BSOD while computer was unattended

[yoshm]

I am new to this forum - thanks in advance for your help.

I left my computer running (with a few programs open: Word 2010, Excel, Opera, etc.). When I came back, a BSOD awaited me.

I've attached a photo I took of the screen and a zip file containing:

• the output directory of the jcgriff tool
• The perfmon output
  

I noted that the current MEMORY.DMP file did not seem to be copied to the jcgriff directory - should I upload that, too?

Also - FYI - I started the jcgriff tool and almost immediately canceled it because I realized I had not followed the instruction to Run As Administrator. I then re-ran it correctly.

My system specs:
Is Windows 7 . . .
- x86 (32-bit) or x64 ?
- the original installed OS on the system? YES
- an OEM or full retail version?
- OEM = came pre-installed on system
- Full Retail = you purchased it from retailer

- What is the age of system (hardware)? 1.5 years.
- What is the age of OS installation (have you re-installed the OS?) have not re-installed - it is original factory installation.

 

[Heyyou]

Did the computer re-start OK? Some times a bsod can occur for no apparent reason, but on re-boot all is well.

 

[yoshm]

Hi HeyYou,

Thanks for the quick reply. It restarted OK, but all is not well. I have had recurring blue-screens for the last month or two (and less frequently before that). Yesterday's made me decide it wasn't going to go away by itself & I started looking for a solution - and found this forum.

This morning - after waking my computer from Sleep mode I mistyped my password & before I had a chance to try again, it blue-screened again. (Should I re-do the jcgriff & perfmon procedure?).

I have attached a photo of today's blue screen. I've also attached photos of some other blue screens in the recent past. You can see the date of each bluescreen by the filename from when I snapped the photo. They are in reverse chronological order going back to March 5.

Thanks for any guidance,
Yosh

 

[yowanvista]

You may have a virus that is affecting many systems lately. Run the Kaspersky TDSSKILLER program: How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880018533e4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b3100
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
CLASSPNP!ClasspDequeueIdleRequest+44
fffff880`018533e4 48895008        mov     qword ptr [rax+8],rdx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000ba2580 -- (.trap 0xfffff80000ba2580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8004c339f8
rdx=fffffa8004c33a00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018533e4 rsp=fffff80000ba2710 rbp=0000000000000002
 r8=000000005aa3e5f6  r9=0000000000000000 r10=fffff800035f6e80
r11=fffffa8004c33a50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
CLASSPNP!ClasspDequeueIdleRequest+0x44:
fffff880`018533e4 48895008        mov     qword ptr [rax+8],rdx ds:2a60:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034801e9 to fffff80003480c40

STACK_TEXT:  
fffff800`00ba2438 fffff800`034801e9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00ba2440 fffff800`0347ee60 : fffffa80`091598d0 fffffa80`07e57050 00000000`00000000 fffffa80`04c33010 : nt!KiBugCheckDispatch+0x69
fffff800`00ba2580 fffff880`018533e4 : 00000000`00000001 fffffa80`04a9ad40 fffff800`00ba2800 fffffa80`04c33010 : nt!KiPageFault+0x260
fffff800`00ba2710 fffff880`01863ef5 : fffffa80`04c311b0 00000000`0000ffff 00000000`00000001 fffff800`035f6e80 : CLASSPNP!ClasspDequeueIdleRequest+0x44
fffff800`00ba2740 fffff880`018542fd : fffffa80`04c33a10 fffffa80`04c33a50 00000000`00000001 fffff800`034895fa : CLASSPNP!ClasspServiceIdleRequest+0x15
fffff800`00ba2770 fffff800`0348c5fc : fffff800`035f6e80 00000000`00000000 00000002`408f0088 00000000`00000004 : CLASSPNP! ?? ::FNODOBFM::`string'+0x3116
fffff800`00ba27a0 fffff800`0348c496 : fffffa80`04c33a10 00000000`002c008e 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00ba2810 fffff800`0348c37e : 00000068`bdfe7704 fffff800`00ba2e88 00000000`002c008e fffff800`035fa448 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00ba2e60 fffff800`0348c167 : fffff800`035f6ec1 00000000`002c008e fffff880`00f40f00 00000000`0000008e : nt!KiTimerExpiration+0x1be
fffff800`00ba2f00 fffff800`03483765 : 00000000`00000000 fffffa80`0704c250 00000000`00000000 fffff880`0442b588 : nt!KiRetireDpcList+0x277
fffff800`00ba2fb0 fffff800`0348357c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`08db91e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CLASSPNP!ClasspDequeueIdleRequest+44
fffff880`018533e4 48895008        mov     qword ptr [rax+8],rdx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  CLASSPNP!ClasspDequeueIdleRequest+44

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929b

FAILURE_BUCKET_ID:  X64_0xD1_CLASSPNP!ClasspDequeueIdleRequest+44

BUCKET_ID:  X64_0xD1_CLASSPNP!ClasspDequeueIdleRequest+44

Followup: MachineOwner
---------

 

[yoshm]

Thanks, Yowanvista, for the suggestion. I ran the Kapersky program and it found no threats.

Any other ideas or suggestions?

FYI, in general, my system seems to get stuck a lot - I spend inordinate amounts of time waiting for Windows explorer to respond. This made me think that it may be some driver that is bad (and may also be causing the blue screens). But how to find out which?

Thanks,
Yosh

 

[yoshm]

Question: Should I re-run jcgriff tool and/or perfmon & upload results?

 

[yowanvista]

Question: Should I re-run jcgriff tool and/or perfmon & upload results?

Re-run it, your attachment doesn't seem to contain any recent dump files.

 

[yoshm]

From bad to worse...

Question: Should I re-run jcgriff tool and/or perfmon & upload results?

Re-run it, your attachment doesn't seem to contain any recent dump files.

I re-ran it yesterday and it is attached.

I put the machine to "sleep" last night. When I opened it this morning - a new blue screen! (See attached photo).

I am re-re-running jcgriff and will upload when it is complete.

Note that I do not see any recent "mini-dumps" - why would I not be getting those? What about the full dump (MEMORY.DMP) - should I be uploading that somehow?

Also, I do not know if this is related, but I got a message that drivers were causing Windows to resume slowly - I've attached a screenshot. I note there a mention of a device "Blackberry SD" - not sure what that is or how to get rid of it. I've uninstalled all the Blackberry software a few weeks ago. The Intel driver I assume I need for the display.

Thanks for any help. Things are going form bad to worse so I sure hope someone can guide me to finding what's wrong...

Thanks!
Yosh

p.s. should jcgriff take so long to run? It's been going for nearly an hour - previously it also took a really long time.

 

[yoshm]

Here's the next jcgriff (see my previous post).

Can anyone help?

 

[yowanvista]

Here's the next jcgriff (see my previous post).

Can anyone help?

Your attachments contain no recent dumps, the latest ones date from last year.

 

[yoshm]

Here's the next jcgriff (see my previous post).

Can anyone help?

Your attachments contain no recent dumps, the latest ones date from last year.

Yes - I know. I wrote before:

Note that I do not see any recent "mini-dumps" - why would I not be getting those? What about the full dump (MEMORY.DMP) - should I be uploading that somehow?

Since writing that, I went & checked and saw that my system was set to do a kernel dump. I changed it now to do minidumps. I don't know why it was set a year ago for mini & then switched to kernel...

Does the jcgriff tool not extract info from the kernel dump that would be of use in resolving it? If not, is there some other tool for analyzing the kernel dump?

Is there any information in the photos of the blue-screens that would help to understand what is going wrong? Anywhere else I can look to figure this out?

The good news is that since the BSOD a few days ago I haven't had another. IF I do, I will run jcgriff again & post - this time I hope with a current minidump.

thanks,
yosh

 

[yowanvista]

Here's the next jcgriff (see my previous post).

Can anyone help?

Your attachments contain no recent dumps, the latest ones date from last year.

Yes - I know. I wrote before:

Note that I do not see any recent "mini-dumps" - why would I not be getting those? What about the full dump (MEMORY.DMP) - should I be uploading that somehow?

Since writing that, I went & checked and saw that my system was set to do a kernel dump. I changed it now to do minidumps. I don't know why it was set a year ago for mini & then switched to kernel...

Does the jcgriff tool not extract info from the kernel dump that would be of use in resolving it? If not, is there some other tool for analyzing the kernel dump?

Is there any information in the photos of the blue-screens that would help to understand what is going wrong? Anywhere else I can look to figure this out?

The good news is that since the BSOD a few days ago I haven't had another. IF I do, I will run jcgriff again & post - this time I hope with a current minidump.

thanks,
yosh

You may use Bluescreenview but it produces very little details
Blue screen of death (STOP error) information in dump files.

 

[yoshm]

You may use Bluescreenview but it produces very little details
Blue screen of death (STOP error) information in dump files.

Thanks for the suggestion. I actually had already tried that tool - but it doesn't help with the MEMORY.DMP file - only minidumps - as he writes on that page: "BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table."

Any similar tool for interpreting the regular dump file?

 

[yowanvista]

You may use Bluescreenview but it produces very little details
Blue screen of death (STOP error) information in dump files.

Thanks for the suggestion. I actually had already tried that tool - but it doesn't help with the MEMORY.DMP file - only minidumps - as he writes on that page: "BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table."

Any similar tool for interpreting the regular dump file?

You could use WinDBG for detailed analysis of the memory dump but it could be little tricky .

 

[yoshm]

You could use WinDBG for detailed analysis of the memory dump but it could be little tricky .

Hmmm... never used it. Google shows it's something I should probably learn. One tutorial I saw also referred only to the minidump files. I presume, though, that I can use it with a Kernel Dump, too - but I have to learn about that still...

Thanks for the pointer. If you have any recommended resource for applying it to my problem I'll appreciate it.

 

[yoshm]

Another BSOD

I got a new BSOD a couple days ago - see photo attached.

I checked the minidump directory and there is NOT a dump there - despite my setting it to be saved and in the default location (see attached screenshot).

1. Why am I not getting a dump? I see on the BSOD that it was "initializing for crash dump" - but more than half an hour later it had not progressed.
2. Can anyone tell from the screen shots (today & previous) what is the problem or a direction for me to investigate further?

Thanks,
Yosh

 

[writhziden]

It has to do with your backup software. Do you have a 3rd party backup application? Do you have any pending backups through Windows Backup and Restore? http://www.sevenforums.com/tutorials/615-backup-user-system-files.html

 

[yoshm]

Thanks very much for the quick answer. I would have replied sooner, but I've been battling my computer (as I'll describe below)

It has to do with your backup software.

How are you able to see that?

Do you have a 3rd party backup application?

Yes - I use CrashPlan and have a subscription to backup to their cloud servers.

Do you have any pending backups through Windows Backup and Restore? http://www.sevenforums.com/tutorials/615-backup-user-system-files.html

No. I have never set it up. I use CrashPlan. I just took a look in Control Panel and it says "Windows Backup has not been set up."

Meanwhile - here's what else has happened.

This morning I woke up the computer from Sleep. Within a few minutes I had a new BSOD (See 1st attachment).

I restarted and within a few minutes got a new BSOD (see 2nd attachment).

Both times it seemed to hang when it was supposed to be writing the dump file (I waited 5-10 minutes before restarting). I checked the Minidump directory and there are no new files there - only the old ones from 2011.

Since the BSOD advised me to run CHKDSK, I did. It found no errors (see 3rd attachment)

After CHKDSK, the computer restarted. I tried to Login and the computer hung without even giving me the password prompt.

Restarted and this time it hung after the password was accepted.

Restarted and this time I asked for "Last known good configuration" - and this time I was able to get on (and write this message).

I notice that the BSODs have different information on them (they're not all the same). Are there some clues there as to the source of my grief?

And do you have any idea how I can get the minidumps to be written when this happens again?

Thanks,
Yosh

 

[writhziden]

All of these crashes and errors are hard disk related. I noted the backup software because of the Volume Shadow Copy Service (VSS) and the volsnap.sys driver associated with it. I wonder if your hard disk controller drivers are corrupted. Uninstall them and let Windows install the drivers on startup.

1. Click Start Menu
2. Right Click My Computer/Computer
3. Click Manage
4. Click Device Manager from the list on the left
5. Expand IDE ATA/ATAPI controllers
6. Right click each device
7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
8. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer only if Windows asks you to.
10. Let Windows install the drivers. You may need to do one device at a time if each device requires a restart.

Alternatively:

1. Login as an adminstrative user.
2. Click Start Menu
3. Click Control Panel
4. Click Hardware and Sound
5. Click Device Manager (the last link under Devices and Printers)
6. Expand IDE ATA/ATAPI controllers
7. Right click each device
8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
10. Restart your computer only if Windows asks you to.
11. Let Windows install the drivers. You may need to do one device at a time if each device requires a restart.

 

[yoshm]

Hi writhziden,

You are right that all of them seem to be related to the disk - including the one this morning that referenced iaStor.sys. Maybe that is also why it can't write the dump file at the end of the blue screen.

Thanks for the instructions. Before I carry them out I want to be sure I understand if there's any risk in doing this - is there? I.E., if I uninstall the disk driver (there's only one - it's "Intel(R) 5 Series 4 Port SATA AHCI Controller"), is there any danger that my disk would be damaged by doing this or inaccessible altogether (e.g., if Windows DOES ask me to reboot - how will it read my disk if there is no driver?)

Many thanks for all your help,
Yosh