to help with debugging your crashes :)

If you get any more bluescreens please upload the .dmp files and let us know how the memory checking goes

LJThorburn · 02 Mar 2011

I have had a few more blue screens since, the latest one mentioned "driver irql not less or equal" as opposed to just irql. I have attached the updated mini dump files but I havent done anything mentioned above yet as Ive just got in from a meeting after work so I will probably have a bash at some of that tomorrow....

Thanks in advance though!!

LJThorburn · 02 Mar 2011

PS i cant move any sticks singley as its a laptop I have and I cant access the RAM, unless Im just bein dumb and there is some sort of way of doing it....

LJThorburn · 02 Mar 2011

PPS....I cant find anything called LSI SoftModem in my device manager, the only thing under modems Agere systems HDA modem...I've looked under everything else as well

**cluberti** · 02 Mar 2011

All of your recent memory dumps are actually blaming a driver, sdbus.sys, for causing a page fault at an Interrupt ReQuest Level (IRQL) of DPC_DISPATCH (2):

Code:

// Thread that ultimately caused the machine to crash:
0: kd> !thread
GetPointerFromAddress: unable to read from fffff80002d0b000
THREAD fffffa8005aae060  Cid 0a94.09a8  Teb: 000007fffff8a000 Win32Thread: fffff900c306ac30 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from fffff80002c49ba4
Owning Process            fffffa800564b060       Image:         explorer.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      598941       
Context Switch Count      2063                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000007fefdbcc7d4
Stack Init fffff88006567db0 Current fffff88006567620
Base fffff88006568000 Limit fffff88006560000 Call 0
Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff800`00ba24b8 fffff800`02ad2ca9 : 00000000`0000000a fffff880`045e60b8 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff800`00ba24c0 fffff800`02ad1920 : fffff880`045ea110 fffff800`00ba2830 fffffa80`069ec570 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00ba2600 fffff880`045e60b8 : fffff800`02adf29e 00000000`00000000 fffffa80`05804660 fffffa80`409e0001 : nt!KiPageFault+0x260 (TrapFrame @ fffff800`00ba2600)
fffff800`00ba2798 fffff800`02adf29e : 00000000`00000000 fffffa80`05804660 fffffa80`409e0001 00000000`00000000 : <Unloaded_sdbus.sys>+0x100b8
fffff800`00ba27a0 fffff800`02adedd6 : fffffa80`055cb168 fffffa80`055cb168 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
fffff800`00ba2810 fffff800`02adf4be : 00000015`c131619e fffff800`00ba2e88 00000000`0009239e fffff800`02c51648 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00ba2e60 fffff800`02adecb7 : fffff800`02c4dec7 fffffa80`0009239e 00000000`00000000 00000000`0000009e : nt!KiTimerExpiration+0x1be
fffff800`00ba2f00 fffff800`02ad9865 : 00000000`00000000 fffffa80`05aae060 00000000`00000000 fffff880`04290588 : nt!KiRetireDpcList+0x277
fffff800`00ba2fb0 fffff800`02ad967c : 00000000`00000000 fffff800`02a24895 fffff800`02a49460 fffff880`06567ca0 : nt!KxRetireDpcList+0x5 (TrapFrame @ fffff800`00ba2e70)
fffff880`06567be0 fffff800`02b1d113 : fffff800`02acfc60 fffff800`02acfccc fffffa80`05aae060 fffff880`06567ca0 : nt!KiDispatchInterruptContinue
fffff880`06567c10 fffff800`02acfccc : fffffa80`05aae060 fffff880`06567ca0 00000000`00000b40 fffffa80`0250e310 : nt!KiDpcInterruptBypass+0x13
fffff880`06567c20 00000000`773fcf07 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLock+0x1fc (TrapFrame @ fffff880`06567c20)
00000000`0531b3f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773fcf07
 
// The trapframe showing *why* the crash was triggered:
0: kd> .trap fffff800`00ba2600
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000002000 rbx=0000000000000000 rcx=fffffa8004002168
rdx=fffffa80040020f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880045e60b8 rsp=fffff80000ba2798 rbp=0000000000000002
 r8=0000000076946239  r9=0000000001cbd91a r10=fffff80002a63000
r11=fffff80000ba27e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
<Unloaded_sdbus.sys>+0x100b8:
fffff880`045e60b8 ??              ???
 
// OS - Windows 7 RTM:
0: kd> vertarget
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Wed Mar  2 08:54:13.332 2011 (UTC - 5:00)
System Uptime: 0 days 6:25:10.687
 
// Hardware - HP Pavilion dv5 1211em:
0: kd> !sysinfo machineid
Machine ID Information [From Smbios 2.4, DMIVersion 36, Size=990]
BiosMajorRelease = 15
BiosMinorRelease = 32
FirmwareMajorRelease = 152
FirmwareMinorRelease = 39
BiosVendor = Hewlett-Packard
BiosVersion = F.20
BiosReleaseDate = 10/08/2008
SystemManufacturer = Hewlett-Packard
SystemProductName = HP Pavilion dv5 Notebook PC
SystemFamily = 103C_5335KV
SystemVersion = Rev 1
SystemSKU = NG237EA#ABU
BaseBoardManufacturer = HP
BaseBoardProduct = 3600
BaseBoardVersion = 98.27

Sdbus.sys in this dump currently has a timer registered (it must be registered to do something at intervals, although I'd have to research specifically what - otherwise, I assume it's polling an SD card reader for insertion of a card), and the kernel is saying the timer for that object has expired and is calling back into sdbus.sys to handle the timer expiry. However, for whatever reason, sdbus.sys is no longer loaded - thus any calls into it will cause a paging fault at IRQL 2. The reason this causes a crash is because Windows absolutely positively ***!!!cannot!!!*** page fault at a IRQL higher than 1, because only devices that run at higher IRQL can interrupt a lower IRQL, as Windows is designed. A page fault would cause the NT memory manager to need to make a request for data from disk to put into memory, but that request would come from IRQL 1, or APC_LEVEL. You'll note (if you visited the link above) that APC_LEVEL is IRQL 1, which is lower than 2 - thus, the system would irrevocably hang at this point if that page fault request was to be queued. Thus, instead of hanging the system forever, Windows instead bugchecks with either a bugcheck code 0xA or 0xD1 - they both ultimately mean the same thing, and that is what happened above.

Sdbus.sys is a Windows 7 driver, but it should only load if there's an SD card reader (or a SD card reader driver from a 3rd party) loaded/installed. Thus, this would indicate that you have 3rd party SD card drivers installed, potentially a 3rd party filter driver (like antivirus or hardware disk/filter drivers), or the SD card reader itself attached to the system that could be the likely culprits for this behavior. I would start by making sure all of your drivers are up to the latest version by the manufacturer, and that you also install Windows 7 SP1. Also, you are not using the HP BIOS version that actually has support for Windows 7 (F.38, November 2009) on that particular machine, which is available for download here.

LJThorburn · 03 Mar 2011

Wow...well all that was like speakin another language to me lol. Sorry to sound dense. So basically if I update all my drivers that should work?
Before I installed Windows 7 I used something called Double Driver to back up all the drivers I had on the laptop when it was running Vista Home edition, had no blue screens with that. Would that help if I re-installed all the drivers from that program?
Also as an added note my laptop does have a built in SD card reader, but why does the blue screen only appear when I close the laptop lid and it goes into sleep mode? Whats the connection? It doesnt happen any other time *touch wood*!!