BSOD Computer was idle

[jakesnake3037]

It BSOD's about once a week! No clue why!

 

[writhziden]

Antivirus Software:

ccsvchst.exe	c:\program files (x86)\norton internet security\engine\19.5.0.145\ccsvchst.exe	1636	8	1024	10240	3/1/2012 4:28 PM	11.2.0.9	135.01 KB (138,248 bytes)	2/9/2012 3:12 AM
ccsvchst.exe	c:\program files (x86)\norton internet security\engine\19.5.0.145\ccsvchst.exe	2060	8	1024	10240	3/1/2012 4:29 PM	11.2.0.9	135.01 KB (138,248 bytes)	2/9/2012 3:12 AM

Possible out of date drivers

BrUsbSer	fffff880`04c00000	fffff880`04c04c80	Sat Sep 02 18:53:35 2006 (44fa278f)	00008789		BrUsbSer.sys
BrSerIf	fffff880`00fdb000	fffff880`00ffa000	Mon Dec 11 10:45:01 2006 (457d991d)	0001b3de		BrSerIf.sys

BrUsbSer.sys
BrSerIf.sys

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\jakesnake3037\Windows_NT6_BSOD_jcgriff2\030112-25443-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03018000 PsLoadedModuleList = 0xfffff800`0325d670
Debug session time: Thu Mar  1 15:27:26.865 2012 (UTC - 7:00)
System Uptime: 0 days 7:21:49.036
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80003383415, 0, 1}

Probably caused by : ntkrnlmp.exe ( nt!NtSetInformationProcess+3c8 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003383415, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000001, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!NtSetInformationProcess+3c8
fffff800`03383415 448d6bf9        lea     r13d,[rbx-7]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000001

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c7100
 0000000000000001 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  lsm.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800aba8350 -- (.trap 0xfffff8800aba8350)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbd7f701a665e rbx=0000000000000000 rcx=ffffffffffffffff
rdx=0000000000000029 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003383415 rsp=fffff8800aba84e0 rbp=fffff8800aba88b0
 r8=fffff8800aba8a48  r9=0000000000000028 r10=ffffffffffffffff
r11=00000000002ed74c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!NtSetInformationProcess+0x3c8:
fffff800`03383415 448d6bf9        lea     r13d,[rbx-7]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030e0588 to fffff80003094c40

STACK_TEXT:  
fffff880`0aba7ac8 fffff800`030e0588 : 00000000`0000001e ffffffff`c0000005 fffff800`03383415 00000000`00000000 : nt!KeBugCheckEx
fffff880`0aba7ad0 fffff800`030942c2 : fffff880`0aba82a8 00000000`00000008 fffff880`0aba8350 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0aba8170 fffff800`03092e3a : 00000000`00000000 00000000`00000001 fffffa80`0cff1000 00000000`00000008 : nt!KiExceptionDispatch+0xc2
fffff880`0aba8350 fffff800`03383415 : fffff880`0aba84f8 fffff8a0`0e9a45c0 00000000`72500000 ffffffff`00000014 : nt!KiPageFault+0x23a
fffff880`0aba84e0 fffff800`03093ed3 : 00000000`001fffff 00000000`00000000 fffffa80`0cd82b30 fffff800`001fffff : nt!NtSetInformationProcess+0x3c8
fffff880`0aba8830 fffff800`03090470 : fffff800`03382cce 00000000`00000000 fffff800`0338ea5f fffff8a0`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0aba89c8 fffff800`03382cce : 00000000`00000000 fffff800`0338ea5f fffff8a0`00000000 fffffa80`0cd19b08 : nt!KiServiceLinkage
fffff880`0aba89d0 fffff800`033812fd : 00000000`00016000 00000000`00080000 00000000`00000000 00000000`00001000 : nt!RtlCreateUserStack+0x122
fffff880`0aba8ac0 fffff800`03380f2e : fffffa80`10aa0060 fffff880`0aba9928 fffffa80`0cd19c00 fffff880`0aba9510 : nt!PspAllocateThread+0x299
fffff880`0aba8ce0 fffff800`03384e35 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff880`0aba9510 : nt!PspCreateThread+0x1d2
fffff880`0aba8f60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateThreadEx+0x25d


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtSetInformationProcess+3c8
fffff800`03383415 448d6bf9        lea     r13d,[rbx-7]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!NtSetInformationProcess+3c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!NtSetInformationProcess+3c8

BUCKET_ID:  X64_0x1E_c0000005_nt!NtSetInformationProcess+3c8

Followup: MachineOwner
---------

There was only one .dmp file included. If you are using any file cleanup software (CCleaner, Windows Disk Cleanup, etc.), please refrain from doing so after the crashes because they can remove the .dmp files.

The .dmp file was rather inconclusive. Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash.



Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

• If you are overclocking any hardware, please stop.
  
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
  
  
  
• Scan for viruses.
  
  
  
• Install all Windows updates.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.