BSOD at random intervals. There's no consistency.

[jamiepugh]

Hi

PC has just (a few weeks ago) begun to give BSOD. They don't appear to be consistent.

Windows Update is up to date, OS is geniune and I've used 2 different sticks of memory, but its still unstable. And I've not added anything new.

Can someone have a look at the dump file please?

Thanks
Jay

 

[x BlueRobot]

Welcome to the forums jamiepugh,

[COLOR="Red"]BugCheck A[/COLOR], {fffff880008b5610, 2, 1, fffff8000308576f}

*** WARNING: Unable to verify timestamp for MpFilter.sys
*** ERROR: Module load completed but symbols could not be loaded for MpFilter.sys
Probably caused by : [COLOR="red"]MpFilter.sys[/COLOR] ( MpFilter+b4e4 )

It seems that the MSE driver may have referenced invalid memory address, and then attempted to cause a interrupt at a IRQL level which was too high.

2: kd>[COLOR="SeaGreen"] lmvm MpFilter[/COLOR]
start             end                 module name
fffff880`011c3000 fffff880`011fb000   MpFilter T (no symbols)           
    Loaded symbol image file: MpFilter.sys
    Image path: \SystemRoot\system32\DRIVERS\MpFilter.sys
    Image name: MpFilter.sys
    Timestamp:        [COLOR="red"]Wed Oct 31 22:43:06 2012[/COLOR] (5091A97A)
    CheckSum:         0003BD03
    ImageSize:        00038000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

1. Remove MSE (Microsoft Security Essentials)
2. Install MSE, and then fully update.
3. Run a Full Scan

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[jamiepugh]

Hi

I uninstalled MSE and reinstalled. But no difference, its still BSOD regularly.

I'll try verifier next, but here are the latest dumps (maybe there's something else wrong)...

Thanks

 

[x BlueRobot]

There seems to most likely a driver-related cause, could you please enable Driver Verifier, it doesn't seem to be enabled:

4: kd> [COLOR="SeaGreen"]!verifier[/COLOR]

Verify Level 0 ... enabled options are:

Summary of All Verifier Statistics

RaiseIrqls                             0x0
AcquireSpinLocks                       0x0
Synch Executions                       0x0
Trims                                  0x0

Pool Allocations Attempted             0x0
Pool Allocations Succeeded             0x0
Pool Allocations Succeeded SpecialPool 0x0
Pool Allocations With NO TAG           0x0
Pool Allocations Failed                0x0
Resource Allocations Failed Deliberately   0x0

Current paged pool allocations         0x0 for 00000000 bytes
Peak paged pool allocations            0x0 for 00000000 bytes
Current nonpaged pool allocations      0x0 for 00000000 bytes
Peak nonpaged pool allocations         0x0 for 00000000 bytes

BSOD Analysis:

-----------------------------------------------------------------------------

[COLOR="Red"]BugCheck C2[/COLOR], {[COLOR="Blue"]7[/COLOR], 109b, 0, [COLOR="SeaGreen"]fffffa8006821630[/COLOR]}

GetPointerFromAddress: unable to read from fffff80003302100
GetUlongFromAddress: unable to read from fffff800033021c0
Probably caused by : ntkrnlmp.exe ( nt!ObpCloseHandleTableEntry+c4 )

Usual causes:  Device driver, Memory

This bugcheck indicates the current thread was attempting to free the same pool allocation twice, or a device driver was performing incorrect memory operations.

4: kd> [COLOR="seagreen"]!pool fffffa8006821630[/COLOR]
[COLOR="Blue"]Pool page fffffa8006821630 region is Nonpaged pool[/COLOR]
 fffffa8006821000 size:  160 previous size:    0  (Allocated)  Ntfx
 fffffa8006821160 size:   10 previous size:  160  (Free)       CcBc
 fffffa8006821170 size:   30 previous size:   10  (Allocated)  ReEv
 fffffa80068211a0 size:  150 previous size:   30  (Allocated)  File (Protected)
 fffffa80068212f0 size:  150 previous size:  150  (Allocated)  File (Protected)
 fffffa8006821440 size:   10 previous size:  150  (Free)       FMic
 fffffa8006821450 size:  100 previous size:   10  (Allocated)  MmCa
 fffffa8006821550 size:   b0 previous size:  100  (Allocated)  Hal 
[COLOR="Red"]*fffffa8006821600 size:   80 previous size:   b0  (Allocated) *Even (Protected)[/COLOR]
		Pooltag Even : Event objects
 fffffa8006821680 size:   a0 previous size:   80  (Free)       ViMm
 fffffa8006821720 size:  1b0 previous size:   a0  (Allocated)  MmCi
 fffffa80068218d0 size:  150 previous size:  1b0  (Allocated)  File (Protected)
 fffffa8006821a20 size:  150 previous size:  150  (Allocated)  File (Protected)
 fffffa8006821b70 size:  150 previous size:  150  (Allocated)  File (Protected)
 fffffa8006821cc0 size:  170 previous size:  150  (Allocated)  MmCi
 fffffa8006821e30 size:  1d0 previous size:  170  (Allocated)  Ntfi

4: kd> [COLOR="SeaGreen"]!poolval fffffa8006821630[/COLOR]
Pool page fffffa8006821630 region is Nonpaged pool

Validating Pool headers for pool page: fffffa8006821630

Pool page [ fffffa8006821000 ] is VALID.

I don't think we are dealing with any pool corruption which is good.

 

[jamiepugh]

Hi

I can't run Verifier (for non-MS drivers) because all of the drivers are MS.

Any ideas?

Jamie

 

[x BlueRobot]

Please post a screenshot for Step #5 within the Driver Verifier tutorial:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html
• How to Use the Snipping Tool in Vista

Scan for any missing, modified or corrupted protected Windows files with:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[x BlueRobot]

Update:

I believe since the Even tag has the Protected bit set added to it, this allows the operating system to check if the pool tag being freed was supposed to be freed, and therefore since the Even tag was freed, but wasn't maybe intended to be, the system then bugchecks with the Stop Code 0xC2.

According to some searching, the Even pool tag belongs to the Event Viewer.

 

[jamiepugh]

Ok

Don't know why only MS drivers were showing up before, but they are all back now, so I enabled Verifier again. Its BSOD quite a few times since, so here are the new dump files...

BTW: Thanks for the update info above but I'm afraid I don't really understand any of it! Sorry bluerobot. Building houses is my expertise; i'm not very good at code analysis.

Thanks
Jamie

 

[x BlueRobot]

Thanks for the dump files, the problem does seem to be definitely related to drivers which I was expecting

BSOD Analysis:

----------------------------------------------------------------------------

[COLOR="Red"]BugCheck C9[/COLOR], {[COLOR="Blue"]23e[/COLOR], fffff880058cc9ec, fffff98023b7ac10, 0}

Unable to load image \SystemRoot\system32\DRIVERS\shbecr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for shbecr.sys
*** ERROR: Module load completed but symbols could not be loaded for shbecr.sys
Probably caused by : [COLOR="red"]shbecr.sys[/COLOR] ( shbecr+69ec )

The shbecr.sys driver marked a IRP pending, but didn't return the STATUS_PENDING flag.

0: kd> [COLOR="SeaGreen"]lmvm shbecr[/COLOR]
start             end                 module name
fffff880`058c6000 fffff880`058d8000   shbecr   T (no symbols)           
    Loaded symbol image file: shbecr.sys
    Image path: \SystemRoot\system32\DRIVERS\shbecr.sys
    Image name: shbecr.sys
    Timestamp:        [COLOR="red"]Fri May 30 13:28:27 2008[/COLOR] (483FF2EB)
    CheckSum:         00014042
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The driver at fault here, seems to be linked to Handelsbanken Card Reader driver, and is very outdated, it seems to been have developed by a company called Todos Data System AB. I would check for updates for the driver, however, if it is the latest version then I would remove the device and it's driver.

Their main website isn't loading for me, so here's the Wiki page - http://en.wikipedia.org/wiki/Todos_Data_System

You may disable Driver Verifier now.

 

[jamiepugh]

Hi

I removed the Handelsbanken driver, but its made no difference, its still regularly BSOD.

I can't enable Verifier because all of the drivers are MS again. I ran the SFC /scannow but this found no issues.

I've attached the latest dump files...

Thanks
Jamie

 

[x BlueRobot]

[COLOR="Red"]BugCheck D1[/COLOR], {[COLOR="SeaGreen"]8[/COLOR], 2, [COLOR="Blue"]1[/COLOR], [COLOR="Orange"]fffff880018880e2[/COLOR]}

Probably caused by : tcpip.sys ( tcpip!TtFireTimerEx+12b )

Usual causes:  Device driver

It seems that the two drivers listed below attempted to page non-paged pool.

0: kd> [COLOR="SeaGreen"]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff800`00b9c038 fffff800`030c71a9 nt!KeBugCheckEx
fffff800`00b9c040 fffff800`030c5e20 nt!KiBugCheckDispatch+0x69
fffff800`00b9c180 fffff880`018880e2 [COLOR="Red"]nt!KiPageFault+0x260[/COLOR]
fffff800`00b9c310 fffff880`018881ad [COLOR="Orange"]tcpip!TtFireTimerEx+0x12b[/COLOR]
fffff800`00b9c330 fffff880`018884ee tcpip!IppAddressSetTimeout+0x5d
fffff800`00b9c450 fffff880`018883e8 tcpip!Ipv6pInterfaceSetTimeout+0x7f
fffff800`00b9c4d0 fffff880`01888ab9 tcpip!IppCompartmentSetTimeout+0x88
fffff800`00b9c540 fffff800`030d284c tcpip!IppTimeout+0x89
fffff800`00b9c570 fffff800`030d26e6 nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5e0 fffff800`030d25ce nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`030d23b7 nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`030bf90a nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 nt!KiIdleLoop+0x5a

TRAP_FRAME:  fffff80000b9c180 -- ([COLOR="SeaGreen"].trap 0xfffff80000b9c180[/COLOR])
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80000b9c310 rbx=0000000000000000 [COLOR="Red"]rcx=0000000000000000[/COLOR]
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018880e2 rsp=fffff80000b9c310 rbp=0000000000000002
 [COLOR="red"]r8=fffff80000b9c350[/COLOR]  r9=fffffa8004683db0 r10=0000000000000000
r11=00000000000003b4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po cy
tcpip!TtFireTimerEx+0x12b:
[COLOR="Orange"]fffff880`018880e2[/COLOR] 48894108        mov     qword ptr [COLOR="Red"][rcx+8][/COLOR],rax ds:00000000`00000008=????????????????
Resetting default scope

0: kd> [COLOR="SeaGreen"]lmvm Rt64win7[/COLOR]
start             end                 module name
fffff880`0446b000 fffff880`0450b000   Rt64win7 T (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:       [COLOR="Red"] Tue Sep 27 15:50:33 2011[/COLOR] (4E81E2B9)
    CheckSum:         0009FB77
    ImageSize:        000A0000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update your Realtek (RTL8168D/8111D) network driver from here - Realtek

0: kd> [COLOR="seagreen"]lmvm nvlddmkm[/COLOR]
start             end                 module name
fffff880`04841000 fffff880`052e8000   nvlddmkm T (no symbols)           
    Loaded symbol image file: nvlddmkm.sys
    Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    Image name: nvlddmkm.sys
    Timestamp:        [COLOR="Red"]Fri Jan 18 13:22:15 2013[/COLOR] (50F94C87)
    CheckSum:         00A92B69
    ImageSize:        00AA7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update the nVidia graphics card driver to the latest WHQL driver, which is available from here - NVIDIA Driver Downloads - Advanced Search

Version: 320.49
Release Date for Desktops and Notebooks : July 1st 2013
In Device Manager: 9.18.13.2049

 

[jamiepugh]

Hi BlueRobot

Thanks for your help up to now...

I've updated the Realtek and nVidia drivers but I'm still getting BSOD regularly. (I've attached the latest dumps)

Could it be memory or is it deffo a driver?

Many thanks

Jamie Pugh

 

[x BlueRobot]

[COLOR=Red]BugCheck 19[/COLOR], {[COLOR=Blue]3[/COLOR], [COLOR=SeaGreen]fffff8a002496220[/COLOR], 3651, fffff8a002496220}

Probably caused by : [COLOR=Red]Pool_Corruption[/COLOR] ( nt!ExDeferredFreePool+c96 )

Usual causes:  Device driver

Other causes can include RAM and the hard-drive.

Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a002496220, the pool entry being checked.
[COLOR=Red]Arg3: 0000000000003651[/COLOR], the read back flink freelist value (should be the same as 2). <-- Corrupted Address
Arg4: fffff8a002496220, the read back blink freelist value (should be the same as 2).

0: kd> [COLOR=SeaGreen]!pool fffff8a002496220[/COLOR]
GetPointerFromAddress: unable to read from fffff80003301100
Pool page fffff8a002496220 region is GetUlongFromAddress: unable to read from fffff800033011c0
[COLOR=Blue]Paged pool[/COLOR]
 fffff8a002496000 size:  210 previous size:    0  (Free )  SeSd
[COLOR=Red]*fffff8a002496210 size:   40 previous size:  210  (Free)      *....[/COLOR]
        Owning component : Unknown (update pooltag.txt)
 fffff8a002496250 size:   e0 previous size:   40  (Allocated)  MPCp
 fffff8a002496330 size:   30 previous size:   e0  (Allocated)  Ntf0
 fffff8a002496360 size:   30 previous size:   30  (Allocated)  PfFK
 fffff8a002496390 size:  170 previous size:   30  (Allocated)  MPsc
 fffff8a002496500 size:   40 previous size:  170  (Allocated)  NtFs
 fffff8a002496540 size:  110 previous size:   40  (Allocated)  IoNm
 fffff8a002496650 size:   f0 previous size:  110  (Allocated)  NtFs
 fffff8a002496740 size:   a0 previous size:   f0  (Free)       Sect
 fffff8a0024967e0 size:  200 previous size:   a0  (Allocated)  FMfn
 fffff8a0024969e0 size:   90 previous size:  200  (Allocated)  FSim
 fffff8a002496a70 size:   c0 previous size:   90  (Allocated)  FIcs
 fffff8a002496b30 size:  4d0 previous size:   c0  (Allocated)  Ntff

0: kd> [COLOR=SeaGreen]!poolval fffff8a002496220[/COLOR]
Pool page fffff8a002496220 region is Paged pool

Validating Pool headers for pool page: fffff8a002496220

[COLOR=Red]Pool page [ fffff8a002496000 ] is VALID[/COLOR].

What I think has happened, is that an allocation has become free, but the linked list hasn't been updated, to show that address is free to use.

I would test for drivers one more time, since you seem to have a few driver related causes in the dumps, if nothing arises from Driver Verifier, then we can begin testing the hard-drive and testing the RAM etc.

 

[jamiepugh]

Hi

Ok, I enabled Verifier again and its BSOD a few times now. Here are the dumps...

Thanks
Jamie

 

[x BlueRobot]

[COLOR="Red"]BugCheck 4E[/COLOR], {[COLOR="Blue"]99[/COLOR], b3562, 3, 6157a}

Probably caused by : [COLOR="Red"]memory_corruption[/COLOR] ( nt!MiBadShareCount+4c )

Usual causes:  Device driver, memory

The bugcheck indicates that a PTE or a PFN list has become corrupt, the PFN structure is used to track each physical page and how it is being used by the system. I couldn't see anything related to drivers, apart from a stray pointer pointing to an invalid memory address, which could be corrupt, if the RAM is at fault here.

fffff880`0bc67048 fffff800`03166a0c : 00000000`0000004e 00000000`00000099 00000000`000b3562 00000000`00000003 : nt!KeBugCheckEx
fffff880`0bc67050 fffff800`031382d5 : fffffa80`04b2eb30 00000000`00000001 00000000`fffffffe fffff680`00348000 : nt!MiBadShareCount+0x4c
fffff880`0bc67090 fffff800`030a7896 : fffff700`01080760 fffffa80`04b2eec8 fffff700`01080000 fffff8a0`0bdee1e8 : nt! ?? ::FNODOBFM::`string'+0x2062a
fffff880`0bc671a0 fffff800`030a8872 : fffffa80`04b2eb30 fffffa80`00000000 00000000`00007970 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x3fb
fffff880`0bc67a50 fffff800`033adcba : fffff8a0`0335a060 00000000`00000001 00000000`00000000 fffffa80`04b32640 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0bc67aa0 fffff800`03392188 : [COLOR="SeaGreen"]00000000`c0000005[/COLOR] 00000000`00000001 00000000`7ef9b000 fffffa80`04b3f6b0 : nt!PspExitThread+0x56a
fffff880`0bc67ba0 fffff800`030d6e93 : fffffa80`04b2eb30 fffffa80`c0000005 fffffa80`04b32640 fffffa80`06820060 : nt!NtTerminateProcess+0x138
fffff880`0bc67c20 00000000`76d615da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0351e278 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d615da

I would disable Driver Verifier, and then begin testing the RAM for any issues:

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run Memtest86+ for least 9-10 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

 

[jamiepugh]

BlueRobot

Its taken me a while to get back to you, sorry. Thanks so much - all sorted now.

The actual memory sticks were ok and the individual sockets were ok, BUT the motherboard didnt like them in the same bank (i.e. 1&2 or 3&4). So, the sticks are in slots 1 & 3 and its fine.

Thanks again.