Solved BSOD often after waking up from sleep mode - new computer

[tmichael]

Here is the BSOD error message:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 3b
BCP1: 00000000C0000005
BCP2: FFFFF960002F18F7
BCP3: FFFFF8800AD77EA0
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\091312-27159-01.dmp
C:\Users\tmichael\AppData\Local\Temp\WER-694844-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\windows\system32\en-US\erofflps.txt

A zipfile of the logs from SF Diagnostic Tool is uploaded to this thread.

I'm grateful for any help.

 

[koolkat77]

Welcome
All your dumps show win32k.sys as the problem but that's not the realcause.

If you are overclocking any hardware, please stop.

Lets enable driver verifier to rule out buggy drivers.

Verifier puts extreme stress on the drivers, bad ones will cause BSOD. If we change all those drivers we hope for no more BSODs, If you get no BSODs, then its not a driver and we look to hardware.

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Information
Driver Verifier runs in the background, "testing" drivers for bugs. If it finds one, a Blue Screen of Death (BSOD) will result; the corresponding dump file will hopefully show the faulty driver.

Driver Verifier monitors kernel-mode drivers and graphics drivers to detect illegal function calls or actions that might corrupt the system. It can subject the drivers to a variety of stresses and tests to find improper behavior.

Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

 

[tmichael]

BSOD problem solved

Thanks for your suggestions. Actually, the solution was pretty easy. I ran sfc to check if there were any system file problems. It was able to find and repair the errors in the system files (log entries attached). The computer has been running for more than five days now without a BSOD.

 

[koolkat77]

Oh well , glad to hear that you could to solve the bsods.
Happy computing.

 

[tmichael]

BSOD problem recurs

Alas! Apparently I marked this problem "solved" too soon. The problem was not solved by the system file fixes after all. The exact same problem happened again this morning. Time to check the drivers, I guess.

 

[koolkat77]

Can you upload the dumps?
And yes you should enable verifier.

 

[tmichael]

BSOD problem recurs

Here are the dumps from the diagnostic tool with driver verifier enabled.

Thanks for your patience.

 

[koolkat77]

Are these the BSoD you're getting after enabling verifier?
Doesn't look like verifier is enabled yet, please enable it.

BugCheck 50 = PAGE_FAULT_IN_NONPAGED_AREA (50) =
Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system
service, Antivirus, Device driver, NTFS corruption, BIOS. BSOD Index

BugCheck 3B = SYSTEM_SERVICE_EXCEPTION (3b) =
Usual causes: System service, Device driver, graphics driver, memory. BSOD Index

Problematic software:

Start Menu\Programs\AVG	Public:Start Menu\Programs\AVG	Public

Please uninstall AVG Antivirus while we are troubleshooting with your comp.
Download and install MSE and run a full scan once updated.
:ar: Microsoft Security Essentials - Free Antivirus for Windows

*Run the system file checker for repairing any damaged files within windows:
:ar: http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

*To make sure your hard drive is good, run:
:ar: http://www.sevenforums.com/tutorials/433-disk-check.html

*Run the short and long tests with SeaTools:

:ar:SeaTools for Windows
:ar:SeaTools for DOS

* Run Memory test for 8 passes preferably overnight.
:ar: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Post back results

 

[tmichael]

BSOD problem recurs

It looks like the problem was caused by the AVG antivirus software. When I saw that suggestion in your reply I recalled two things: 1) when I first installed the software I got a message saying that it might not have installed properly, but since it seemed to function ok, I didn't think more about it; 2) when I first tried to run the Windows disk check I got an error message saying that a "software error" was preventing the disk checker from running. When I uninstalled AVG and installed Microsoft Security Essentials, that error message disappeared and the disk check showed no disk errors. I ran a complete scan using MSE and found no viruses.

I have now had eight days of fairly heavy use without further crashes. So I am tentatively marking this thread as solved (again!) conscious that I got burned when I did that last time.

Thank you so much for your helpful suggestions.

 

[koolkat77]

Thanks for reporting back.

Hopefully this is the end of your PC problems , feel free to come back here for any further issues.

 

[tmichael]

BSOD problem recurrs again

After two returns for factory repairs due to a high dpc latency problem, which involved several hardware fixes and a complete system reinstall, I find that the BSOD problem is recurring, although at a much longer interval (10 days). It has never happened when I have been working on the computer, only when it is idle.

 

[Vir Gnarus]

Can you turn on Driver Verifier and let it produce more crashes, then send us the resulting crashdumps? Thanks.

- Isaac

 

[tmichael]

Turning on the driver verifier resulted in no bsod's. I am uploading the most recent dumps.

One problem that did occur: the diagnostic tool kept hanging with an "unhandled exception." I had to run it several times to get a complete set of logs. Here is the error message:

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.IO.IOException: The process cannot access the file 'C:\windows\EventSys.txt' because it is being used by another process.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.Delete(String path)
at Microsoft.VisualBasic.FileIO.FileSystem.DeleteFileInternal(String file, UIOptionInternal showUI, RecycleOption recycle, UICancelOption onUserCancel)
at Microsoft.VisualBasic.MyServices.FileSystemProxy.DeleteFile(String file)
at WindowsApplication2.Form1.Button1_Click(Object sender, EventArgs e)
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5466 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
----------------------------------------
SF Diagnostic Tool
Assembly Version: 1.0.0.0
Win32 Version: 5.0.0.3
CodeBase: file:///C:/Users/samsung/Documents/Computer/SF_Diagnostic_Tool.exe
----------------------------------------
Microsoft.VisualBasic
Assembly Version: 8.0.0.0
Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
----------------------------------------
System
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5467 (Win7SP1GDR.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Runtime.Remoting
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)
CodeBase: file:///C:/windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

 

[Vir Gnarus]

Leave Driver Verifier on until you happen to experience a BSOD. If for some reason your system stabilizes with DV enabled, then you'll have to turn it off.

 

[tmichael]

Driver Verifier has produced no bsod's since I started it yesterday. I have turned it off.

I noticed from the EventApp.txt that I uploaded yesterday that there is a repeated error: "Volume Shadow Copy Service warning: VSS was denied access to the root of volume \\?\Volume{17390d74-3f34-11e2-92ee-c485081f3884}\." I have checked the administrator permissions and everything seems in order. Could that be the problem?

 

[tmichael]

The system crashed again this morning. I am attaching the dumps. I ran the driver verifier over the week-end, as I indicated in the previous post, without effect, so I turned it off. I am turning it back on.

These bsod's never occur when I am at the computer--only when the system is idle and the screen on standby. I don't know if that is relevant.

 

[Vir Gnarus]

In a good majority of your crashdumps, the pattern I find is it involves drawing window elements (buttons, window frame, etc.) through the win32k window manager. They are also responsible for handling input devices like keyboard and mouse. This correlates with another crash (0x1A) that - while not showing involvement with win32k - did come up with the running process as the Synaptic touchpad process. If you haven't already, try the following:

• Update BIOS
• Update graphics & input device drivers and software, especially the touchpad drivers.
• Uninstall the Synaptic touchpad drivers/software if previous options don't fix symptoms. Make sure a mouse is available in case touchpad stops working (shouldn't).
• Uninstall all software that came pre-installed with the system (bloatware). Better yet, if you have a copy of a clean version of Windows (non-OEM version), install that.

I really can't discern beyond these what's going on. They are simple minidumps, and without Driver Verifier doing the BSODs they are only showing the aftermath of a problem that has occurred in the past, not the actual problem. The only hint I see is that a symbolic link object has gone missing, but without a kernel dump (MEMORY.DMP in Windows directory) I can't dive further, and even then I'm not 100% guaranteed that I will find the answers I'll seek because the system is crashing too late. I will say, though, that often times when I've had people struggling with similar issues with their touchpad, it's because of an internal hardware failure of either the keyboard/touchpad area or the motherboard itself (motherboard most often likely). I'm not sure what parts Samsung or whoever your OEM is said they fixed, but it's best to ask them for a complete, 100% system replacement next time because previous sendovers have not fixed the problem.


I will try to work with you as much as I can, but without solid data on this I - and others here at SF - can only go so far. The rest is just grasping at straws.



Analysts:


Crashdumps for 0x3B crashes are very consistent, dealing with the win32k kernel-mode subsystem driver attempting to perform window managing for dwm.exe (desktop window manager). c0000034 (object name not found) error is discovered in all of them, and usually resides during an attempt to locate a symbolic link object, perhaps pointing to some window object or something, can't tell from minidumps. I do see an IPI request in the raw stack, which means some of the work has been transferred over to another logical processor, but without a kernel dump one can't see any running thread but the crashing one. Though despite this lack of info, win32k also governs human input through input devices and translates it to activity on the desktop, so that makes me curious about the 0x1A crash that showed Synaptic touchpad process as running at the time.

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000311bd7, Address of the instruction which caused the bugcheck
Arg3: fffff8800af6fea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!SFMLOGICALSURFACE::SetShape+157
fffff960`00311bd7 488b5508        mov     rdx,qword ptr [rbp+8]

CONTEXT:  fffff8800af6fea0 -- (.cxr 0xfffff8800af6fea0)
rax=fffff8800af708c8 rbx=0000000000000000 rcx=fffff900c1ff7d40
rdx=fffff900c00c0010 rsi=0000000000000000 rdi=fffff900c1ff7d40
rip=fffff96000311bd7 rsp=fffff8800af70880 rbp=0000000000000018
 r8=000000000212ff6b  r9=000000000000ff6c r10=000000000002fe44
r11=fffff8800af708b0 r12=0000000000000001 r13=fffff900c00c0010
r14=fffff900c00c0010 r15=8000000000001000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
win32k!SFMLOGICALSURFACE::SetShape+0x157:
fffff960`00311bd7 488b5508        mov     rdx,qword ptr [rbp+8] ss:0018:00000000`00000020=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000311bd7

STACK_TEXT:  
fffff880`0af70880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SFMLOGICALSURFACE::SetShape+0x157


FOLLOWUP_IP: 
win32k!SFMLOGICALSURFACE::SetShape+157
fffff960`00311bd7 488b5508        mov     rdx,qword ptr [rbp+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!SFMLOGICALSURFACE::SetShape+157

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50aeecc6

STACK_COMMAND:  .cxr 0xfffff8800af6fea0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157

BUCKET_ID:  X64_0x3B_win32k!SFMLOGICALSURFACE::SetShape+157

Followup: MachineOwner
---------

3: kd> [COLOR=Blue]!niemiro.rawstack[/COLOR]
dps fffff8800af6f000 fffff8800af705d0
fffff880`0af6f000  00000000`00000000
fffff880`0af6f008  00000000`00000000
fffff880`0af6f010  00000000`00000000
fffff880`0af6f018  00000000`00000000
fffff880`0af6f020  00000000`00000000



...


fffff880`0af6f840  00000000`00000000
fffff880`0af6f848  fffff880`0af6f870
fffff880`0af6f850  fffff800`02ee5e40 nt!KiSystemServiceHandler
fffff880`0af6f858  fffff800`0302e638 [COLOR=Green]nt!_imp_NtOpenSymbolicLinkObject+0x9130[/COLOR]
fffff880`0af6f860  fffff880`0af6fd40
fffff880`0af6f868  00000000`00000000
fffff880`0af6f870  00000000`69634d00
fffff880`0af6f878  fffff8a0`023345d0
fffff880`0af6f880  fffff880`0af6f990
fffff880`0af6f888  fffffa80`05b45060
fffff880`0af6f890  fffff8a0`02ef7d10
fffff880`0af6f898  fffffa80`05b45060
fffff880`0af6f8a0  00001f80`00000010
fffff880`0af6f8a8  00000000`000f0010
fffff880`0af6f8b0  00010202`00180000
fffff880`0af6f8b8  00000000`00000002
fffff880`0af6f8c0  00000000`[COLOR=Red]c0000034[/COLOR]
fffff880`0af6f8c8  fffff880`0af6fe90
fffff880`0af6f8d0  fffff8a0`000103f0
fffff880`0af6f8d8  00000000`28386cf4
fffff880`0af6f8e0  fffff880`0af6fe58
fffff880`0af6f8e8  fffff800`031b2009 nt!CmpParseCacheLookup+0x21d
fffff880`0af6f8f0  00000000`00000000



...



fffff880`0af6fb28  fffff900`c207b618
fffff880`0af6fb30  fffff900`c78c3030
fffff880`0af6fb38  fffff800`02e32552 [COLOR=Green]hal!HalpRequestIpiSpecifyVector[/COLOR]+0x41
fffff880`0af6fb40  00000001`00000018
fffff880`0af6fb48  00001558`0000007c
fffff880`0af6fb50  00000017`00000000
fffff880`0af6fb58  00000212`000003b1
fffff880`0af6fb60  00000000`00000206
fffff880`0af6fb68  fffff800`02f05be3 [COLOR=Green]nt!KiIpiSendRequest[/COLOR]+0x2d3
fffff880`0af6fb70  fffff880`00000000
fffff880`0af6fb78  00000000`00000000

0x1A crash:

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, The subtype of the bugcheck.
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2

BUGCHECK_STR:  0x1a_41287

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

[COLOR=Green]PROCESS_NAME:  SynTPHelper.ex[/COLOR]

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a8867f0 -- (.trap 0xfffff8800a8867f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8a00232fb68
rdx=000000007fefaa23 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ee8e89 rsp=fffff8800a886980 rbp=fffff8800a886a00
 r8=0000000000000000  r9=fffff8a00232fb60 r10=fffffa800956bca0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MmAccessFault+0x1c99:
fffff800`02ee8e89 488b10          mov     rdx,qword ptr [rax] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e6ad2e to fffff80002edafc0

STACK_TEXT:  
fffff880`0a886688 fffff800`02e6ad2e : 00000000`0000001a 00000000`00041287 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a886690 fffff800`02ed90ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x454b5
fffff880`0a8867f0 fffff800`02ee8e89 : 00000000`00000000 000007fe`faa2300c ffffffff`ffffffff fffff800`00000000 : nt!KiPageFault+0x16e
fffff880`0a886980 fffff800`02ed90ee : 00000000`00000000 000007fe`faa2300c 00000000`76ff2501 000007fe`faa10000 : nt!MmAccessFault+0x1c99
fffff880`0a886ae0 00000000`76eedd9c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0012ede0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76eedd9c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+454b5
fffff800`02e6ad2e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+454b5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454b5

BUCKET_ID:  X64_0x1a_41287_nt!_??_::FNODOBFM::_string_+454b5

Followup: MachineOwner
---------

 

[tmichael]

Thank you for all your efforts. I will try your suggestions and let you know if anything works.

I typically turn the touchpad off, since I use an external mouse. I have updated the mouse driver. Would it make sense to disable the Synaptic touchpad driver?

 

[Vir Gnarus]

Try disabling it altogether, yes, as well as uninstall that Synaptic software. However, if there is indeed a problem with the touchpad, it often means there's an issue with the mobo.

 

[tmichael]

The computer has run for a month now without a crash. I ininstalled the Synaptic software (but have not disabled the driver). I have also avoided leaving the computer idle for long periods--crashes seemed only to occur when the screen had blanked after a period of inactivity. Thanks again for your help. I'm going to tentatively mark this thread as "solved" (fingers crossed).