BSOD process or thread crucial to system operation has ended

[Petey7]

I've getting occasional BSOD lately. They sometime occur only a day a part, sometimes a week. It started I'd say a month or so ago, which was also couple weeks after I had reinstalled Windows 7, which I did after an uninstall of Office 2013 seemed to have not completed correctly, and had also never gotten most of the preinstalled junk of this laptop anyways. I think I installed all the necessary drivers. All hardware functions correctly and nothing is missing in Device Manager.

Every time it is the same message "A process or thread crucial to system operation has unexpectedly ended". So far I have ran scans with MSE, MBAM Pro, and WDO, which have found no signs of viruses or other malware. I have run sfc /scannow, checkdisk and every scan that Seatools has. No problems have been detected with the harddrive, sfc found no integrity errors. Last night I had memtest86+ running off of a usb drive run for 7 passes. No errors were found. I went through Event Viewer and found nothing that seemed related. I checked and all my drivers seem to be up to date.

I hope I included all necessary information. My system specs are up to date. The three dumps I have are attached below. I had deleted the older ones with ccleaner without thinking. If I left out anything, let me know. Its been a while, since I've done much troubleshooting on a computer, so I might be overlooking something.

View attachment 275670

EDIT: Sorry, I didn't see about the diagnostic tool (which seems amazing btw) until after starting the thread. Here is the requested zip.

View attachment 275673

 

[VistaKing]

Your BSODs are hard drive related

bsod F4

Use the link below to test your hard drive

:ar: SeaTools for Windows | Seagate

 

[Petey7]

I've already run every test seatools has and found no issues, but will do so again immediately after posting this. Question: my computer has a HDD protection feature that stops the hard drive when a vibration is detected. I noticed that at least one crash happened when bumping my knee on my desk. Could that be causing it?

 

[VistaKing]

Could be. Also run these two things after you run the test

1st Test :

Open up an Elevated Command Prompt. Click on rb: in

type CMD . Right click on CMD under Programs (1) choose

. On the User Access Control window click on the Yes button . Command Prompt opens up to C:\Windows\System32>_

Type the command below

chkdsk /F /R

press [ENTER]

When you type chkdsk /F /R you will get this message

The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process.  Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

When you type " Y " and press [Enter] you get this message below

This volume will be checked the next time the system restarts.

C:\Windows\system32>

Close the command prompt window by typing exit and press [enter] Restart the PC manually .

When you're back inside Windows. Open up Powershell by clicking on rb: type Powershell inside

and press [ENTER] . Inside the Powershell paste the command below

get-winevent -FilterHashTable @{logname="Application"; id="1001"}| ?{$_.providername –match "wininit"} | fl timecreated, message | out-file Desktop\CHKDSKResults.txt

and Press [Enter] upload the CHKDSKResults.txt file

   Note

To paste inside the Powershell window press on the right click button on the mouse

2nd Test:

Open up an Elevated Command Prompt. Click on rb: in

type CMD . Right click on CMD under Programs (1) choose

. On the User Access Control window click on the Yes button . Command Prompt opens up to C:\Windows\System32>_

Type the command below

SFC /SCANNOW and press [ENTER]

   Note

There is a space after the letter C in SFC

 

[Petey7]

Thank you for the fast and detailed replies. I've done the SMART and Short DST so far, and I'm doing the long generic, which will take a couple hours at least. I'll do the other test after that finishes. Another question: could it be a connection problem? I.E. could removing the hard drive, putting it back in, and making sure it is in securely, possibly help?

 

[x BlueRobot]

Hi Petey7,

[COLOR=Red]BugCheck F4[/COLOR], {3, [COLOR=SeaGreen]fffffa8007424b30[/COLOR], fffffa8007424e10, fffff800031d4350}

----- ETW minidump data unavailable-----
Probably caused by : wininit.exe

This bugcheck indicates that a crucial thread or process has been terminated unexpectedly.

3: kd> [COLOR=SeaGreen]!process fffffa8007424b30[/COLOR]
GetPointerFromAddress: unable to read from fffff80003105000
PROCESS fffffa8007424b30
    SessionId: none  Cid: 0214    Peb: 7fffffd9000  ParentCid: 0174
    DirBase: 15aaff000  ObjectTable: fffff8a001ab4f90  HandleCount: <Data Not Accessible>
    Image: wininit.exe
    VadRoot fffffa8007421820 Vads 66 Clone 0 Private 535. Modified 9. Locked 2.
    DeviceMap fffff8a000008aa0
    Token                             fffff8a001ab4af0
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         105008
    QuotaPoolUsage[NonPagedPool]      10456
    [COLOR=Red]Working Set Sizes (now,min,max)  (1358, 50, 345) (5432KB, 200KB, 1380KB)[/COLOR]
    [COLOR=Red]PeakWorkingSetSize                1358[/COLOR]
    VirtualSize                       49 Mb
    PeakVirtualSize                   53 Mb
    PageFaultCount                    1633
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      651

        *** Error in reading nt!_ETHREAD @ fffffa8007428b50

Okay, what got my attention is the size of the working set, the working set is the amount of virtual memory pages currently within physical memory (RAM). These pages are used to reduce the need for a page fault.

The Minimum Working Set is the number of pages that the Memory Manager attempts to keep in physical memory for that current process, and the Maximum Working Set is the the amount of pages which it attempts to keep no more than.

Now, the current Working Set size has exceeded the maximum amount which should be used, I understand that if the maximum working set size is exceeded then it can degrade system performance. I think there may be a memory leak.

I may wrong about this though, so I'm open to any corrections by anyone.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

This exception code is usually when device drivers attempt to access and use invalid memory addresses.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[Petey7]

Seatools found no problems, chkdsk found no bad sectors, sfc /scannow found no integrity errors again. The requested txt file is below.

View attachment 275707

The driver verifier makes me nervous, but I'll be starting it shortly. Hopefully it will reveal something. I'll be sure to upload any additional minidumps.

 

[Petey7]

First time it tried to start after enabling the driver verifier it crashed. Here is the mindump. Hopefully it reveals something.

View attachment 275708

It occurred to me that my graphics driver is the newest one from the Intel site, and not the Toshiba site, which is an older version, and I can't find any details on. Should I switch to the Toshiba driver?

 

[VistaKing]

Try this driver . Its from the Toshiba's site for your laptop

:ar: http://cdgenp01.csd.toshiba.com/content/support/downloads/TC00505400A.exe

 

[x BlueRobot]

With OEM computers, it's always best to go with their drivers, since they usually create specific modifications for the model.

Although, saying that, I've updated from AMD and haven't had any problems.

I'm having a look at your dump file now.

 

[x BlueRobot]

[COLOR=Red]BugCheck A[/COLOR], {[COLOR=DarkOrange]0[/COLOR], [COLOR=Blue]2[/COLOR], 0, [COLOR=SeaGreen]fffff80002ea6bd4[/COLOR]}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Usual causes:  Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

This bugcheck indicates that device driver has attempted to access a invalid memory address, or perform an instruction at a inappropriate IRQL level.

TRAP_FRAME:  fffff880031c4130 -- ([COLOR=SeaGreen].trap 0xfffff880031c4130[/COLOR])
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880031c44f8 rbx=0000000000000000 [COLOR=Orange]rcx=0000000000000000[/COLOR]
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ea6bd4 rsp=fffff880031c42c0 rbp=0000000000000000
 r8=fffff880031c43c8  r9=fffff880031c43c0 r10=0000000000000002
r11=fffff80002ea5f70 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
[COLOR=SeaGreen]nt!IopCompleteRequest+0xc64:
fffff800`02ea6bd4 488b09     [/COLOR]     mov     rcx,qword ptr [COLOR=Red][rcx][/COLOR] ds:00000000`00000000=????????????????

1: kd>[COLOR=SeaGreen] k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`031c3fe8 fffff800`02e911a9 nt!KeBugCheckEx
fffff880`031c3ff0 fffff800`02e8fe20 nt!KiBugCheckDispatch+0x69
fffff880`031c4130 fffff800`02ea6bd4 [COLOR=Red]nt!KiPageFault[/COLOR]+0x260 <-- Offending Instruction
fffff880`031c42c0 fffff800`02e84617 [COLOR=SeaGreen]nt!IopCompleteRequest+0xc64[/COLOR] 
fffff880`031c4390 fffff800`02e8781d [B]nt!KiDeliverApc[/B]+0x1c7
fffff880`031c4410 fffff800`02e9898f [B]nt!KiCommitThreadWait[/B]+0x3dd
fffff880`031c44a0 fffff800`030ffd32 [B]nt!KeWaitForSingleObject[/B]+0x19f
fffff880`031c4540 fffff800`0324efe4 nt!IopSynchronousCall+0x102
fffff880`031c45b0 fffff800`0327fd2f nt!IopQueryLegacyBusInformation+0x64
fffff880`031c4660 fffff800`032811b2 nt!PipCallDriverAddDevice+0x76f
fffff880`031c4810 fffff800`0328164c nt!PipProcessDevNodeTree+0x2b2
fffff880`031c4a80 fffff800`02f947f2 nt!PiProcessStartSystemDevices+0x7c
fffff880`031c4ad0 fffff800`02e9b251 nt!PnpDeviceActionWorker+0x302
fffff880`031c4b70 fffff800`0312fede nt!ExpWorkerThread+0x111
fffff880`031c4c00 fffff800`02e82906 nt!PspSystemThreadStartup+0x5a
fffff880`031c4c40 00000000`00000000 nt!KiStartSystemThread+0x16

From the call stack, the thread was placed in a wait state, to allow the APC to called, and allow a driver to complete it's I/O request, which is why the IRQL level was pushed up to DISPATCH_LEVEL. The IRQL level was lowered, so when a driver wanted to page some data into memory, it was a illegal operation.

1: kd> [COLOR=SeaGreen]!irql[/COLOR]
Debugger saved IRQL for processor 0x1 -- 2 (DISPATCH_LEVEL)

Now, although noticed that the Flink and Blink addresses for the linked list were invalid, therefore I went and checked the instruction, and it said that there was some pool corruption.

LOCK_ADDRESS:  fffff80003095b80 -- (!locks fffff80003095b80)

Resource @ nt!PiEngineLock (0xfffff80003095b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

1: kd> [COLOR=SeaGreen]!poolval fffff80002ea6000[/COLOR]
Pool page fffff80002ea6000 region is Nonpaged pool

Validating Pool headers for pool page: fffff80002ea6000

Pool page [ fffff80002ea6000 ] is __inVALID.

Analyzing linked list...
[COLOR=Red][ fffff80002ea6000 ]: invalid previous size [ 0x41 ] should be [ 0x0 ][/COLOR]
[ fffff80002ea6000 --> fffff80002ea6030 (size = 0x30 bytes)]: Corrupt region


Scanning for single bit errors...

None found

Sorry for the really long post, but I think we may be dealing with some kind of driver issue here. I would keep Driver Verifier running, some people even recommend 36 hours.

 

[Petey7]

I switched out the drivers, played a couple games, and saw no degradation in performance. I still have the driver verifier on, but haven't had another crash yet.

I'm fine with long posts. They are most informative. Thank you for the help so far.

 

[x BlueRobot]

Welcome, hopefully we can see this issue solved

 

[Petey7]

Just to keep you updated, I've had the driver verifier on for about 45 hours now, and I haven't received a crash since the first one. Maybe it was the video driver, since it was the only one not from Toshiba, but I'm not sure. Should I turn off driver verifier at this point?

 

[VistaKing]

Run a scan with Malwarebytes . Update the definitions before you do a Full Scan .

Have you ran a memory test running memtest86+ ?

 

[Petey7]

Vistaking, all of that is covered in the first post. Multiple scans with MBAM, MSE and WDO found no viruses. Memtest86+ ran for 7 passes with no errors.

 

[VistaKing]

Turn off the Driver verifier . See how the PC is running if you get any crashes (BSOD) upload using the Tool

 

[x BlueRobot]

Disable Driver Verifier as already suggested, and you may run this command in an elevated command prompt, to make sure Driver Verifier has been disabled:

verifier /query

 

[Petey7]

I turned off driver verifier when Vista said to. The computer seems to be running well at the moment. I'm gonna give it some time before marking the thread as solved. I repped bluerobot. Would have done it for Vista too but it says I need to spread it around more first.

 

[x BlueRobot]

Leave the thread open for a few days