Solved BSOD STOP 101 when watching netflix (fine when gaming in bf3/Diablo 3)

[funtimeerror]

Hey guys,

my friends PC that she just got has been randomly BSOD'ing whenever she watches netflix (and only netflix). It doesnt always BSOD, sometimes it just completely locks up and you have to hard power cycle it because nothing is responding.

I've attached the BSOD minidumps as well as the output of msinfo32 and dxdiag. Let me know if anything else is needed.

System specs are in attachments, but heres a quick rundown
Windows 7 Home Premium (64 bit)
Gigabyte GA-970A-D3 Motherboard
AMD FX(tm)-8150 Eight-Core Processor, 3624 Mhz
16.0 GB Ram
NVIDIA GeForce GTX 570

So, here's what I've tried so far,

* since its only been affecting netflix so far I reinstalled Silverlight.
* the minidumps point to RT64win7.sys, so i reinstalled and tried 4-5 different versions of the Realtek drivers that are for the built-in card in question (currently latest driver is installed)
* tried turning off AMD Cool/Quiet and C1E support on the bios (i had a weird C1E issue on my mobo so i figured I'd at least try that)
* tested chrome, internet explorer and firefox... all have the issue.

any help on this would be greatly appreciated, this issue's been driving me up a wall.

 

[funtimeerror]

on a side note,

i'm going to follow this guide on Saturday to see if its the CPU or not.
Class 101 for 0x101 Bugchecks

 

[writhziden]

We prefer that you follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide more information, but I will do the best I can with the given information.


3rd Party Drivers:

Drivers in red should be updated. Drivers in blue are corrupted and should be uninstalled and re-installed. Drivers in sea green are known to cause issues with Windows 7 and the software should be removed from the system:

[B][COLOR="Blue"]lmimirr.dll unavailable  0 00:00:00 1969 (00000000)
lmimirr2.dll unavailable  0 00:00:00 1969 (00000000)[/COLOR][/B]
[COLOR="Red"]lmimirr.sys Tue Apr 10 16:32:45 2007 (461C108D)
RaInfo.sys Fri Jan 4 11:57:14 2008 (477E818A)
LMIRfsDriver.sys Mon Jul 14 10:26:56 2008 (487B7E50)[/COLOR]
[COLOR="SeaGreen"][B]gdrv.sys Thu Mar 12 21:22:29 2009 (49B9D175)[/B][/COLOR]
GEARAspiWDM.sys Mon May 18 06:17:04 2009 (4A1151C0)
RtNdPt60.sys Sun Jul 19 20:27:32 2009 (4A63D614)
amdsata.sys Wed Oct 7 14:13:09 2009 (4ACCF655)
amdxata.sys Wed Oct 7 14:13:10 2009 (4ACCF656)
LGVirHid.sys Mon Nov 23 18:36:48 2009 (4B0B38B0)
LGBusEnum.sys Mon Nov 23 18:36:48 2009 (4B0B38B0)
rikvm_9EC60124.sys Tue Oct 5 19:27:35 2010 (4CABD087)
AppleCharger.sys Mon Jan 10 02:57:29 2011 (4D2AD809)
ALSysIO64.sys Sat Jul 9 18:27:45 2011 (4E18F201)
EtronXHCI.sys Mon Jul 25 15:30:56 2011 (4E2DE090)
EtronHub3.sys Mon Jul 25 15:30:59 2011 (4E2DE093)
LHidFilt.Sys Fri Sep 2 00:23:09 2011 (4E60764D)
LMouFilt.Sys Fri Sep 2 00:23:15 2011 (4E607653)
LUsbFilt.Sys Fri Sep 2 00:23:19 2011 (4E607657)
RTCore64.sys Tue Sep 6 06:24:50 2011 (4E661112)
usbfilter.sys Wed Dec 14 00:44:02 2011 (4EE853C2)
RTKVHD64.sys Tue Jan 17 04:14:33 2012 (4F155819)
nvhda64v.sys Tue Jan 17 05:45:46 2012 (4F156D7A)
MpFilter.sys Fri Mar 9 04:05:26 2012 (4F59E3F6)
nvlddmkm.sys Tue Apr 3 07:01:59 2012 (4F7AF4C7)
Rt64win7.sys Wed Apr 11 10:29:16 2012 (4F85B15C)

lmimirr.dll
lmimirr2.dll
lmimirr.sys
RaInfo.sys
LMIRfsDriver.sys
gdrv.sys
GEARAspiWDM.sys
RtNdPt60.sys
amdsata.sys
amdxata.sys
LGVirHid.sys
LGBusEnum.sys
rikvm_9EC60124.sys
AppleCharger.sys
ALSysIO64.sys
EtronXHCI.sys
EtronHub3.sys
LHidFilt.Sys
LMouFilt.Sys
LUsbFilt.Sys
RTCore64.sys
usbfilter.sys
RTKVHD64.sys
nvhda64v.sys
MpFilter.sys
nvlddmkm.sys
Rt64win7.sys

Recommend removing your Gigabyte utilities through Start Menu -> Control Panel -> Uninstall a program. They can provide software interfaces with the hardware for overclocking, and even when the overclock is not enabled, that interface can cause instability. They are also not needed for the system to function properly and may reduce system resources.​

Analysis:

The link you refer to is a good place to start. It is strange that it is pointing to a network driver, though. I rarely see 0x101 show a driver in the stack; it is usually all Windows based... I wonder if it is due to the corrupted LogMeIn software.​

 

[funtimeerror]

well after looking thru the memory.dmp and checking the interupt levels on the processors, it doesnt appear to be bad hardware as the 'r if' output was 0 and not 1. I've attached the requested full info dump.

Im having my friend reinstall logmein and remove the gigabyte software

 

[writhziden]

You seem well versed in using the debugger. Nice work! I assume you read the thread by Vir Gnarus, who is probably the best I have seen at digging deep into .dmp files and coming out with very useful info.

Let us know how things go with the LogMeIn re-install and whether fixing its drivers stops the processor hang.

 

[funtimeerror]

I'm still learning the debugging end

I've done alot of coding so doing it from this side is just taking a bit of time getting used to it..

2: kd> !thread
THREAD fffffa801554b060  Cid 10d8.0f74  Teb: 000000007efaa000 Win32Thread: fffff900c2aaac20 RUNNING on processor 2
Not impersonating
DeviceMap                 fffff8a0099bf640
Owning Process            fffffa8015821060       Image:         chrome.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      1149033        Ticks: 524 (0:00:00:08.174)
Context Switch Count      3155                 LargeStack
UserTime                  00:00:00.140
KernelTime                00:00:00.062
Win32 Start Address 0x0000000069266d4d
Stack Init fffff8800ac81c70 Current fffff8800ac80e80
Base fffff8800ac82000 Limit fffff8800ac7b000 Call 0
Priority 11 BasePriority 10 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
2: kd> !irql 2
Debugger saved IRQL for processor 0x2 -- 0 (LOW_LEVEL)
2: kd> !gle
Unable to read TEB at 000000007efaa000
2: kd> !TEB 000000007efaa000
TEB at 000000007efaa000
error InitTypeRead( TEB )...

in a nutshell 101 BSOD's are a pain

probably helpful to note that this is an 8 core computer.... had to get the stack off the core that caused the issue (core #2), which in this case... wasnt in memory during the dump :/

here's a link to the full memory dump (once it finishes sync'ing to my dropbox around 2am Central time given my current speed)
http://db.tt/R7MFau0o

 

[writhziden]

I am also a software developer. I enjoy doing the debugging work and determining what is causing crashes.

Unfortunately, I have not yet learned the differences between the minidump and kernel dump since I rarely receive a MEMORY.DMP on these forums. I just started learning this back in November, and we have since lost a number of our blue screen experts due to them burning out, moving to other things, etc. so I have picked up a number of threads to keep the crashes and debugging forum well supported. I work on here as a volunteer in my free time, and spend the rest of my time doing PhD research. I say all this because it leaves me with very little free time to learn more of the intricacies of kernel based analysis.

I feel bad that you uploaded that file since I cannot provide more insight with it.

 

[funtimeerror]

Quick update on this issue.

Uninstalled the realtek NIC and did the 'remove driver' option, then also went into device manager, showed hidden devices and removed the realtek NDIS device. Rebooted and reinstalled the nic drivers (RtNdPt60.sys Dec 13 2010 (NDIS driver), RT64Win7.sys Sep 29 2011 (device driver)) and it seems to be working at the moment as we where able to watch netflix for 30 minutes without a crash.

I'll monitor for a week before writing up a final resolution post and marking as solved

 

[writhziden]

Thank you for posting back the details of your steps. That may help others who have similar problems. Was LogMeIn also taken care of?

Even though it may not have been the direct cause, LogMeIn was corrupted and may cause other issues down the line. Just wanted to make sure that was also resolved.

 

[funtimeerror]

We uninstalled logmein, and watched netflix prior to my purging of all things realtek. Still got a bsod. After reinstalling the realtek driver per my last post, theres only been 1 bsod (same issue) but before the bsod, silverlight actually did an appcrash first. So.... hopefully there's some info in there on whats going on

 

[funtimeerror]

digging thru the memory.dmp on this one. I guess the good news is that the network card isnt on the stack on this one

Still hard to tell whats causing it so far but I'll keep yall updated.

(edit: found a good resource if anyone else wants it.... http://blogs.msdn.com/b/ntdebugging...ugging-a-clock-watchdog-timeout-bugcheck.aspx also http://blogs.msdn.com/b/ntdebugging...l-stack-reconstruction-and-stack-walking.aspx for the 64bit world)

 

[writhziden]

I also found something interesting for network related crashes. Doubt it'll help (now that the network device is off the stack), but it may be worth trying: Computer stops responding when you run an application that uses the Windows Filtering Platform API in Windows 7, Windows Server 2008 R2, Windows Server 2008, or Windows Vista

 

[funtimeerror]

out of curiosity how do i tell which service it was that crashed

0: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`07a33298 fffff800`0352defa : 00000000`00000101 00000000`00000019 00000000`00000000 fffff880`03117180 : nt!KeBugCheckEx
fffff880`07a332a0 fffff800`034e0cd7 : 00000000`00000000 fffff800`00000006 00000000`00002711 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4e2e
fffff880`07a33330 fffff800`03419895 : fffff800`0343f460 fffff880`07a334e0 fffff800`0343f460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`07a33430 fffff800`034d3713 : 00000000`32346a3f fffff800`03649e80 00000000`00000000 00000000`00000000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`07a33460 fffff800`034e5fb2 : fffff800`03649e80 fffff880`00000001 00000000`00000000 fffff980`1e4a8ee0 : nt!KiInterruptDispatchNoLock+0x163 (TrapFrame @ fffff880`07a33460)
fffff880`07a335f0 fffff800`0357d2e6 : 00000000`00000000 fffff800`03649e80 fffff980`1e4a8ee0 00000000`00000000 : nt!KiIpiSendRequestEx+0xb2
fffff880`07a33630 fffff800`035d6119 : 00000000`00000001 fffff880`07a336f0 fffff6fc`c00f2540 fffff980`1e4a8ee0 : nt!KeFlushSingleTb+0x126
fffff880`07a336b0 fffff800`0360193b : fffff800`03458000 00000000`2b707249 00000000`001ad5b8 00000000`00000001 : nt!MmFreeSpecialPool+0x349
fffff880`07a33800 fffff800`03978026 : fffffa80`11805d02 fffffa80`11805df0 00000000`00000000 fffff980`1e4a8ee0 : nt!ExDeferredFreePool+0xf33
fffff880`07a338b0 fffff800`039785ec : fffff800`034c9cda fffff980`1e4a8ee0 fffff880`07a33ae0 fffffa80`111dc0b0 : nt!VfIoFreeIrp+0xe6
fffff880`07a338e0 fffff800`034c9cda : fffff880`07a33978 fffff880`07a33b60 00000000`00000010 fffff800`037dadb0 : nt!IovFreeIrpPrivate+0x5c
fffff880`07a33920 fffff800`034ca020 : 00000000`00000001 fffff880`07a339a0 000007fe`fd2f3e00 00000000`00000000 : nt!KiDeliverApc+0x2ca
fffff880`07a339a0 fffff800`034d64f7 : fffffa80`111dc060 00000000`ffffffff 00000000`00000000 fffffa80`118dbcb0 : nt!KiInitiateUserApc+0x70
fffff880`07a33ae0 00000000`76e0135a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c (TrapFrame @ fffff880`07a33ae0)
00000000`1de1f6d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e0135a

i mean, from what i can tell from this stack, a system service stopped. It tried to free all its stuff up but got stuck in a loop and then became unresponsive.

So what service was hit by the nt!KiSystemServiceExit+0x9c

 

[funtimeerror]

ok, so i made some headway looking at the WER reports...

on CPU core 6, chrome is the active thread that is hung.
Per the AppCrash reports, Chrome is using coreclr.dll which is what crashed/hung (the silverlight dll) getting more info now.

next steps will be uninstalling silverlight/.NET verifying all of it is gone, then reinstalling.

 

[writhziden]

Good steps. I do see those in your event viewer logs as causing application crashes. Did not see anything indicating they were on CPU core 6 and causing a hang. Could you provide a code box, [code]<info inside code box>[/code], with the WER report and where you found that highlighted in red? Surround the information in [B][COLOR="RED"]<your info here>[/COLOR][/B] to provide us with the highlighted errors.

 

[funtimeerror]

I couldn't find the WER report with it, but instead of messing with silver light/.NET I bumped up the vcore voltage from 1.45 to 1.5v. No issues with Netflix yet so fingers crossed that's what it was

 

[writhziden]

A VCore bump can sometimes resolve 0x101 crashes. Odd that it would have been under-Volted, though. The VCore is usually only an issue if the system is overclocked.

 

[funtimeerror]

true.... which is why i find it odd.

The CPU did have a 'Core Turbo' mode that was turned on by default. Adjusting the voltage turned it off. That could have been it as well. Gonna mark it as solved as no BSOD's in last 10 days.
VCore boost ftw