BSOD in any browser. Memory Management. Driver Issue

[shortshort]

I was getting lots of BSODs and THEN I started updating drivers. Seemed to get better, then got much worse. Please help to tell me which driver(s) are causing my issue. Note I was also getting a BSOD for another reason that escapes me right now - hopefully in one of the many crash logs.

I NEVER have been able to install SP1 on this machine. When I complained to HP when it was still under warranty, they said I did not need it. I have many many items from HP. NO MORE. This machine has been plagued with issues since I got it and their version of tech support is a joke. HP replaced the MB under warranty.

See attachment.

Thanks in advance for any help.

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1a
BCP1: 0000000000041790
BCP2: FFFFFA80041A9810
BCP3: 000000000000FFFF
BCP4: 0000000000000000
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

 

[koolkat77]

• Virus Check:
  • Make scans with these tools below:
    • TDSSKiller Rootkit Removal Utility Free Download | Kaspersky Lab US
    • Online Virus Scanner Eset
• Application conflict:
  • Reduce the start-up items. This will help avoid software conflicts:
    • Remove Startup Programs in Windows 7
    • Clean Startup in Windows 7

• System File Checker
  • The SFC /SCANNOW Command - System File Checker scans the integrity of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible. If you have modified your system files as in theming explorer/system files, running sfc /scannow will revert the system files to it's default state.
    • Link to full tutorial: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
• Run Disk Check in Windows 7
  • Run this on your Hard Drive(s). This will show you how to run Check Disk or chkdsk in Windows 7 to check a selected hard disk for file system errors and bad sectors on it. With both boxes checked for all HDDs and with Automatically fix file system errors. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
    • Link to full tutorial: http://www.sevenforums.com/tutorials/433-disk-check.html

• Test and Diagnose RAM issues with MEMTEST86+
  • Pay close attention to Part 3 of the tutorial "If you have errors". Take the test for at least 7-10 passes. It may take up to 22 passes to find problems.
    • Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

• Check for heating issues using Speccy or HWmonitor
  • HWMonitor CPUID - System & hardware benchmark, monitoring, reporting
  • Speccy - System Information - Free Download
    • Please upload a summary tab using Speccy. http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

• Use Crystal Disk Info to upload a screenshot of your Hard Drives (s).
  • Then test your Hard Drives (s) running a Hard Drive Diag.

 

[shortshort]

Now won't start

Ran TDSSKiller Rootkit Removal Utility - nothing
Online Virus Scanner Eset - web page would not load so could not run.

Followed Clean Start proceedure - now will not start. Get StartRep.exe application error. Instruction at 0xfb72584d referenced memory at oxooooooo8. That memory could not be read.

Pulled each memory module and still have same problem - will not start.

 

[x BlueRobot]

[COLOR="Red"]BugCheck 1A[/COLOR], {[COLOR="Blue"]41790[/COLOR], [COLOR="SeaGreen"]fffffa80041a9810[/COLOR], [COLOR="Orange"]ffff[/COLOR], 0}

Probably caused by : win32k.sys ( win32k!FreeView+a2 )

The first parameter indicates that a page table page has become corrupt, the second parameter, and since this is a x64 operating system, points to the PFN of the corrupt page table page.

3: kd> [COLOR="SeaGreen"]dt nt!_MMPFN fffffa80041a9810[/COLOR]
   +0x000 u1               : <unnamed-tag>
   +0x008 u2               : <unnamed-tag>
   +0x010 PteAddress       : 0xfffff6fb`40000010 _MMPTE <-- PTE for physical page
   +0x010 VolatilePteAddress : 0xfffff6fb`40000010 Void
   +0x010 Lock             : 0n1073741840
   +0x010 PteLong          : 0xfffff6fb`40000010
   +0x018 u3               : <unnamed-tag>
   +0x01c UsedPageTableEntries : [COLOR="Orange"]0xffff[/COLOR] <-- Dropped below 0
   +0x01e VaType           : 0 ''
   +0x01f ViewCount        : 0 ''
   +0x020 OriginalPte      : _MMPTE
   +0x020 AweReferenceCount : 0n128
   +0x028 u4               : <unnamed-tag>

3: kd> [COLOR="SeaGreen"]k[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`0b2e4c38 fffff800`032f074e nt!KeBugCheckEx
01 fffff880`0b2e4c40 fffff800`032b09c9 nt! ?? ::FNODOBFM::`string'+0x32f36
02 fffff880`0b2e4e00 fffff800`03591e90 [COLOR="Red"]nt!MiRemoveMappedView[/COLOR]+0xd9
03 fffff880`0b2e4f20 fffff960`0012e07a [COLOR="Red"]nt!MiUnmapViewOfSection[/COLOR]+0x1b0
04 fffff880`0b2e4fe0 fffff960`0012be83 win32k!FreeView+0xa2
05 fffff880`0b2e5050 fffff800`0351eeec win32k!UnmapDesktop+0x6b
06 fffff880`0b2e5080 fffff800`03535823 nt!ExpWin32SessionCallout+0x5c
07 fffff880`0b2e50e0 fffff800`03574024 nt!ExpWin32CloseProcedure+0x53
08 fffff880`0b2e5130 fffff800`0358f881 nt!ObpDecrementHandleCount+0xb4
09 fffff880`0b2e51b0 fffff800`0358f794 nt!ObpCloseHandleTableEntry+0xb1
0a fffff880`0b2e5240 fffff960`0012f163 nt!ObpCloseHandle+0x94
0b fffff880`0b2e5290 fffff960`0012614b win32k!DestroyProcessInfo+0x327
0c fffff880`0b2e52c0 fffff960`00126246 win32k!xxxUserProcessCallout+0x15f
0d fffff880`0b2e5310 fffff800`0355cccd win32k!W32pProcessCallout+0x4e
0e fffff880`0b2e5340 fffff800`035361fb nt!PspExitThread+0x561
0f fffff880`0b2e5400 fffff800`0327cad3 nt!NtTerminateProcess+0x25b
10 fffff880`0b2e5480 fffff800`03279070 nt!KiSystemServiceCopyEnd+0x13
11 fffff880`0b2e5618 fffff800`032b7a9c nt!KiServiceLinkage
12 fffff880`0b2e5620 00000000`00000000 nt!KiDispatchException+0x53b

I've given a explantation of the bugcheck here - BSODTutorials: Debugging Stop 0x1A - MEMORY_MANAGEMENT

Other good references are: The Basics:Bugchecks Explained: PFN_LIST_CORRUPT and CodeMachine - Article - Catalog of key Windows kernel data structures

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

Select Individual Settings, and then enable all the options apart from Low Resources Simulation.

 

[shortshort]

How to fix if it is win32k.sys

Assuming it is Probably caused by : win32k.sys , how do I fix it? Can I just copy over that file with a good copy? If so, which one is it? Searching for it I find lots of them.

 

[x BlueRobot]

Have you followed any of my advice?

win32k.sys is part of the Windows subsystem, it's not the problem here.

 

[shortshort]

Was unable to boot the drive so I couldn't run anything (see above).

Some more info. I have 2 hard drives with the HP win 7 premium on one and a microsoft win 7 premium on the other. They both experience the BSOD. We have been working through the worst one (on a SSD) which is the microsoft version. That is the one that stopped working. Attempted Startup repair and got an application error. Attempted a restore (recent restore disappeared). Did a SFC/Scannow. It then did a boatload of updates.

Thanks, will run Driver Verifier now.

 

[x BlueRobot]

You may have to use http://www.sevenforums.com/tutorials/682-command-prompt-startup.html to turn on Driver Verifier, and then attempt to boot the computer. Otherwise, I would suggest following this guide - http://www.sevenforums.com/tutorials/219533-troubleshooting-windows-7-failure-boot.html

 

[shortshort]

One step forward, 2 steps back......

I connected through VPN and was able to run ESOP antivirus scan. Found 51 issues that were resolved over 2 operating systems and 3 drives (took about 13 hours to run).

When I started verifier it crashed before it fully booted. Then would no longer boot - got BSOD. Tried to restore, got an error and would not. It eventually was able to boot (in safe mode). Hopefully attachment will help. Thanks.

 

[shortshort]

Could not do a repair. Did run SFC/scannow. It said it found corrupt files but was unable to fix some of them. Log file attached if that helps. Now that I think about it, before I did this same thing, I never got a system restore to work.

 

[x BlueRobot]

2013-11-24 20:08:12, Info                  CSI    000002e9 [SR] Verify complete
2013-11-24 20:08:12, Info                  CSI    000002ea [SR] Repairing 1 components
2013-11-24 20:08:12, Info                  CSI    000002eb [SR] Beginning Verify and Repair transaction
2013-11-24 20:08:12, Info                  CSI    000002ec Hashes for file member \SystemRoot\WinSxS\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7600.16385_none_019357585ef99a63\atidxx32.dll do not match actual file [l:24{12}]"atidxx32.dll" :
  Found: {l:32 b:WsLGpTlqQbNS99ITCkqpWCzfIJgq5ufH2QBefxh9+GE=} Expected: {l:32 b:9vls4vOnyihVVKkUR4IMmVvkUqTHr6om2OnpYSG5FAo=}
2013-11-24 20:08:12, Info                  CSI    000002ed [SR] Cannot repair member file [l:24{12}]"atidxx32.dll" of atiilhag.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-11-24 20:08:12, Info                  CSI    000002ee Hashes for file member \SystemRoot\WinSxS\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7600.16385_none_019357585ef99a63\atidxx32.dll do not match actual file [l:24{12}]"atidxx32.dll" :
  Found: {l:32 b:WsLGpTlqQbNS99ITCkqpWCzfIJgq5ufH2QBefxh9+GE=} Expected: {l:32 b:9vls4vOnyihVVKkUR4IMmVvkUqTHr6om2OnpYSG5FAo=}
2013-11-24 20:08:12, Info                  CSI    000002ef [SR] Cannot repair member file [l:24{12}]"atidxx32.dll" of atiilhag.inf, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type = [l:24{12}]"driverUpdate", TypeName neutral, PublicKey neutral in the store, hash mismatch

Try a Repair Install firstly. It seems like hash mismatches.

 

[x BlueRobot]

[COLOR="Red"]BugCheck C9[/COLOR], {[COLOR="Blue"]6[/COLOR], 103, [COLOR="SeaGreen"]fffff9800c1a6c10[/COLOR], 0}

Probably caused by : InputFilter_FlexDef2b.sys ( InputFilter_FlexDef2b+1c30 )

1: kd> [COLOR="SeaGreen"]!irp fffff9800c1a6c10[/COLOR]
Irp is active with 11 stacks 8 is current (= 0xfffff9800c1a6ed8)
 No Mdl: No System Buffer: Thread fffffa800a803680:  Irp stack trace.  [COLOR="Red"]Pending has been returned[/COLOR]
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0 10 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800d9c2440 00000000 fffff880040a0120-fffff880031bd198    
	      fffffa800d9c2440: Could not read device object or _DEVICE_OBJECT not found
	usbfilter
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800d9d1be0 00000000 fffff80003715540-00000000    
	      fffffa800d9d1be0: Could not read device object or _DEVICE_OBJECT not found
	nt!ViFilterStartCompletionRoutine
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800d6a5e00 00000000 fffff8800619c200-fffff880031bd3b0    
	      Cannot read _DRIVER_OBJECT at fffffa800b8f7e70
	InputFilter_FlexDef2b
			Args: 00000000 00000000 00000000 00000000
[COLOR="Red"]>[ 1b, 0]   0 e0 fffffa800d6a5b80 00000000 fffff80003715540-00000000 Success Error Cancel 
	      Cannot read _DRIVER_OBJECT at fffffa800d9e0b40
	nt!ViFilterStartCompletionRoutine[/COLOR]
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 e0 fffffa800d6a5940 00000000 fffff880061a5c68-fffff880031bd500 Success Error Cancel 
	      Cannot read _DRIVER_OBJECT at fffffa800b8f7e70
	hidusb!HumPnpCompletion
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 e0 fffffa800d6a6b40 00000000 fffff880061b479c-fffff880031bd570 Success Error Cancel 
	      fffffa800d6a6b40: Could not read device object or _DEVICE_OBJECT not found
	HIDCLASS!HidpSynchronousCallCompletion
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 e0 fffffa800d6a6b40 00000000 fffff80003389cf0-fffffa800da07e80 Success Error Cancel 
	      fffffa800d6a6b40: Could not read device object or _DEVICE_OBJECT not found
	nt!PnpDeviceCompletionRoutine
			Args: 00000000 00000000 00000000 00000000

1: kd> [COLOR="SeaGreen"]lmvm InputFilter_FlexDef2b[/COLOR]
start             end                 module name
fffff880`0619b000 fffff880`061a4000   InputFilter_FlexDef2b T (no symbols)           
    Loaded symbol image file: InputFilter_FlexDef2b.sys
    Image path: \SystemRoot\system32\DRIVERS\InputFilter_FlexDef2b.sys
    Image name: InputFilter_FlexDef2b.sys
    Timestamp:        [COLOR="Red"]Sat Jun 19 01:36:01 2010[/COLOR] (4C1C10F1)
    CheckSum:         000111CA
    ImageSize:        00009000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Dongguan Siliten Electronic Co. - Flex Define HID Keyboard Driver seems to be causing problems, please update the driver from here - DONGWAN472017

1: kd> [COLOR="SeaGreen"]!dpx[/COLOR]
Start memory scan  : 0xfffff880031bd2a8 ($csp)
End memory scan    : 0xfffff880031be000 (Stack Base)

               rsp : 0xfffff880031bd2a8 : 0xfffff800037290c2 : nt!IovCompleteRequest+0xc2
0xfffff880031bd2a8 : 0xfffff800037290c2 : nt!IovCompleteRequest+0xc2
0xfffff880031bd2f8 : 0xfffff80003726737 : nt!VerifierKeWaitForSingleObject+0x177
0xfffff880031bd318 : 0xfffff8000372fc00 : nt!IovCallDriver+0x550

The driver has marked a IRP as pending in the IRP stack, but has called nt!IoCompleteRequest, when the IRP has finished being processed, it still holds the STATUS_PENDING flag.

nt!IoCompleteRequest Definition:

VOID 
  IoCompleteRequest(
    IN PIRP  Irp,
    IN CCHAR  PriorityBoost
    );

The first parameter is a pointer to the IRP to be completed.

1: kd> [COLOR="SeaGreen"]lmvm usbfilter[/COLOR]

start             end                 module name
fffff880`0409c000 fffff880`040ad000   usbfilter T (deferred)             
    Image path: \SystemRoot\system32\DRIVERS\usbfilter.sys
    Image name: usbfilter.sys
    Timestamp:        [COLOR="Red"]Wed Aug 29 02:27:12 2012[/COLOR] (503D6FF0)
    CheckSum:         00016B8F
    ImageSize:        00011000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Please update your AMD USB Filter Driver, which is most likely to be part of the chipset driver package - Support & Drivers

I would also check your model or motherboard support page.

 

[shortshort]

I guess "Your Dongguan Siliten Electronic Co. - Flex Define HID Keyboard Driver seems to be causing problems, please update the driver from here - DONGWAN472017" is my HP Keyboard??

The website is not clear on updating. Test 1, Test 2, Test 3?? I have no issue putting in a Dell keyboard (I own a bunch) and deleting the old drivers. When I went to the Device & Printers, selected the keyboard, under properties, all options (delete, update ...) were greyed out. Seems it is using the microsoft default drivers. In which case why is it giving me this problem and more importantly, how do I delete them? Thanks.

Ran out of time tonight for more work.

 

[x BlueRobot]

Post a screenshot of the Device Manager greyed out boxes - http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Have you tried deleting the driver from it's folder?

C:\system32\DRIVERS\InputFilter_FlexDef2b.sys

 

[shortshort]

I did swap keyboards and things are at least much better. Have been busy outside of the computer so I can't say for sure everything is fixed. Today I deleted the driver (from both operating systems). I will run the driver verifier again and see what happens.

Thanks very much for your help.