BSOD on start up.

[Lulubop]

Usually happens 1 or 2 times, then it won't happen for the rest of the day. Though the problems returns the next day. I've updated my video card drivers, as well as diagnosed any issues with my memory and Hard Drive, finding no issues. This seems to be effecting my Desktop Windows Manager as well.


Dump File 072810-20826-01.dmp
Crash Time 7/28/2010 1:23:43 PM
Bug Check String MEMORY_MANAGEMENT
Bug Check Code 0x0000001a
Parameter 1 00000000`00003452
Parameter 2 000007fe`fdc93000
Parameter 3 fffff700`01081170
Parameter 4 99d00001`2aab5024
Caused By Driver ntoskrnl.exe
Caused By Address ntoskrnl.exe+70600
File Description NT Kernel & System
Product Name Microsoft® Windows® Operating System
Company Microsoft Corporation
File Version 6.1.7600.16539 (win7_gdr.100226-1909)
Processor x64
Computer Name
Full Path C:\Windows\Minidump\072810-20826-01.dmp
Processors Count 4
Major Version 15
Minor Version 7600

Is it possible this can be related to an outdated Network adapter driver?

 

[Jonathan_King]

It is certainly possible.

Please follow these directions: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[Lulubop]

After updating the drivers on my network card using the auto update my computer crashes anytime I try to open a browser. I am on my phone at the moment.

 

[Tews]

We really need the .dmp files... can you boot into safe mode and upload them?

 

[Lulubop]

Sorry.

 

[Jonathan_King]

Please enable driver verifier: http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\DOCUME~1\JK\LOCALS~1\Temp\Temporary Directory 1 for bsod.zip\bsod\Windows7_BSOD_jcgriff2\072710-22947-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`0280b000 PsLoadedModuleList = 0xfffff800`02a48e50
Debug session time: Tue Jul 27 13:26:20.831 2010 (GMT-4)
System Uptime: 0 days 0:13:08.236
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {3452, 940b000, fffff700010ae220, bb3000005466f866}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33a23 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003452, The subtype of the bugcheck.
Arg2: 000000000940b000
Arg3: fffff700010ae220
Arg4: bb3000005466f866

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_3452

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028eefb3 to fffff8000287b600

STACK_TEXT:  
fffff880`0832cff8 fffff800`028eefb3 : 00000000`0000001a 00000000`00003452 00000000`0940b000 fffff700`010ae220 : nt!KeBugCheckEx
fffff880`0832d000 fffff800`0284e5a2 : fffffa80`05e33060 fffffa80`00001f05 fffff8a0`00001dd0 fffff880`00000000 : nt! ?? ::FNODOBFM::`string'+0x33a23
fffff880`0832d8b0 fffff800`02b61c4f : fffff8a0`02480a70 fffff880`0832dc20 00000000`00000000 fffffa80`03dfeb60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0832d900 fffff800`02b3a4d1 : 00000000`c0000005 fffff800`02898f01 000007ff`fffac000 fffffa80`05e9cb60 : nt!PspExitThread+0x92f
fffff880`0832d9c0 fffff800`028580e3 : 00000000`00000000 fffff880`0832db40 00000000`00000000 fffff800`02876df0 : nt!PsExitSpecialApc+0x1d
fffff880`0832d9f0 fffff800`02858520 : 00000000`08f5fa10 fffff880`0832da70 fffff800`02b3a5dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0832da70 fffff800`0287a8f7 : fffffa80`03dfeb60 00000000`08f5f8f8 fffff880`0832dbc8 0000007f`ffffffff : nt!KiInitiateUserApc+0x70
fffff880`0832dbb0 00000000`7767030a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`08f5f8d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7767030a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33a23
fffff800`028eefb3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33a23

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+33a23

BUCKET_ID:  X64_0x1a_3452_nt!_??_::FNODOBFM::_string_+33a23

Followup: MachineOwner
---------

 

[Lulubop]

I have it enable following all the steps, but I'm curious as to how I find the memory dump file if/when the blue screen does occur. Or is it the same process I already posted.

Thanks.

 

[Jonathan_King]

It's the same process you used to upload the other dumps.

 

[Lulubop]

Well, since starting the Verifier I have yet to have a BSOD. I like it's safe to rule out any drivers being the issue and I believe the issue is actually with the Memory. Browsing around the board, I ran into a topic where the poster had a similar issue of only getting BSOD on start up and only in the morning after hours of not using there computer. I used the Memok feature that comes with the Mobo and no BSOD for the first time in a few days. I have no idea if this is nothing more than a quick fix, but it seems to be fine for now. Though my desktop windows manager still enables and disables itself during the first few minutes of start up with out warning. Weather that's related to the BSOD I don't know.

 

[cluberti]

It looks like, according to the dump that JK posted, the MmCleanProcessAddressSpace function was actually called by MiDeleteAllHashMappings:

1: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff880`0832cff8 fffff800`028eefb3 nt!KeBugCheckEx
01 fffff880`0832d000 fffff800`0284e5a2 nt! ?? ::FNODOBFM::`string'+0x33a23
02 fffff880`0832d8b0 fffff800`02b61c4f nt!MmCleanProcessAddressSpace+0x96
03 fffff880`0832d900 fffff800`02b3a4d1 nt!PspExitThread+0x92f
04 fffff880`0832d9c0 fffff800`028580e3 nt!PsExitSpecialApc+0x1d
05 fffff880`0832d9f0 fffff800`02858520 nt!KiDeliverApc+0x2eb
06 fffff880`0832da70 fffff800`0287a8f7 nt!KiInitiateUserApc+0x70
07 fffff880`0832dbb0 00000000`7767030a nt!KiSystemServiceExit+0x9c
08 00000000`08f5f8d8 00000000`00000000 0x7767030a

1: kd> u fffff800`0284e5a2
nt!MmCleanProcessAddressSpace+0x96:
fffff800`0284e5a2 488d8e98030000  lea     rcx,[rsi+398h]
fffff800`0284e5a9 e8920c0000      call    nt!MiDeleteAllHashMappings (fffff800`0284f240)
fffff800`0284e5ae 488bc3          mov     rax,rbx
fffff800`0284e5b1 f0480fc18698030000 lock xadd qword ptr [rsi+398h],rax
fffff800`0284e5ba a802            test    al,2
fffff800`0284e5bc 0f853e990a00    jne     nt! ?? ::FNODOBFM::`string'+0x3db00 (fffff800`028f7f00)
fffff800`0284e5c2 80a750040000f7  and     byte ptr [rdi+450h],0F7h
fffff800`0284e5c9 664401afc6010000 add     word ptr [rdi+1C6h],r13w

It looks like, ultimately, cleaning up process space is causing issues on this box. Most of the dumps are exactly the same in exactly the same spot in svchost.exe code, so I'd say it's not very likely this is a hardware or RAM issue, but perhaps a refcount issue in svchost or one of your kernel filter drivers. I'd be taking these to Microsoft PSS, honestly, and getting them to work with you on this.

 

[Lulubop]

BSOD again upon start up today.

 

[Jonathan_King]

I suspect the issue is caused by your outdated ASACPI.sys file. Please install the latest ATK0110 Utility for Windows 7/Vista from here: ASUSTeK Computer Inc.-Support-

...Summary of the Dumps:

[font=lucida console]
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Debug session time: Fri Jul 30 14:00:36.069 2010 (UTC - 4:00)
System Uptime: 0 days 0:02:15.146
BugCheck C1, {fffff9800bab4fe0, fffff9800bab4018, 9b001c, 23}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+9a )
BUGCHECK_STR:  0xC1_23
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  aim.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
[/font]

 

[Lulubop]

I BSOD trying to install the new driver.

 

[Jonathan_King]

Did you clean out the Minidump folder after the last one? There are no dumps in that folder for some reason...not even old ones.

 

[Lulubop]

wELL


Dump File 073010-20576-01.dmp
Crash Time 7/30/2010 4:37:17 PM
Bug Check String DRIVER_VERIFIER_IOMANAGER_VIOLATION
Bug Check Code 0x000000c9
Parameter 1 00000000`0000022f
Parameter 2 fffff880`03ff09a0
Parameter 3 fffff980`1aaf2cf0
Parameter 4 00000000`00000000
Caused By Driver ASACPI.sys
Caused By Address ASACPI.sys+19a0
File Description
Product Name
Company
File Version
Processor x64
Computer Name
Full Path C:\Windows\MiniDump\073010-20576-01.dmp
Processors Count 4
Major Version 15
Minor Version 7600

 

[Jonathan_King]

Keep trying to install that driver...you may try using Safe Mode.

http://www.sevenforums.com/tutorials/69585-safe-mode.html

 

[Lulubop]

I'll try again, but I did have the Driver Verifier running, and it seems to have caused it when I tried to install the new driver.


Dump File 073010-20576-01.dmp
Crash Time 7/30/2010 4:37:17 PM
Bug Check String DRIVER_VERIFIER_IOMANAGER_VIOLATION
Bug Check Code 0x000000c9
Parameter 1 00000000`0000022f
Parameter 2 fffff880`03ff09a0
Parameter 3 fffff980`1aaf2cf0
Parameter 4 00000000`00000000
Caused By Driver ASACPI.sys
Caused By Address ASACPI.sys+19a0
File Description
Product Name
Company
File Version
Processor x64
Computer Name
Full Path C:\Windows\MiniDump\073010-20576-01.dmp
Processors Count 4
Major Version 15
Minor Version 7600

 

[Jonathan_King]

Turn off driver verifier, by running verifier.exe and selecting "delete existing setting".

Then try to update that driver, using Safe Mode if necessary.

 

[Lulubop]

Still can't, all I get is a black box that disappears immediately when I try and install. I try to look for the latest driver updates on for ATTK0110 on the device manager but it says I'm up to date. Is ok to remove it completely?

 

[Jonathan_King]

That black box is what is installing the drivers. Check in C:\Windows\System32\Drivers and right-click on the ASACPI.sys file. See if the date is now 2009 or 2010.