BSOD 3b on new PC

[freekp]

As mentioned in the title i'm getting bugged by BSODS on my new pc.
They don't occur often, so far there have been six in about a week of using the pc.
The BSODS occur under various circumstances, running Speedfan, installing VS2008 or simply using Firefox.

Specs of the pc are:
Windows 7 64 bit
Core i7 860
MSI P55-GD65
4GB GeIL GV34GB1333C7DC
Sapphire HD5770 1GB GDDR5 PCIE
Samsung Syncmaster 2443BW
Samsung Spinpoint F3 HD103SJ, 1TB
Seasonic M12II 520W

Things I have tried so far are:
Checked to see if all drivers are up to date.
Ran Memtest over night for 17 passes, no errors.
Did sfc /scannow, no errors there either.
Tried to do some debugging with WinDbg but so far I haven't become much wiser.

The minidump files are attached with this post.
Any help would be much appreciated.

 

[Product FRED]

I'll take a look for you.

For the kernel error, three options, all referring to memory-type errors:

- Faulty or mis-matched RAM
- Corrupted/faulty page-file (virtual memory) - this can can be fixed by manually setting a - higher-than-max required page-file size
- faulty hardware drivers

For the win32k.sys error, check this out http://social.technet.microsoft.com/forums/en-US/itprovistades

The latter solution may seem old, but it's definitely related since it's the same address and you have an ATi card. Try updating the drivers.

On Mon 3/22/2010 9:40:47 PM your computer crashed
This was likely caused by the following module: win32k.sys
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF960001241A2, 0xFFFFF88008BAE010, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\032210-18283-01.dmp
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Thu 3/18/2010 9:40:47 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002D9F56D, 0xFFFFF88009C59740, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\031810-32261-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Thu 3/18/2010 9:40:46 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80002E67827, 0xFFFFF88003368168, 0xFFFFF880033679C0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\031810-12542-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Thu 3/18/2010 9:40:47 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002DAD56D, 0xFFFFF88008575740, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\031810-14991-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Thu 3/18/2010 9:40:47 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80002D5056D, 0xFFFFF88009BF0740, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
Dump file: C:\Windows\Minidump\031810-13930-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Thu 3/18/2010 9:40:47 PM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF80002DC51FC, 0xFFFFF8800335B988, 0xFFFFF8800335B1E0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Dump file: C:\Windows\Minidump\031810-21699-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

 

[freekp]

Thank you for the quick reply.
Some things that were mentioned in your link to another post here (before it was edited? http://www.sevenforums.com/crashes-debugging/59040-win32k-sys-bsod-0x0000008e.html) are:
The BIOS, which I updated to the latest version before installing Windows 7.
RAM was checked overnight with memtest with both sticks in, ran for 17 passes, no errors.
Not sure if testing them individually would be useful?
About the video card drivers. I currently have the Catalyst 10.2 drivers installed as well as the Catalyst Control Center. Would uninstalling these two and trying different (older) drivers be worth a shot?

You mentioned changing the page-file size.
Currently it has 4087mb allocated with 6130mb recommended.
Would that mean I have to set both the initial size and max size above 6130mb?

 

[Product FRED]

Thank you for the quick reply.
Some things that were mentioned in your link to another post here (before it was edited? http://www.sevenforums.com/crashes-debugging/59040-win32k-sys-bsod-0x0000008e.html) are:
The BIOS, which I updated to the latest version before installing Windows 7.
RAM was checked overnight with memtest with both sticks in, ran for 17 passes, no errors.
Not sure if testing them individually would be useful?
About the video card drivers. I currently have the Catalyst 10.2 drivers installed as well as the Catalyst Control Center. Would uninstalling these two and trying different (older) drivers be worth a shot?

You mentioned changing the page-file size.
Currently it has 4087mb allocated with 6130mb recommended.
Would that mean I have to set both the initial size and max size above 6130mb?

Just the maximum should do it, but like I said, there can be multiple causes.

 

[freekp]

Got 2 more bsods as shown below.
So far memtest isn't giving any errors.
I've also tested the hd with a utility, no errors there either.
No clue so far as to what driver could be causing the problem.
Afaik I've updated all of them to the latest version.
Attached the minidumps in the zip file again.

BugCheck 3B, {c0000005, fffff80002fad56d, fffff88008aa6740, 0}
Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1dd )

BugCheck 1000007E, {ffffffffc0000005, fffff80002fca1fc, fffff88003377988, fffff880033771e0}
Probably caused by : ntkrnlmp.exe ( nt!CmpRemoveKeyHash+4c )

 

[freekp]

It seems the errors have expanded to 7E ones as well as I've had another one. :S

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002f811fc, fffff8800337e988, fffff8800337e1e0}

Probably caused by : ntkrnlmp.exe ( nt!CmpRemoveKeyHash+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002f811fc, The address that the exception occurred at
Arg3: fffff8800337e988, Exception Record Address
Arg4: fffff8800337e1e0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!CmpRemoveKeyHash+4c
fffff800`02f811fc 488b01 mov rax,qword ptr [rcx]

EXCEPTION_RECORD: fffff8800337e988 -- (.exr 0xfffff8800337e988)
ExceptionAddress: fffff80002f811fc (nt!CmpRemoveKeyHash+0x000000000000004c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffff8800337e1e0 -- (.cxr 0xfffff8800337e1e0)
rax=7ffff8a009dffdf8 rbx=fffff8a0087ffde8 rcx=7ffff8a009dffe00
rdx=0000000000000a44 rsi=0000000000000004 rdi=fffff8800337ec00
rip=fffff80002f811fc rsp=fffff8800337ebc8 rbp=fffff8800337ec74
r8=00000000b2d05e15 r9=000000001a84076c r10=fffff8a002162258
r11=fffff8a0087ffdf8 r12=0000000000000002 r13=0000000000000002
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!CmpRemoveKeyHash+0x4c:
fffff800`02f811fc 488b01 mov rax,qword ptr [rcx] ds:002b:7ffff8a0`09dffe00=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec60e0
ffffffffffffffff

FOLLOWUP_IP:
nt!CmpRemoveKeyHash+4c
fffff800`02f811fc 488b01 mov rax,qword ptr [rcx]

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from fffff80002f813c2 to fffff80002f811fc

STACK_TEXT:
fffff880`0337ebc8 fffff800`02f813c2 : fffff8a0`087ffde8 fffff880`0337ec74 00000000`00000004 00000000`00000001 : nt!CmpRemoveKeyHash+0x4c
fffff880`0337ebd0 fffff800`02ee76ce : fffff8a0`087ffde8 fffff880`0337ec5c 00000000`00000004 00000000`00000002 : nt!CmpCleanUpKcbCacheWithLock+0x52
fffff880`0337ec00 fffff800`02c9d161 : fffff800`02ee7394 fffff800`02e335f8 fffffa80`039e6b60 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a
fffff880`0337ecb0 fffff800`02f33166 : 8bc93345`00202464 fffffa80`039e6b60 00000000`00000080 fffffa80`039d0040 : nt!ExpWorkerThread+0x111
fffff880`0337ed40 fffff800`02c6e486 : fffff880`03167180 fffffa80`039e6b60 fffff880`031720c0 e38b4930`738b4928 : nt!PspSystemThreadStartup+0x5a
fffff880`0337ed80 00000000`00000000 : fffff880`0337f000 fffff880`03379000 fffff880`0337e970 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CmpRemoveKeyHash+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

STACK_COMMAND: .cxr 0xfffff8800337e1e0 ; kb

FAILURE_BUCKET_ID: X64_0x7E_nt!CmpRemoveKeyHash+4c

BUCKET_ID: X64_0x7E_nt!CmpRemoveKeyHash+4c

Followup: MachineOwner

 

[freekp]

I'm still getting BSODS since my last post however these have a bit more information attached to them.
I have installed Bad Company 2 this week and had several blue screens while playing that point in the direction of dxgmms1.sys.
Before installing BC2 I've uninstalled the 10.2 Catalyst drivers and installed the 10.3 ones.

I have also ran driver verifier which caused me to crash several times on the reboot with the blue screen blaming MBfilt64.sys.

Attached are the minidumps in 4 separate zip files sorted according to the driver that's to blame.

The right course seems to be to reinstall the display driver.
Should I simply uinstall the current one first and remove any leftovers with driversweeper?
Once again, any help is much appreciated.

 

[freekp]

Still getting a variety of BSODS.
I've included another zip file with minidumps.

************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff8a00c073670, fffff8a00c073670, 7ffff8a00c073670}

Probably caused by : Pool_Corruption ( nt!ExFreePool+75b )

Followup: Pool_corruption

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff880043c4cf7, fffff880061f56a8, fffff880061f4f00}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForPreparation+2b )

BugCheck 1000007E, {ffffffffc0000005, fffff8800423339f, fffff880021f3438, fffff880021f2c90}

Unable to load image \SystemRoot\System32\drivers\dxgkrnl.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for dxgkrnl.sys
*** ERROR: Module load completed but symbols could not be loaded for dxgkrnl.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_SEGMENT::InvalidateAllVirtualAddress+6b )

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88007985bf8, fffff88007985450, fffff88001290d10}

Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveHashEntry+c4 )

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960000f41a2, fffff88008559010, 0}

Probably caused by : win32k.sys ( win32k!EngTextOut+11e )

 

[freekp]

Sorry to once again bump my post but I'm at a bit of a loss here on what to do next.
Does anyone have any ideas on where to look next?
That would be much appreciated.

 

[Jonathan_King]

Hmm... try testing your RAM. Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder. Boot from the CD, and run at least 5 passes.

 

[freekp]

I have done that for 2 nights already.
Both ran for at least 10 passes each without a single error.

 

[Jonathan_King]

Uninstall the Catalyst suite; only install the driver itself.

 

[freekp]

Ah my bad, didn't mention that yet.
I've reinstalled the ATI 10.3 drivers without the catalyst suite which didn't solve the problems.

Things i've done so far.
- Reinstalled video drivers, left catalyst suite out
- Checked ram with memtest for 10+ passes, no errors
- Did sfc /scannow, no problems there.
- Checked HD with a tool

 

[Jonathan_King]

I recommend uninstalling your display adapter completely, and play around with older versions until you find one that works, or you can't find any more.

 

[freekp]

I have uninstalled the 10.3 ati display driver and installed 10.4 this week.
I've also updated my realtek sound driver to the latest version.
That did not help however as I still got a few BSODS the past few days.
I have attached a few minidumps again although i doubt even more are of any use.

Some additional information that might be useful.
I'm running NOD32 as the antivirus scanner.
MSI afterburner is also running to control the fan speed of the videocard.
Fan speed is based on temp, idle speed is 25% as the standard 40% makes a rather annoying high pitched buzzing noise.
Like it could use a bit of oiling.
If i recall correctly the first BSOD I ever got was when I had just installed Speedfan which I promptly uninstalled again.

I will follow your advice Jonathan_King and find one of the older version 9 display drivers and see if the problems still persist.

 

[Jonathan_King]

I think we're on the right track. All of the dmps have the same bugcheck, 3B:

[B]Usual causes:[/B]  System service, Device driver, graphics driver, ?memory

BSOD Index

We have eliminated memory, so we are left with a driver, which agrees completely with past dmps. I believe the cause is the video card or its driver.

 

[freekp]

I have been running my pc for a bit over 2 weeks now with the ATI 9.12 video drivers installed.
Those are the oldest drivers that are compatible with my Radeon 5770 video card.
In those 2 weeks I didn't have a single BSOD although I haven't played BF2: Bad Company 2
which was a regular cause for blue screens.
What I am getting however are occasional lockups where the screen just goes to black and
there is no other option than rebooting.
This happens for example when I load a youtube vid or when the pc goes into screensaver mode.

I wonder if this means the video card might be defective or that it could still be a memory issue like in this topic.
http://www.sevenforums.com/crashes-debugging/69394-windows-7-x64-crashed-bsod-help-please-5.html

 

[Jonathan_King]

Memtest suggested that the problem was not with RAM. I suspect the video card is bad.

 

[MarkJohnson]

I just registered to post this.

I thought I'd post here to you my experience with this crappy Geil RAM. I kept getting BSOD all the time as well, it was so bad I couldn't install Win7 at all. I was going to send the motherboasrd back as memory passed memtest and Linx with no issue. I decided to try my memory from my x58 motherboard (Corsair 1600) and put them in and my system was 100% stable.

I don't know what's up with this memory, but it refused to work in my Biostar TH55B HD mother board (1156 Core i3 530 processor)

If you have other DDR3 memory or can borrow some, do so and I'm sure all will be fine. I ended up buying some cheapo G.Skill memory and no problems since.

Good luck
-=Mark=-

 

[freekp]

Hi,

It's been a year since I've last made a post in this topic but my problem with BSODs still remain.
I want to get to the bottom of this and finally fix this annoying issue.
Attached with this post are 2 files:
- Zip file containing all BSODs I've had over the past 1,5 years categorised by error code in separate zips and the perform HTML file.
- Zip file containing only the recent BSODs of the past 2 months.

Each zip file contains the dmp file and a txt file containing the output of WinDbg with !analyze -v

The type of BSODS I have had and how many times are:

• 1 - 1
• 1A - 1
• 1E - 9
• 3B - 68
• 19 - 2
• 24 - 5
• 50 - 1
• 109 - 1
• 116 - 2
• 1000007E - 28
• A - 1

Over the past few months I've ran driver verifier and updated/uninstalled drivers and software that might be causing problems.
BSODs that occured with Driver Verifier enabled are included in the All zip file.
I have also run memtest as well as HD utility software several times with neither giving any errors.

I believe the issue is a hardware one and I think it's either the memory, the video card or perhaps the motherboard. My next step will be to switch out ram modules running the pc with only 1 at a time as well as in differents slots on the mobo.
If that doesn't solve it I'll look into replacing the video card and the ram.

If any of you has any other suggestions on what to do next, I'll gladly hear them.

@MarkJohnson Thank you for your post. I'll see if I can find some other memory to test with. Sorry for the late reply, got caught up with work.