BSOD Keeps Happening Every Night.

[IsLNdbOi]

Almost every morning I've woken up to my computer with a message saying it has recovered from a serious error.

I don't know what's causing it.

I have attached dump files from two separate mornings though.


Can anyone try to decipher them to see what's going on?

 

[Arc]

Hell IsLNdb0i.

Based on the two dumps you uploaded, I may suggest you the following.

1. Uninstall the latest version of nVidia display driver using Driver Fusion, and install an older one, which was stable there.

2. Perform a Disc Check.

1. Reseat the sata and power.
2. Run chkdsk /f/r, following the option two of the tutorial Disk Check
3. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

3. Uninstall Microsoft Security essential and reinstall it, with all the updates.
How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item


But, we need some more information. You need to upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

 

[IsLNdbOi]

Got another two dumps within the last half hour. I'm attaching them here. Can you please take a look at these two new ones as well? The last BSOD had a completely new error:

driver_power_state_failure

 

[IsLNdbOi]

I've now uploaded the MSINFO32 file in my previous post as well.

 

[Arc]

Well, it is caused by TouchChip USB Kernel Driver (FingerPrint Sensor).

kd> !irp fffffa8012272b10
Irp is active with 11 stacks 10 is current (= 0xfffffa8012272e68)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[ 16, 2]   0 e1 fffffa80115ac060 00000000 fffff80002c78b40-fffffa801195d0d0 [COLOR=Red]Success Error Cancel pending
          Unable to load image \SystemRoot\System32\Drivers\tcusb.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tcusb.sys
*** ERROR: Module load completed but symbols could not be loaded for tcusb.sys
 \Driver\TcUsb    nt!IopUnloadSafeCompletion[/COLOR]
            Args: 00000000 00000001 00000003 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-fffffa80111c4da0    

            Args: 00000000 00000000 00000000 00000000
0: kd> !devobj fffffa80115ac060
Device object (fffffa80115ac060) is for:
 InfoMask field not found for _OBJECT_HEADER at fffffa80115ac030
 \Driver\TcUsb DriverObject fffffa80111c4e70
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00002050
DevExt fffffa80115ac1b0 DevObjExt fffffa80115ac808 
ExtensionFlags (0000000000)  
[COLOR=Red]AttachedTo (Lower) fffffa8011528060 \Driver\usbhub[/COLOR]
Device queue is not busy.
0: kd> lmvm tcusb
start             end                 module name
fffff880`0c50c000 fffff880`0c51f000   tcusb    T (no symbols)           
    Loaded symbol image file: tcusb.sys
    Image path: \SystemRoot\System32\Drivers\tcusb.sys
   [COLOR=Red] Image name: tcusb.sys
    Timestamp:        Fri Aug 19 06:05:41 2011[/COLOR] (4E4DAFDD)
    CheckSum:         00015187
    ImageSize:        00013000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Update it from AuthenTec Support | Home.

Let us know the results.

 

[IsLNdbOi]

Ah ok, so which of the BSODs / dump files was caused by the TouchChip driver? All of them?

 

[Arc]

Have you updated it ?

 

[IsLNdbOi]

I used Driver Sweeper to completely remove my NVIDIA GeForce drivers and software, THEN I installed the latest ForceWare AND I updated the driver for the TouchChip.

I'll have to use the PC as I was for the next few days to see if I experience the issues still.

So were all those BSODs and dump files caused by the TouchChip driver?

 

[Arc]

The power state failure one.

The other one wast not specifying anything, but the device driver error is one of all the causes of stop 0x50.

Let us know how it is working now.

 

[IsLNdbOi]

Just happened again. Walked near the room and suddenly heard the Windows 7 boot sound which I shouldn't have heard since the PC should have been on, idling.

Went to the PC and the little window was there again, this time saying:
Windows Has Recovered From An Unexpected Shutdown



I have again attached the dump file(s) for this incidence.

 

[Arc]

Well, here is your crash report.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80cbc8dc98, 0, fffff80002c51b3b, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+27f )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80cbc8dc98, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002c51b3b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb1100
 fffffa80cbc8dc98 

FAULTING_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  minirosetta_gr

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ce3ecf0 -- (.trap 0xfffff8800ce3ecf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffffa80cbc8dc70
rdx=0000000003279009 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c51b3b rsp=fffff8800ce3ee80 rbp=fffff7000108de80
 r8=fffffa8012ba6768  r9=0000000000000000 r10=0000000000000d9c
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MiDeleteAddressesInWorkingSet+0x27f:
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h] ds:fffffa80`cbc8dc98=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c288af to fffff80002c81fc0

STACK_TEXT:  
fffff880`0ce3eb88 fffff800`02c288af : 00000000`00000050 fffffa80`cbc8dc98 00000000`00000000 fffff880`0ce3ecf0 : nt!KeBugCheckEx
fffff880`0ce3eb90 fffff800`02c800ee : 00000000`00000000 fffffa80`cbc8dc98 000f01ff`00020000 b3f00043`ed9ed867 : nt! ?? ::FNODOBFM::`string'+0x437c1
fffff880`0ce3ecf0 fffff800`02c51b3b : fffffa80`0cac50a8 fffff880`0ce3ef00 fffff880`0ce3f3b8 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0ce3ee80 fffff800`02c52c9e : fffffa80`12ba63d0 fffffa80`00000008 fffff880`00000d9c fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x27f
fffff880`0ce3f730 fffff800`02f5365a : fffff8a0`160af060 fffff880`0ce3fae0 00000000`00000000 fffffa80`139da060 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0ce3f780 fffff800`02f36b7d : 00000000`00000000 00000000`00000001 00000000`7efd8000 fffffa80`12b98b50 : nt!PspExitThread+0x56a
fffff880`0ce3f880 fffff800`02c74b3a : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`02c7d810 : nt!PsExitSpecialApc+0x1d
fffff880`0ce3f8b0 fffff800`02c74e80 : 00000000`00000246 fffff880`0ce3f930 fffff800`02f36af0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0ce3f930 fffff800`02c812f7 : 00000000`00000000 fffff800`02f666ac fffff880`0ce3fb60 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`0ce3fa70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteAddressesInWorkingSet+27f
fffff800`02c51b3b 488b4128        mov     rax,qword ptr [rcx+28h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+27f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

BUCKET_ID:  X64_0x50_nt!MiDeleteAddressesInWorkingSet+27f

Followup: MachineOwner
---------

According to Carrona.org, STOP 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

► For Memory,
http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
Run it, for at least eight passes, preferably overnight.

► For Faulty sysem service.
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

► For Antivirus,
Uninstall MSE.
How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item
Then reinstall it again, and all the updates.

► For Device Driver,
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

► For NTFS corruption,

1. Update your SSD,s firmware.
2. Re-seat the sata and power.
3. Run chkdsk /f/r, following the option two of the tutorial Disk Check
4. Seatool for dos: SeaTools | Seagate download
   Burn it in a blank cd. boot from the CD, click on "Accept", wait for it to finish detecting the drives, then in the upper left corner select "Basic Tests", then select "Long Test" and let it run.

► You may leave the BIOS alone, IMHO.

BIOS Version/Date    American Megatrends Inc. P1.30, [COLOR=Red][B]7/13/2012[/B][/COLOR]

Do these and let us know the results

 

[IsLNdbOi]

This is a new system build I did myself. After putting it together, the first thing I did even before installing Windows was to run Memtest 86+. I ran it for over 24 hours and it did not find any errors.

I haven't run chkdsk c:/f/r since I finished installing all of my software and I ran chkdsk on all three of my drives (C, D, and E). It didn't show any major issues. Just something about repairing a USN Journal. I still have to try SFC /Scannow.

My only antivirus is Microsoft Security Essentials and I just installed it a few days ago along with all of the latest updates for it through Windows Update.

My SSDs all have the latest firmware and I even ran HDDErase (their internal secure erase command) on each one of them before installing Windows.

I still have to try Driver Verifier.

 

[IsLNdbOi]

Oh, I also disabled the page file on C and created a static 2GB page file on a separate SSD (my E drive). Would that cause any issues?

 

[centaur78]

Hi

Please use the SF diagnostic tool to post all the files in one shot.

Then use this to update your system profile..

 

[IsLNdbOi]

Ok, I've filled in my info. from the System Info. tool and have attached everything from the SF diagnostic tool.

Driver Verifier has also been running for around 24 hours now. Was something supposed to happen with that?

 

[Vir Gnarus]

First verify (punny) that Driver Verifier is indeed active. You can do this by either going to command line and typing verifier /query and it'll give list of drivers being verified and checks that are on. Or you can go back into Driver Verifier GUI as you did to set it up, but instead select the option "Display existing settings". If you do not see a list of drivers at least, then Driver Verifier is not on.

If you've determined DV is in fact on, keep it on. Use your computer normally, or if there's anything you know that will specifically BSOD your system, do that, and let it BSOD. Any crashes that occur should provide more accurate crashdumps when DV is active, which we can use to better ascertain cause.

Btw, I notice you don't have any dump files in the latest zip. It's preferred that you go to the C:/Windows/Minidump directory and stuff a zip file full of em and send it over. If you do not see any dump files at all, then you probably are using some system cleaner app like CCleaner. It is advised you do not use these applications in the future, especially since we are troubleshooting your BSODs right now and they love to prune diagnostic files like these crashdumps.

 

[IsLNdbOi]

Yes, it looks like Driver Verifier is active. I do use CCleaner. Didn't know that it erases the dump files. That's why there are no dump files in the IsLNdbOi.zip file?

 

[Vir Gnarus]

Correct. Let your system crash a couple more times with DV on and provide the crashdumps for those.

 

[IsLNdbOi]

Strange... Ever since I turned on Driver Verifier, I haven't had any BSODs. It's been on now for 5 days.

It has slowed my system down a little though. Takes longer for it to fully startup.

 

[Vir Gnarus]

That's typical, as drivers have to fulfill extra checks when doing stuff.

Try turning DV off and then test again in normal environment. If it destabilizes, then perhaps we're looking at what's called a race condition, where two threads are competing for some resource and while usually one happens to mess with something at the wrong time, having DV in place slowed it down enough to put it in check. That's just speculation though.