Solved BSOD - whocrashed points to cdd.dll and kernel

[jamestcoop]

Hi. Thank you all for your help.

My computer has been getting BSOD memory dump errors for a couple of weeks now and I have tried many tools to pin down the error but at this point I need some expert guidance.

Steps I've taken so far:
Booting to safe mode and restoring to an earlier configuration before bsod started.
Uninstalling nvidia graphics card driver updates since after that driver update is when the problems first appeared (this could be synchronicity and not related).
Uninstalling and reinstalling everything but the OS.
Formatting the ssd and reinstalling a fresh copy of win7 using an older nvidia graphics driver that I knew to work for months without problems in the past.
Ran Memtest86+ for 3 passes with 0 errors reported in memory

Utilities for error checking I already installed:
WhoCrashed
NirSoft tools
Win Debugger utilities (windbgx64)
Driver Verifier

I still get the bsod. Most recently while playing Warframe but it's not always while gaming. Additionally the computer won't come back from sleep mode some times. When it does bsod it won't always restart correctly (the blue/on light will light up but nothing displays on the monitor and there is no sound of windows starting up so I am thinking it isn't getting past POST).

WhoCrashed seems to point to CDD.DLL and the kernel as the culprits but from what I've read they probably (hopefully) are fine and those were the services that were requesting information from the broken utility/driver when the bsod happens.

I've attached the memory dump file. Is there any other information you need?

Thanks in advance!!!!!!!!!!!!!!!!!!

 

[YoYo155]

I would start by running Driver Verifier, following this tutorial | http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Post back with the new dump files!

 

[jamestcoop]

Ok I started Driver Verifier selecting everything but Windows components.

I put the computer to sleep while I went to run an errand. When I came back I moved the mouse, it came out of sleep mode, and about 1 second later bsod memory dump.

After the bsod the screen goes blank and is not responsive so I restarted the computer with the restart button on the tower. After restart I selected windows in safe mode with networking and after the windows splash screen loaded but before I could log in there was another bsod memory dump.

Attached is the new dump and other compressed files.

Thanks again for all your help!!

 

[jamestcoop]

I don't know if this helps, but here is what WhoCrashed said about the most recent problems:

"On Mon 8/5/2013 1:41:22 AM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: Unknown (0xFFFFF80002C7FC00)
Bugcheck code: 0x1A (0x411, 0xFFFFF6FC5000F7C8, 0x84600001A3FF3882, 0xFFFFF6FC5000F7C1)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error.
Google query: MEMORY_MANAGEMENT



On Sat 8/3/2013 11:37:20 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080313-7503-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x4E (0x7, 0x195A87, 0x1, 0x0)
Error: PFN_LIST_CORRUPT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 7/28/2013 10:50:30 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\072813-9313-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x6F880)
Bugcheck code: 0x4E (0x9A, 0x14B281, 0x1, 0x0)
Error: PFN_LIST_CORRUPT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. "

 

[YoYo155]

Ok I started Driver Verifier selecting everything but Windows components.

I put the computer to sleep while I went to run an errand. When I came back I moved the mouse, it came out of sleep mode, and about 1 second later bsod memory dump.

After the bsod the screen goes blank and is not responsive so I restarted the computer with the restart button on the tower. After restart I selected windows in safe mode with networking and after the windows splash screen loaded but before I could log in there was another bsod memory dump.

Attached is the new dump and other compressed files.

Thanks again for all your help!!

The latest dump wasn't included in the last file you uploaded.

This one:

"On Mon 8/5/2013 1:41:22 AM GMT your computer crashed

You can upload it separately, you'll find it in a folder called minidump:

C:\Windows\minidump\
Look for a file from 8/5/2013.
If you're having issues uploadig | http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html
​

 

[jamestcoop]

Sorry I thought I followed the instructions correctly but I guess not.

Since then it has BSOD'ed another 3-4 times and I've included the new SF zipped folder and the more recent mini dump file in this post.

This is really frustrating! Thanks again for your help in figuring this out

 

[YoYo155]

Driver Verifier wasn't enabled.

Follow this tutorial instead | http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[jamestcoop]

Here are some more. Driver verifier was on this time I hope!

On Tue 8/6/2013 6:48:18 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080613-11466-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x411, 0xFFFFF6FC50051288, 0x81800000BE9C3882, 0xFFFFF6FC50051281)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 8/6/2013 6:48:18 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: nvlddmkm.sys (nvlddmkm+0x16F9B2)
Bugcheck code: 0x1A (0x411, 0xFFFFF6FC50051288, 0x81800000BE9C3882, 0xFFFFF6FC50051281)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\drivers\nvlddmkm.sys
product: NVIDIA Windows Kernel Mode Driver, Version 311.06
company: NVIDIA Corporation
description: NVIDIA Windows Kernel Mode Driver, Version 311.06
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 311.06 , NVIDIA Corporation).
Google query: NVIDIA Corporation MEMORY_MANAGEMENT



On Tue 8/6/2013 2:19:11 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080613-8096-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x5001, 0xFFFFF780C0000000, 0x4F82, 0x4F83FFFFFFF6)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 8/6/2013 5:05:06 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-9375-01.dmp
This was probably caused by the following module: ???????????.sys (Unloaded_???????????+0x1A)
Bugcheck code: 0x1A (0x5005, 0xFFFFF70001080000, 0xBC9, 0x1E54)
Error: MEMORY_MANAGEMENT
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: ???????????.sys .
Google query: ???????????.sys MEMORY_MANAGEMENT



On Tue 8/6/2013 4:10:27 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-10062-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1E (0xFFFFFFFFC000001D, 0xFFFFF80002FC1328, 0x0, 0xFFFFFA8006A50800)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 8/6/2013 2:16:54 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-7519-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x5003, 0xFFFFF780C0000000, 0xDB5, 0xDB300001B62)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 8/6/2013 2:15:44 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080513-10108-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x5003, 0xFFFFF70001080000, 0x2474, 0x2462000048E0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

 

[YoYo155]

Remove ATK0110 ACPI Utility:

ASACPI.sys   Mon Mar 28 05:30:36 [COLOR=Red][U][B]2005[/B][/U][/COLOR]

Driver Reference Table - ASACPI.sys
​

 

[jamestcoop]

Thank you so much for the information.

How do I go about removing this ACPI utility? Do I need to replace it with something else or can I just delete it somehow and be good to go?

I was looking for an updated version of this utility which took me to this (ATK0110 ACPI UTILiTY - Drivers - Windows 7) which took me to this (ASUS Motherboard : World’s 1st MB to Obtain WHQL Certification !) which took me to this (ASUSTeK Computer Inc. -Support- Drivers and Download Tools).

Is this the right direction or can I just delete the utility? How do I do that? Sorry for being clueless. Thank you for all this help. I really do appreciate it.

Also, any tutorial you can direct me to which might help me understand how you knew this was the utility causing the crashes/bsods? Thanks again!

 

[YoYo155]

You can just remove it Asus Bloatware are known to cause BSOD with Windows 7, especially that OLD!
Remove it as you would any other software then follow through with | http://www.sevenforums.com/tutorials/83814-drivers-clean-left-over-files-after-uninstalling.html

To make sure it's gone.

EDIT:


It was pointed out to me that it is better to update the driver rather then to remove it
seeing it will be automatically installed on reboot.

Click the link below:

Updated Version : 2009/12/07

Choose Windows 7 64bit
View attachment 280120

Scroll down and find:
View attachment 280121

​

 

[jamestcoop]

I found and downloaded the appropriate ATK 0110 from the link above and went to the folder for 64 (instead of 32) and win7 and double clicked on the file AsAcpiIns.exe which caused a bsod (possibly because I was listening to a radio program when attempting the install). Anyway I restarted the computer and went back and re-ran AsAcpiIns.exe and it ran without error (basically a cmd window opened briefly and closed and it was done).

I don't know if it worked. Do you know how to check where that driver would be listed? I found by typing "driverquery" into a command prompt I get a list of installed drivers which shows (briefly):

Module Name  Display Name           Driver Type   Link Date             
============ ====================== ============= ======================
1394ohci     1394 OHCI Compliant Ho Kernel        11/20/2010 2:44:56 AM 
ACPI         Microsoft ACPI Driver  Kernel        11/20/2010 1:19:16 AM 
AcpiPmi      ACPI Power Meter Drive Kernel        11/20/2010 1:30:42 AM 
adp94xx      adp94xx                Kernel        12/5/2008 3:54:42 PM  
adpahci      adpahci                Kernel        5/1/2007 10:30:09 AM  
adpu320      adpu320                Kernel        2/27/2007 4:04:15 PM  
AFD          Ancillary Function Dri Kernel        12/27/2011 7:59:20 PM 
agp440       Intel AGP Bus Filter   Kernel        7/13/2009 4:38:43 PM  
aliide       aliide                 Kernel        7/13/2009 4:19:47 PM  
amdide       amdide                 Kernel        7/13/2009 4:19:49 PM  
AmdK8        AMD K8 Processor Drive Kernel        7/13/2009 4:19:25 PM  
AmdPPM       AMD Processor Driver   Kernel        7/13/2009 4:19:25 PM  
amdsata      amdsata                Kernel        3/18/2010 5:45:17 PM  
amdsbs       amdsbs                 Kernel        3/20/2009 11:36:03 AM 
amdxata      amdxata                Kernel        3/19/2010 9:18:18 AM  
AppID        AppID Driver           Kernel        11/20/2010 2:14:37 AM 
arc          arc                    Kernel        5/24/2007 2:27:55 PM  
arcsas       arcsas                 Kernel        1/14/2009 11:27:37 AM 
AsyncMac     RAS Asynchronous Media Kernel        7/13/2009 5:10:13 PM  
atapi        IDE Channel            Kernel        7/13/2009 4:19:47 PM  
b06bdrv      Broadcom NetXtreme II  Kernel        2/13/2009 2:18:07 PM

.....
etc.

The ATK / ASUS ACPI driver is not on this list, right? Does this mean it is gone?

 

[YoYo155]

The way to really look for it in MSINFO32.

Start> RUN> "MSINFO32" without the quotes then hit [Enter].

In MSINFO32;
Press Ctrl+F and search for; ASACPI

If it doesn't find it it's gone.
​

 

[jamestcoop]

Ok so it's still there in MSINFO32. How do I tell if the version listed is the old (broked/bsod cause) version or the new one I just downloaded and (hopefully) installed?

mtsensor	ATK0110 ACPI UTILITY	c:\windows\system32\drivers\asacpi.sys	Kernel Driver	No	Manual	Stopped	OK	Normal	No	No

Should I just go to that path c:\windows\system32\drivers path and delete it? What will that break?

 

[YoYo155]

Don't just delete it.

You can browse to "C:\Windows\system32\drivers" and look in its properties.

View attachment 280141*this is just an example, you should look for asacpi.sys

 

[jamestcoop]

Ok properties says the current file was created Thursday, ‎May ‎14, ‎2009, ‏‎9:26:24 AM and is version 1043.5.0.0

I am having a hard time finding out if there is a newer version than what is installed. I found this (ASUSTeK Computer Inc. -Support- Drivers and Download ATK_package) but it says the ATK utilities are specific to Notebook and so that's a little confusing if this is the right place to be looking or not.

This site (Drivers and Download (M4A77TD PRO) [Official Site - Main Page]) shows an ATK0110 utility for my motherboard with a date of 2009.12.07 so that would be slightly newer than 5/14/2009 but still really old. Should I download and install this?

Again my neverending thanks for your patience and help with this.

 

[YoYo155]

No don't download anything not from the OEM's (Original Equipment Manufacturer) website.

Since updating, did you have any issues?

 

[jamestcoop]

Yeah still having issues.

I updated asacpi as directed above but the system was still doing bsod. I went to the system32/drivers folder and deleted asacpi entirely and it does not appear to be reinstalling itself as your earlier post indicated it might. It is gone I have rebooted a few times.

I read elsewhere that MS Security Essentials can cause BSOD so I removed it and installed Avast for antivirus instead.

I got a couple more bsod's today and I've attached the minidump files. The first one probably does not have driver verifier on but the later ones should.

Here is what whocrashed reports:

On Wed 8/7/2013 10:34:50 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080713-25599-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x1A (0x411, 0xFFFFF6FC50073B08, 0x8570000011DF6882, 0xFFFFF6FC50073B01)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 8/7/2013 10:34:50 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x1B88E)
Bugcheck code: 0x1A (0x411, 0xFFFFF6FC50073B08, 0x8570000011DF6882, 0xFFFFF6FC50073B01)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Wed 8/7/2013 2:58:37 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080713-7410-02.dmp
This was probably caused by the following module: unknown_module_00000000`00000002.sys (Unloaded_Unknown_Module_00000000`00000002+0x17)
Bugcheck code: 0x19 (0x20, 0xFFFFF8A00928D7E0, 0xFFFFF8A00928D868, 0x5080304)
Error: BAD_POOL_HEADER
Bug check description: This indicates that a pool header is corrupt.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: unknown_module_00000000`00000002.sys .
Google query: unknown_module_00000000`00000002.sys BAD_POOL_HEADER



On Wed 8/7/2013 2:48:25 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080713-7410-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C00)
Bugcheck code: 0x4E (0x99, 0x1296EA, 0x2, 0x12A7B5)
Error: PFN_LIST_CORRUPT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that the page frame number (PFN) list is corrupted.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 8/6/2013 9:46:50 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\080613-11154-01.dmp
This was probably caused by the following module: asacpi.sys (ASACPI+0x19A0)
Bugcheck code: 0xC9 (0x22F, 0xFFFFF88003FDF9A0, 0xFFFFF980176FECF0, 0x0)
Error: DRIVER_VERIFIER_IOMANAGER_VIOLATION
Bug check description: This is the bug check code for all Driver Verifier
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: asacpi.sys .
Google query: asacpi.sys DRIVER_VERIFIER_IOMANAGER_VIOLATION

 

[YoYo155]

Yeah still having issues.

I updated asacpi as directed above but the system was still doing bsod. I went to the system32/drivers folder and deleted asacpi entirely and it does not appear to be reinstalling itself as your earlier post indicated it might. It is gone I have rebooted a few times.

I read elsewhere that MS Security Essentials can cause BSOD so I removed it and installed Avast for antivirus instead.

I got a couple more bsod's today and I've attached the minidump files. The first one probably does not have driver verifier on but the later ones should.

Please check your RAM.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html
*Read and follow carefully.
​

If no errors were found make sure your Intel 520 Series SSD is up to date with the latest firmware

Intel® Solid-State Drive Toolbox

F.A.Q
​

​

 

[jamestcoop]

Ok I installed intel's ssd tool and everything there appears up to date.

I ran memtest86+ for 2 more passes today with no errors. I will run it overnight to get the complete 7 passes as recommended in the article you reference above.

In meantime, here are a few more minidump files attached as a zip archive.

Can I ask how it is you figured out what was the offending driver before? Is there a tutorial you might link me to with more information about reading windbg, whocrashed, and other dump/crash tools? Thanks again for all the help!