Solved BSOD - Windows rebooted from bugcheck

[PuterUser]

Custom built PC under two months old. This is the 6th BSOD!

The maintenance report is as follows:

Description
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x0000000000041790, 0xfffffa8005fff850, 0x000000000000ffff, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052314-6318-01.

 

[Arc]

Hi PuterUser.

The crash dumps are not very specific about the probable causes. Though it gives a hint of memory corruption. It may be either a failure from the part of physical RAM, or any driver is passing bad information to the memory.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If it does not show any error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Let us know the results, with the subsequent crash dumps, if any.
____________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8005fff850, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8005fff850
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

LAST_CONTROL_TRANSFER:  from fffff80002ef3d50 to fffff80002e82bc0

STACK_TEXT:  
fffff880`0bfe5ff8 fffff800`02ef3d50 : 00000000`0000001a 00000000`00041790 fffffa80`05fff850 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0bfe6000 fffff800`02eb57d9 : 00000000`00000000 00000000`0b073fff 00000000`00000000 fffff8a0`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0bfe61c0 fffff800`0319c0f1 : fffffa80`13d03890 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0bfe62e0 fffff800`0319c4f3 : fffff880`00000000 00000000`0ac10000 fffffa80`00000001 fffff960`000d6300 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0bfe63a0 fffff800`02e81e53 : fffff900`c2552ef8 00000000`00000000 fffffa80`0d035240 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0bfe63f0 fffff800`02e7e410 : fffff960`000d73de 00000000`00000001 00000000`00000000 fffff900`c2c84cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0bfe6588 fffff960`000d73de : 00000000`00000001 00000000`00000000 fffff900`c2c84cc0 00000000`00000001 : nt!KiServiceLinkage
fffff880`0bfe6590 fffff960`000df6a9 : 00000000`00000000 fffff880`00000001 fffff900`c2c84cc0 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`0bfe66e0 fffff960`000d6c40 : 00000000`000017ac fffff880`0bfe6a00 fffff900`c2560ce0 fffff880`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`0bfe6740 fffff960`000d637f : 00000000`00000000 fffff880`0bfe6ae0 fffffa80`134e3060 00000000`00000000 : win32k!GdiProcessCallout+0x200
fffff880`0bfe67c0 fffff800`03157fc1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`134e3000 : win32k!W32pProcessCallout+0x6b
fffff880`0bfe67f0 fffff800`0313cb7d : 00000000`c0000005 00000000`c0000001 fffffa80`78457300 fffffa80`19755b50 : nt!PspExitThread+0x4d1
fffff880`0bfe68f0 fffff800`02e756fa : 00000000`00000100 fffffa80`134e3120 00000000`00000001 fffff800`02e787fd : nt!PsExitSpecialApc+0x1d
fffff880`0bfe6920 fffff800`02e75a40 : 00000000`00000246 fffff880`0bfe69a0 fffff800`0313caf0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0bfe69a0 fffff800`02e81ef7 : fffffa80`134e3060 00000000`00000264 00000000`00000000 fffffa80`13d1aa60 : nt!KiInitiateUserApc+0x70
fffff880`0bfe6ae0 00000000`75092e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0314ed48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75092e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3a2
fffff960`000d73de e9d6010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000d75b9)

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3a2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  52f4357b

IMAGE_VERSION:  6.1.7601.18388

FAILURE_BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3a2

BUCKET_ID:  X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3a2

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x1a_41790_win32k!surface::bdeletesurface+3a2

FAILURE_ID_HASH:  {ea9c0e2b-5706-e8a0-1810-55febb26c328}

Followup: MachineOwner
---------

 

[PuterUser]

Thanks Arc, especially for your quick reply. Will be back with the results soon.

 

[PuterUser]

Hi Arc,

I ran Memtest for 7 passes over 17 hours, no errors reported.

I have been trying to run the Driver Verifier with no success. Am able to input all the settings according to the instructions, but when I restart the PC it fails to open Windows 7 and goes into BSOD (Error message mentions Memory failure, code ...01c). I have tried twice with same result. Each time I had to reboot into Safemode then disable DV and reboot to get Windows to open normally.

Just wondering if there is some other way to get DV to work or should I try NOT selecting some of the non-Microsoft drivers and see how that goes?

I have noticed that sometimes the BSOD occurs when I am accessing internet through a wireless onboard modem (TP Link 450MBPS Wireless N adaptor which has two drivers (Microsoft and Atheros). Could this be the source of the dramas?

Cheers PuterUser

 

[PuterUser]

Have tried selecting non of the driver with DV and it still crashes W7, even with standard settings only.

Went to TP link site and downloaded latest driver, Justin Case...

Have not had BSOD since but usually it occurred about once a week.

Any other suggestions to stress the drivers currently installed or get DV working, without crashing on startup?

 

[Arc]

Disable Driver verifier in safemode.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Now enable driver verifier again. Does it work this time?

 

[PuterUser]

Thank you, yep, worked. Ok so I just use the PC as normal and hopefully it will wig out somewhere or after 24hours of continuous running then I generate the zipped crash report file and post again?

 

[Arc]

Post again whenever it crash, if it is within this 24 hours.

 

[PuterUser]

Hi Arc,

Just had another BSOD. Seems it is driver related, something to do with a Win7 driver fault (isctd64.sys).

Cheers PuterUser

 

[Arc]

Disable Driver verifier now. And then disable Intel Smart Connect.

BugCheck C9, {6, 103, fffff9807ec9adc0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\ISCTD64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ISCTD64.sys
*** ERROR: Module load completed but symbols could not be loaded for ISCTD64.sys
Probably caused by : ntkrnlmp.exe ( nt!IovCompleteRequest+c2 )

Followup: MachineOwner
---------

 

[PuterUser]

Thank you Arc. I have disabled Driver Verifier. I cannot find Intel Smart Connect program but I do have an Intel Smart Connect Device. Do you want me to uninstall this device? Is it ok to have power management selected on my mouse as I use it to wake up the PC from sleep mode?

 

[Arc]

Yes, better you uninstall the Intel Smart Connect Device.

And, other than the Smart Connect, apparently there is no more need to be worried about the power management policy ATM.

 

[PuterUser]

Thankyou Arc, will let you know if that fixes BSOD.

Cheers PU

 

[PuterUser]

Hi Arc,

I have uninstalled Intel Smart Connect device and associated driver. However this device has now been automatically reinstalled when I rebooted my PC.

I have a Sennheiser wireless headset that did not come with a driver disc and I cannot find on their website any driver downloads for the RS170 (HDR170). When this device is plugged into my PC (which it usually is) then it is showing up as missing a driver after I finished uninstalling Intel Smart Connect Device. I assume that what is happening is that the default driver for this device is found through an auto driver download on the net, and it happens to be installed through Intel Smart Connect. Could this be possible? Can you suggest a workaround for this problem please?

 

[Arc]

Hi mate. I have asked for some better guidance. Please be there, very soon someone will come with some better idea. I also will be there if any further BSODs are needed to read.

 

[PuterUser]

Thanks Arc - appreciate all your help.

Cheers PC

 

[PuterUser]

Hi Arc,

Had no problems until yesterday. Got the BSOD attached after putting my PC into sleep mode. When it was activated by mouse movement, it activated ok but a little while later (with no activity), it developed this BSOD.

Is this BSOD similiar to the others I was having?

 

[Arc]

Not the same bugcheck code.

BugCheck 24, {1904fb, fffff8800a37ea68, fffff8800a37e2c0, fffff8800170ca53}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )

Followup: MachineOwner
---------

But the probability of failing RAM still continues with this one, too; though apparently it may be a storage failure.

Make it sure that your SSD is running with the latest firmware.
How to Upgrade Samsung SSD Firmware | StorageReview.com - Storage Reviews

Also turn off windows search, as a test.
http://www.sevenforums.com/tutorials/25343-windows-search-turn-off.html

Let us know the result.

 

[PuterUser]

Hi Arc,

I have tested my PC with Windows Search off for the last two weeks. There has not been a BSOD event in that time. What does this suggest about the underlying cause of problems with my setup?

I have the latest Samsung SSD firmware installed and continually check it is up to date.

Is there a chance that the RAM is faulty?

Cheers PuterUser

 

[Arc]

Hi Arc,

I have tested my PC with Windows Search off for the last two weeks. There has not been a BSOD event in that time. What does this suggest about the underlying cause of problems with my setup?

The search mechanism causes stop 0x24 BSODs, as I have seen earlier too. That is why I suggested you to disable it. May be it somehow does not match with teh file system structure, I am not very sure. But disabling search works.

Is there a chance that the RAM is faulty?

With a faulty RAM, you would have got some good lot of BSODs within last two weeks. Still, I think you should test the RAM modules with memtest86+, in order to be sure about it.