BSOD happening sometime during system idel; random

[pschand]

I continue to get the BSOD on my computer. I thought it was a video driver problem after installing a new AMD HD6570 graphics card, but have uninsalled and disabled, and continue to get the BSOD. I'm not sure what might be causing it, so I have attached a copy of the actual ble screen error along with perfmon report and windows NT6_BSOD file. I hope someone can help me with this annoying problem. Thanks for all help in advance.

Phil

Processor: AMD Phenom(tm)9150e Quad-Core Processor 1.80GHz
Memory 4.00 GB
System type: 64-bit Windows 7 Professional
Computer: HP Pavilion a6000

View attachment 199784

View attachment 199785

View attachment 199786

 

[zigzag3143]

Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.


What malware app are you running?

 

[pschand]

I'm running Webroot Secure Anywhere.
How would I know what memory is failing? Could it be the memory on my AMD Video Card?

 

[JMH]

Please run these two tests to verify your memory and find which driver is causing the problem.

If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

If you have Raid > update its Driver.


Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html



Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Using Driver Verifier to identify issues with Windows drivers for advanced users

 

[pschand]

I did the memory check and it came back with no errors. I have not had a BSOD for two days now... I did pull each memory stick from the bank and re-seat them. I wonder if this may have fixed the problem? Im going to hold off on the driver test for now, i only want to try that if I get another BSOD. For now, i'm gonna cross my fingers and hope it was just a memory stick that wasnt seated properly.

 

[zigzag3143]

I did the memory check and it came back with no errors. I have not had a BSOD for two days now... I did pull each memory stick from the bank and re-seat them. I wonder if this may have fixed the problem? Im going to hold off on the driver test for now, i only want to try that if I get another BSOD. For now, i'm gonna cross my fingers and hope it was just a memory stick that wasnt seated properly.

No problem. Good luck

 

[pschand]

Well, my good luck ran out and I had another blue screen. So I ran the Driver Verifier for about an hour and had another blue screen. So I have attached all the files and hopefully someone can help me out with this problem. I noticed one thing different about this blue screen error, I got a BCC Code 3b instead of my standard BCC Code 50.

Thanks for any help you may provide.
Phil

 

[writhziden]

Problem devices:

Microsoft Virtual WiFi Miniport Adapter	{5D624F94-8850-40C3-A3FA-A4FD2080BAF3}\VWIFIMP\6&25DFF3A8&0&01	This device is disabled.
Officejet 6500 E709n	ROOT\MULTIFUNCTION\0000	This device is disabled.
Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64	ROOT\NET\0000	This device is disabled.

Antivirus Software:

wrsa.exe	c:\program files\webroot\wrsa.exe	844	8	200	1380	3/1/2012 6:56 PM	8.0.1.143	640.50 KB (655,872 bytes)	11/4/2011 6:59 PM
wrsa.exe	c:\program files\webroot\wrsa.exe	2536	8	200	1380	3/1/2012 6:59 PM	8.0.1.143	640.50 KB (655,872 bytes)	11/4/2011 6:59 PM

Possible out of date drivers:

ISODrv64	fffff880`044b7000	fffff880`044d3000	Fri Nov 02 21:21:18 2007 (472be92e)	0001af0a		ISODrv64.sys
GEARAspiWDM	fffff880`047a0000	fffff880`047ad000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
netr7364	fffff880`02c06000	fffff880`02cbe000	Wed May 20 02:53:31 2009 (4a13c50b)	000b1918		netr7364.sys
purendis	fffff880`056d2000	fffff880`056de000	Fri Jun 05 22:32:06 2009 (4a29f146)	00010fd3		purendis.sys
pnarp	fffff880`056c6000	fffff880`056d2000	Sat Jun 06 00:06:44 2009 (4a2a0774)	000113ff		pnarp.sys
nvstor64	fffff880`0113e000	fffff880`0117c000	Mon Jun 22 16:23:37 2009 (4a400469)	00045393		nvstor64.sys
dump_nvstor64	fffff880`0597d000	fffff880`059bb000	Mon Jun 22 16:23:37 2009 (4a400469)	00045393		dump_nvstor64.sys

[list=1]
Loading Dump File [D:\Kingston\BSODDmpFiles\pschand\Windows_NT6_BSOD_jcgriff2\030112-34023-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03058000 PsLoadedModuleList = 0xfffff800`0329d670
Debug session time: Thu Mar  1 18:44:06.696 2012 (UTC - 7:00)
System Uptime: 0 days 2:01:42.413
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {80000003, fffff800030ccad8, fffff88009b36850, 0}

Probably caused by : ntkrnlmp.exe ( nt!DebugPrompt+18 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff800030ccad8, Address of the instruction which caused the bugcheck
Arg3: fffff88009b36850, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

FAULTING_IP: 
nt!DebugPrompt+18
fffff800`030ccad8 c3              ret

CONTEXT:  fffff88009b36850 -- (.cxr 0xfffff88009b36850)
rax=0000000000000002 rbx=fffff880011a37a0 rcx=fffff880011c6070
rdx=fffff88009b3001f rsi=00000000000001e7 rdi=fffff880011c6090
rip=fffff800030ccad7 rsp=fffff88009b37238 rbp=fffffa80060222e0
 r8=fffff88009b372b0  r9=fffff880011c0002 r10=0000000000000000
r11=fffff88009b37288 r12=0000000000000001 r13=0000000000000000
r14=fffffa8006022200 r15=0000000000000032
iopl=0         nv up ei pl nz ac pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00200212
nt!DebugPrompt+0x17:
fffff800`030ccad7 cc              int     3
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x3B

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800030ccad7

STACK_TEXT:  
fffff880`09b37238 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!DebugPrompt+0x17


FOLLOWUP_IP: 
nt!DebugPrompt+18
fffff800`030ccad8 c3              ret

SYMBOL_NAME:  nt!DebugPrompt+18

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff88009b36850 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_VRF_nt!DebugPrompt+18

BUCKET_ID:  X64_0x3B_VRF_nt!DebugPrompt+18

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\pschand\Windows_NT6_BSOD_jcgriff2\022912-26754-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03002000 PsLoadedModuleList = 0xfffff800`03247670
Debug session time: Wed Feb 29 20:11:30.633 2012 (UTC - 7:00)
System Uptime: 4 days 0:53:57.022
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffffffffffd0, 1, fffff80003088a4c, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!xxxCreateDesktopEx+8e2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80003088a4c, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b1100
 ffffffffffffffd0 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
fffff800`03088a4c f0480fc11f      lock xadd qword ptr [rdi],rbx

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winlogon.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880086882b0 -- (.trap 0xfffff880086882b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c06447e0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003088a4c rsp=fffff88008688440 rbp=fffff88008391ca0
 r8=fffffa800635f388  r9=0000000000000000 r10=fffffffffffffffe
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ObfDereferenceObject+0x2c:
fffff800`03088a4c f0480fc11f      lock xadd qword ptr [rdi],rbx ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000302a9fc to fffff8000307ec40

STACK_TEXT:  
fffff880`08688148 fffff800`0302a9fc : 00000000`00000050 ffffffff`ffffffd0 00000000`00000001 fffff880`086882b0 : nt!KeBugCheckEx
fffff880`08688150 fffff800`0307cd6e : 00000000`00000001 ffffffff`ffffffd0 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`086882b0 fffff800`03088a4c : fffffa80`079e1090 00000000`00000000 fffff900`c06447e0 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`08688440 fffff960`0018945a : fffff880`08391ca0 00000000`00000000 fffffa80`03f7b090 fffffa80`046b0c68 : nt!ObfDereferenceObject+0x2c
fffff880`086884a0 fffff960`001a3593 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : win32k!xxxCreateDesktopEx+0x8e2
fffff880`08688640 fffff960`001a1a6a : 00000000`00000000 fffff880`08391ca0 fffff900`c06447e0 00000000`00000000 : win32k!xxxResolveDesktop+0xa47
fffff880`086889f0 fffff960`001cddcf : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0635f300 : win32k!xxxCreateThreadInfo+0x64e
fffff880`08688b60 fffff960`001a5000 : fffff900`c06447e0 fffffa80`08270b60 fffffa80`08270b60 fffffa80`0635f300 : win32k!UserThreadCallout+0xcf
fffff880`08688b90 fffff800`03322265 : fffffa80`08270b60 fffffa80`0635f300 fffff6fc`40041c58 fffff6fc`40041c88 : win32k!W32pThreadCallout+0x78
fffff880`08688bc0 fffff800`030764fa : fffffa80`08270b60 00000000`00000001 00000000`00000020 00000000`00000000 : nt!PsConvertToGuiThread+0xe9
fffff880`08688bf0 fffff800`0307e09f : 00000000`00000104 00000000`00000001 00000000`7fffffff 000007fe`faa50000 : nt!KiConvertToGuiThread+0xa
fffff880`08688c20 00000000`77894e2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x1c4
00000000`00b7f798 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77894e2a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!xxxCreateDesktopEx+8e2
fffff960`0018945a 49895d38        mov     qword ptr [r13+38h],rbx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  win32k!xxxCreateDesktopEx+8e2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f10ff24

FAILURE_BUCKET_ID:  X64_0x50_win32k!xxxCreateDesktopEx+8e2

BUCKET_ID:  X64_0x50_win32k!xxxCreateDesktopEx+8e2

Followup: MachineOwner
---------


[/list]

1. Caused by Verifier (as expected) but points to a system service. This usually indicates a hardware problem or data corruption.
2. Same error as before, Bug check 0X50.

Start by checking for data corruption:

• Turn off driver Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as Administrator ->
  verifier /reset​
  -> restart your computer
  
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.

 

[pschand]

Ok, so here are the results of my CHKDSK and SFC SCANNOW. I don't really know how to read any of this, but I think it found some errors and fixed them.

 

[writhziden]

No data corruption. It could be hardware, or it may still be an underlying driver that needs to be rooted out. We should start with hardware.

• Monitor temperatures during the following tests.
  
  Use the following programs to monitor the temperatures.​
  • Real Temp is a good CPU temperature monitor.
  • Speccy - System Information - Free Download will monitor all hardware temperatures.
  • HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
  • 
    Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
    
    
    
  • Run http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.