Solved BSOD while computer idle, ntoskrnl.exe

[nomjas]

Hello everyone,

I have built this machine after my old one died (burned after suspected psu failure). Anyway, I formatted the SSD and reinstalled windows 7x64. Unfortunately I keep getting BSODs in random situations - mostly when the PC is being idle, but sometimes when I'm surfing the web. I have not experienced any crashes during playing games. At first, I had HD5850, taken from the old computer, however I was experiencing video driver crashes and sometimes bsods (during web surfing, not gaming). I tried reseating the card, but that did not really help (it kinda got worse), so I removed it. That seemed to help.. for a few days, but the bsod are back now. What I did:

I ran memtest for like 10 hours, no errors.

Chkdsk - no errors

Enable driver verifier -> caused a bsod blaming gdrv.sys ( I uninstalled all gigabyte apps, and renamed gdrv.sys to gdrv.old ), system booted up ok, but after some idle time, bsod again (it said fltmgr.sys was probably to blame)

Comodo seems to cause a bsod, when verifier is enabled and I try to run SF_Diagnostic_Tool, so i ran it from safe mode. Success, but I decided to reboot and disable C antivirus&auto-sandbox, that solved the cmdguard crash issue (so I'm not sure if the last 3 dumps are relevant).

I am clueless about the bsod cause, please help

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {e3, fffff880088a838d, 1fe300, 0}

*** WARNING: Unable to verify timestamp for cmdguard.sys
*** ERROR: Module load completed but symbols could not be loaded for cmdguard.sys
Probably caused by : [COLOR="Red"][B]cmdguard.sys[/B][/COLOR] ( cmdguard+838d )

Followup: MachineOwner
---------

Uninstall Comodo Firewall - use Windows firewall instead and monitor for further BSOD's.

 

[nomjas]

Ok, so I left the computer powered on overnight, and when I woke up it was ok. However, after about half an hour of idle, it crashed again. I'm uploading the newest minidump. Verifier was on. Is uninstalling comodo a must? I haven't had problems with it on other systems. Anyway, the idle bsods seem to be caused by something else than comodo.

//Edit: So I just had another crash, supposedly by some cawvp (which is some comodo thing), so I unistalled it and am gonna monitor stability, like suggested.

 

[nomjas]

Ok, so this did not help. Another idle bsod. Uploading minidump.

It seems to me, that the errors are pretty random? And also the processes at fault are also random?

 

[cluberti]

Whenever I see double faults during a context swap, I initially think drivers - so we do want to make sure we've got the latest drivers for hardware (and system BIOS too) on this device.

However, the second thing I think when I see something double-fault during a context swap is bad hardware.... Just fyi.

1: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff880`009f5ce8 fffff800`032d6429 nt!KeBugCheckEx
01 fffff880`009f5cf0 fffff800`032d48f2 nt!KiBugCheckDispatch+0x69
02 fffff880`009f5e30 fffff800`032da13f nt!KiDoubleFaultAbort+0xb2
03 fffef880`0cadde80 00000000`00000000 nt!SwapContext_PatchXSave+0x8f

1: kd> .trap fffff880`009f5e30
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=fffffa80096fbbb8
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032da13f rsp=fffef8800cadde80 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000f44 r10=fffff80003260000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!SwapContext_PatchXSave+0x8f:
fffff800`032da13f e86c6a0000      call    nt!KeInterlockedClearProcessorAffinityEx (fffff800`032e0bb0)

1: kd> ub
nt!SwapContext_PatchXSave+0x6d:
fffff800`032da11d 48c7c170000000  mov     rcx,70h
fffff800`032da124 0f00d1          lldt    cx
fffff800`032da127 4c8b7670        mov     r14,qword ptr [rsi+70h]
fffff800`032da12b 4c3b7770        cmp     r14,qword ptr [rdi+70h]
fffff800`032da12f 7429            je      nt!SwapContext_PatchXSave+0xaa (fffff800`032da15a)
fffff800`032da131 488b5770        mov     rdx,qword ptr [rdi+70h]
fffff800`032da135 488d8a88000000  lea     rcx,[rdx+88h]
fffff800`032da13c 8b5324          mov     edx,dword ptr [rbx+24h]

1: kd> u nt!SwapContext_PatchXSave+0x8f
nt!SwapContext_PatchXSave+0x8f:
fffff800`032da13f e86c6a0000      call    nt!KeInterlockedClearProcessorAffinityEx (fffff800`032e0bb0)
fffff800`032da144 498d8e88000000  lea     rcx,[r14+88h]
fffff800`032da14b 8b5324          mov     edx,dword ptr [rbx+24h]
fffff800`032da14e e8fd690000      call    nt!KeInterlockedSetProcessorAffinityEx (fffff800`032e0b50)
fffff800`032da153 498b5628        mov     rdx,qword ptr [r14+28h]
fffff800`032da157 0f22da          mov     cr3,rdx
fffff800`032da15a 4c8bbb88feffff  mov     r15,qword ptr [rbx-178h]
fffff800`032da161 488b6e28        mov     rbp,qword ptr [rsi+28h]

Again, if this were my machine, I'd be doing CPU and RAM testing to start. This is not good, especially since you're not overclocking. There doesn't appear to be any issues here (although it is a minidump, we can see a lot in this case), at least not as far as I can tell, yet you're hitting a double-fault when accessing the CPU registers to context-swap data.

 

[nomjas]

I checked RAM with memtest86+ thing, 10 passes, no errors. How can I test CPU?

 

[cluberti]

http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html

 

[nomjas]

I will try to test with Prime95 now, then. Meanwhile, another random bsod while idle (attached).

Moreover, here's a handy compilation of all the errors I had by now. It would appear, that every time, it's a different error (except for comodo, but that's irrelevant, but I identified the reason).

Another exception is SYSTEM_SERVICE_EXCEPTION - those appeared when I had my old graphics (radeonHD5850). When I removed it, I started getting random errors.

The crash only occurs after logging in. When the system is left on "log in screen", it never crashes.

 

[nomjas]

Interesignly, the system does not crash under load.

2.5 hours of small FFTs test + 8 hours of blend test - no crash, no errors, max temp 54C.
This is consistent, with my earlier observations, that the system did not crash during gaming, just when left idle.

What can I do next?

 

[nomjas]

bump

I ran sfc /scannow ; did not find any violations.

I plugged in a new graphics card - r9 290. Tested with furmark and played diablo3 for a bit. Working good. When I closed diablo3, the driver crashed. Also after 10 minutes of idle, driver crashed again. It's a similar issue to the one I had with the other graphics card. So now I'm thinking, should I blame windows7 installation, the ssd or the motherboard, the power saving settings?

Display crash as in the image below:

 

[nomjas]

Ok. This was memories fault after all (even though memtest did not detect any errors).

An advice to everyone having similar errors - remove all memory sticks and plug them in one by one. Memtest can be wrong I guess.

 

[tycischke]

Could you go into a little more detail about how you found out your memory was at fault? I'm having problems that seem pretty similar to yours. And what's your solution? Are you just replacing your memory?

 

[nomjas]

Basically I pulled out all the ram sticks and was trying them one by one. 1 set was fine (no bsod for 48 hours), while when I plugged in the other one bsod returned.

 

[Golden]

Ok. This was memories fault after all (even though memtest did not detect any errors).

I've never heard of that before.....what version of Memtest86+ did you run?

 

[nomjas]

v5.01

I did 8 passes (like I wrote in earlier post), no errors.