Daily Blue Screens

[MustangCSA]

I recently installed Windows 7 Ultimate x64 on my computer. It was a fresh retail install. I was getting a lot of BSOD the first day I installed it, and after searching around the web and these forums I figured I just needed to update as many drivers as I could. So I installed all the drivers from the ASUS website, Logitech, HP and anything else I could think of that was connected to my PC. And everything seemed great after that. Win7 ran for like 3 days without a single hiccup, then today it started again. So if anyone is kind enough to look through the info I attached to see if they can find anything I would really appreciate it. I think I included all the information I needed to, let me know if you need something else. Thanks.

 

[zigzag3143]

I recently installed Windows 7 Ultimate x64 on my computer. It was a fresh retail install. I was getting a lot of BSOD the first day I installed it, and after searching around the web and these forums I figured I just needed to update as many drivers as I could. So I installed all the drivers from the ASUS website, Logitech, HP and anything else I could think of that was connected to my PC. And everything seemed great after that. Win7 ran for like 3 days without a single hiccup, then today it started again. So if anyone is kind enough to look through the info I attached to see if they can find anything I would really appreciate it. I think I included all the information I needed to, let me know if you need something else. Thanks.

These are all caused by memory corruption. This may be being casued by a browser helper object (CI.DLL)

What browser are you using, and what addons? does this happen mostly when you are surfing?

You should test your memory

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Let us know the answer and results


Ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082810-26925-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a0e000 PsLoadedModuleList = 0xfffff800`02c4be50
Debug session time: Sat Aug 28 20:22:38.850 2010 (GMT-4)
System Uptime: 0 days 0:05:29.489
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88000d5d66f, fffff8800393dc50, 0}

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for win32k.sys - 
Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88000d5d66f, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800393dc50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
CI!MFKeyIsTrustedRootKey+70b3
fffff880`00d5d66f 8b1488          mov     edx,dword ptr [rax+rcx*4]

CONTEXT:  fffff8800393dc50 -- (.cxr 0xfffff8800393dc50)
rax=000000005c790166 rbx=000000004f8a0f19 rcx=000000000000060f
rdx=24884ddc78288c6a rsi=00000000024884dd rdi=000000005ca0c1b6
rip=fffff88000d5d66f rsp=fffff8800393e628 rbp=000000008288c6a0
 r8=000000001f8d699f  r9=000000005ca0c1b6 r10=fffff88000d9c0d0
r11=fffff8800393e7a0 r12=0000000000000002 r13=fffff8a00000a3d0
r14=0000000000000160 r15=0ffffffffffffff0
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
CI!MFKeyIsTrustedRootKey+0x70b3:
fffff880`00d5d66f 8b1488          mov     edx,dword ptr [rax+rcx*4] ds:002b:00000000`5c7919a2=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88000d5d66f

STACK_TEXT:  
fffff880`0393e628 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!MFKeyIsTrustedRootKey+0x70b3


CHKIMG_EXTENSION: !chkimg -lo 50 -d !CI
    fffff88000d5d662 - CI!MFKeyIsTrustedRootKey+70a6
    [ 44:40 ]
1 error : !CI (fffff88000d5d662)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffff8800393dc50 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

 

[MustangCSA]

Hi thanks for the quick reply. I'm using Firefox 3.6.8 as my browser, and the only add-ons i have installed are Adblock Plus, Gmail Watcher, Hp Smart Web Printing (It came with the driver download) and then there are two Java Console (6.0.21 and 6.0.20) in the Add-ons window. I seems to happen whether or not I'm using the browser, like it will happen after a reboot or just with the comp sitting there. I'm pretty sure its not the RAM, I went a couple months with G.Skill going back and forth because of a few bad sticks I got from them. The ram currently in there has all been tested individually. Each stick has gone over 12 hours of memtest without any errors, and then all four sticks together have gone 24 hours without any errors. They are running at their stock speeds (800) with a 2N command rate.

 

[cluberti]

If you're sure the RAM is OK, then it's time to enable driver verifier and get another dump.

 

[zigzag3143]

Hi thanks for the quick reply. I'm using Firefox 3.6.8 as my browser, and the only add-ons i have installed are Adblock Plus, Gmail Watcher, Hp Smart Web Printing (It came with the driver download) and then there are two Java Console (6.0.21 and 6.0.20) in the Add-ons window. I seems to happen whether or not I'm using the browser, like it will happen after a reboot or just with the comp sitting there. I'm pretty sure its not the RAM, I went a couple months with G.Skill going back and forth because of a few bad sticks I got from them. The ram currently in there has all been tested individually. Each stick has gone over 12 hours of memtest without any errors, and then all four sticks together have gone 24 hours without any errors. They are running at their stock speeds (800) with a 2N command rate.

Cluberti is correct that Driver Verifier is the next step, but just before that you can try booting FF in safe mode (just to test) to see in the BHO (java, or addon) is the cause.

Good luck


Ken

 

[MustangCSA]

It just happened again twice. First time I was looking at a web page in firefox and went to open up the device manager and then it crashed. Then again less than 10 minutes later it bsod in the middle of me trying to post a reply here about the first time lol. I will try Driver Verify and let you guy knows. Thanks.

 

[MustangCSA]

Ok so I attempted to go to the web page that cluberti linked to about Driver Verifier and it happened again. So after that I started firefox in safe mode and before I could get to that site it did it again. I managed to get there and enable driver verifier, but when I rebooted after follow the instructions on the site it bsod before it booted all the way. Then it boot into some startup repair utility and restored from an earlier point. Any ideas? Which dump files should I attach here for you guys to see?

UPDATE: It happened again seconds after I posted this reply.

 

[MustangCSA]

Here is the last four .dmp files from the Minidump folder that were produced since the last time I posted. Let me know what you guys think I'm going to take a break from this stressful thing for a couple hours. Thanks again for the help.

 

[cluberti]

The dumps all point to potential memory corruption - 3 of the 4 point to corruption of the code integrity module, and one points to an obsolete logmein driver that predates Win7:

3: kd> vertarget
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a06000 PsLoadedModuleList = 0xfffff800`02c43e50
Debug session time: Sat Aug 28 22:28:45.995 2010 (GMT-4)
System Uptime: 0 days 0:00:24.024
 
0: kd> !chkimg -lo 50 -db !CI
2 errors : !CI (fffff88000eff44a-fffff88000eff662)
fffff88000eff440  00  48  8b  6c  24  10  c3  cc  cc  cc *c8  cc  cc  cc  cc  cc .H.l$...........
...
fffff88000eff660  43  18 *40  33  c7  81  f1  2b  a5  00  00  41  03  4b  68  8b C.@3...+...A.Kh.
 
0: kd> lmvm CI
start             end                 module name
fffff880`00ee0000 fffff880`00fa0000   CI         (pdb symbols)          d:\symbols\ci.pdb\5F1BDC2205AC402CB0F09FC7CF17A3701\ci.pdb
    Loaded symbol image file: CI.dll
    Mapped memory image file: D:\Symbols\CI.dll\4A5BE01Dc0000\CI.dll
    Image path: \SystemRoot\system32\CI.dll
    Image name: CI.dll
    Timestamp:        Mon Jul 13 21:32:13 2009 (4A5BE01D)
    CheckSum:         000C6E0E
    ImageSize:        000C0000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ci.dll
    OriginalFilename: ci.dll
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  Code Integrity Module
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
 
3: kd> lmvm lv302a64
start             end                 module name
fffff880`07520000 fffff880`07522380   lv302a64 T (no symbols)           
    Loaded symbol image file: lv302a64.sys
    Image path: \SystemRoot\system32\DRIVERS\lv302a64.sys
    Image name: lv302a64.sys
    Timestamp:        Sat Jul 26 11:06:31 2008 (488B3D77)
    CheckSum:         0000B638
    ImageSize:        00002380
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[MustangCSA]

OK first off thanks for all the help so far. I'm pretty sure the driver you where talking about in the last post was for my webcam. I updated the driver for that but continued getting BSOD. I decided to reinstall the whole thing and hope it helped. So I reinstalled Windows 7 and then installed all the drivers for my motherboard from the ASUS website and every other piece of hardware connected to the computer. Everything went good for about a day and then in the last few hours I've gotten about 3 more Blue Screens. I wanted to point out that in the "Resource and Performance Monitor" it has an error about a device not working properly. It says that a standard PS/2 keyboard is reporting an error and won't be available. I am using a usb Logitech Classic Keyboard 200 and a Logitech wireless mouse that came in a keyboard/mouse combo (MX3200), but I don't have the keyboard anymore. I installed driver for the keyboard/mouse combo. I'm not sure if that could be causing the problem or not, but I did notice that. I've attached the dump, let me know if you guys have any other suggestions.

 

[MustangCSA]

OK so I decided I should follow post 4 again and enable driver verifier. I follow the instructions on the website then reboot. It would BSOD immediately after the windows boot splash. I let it do this twice then I booted into safe mode and did verifier /reset. Here is the dump after doing that. Anyway of testing if maybe my motherboard or video card could be dieing? A couple of the times I rebooted the comp wouldn't POST. It would either just keep acting like it was checking the DVD drive with no beeps or one time I got 1 long beep and 3 short beeps which is apparently a GPU error. It also doesn't detect one of my SATA drives anymore, although I have not opened the case yet to check the cable on that one. Any ideas?

 

[cluberti]

According to your data, driver verifier is pointing to the Logitech camera driver as the culprit, specifically passing an invalid IRP status during an I/O operation:

2: kd> lmvm lv302a64
start             end                 module name
fffff880`02b3d000 fffff880`02b3f400   lv302a64 T (no symbols)           
    Loaded symbol image file: lv302a64.sys
    Image path: \SystemRoot\system32\DRIVERS\lv302a64.sys
    Image name: lv302a64.sys
    Timestamp:        Thu Apr 30 18:41:07 2009 (49FA2903)
    CheckSum:         0000515F
    ImageSize:        00002400
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

That driver predates Win7, so I'd suggest updating it (or better, uninstalling the Logitech software and running for a bit to see if anything changes).

 

[MustangCSA]

OK so far so good. I uninstalled the Logitech webcam driver and software, and it made it all night without a BSOD. I hope this did it, now I just need to figure out the hard drive issue. Thanks for all the help and I'll post back again if anything changes for the worst.

 

[MustangCSA]

Worked great all day then like ten minutes ago it crashed again. I installed a couple games and a few programs then went into the kitchen and came back it had rebooted. Attached is the dump.

 

[cluberti]

This one is actually more forceful in trying to hint at a hardware problem, unlike most other bugcheck codes (STOP 0x50, 0x3B, etc) which only infer it very indirectly:

// CRITICAL_STRUCTURE_CORRUPTION (109) - only param 4 matters:
0: kd> .bugcheck
Bugcheck code 00000109
Arguments a3a039d8`98d11785 b3b7465e`eb4f2997 fffff880`00d3f600 00000000`00000001

Parameter 4 is 0x00000001, which means a *kernel* function in memory has been modified, causing the bugcheck. Since this is an x64 Win7 system with kernel protection, you aren't going to have the ability to hotpatch the Windows kernel (which is showing as the corrupted module holding the changed function as per the dump), so either this is a virus (not likely), or the function was corrupted because the memory holding it was corrupt. For what it's worth, the module that appears patched is win32k.sys, so you might want to consider it could be VirtualBox (I can't see any other driver on the system that would have any particular interest in win32k.sys, but VBox might).

This bugcheck will actually have Win7's problem troubleshooter point you to this URL:
Microsoft Windows Error Reporting

 

[MustangCSA]

OK so I went to the website that you linked and downloaded the Windows Memory Diagnostic tool. I let it run for one pass with no errors, but I will let it go overnight tonight and see what happens then. It says it can't map over 4g of memory, I have 6g in here, so I'm assuming it would be best to remove 2g and then test? I haven't run WMD before, how much do the tests differ from memtest? Any other tests I should run, cpu stress test, motherboard diagnostic or something of that nature? Any other suggestions? Thanks again for all the help so far.

 

[cluberti]

Memtest would be a better test - I was just pointing out that Windows thinks your RAM might be to blame. I'd follow the memtest guide here.

 

[MustangCSA]

OK I started running memtest I'll let it go all night and post back when it's done. I'm hopeing for no errors seeing as I ran memtest for 24 hours right before I installed Windows 7. If it passes without any errors what else can I try?

 

[MustangCSA]

OK so I ran memtest for a full 24 hours without any errors. What's next?

 

[cluberti]

If the hardware's ok, next is on to scanning the OS for any vulnerabilities - preferably offline. If that scan comes up clean, at that point it's down to drivers.