Solved Erratic BSOD issue with new build

bigfatron · Jul 6, 2013

Recently upgraded most of my PC and put a fresh install of Windows 7 on. Since the rebuild i've had repeated problems with BSOD incidents. I've actually been able to use the machine for a few hours at a time with zero issues, then it'll die on me. No real pattern I can reproduce to get it to happen. Sometimes it dies in a game, sometimes just general stuff (copying stuff in Lightroom, web browsing etc). So basically the worst kind of glitch; an intermittent one! PAGE_FAULT_IN_NONPAGED_AREA seems the most common of the numerous BSODs i've had, with IRQL_NOT_LESS_OR_EQUAL as a second.

The motherboard, CPU, PSU and 1 hard drive (which isn't the one the OS is installed on) are new. The RAM, GPU, SSD and two hard drives are from my last build which was trouble free, which makes me think the issue is more likely hardware. Drivers I am using for everything are current. I have also been able to use alternative RAM (which is currently in the machine but I have had BSOD events with) and a different PSU in order to rule those out. I have raised a ticket with the motherboard manufacturer who've so far been less than useless. I was previously using Avast Free as my antivirus, which i've since swapped to AVG in order to try and remove that as a possible cause.

Anyone able to suggest anything I might be missing here?

koolkat77 · Jul 7, 2013

Security App

Code:

[FONT="Lucida Console"]avgidsdrivera.sys          Fri Mar 29 07:40:56 2013 (5154F128)
avgidsha.sys               Fri Feb  8 09:14:48 2013 (51146DA8)
avgldx64.sys               Fri Feb  8 09:14:24 2013 (51146D90)
avgloga.sys                Fri Feb  8 09:14:29 2013 (51146D95)
avgmfx64.sys               Fri Feb  8 09:14:48 2013 (51146DA8)
avgrkx64.sys               Fri Feb  8 09:14:05 2013 (51146D7D)
avgtdia.sys                Thu Mar 21 07:50:47 2013 (514A6777)[/FONT]

Crashes indicate AVG being a possible cause. Remove AVG and replace with Microsoft Security Essentials to see if it provides more stability. :info: Uninstallers (removal tools) for common antivirus software

Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.

Microsoft Security Essentials for Windows
MalwareBytes Free

Information

:warn: Do not start the free trial of MalwareBytes, unselect that option when prompted.
:tip: Update and make full scans with both separately.

Overclocking
If you are overclocking any hardware, STOP. Reset any changed values back to default.

Tip

If you have an SSD, make sure the following are up to date:

SSD firmware
BIOS Version
Chipset Drivers
Hard disk controller drivers/SATA drivers
If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Thanks to Writhziden for the steps above.

Disk Check
For errors on your Hard drive(s): Disk Check

Is the firmware for your SSD up-to-date?

Check for one and see if the stability returns.

Memtest86+
Run Memtest86+ for at least 8-10 passes. It may take up to 20 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.
:info: How to test and diagnose RAM issues with Memtest86+

Note

Pay close attention to part 3 of the tutorial in order to rule the faulty RAM stick out.

Tip

Do this test overnight.

BSOD BUGCHECK SUMMARY

Code:

[FONT="Lucida Console"]Debug session time: Sat Jul  6 22:19:32.479 2013 (UTC + 6:00)
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 0:39:24.666
Probably caused by : memory_corruption ( nt!MiPfnShareCountIsZero+77 )
BugCheck A, {2a80011fd97a, 2, 0, fffff8000349ad67}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000000A]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
Bugcheck code 0000000A
Arguments: 
Arg1: 00002a80011fd97a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8000349ad67, address which referenced memory
BUGCHECK_STR:  0xA
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  avgcsrva.exe
FAILURE_BUCKET_ID:  X64_0xA_nt!MiPfnShareCountIsZero+77
MaxSpeed:     3400
CurrentSpeed: 3400
BiosVersion = F4
BiosReleaseDate = 05/16/2013
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = Z87-D3HP
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Jul  6 21:08:41.613 2013 (UTC + 6:00)
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 2:01:01.800
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+425 )
BugCheck 50, {fffffa80c72d801b, 0, fffff800034687bf, 5}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000050]PAGE_FAULT_IN_NONPAGED_AREA (50)[/url]
Bugcheck code 00000050
Arguments: 
Arg1: fffffa80c72d801b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800034687bf, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)
BUGCHECK_STR:  0x50
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+425
MaxSpeed:     3400
CurrentSpeed: 3392
BiosVersion = F4
BiosReleaseDate = 05/16/2013
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = Z87-D3HP
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/FONT]

bigfatron · Jul 7, 2013

Thanks for the reply koolkat. I have removed AVG and replaced with MSE as requested. Is it that you think AVG is the cause or just to rule it out?

SSD firmware is verified as current, disks have been checked and i've already checked other drivers are as up to date as they can be. I will post back once i've had a chance to do the other tests.

koolkat77 · Jul 7, 2013

Let's keep AVG out of the PC for the time being. You can install it later if it wasn't the real cause of your problem., good luck.

bigfatron · Jul 7, 2013

Memtest x86 crashed after approx 3 hours of running. Had been checking in every half hour and no errors until I came back last and the timer had reset.

Two new BSOD events since trying to post that fact on here. Updated dumps attached.

koolkat77 · Jul 7, 2013

Last two dumps don't say much I believe its a hardware problem, before we start testing that, please run driver verifier.

Driver Verifier
Let's run driver verifier and see if it catches any misbehaving drivers: Driver Verifier - Enable & Disable

bigfatron · Jul 7, 2013

Done. Crashed a couple of times on startup. Booted to safe mode, deactivated verifier and successfully rebooted and the dumps are attached.

koolkat77 · Jul 7, 2013

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\USER\Downloads\bigfatron\SF_07-07-2013\070713-14586-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`0345d000 PsLoadedModuleList = 0xfffff800`036a0670
Debug session time: Sun Jul  7 19:56:51.318 2013 (UTC + 6:00)
System Uptime: 0 days 0:00:06.474
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
........................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23b, fffff88006b42710, fffff980045cccf0, 0}

Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpMajorHandler+0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 000000000000023b, The caller has changed the status field of an IRP it does not understand.
Arg2: fffff88006b42710, The address in the driver's code where the error was detected.
Arg3: fffff980045cccf0, IRP address.
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc9_23b

DRIVER_VERIFIER_IO_VIOLATION_TYPE:  23b

FAULTING_IP: 
HIDCLASS!HidpMajorHandler+0
fffff880`06b42710 48895c2410      mov     qword ptr [rsp+10h],rbx

FOLLOWUP_IP: 
HIDCLASS!HidpMajorHandler+0
fffff880`06b42710 48895c2410      mov     qword ptr [rsp+10h],rbx

IRP_ADDRESS:  fffff980045cccf0

DEVICE_OBJECT: fffffa800e4169a0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  2

LOCK_ADDRESS:  fffff800036d6b80 -- (!locks fffff800036d6b80)

Resource @ nt!PiEngineLock (0xfffff800036d6b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0xfffff800036d6b80
	Thread Count  : 0
	Thread address: 0x0000000000000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff800039604ec to fffff800034d2c00

STACK_TEXT:  
fffff880`0370efa8 fffff800`039604ec : 00000000`000000c9 00000000`0000023b fffff880`06b42710 fffff980`045cccf0 : nt!KeBugCheckEx
fffff880`0370efb0 fffff800`0396a58a : fffff800`0395eb00 fffff880`06b42710 fffff980`045cccf0 00000000`00000000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0370eff0 fffff800`0396b593 : 00000000`0000023b 00000000`c0000010 fffff980`045cccf0 00000000`ffffffff : nt!ViErrorFinishReport+0xda
fffff880`0370f040 fffff800`0396bc52 : fffff980`045ccf28 fffff880`06b42710 fffff880`00f46008 fffffa80`0cd96660 : nt!VfErrorReport1+0x63
fffff880`0370f0e0 fffff800`03960181 : fffffa80`10b1c330 00000000`00000001 00000000`00000000 fffff980`045ccf28 : nt!ViGenericVerifyIrpStackUpward+0x62
fffff880`0370f110 fffff800`0396cc3d : fffffa80`0dee2b90 fffffa80`10b1c010 fffff980`045cccf0 fffff980`045cccf0 : nt!VfMajorVerifyIrpStackUpward+0x91
fffff880`0370f150 fffff800`0397e61d : fffff980`045ccf28 fffff880`0370f340 00000000`c0000010 fffff980`045ccf28 : nt!IovpCompleteRequest2+0xad
fffff880`0370f1c0 fffff800`034d65c1 : fffff980`045ccf2b 00000000`00000000 00000000`000000ff fffff800`03961ffa : nt!IovpLocalCompletionRoutine+0x9d
fffff880`0370f220 fffff800`039762af : fffff980`045cccf0 fffff880`06b4c400 fffffa80`0e416a00 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`0370f310 fffff800`034b7b56 : fffff880`00000013 fffff880`0370f438 fffff980`045ccf28 fffffa80`0e416af0 : nt!IovCompleteRequest+0x19f
fffff880`0370f3e0 fffff880`06b42a0f : 00000000`00000000 fffffa80`0e416af0 00000000`00000001 00000000`00000017 : nt!IopInvalidDeviceRequest+0x16
fffff880`0370f410 fffff880`06b427fb : 00000000`00000000 fffffa80`0e416af0 fffff980`045cccf0 fffff880`0370f4c0 : HIDCLASS!HidpIrpMajorDefault+0x8b
fffff880`0370f450 fffff800`0397cd26 : fffff980`00000002 fffff980`045cccf0 00000000`00000002 fffff800`0397848e : HIDCLASS!HidpMajorHandler+0xeb
fffff880`0370f4c0 fffff800`0397bd52 : fffff980`045ccf70 00000000`00000002 fffffa80`0e6e1a80 fffffa80`10b16cf0 : nt!IovCallDriver+0x566
fffff880`0370f520 fffff800`0397cd26 : fffff980`045cccf0 00000000`00000002 fffffa80`0e6e1930 00000000`00000000 : nt!ViFilterDispatchGeneric+0x62
fffff880`0370f550 fffff800`0397be68 : fffff980`045cccf0 fffffa80`0e6e1930 00000000`00000000 fffffa80`10b20da0 : nt!IovCallDriver+0x566
fffff880`0370f5b0 fffff800`0397bf52 : fffffa80`0dedf360 fffffa80`0cdaeb80 fffffa80`0dedf360 00000000`00000017 : nt!VfIrpSendSynchronousIrp+0xe8
fffff880`0370f620 fffff800`039690bf : fffffa80`10b15d90 00000000`000007ff fffff800`036115b8 fffff800`0386bfa9 : nt!VfWmiTestStartedPdoStack+0x72
fffff880`0370f6c0 fffff800`03585692 : fffffa80`10b15d90 00000000`00000000 00000000`00000000 00000000`00000000 : nt!VfMajorTestStartedPdoStack+0x5f
fffff880`0370f6f0 fffff800`038c056c : fffffa80`10b15d90 fffffa80`0cdaeb80 00000000`00000001 00000000`00000000 : nt!PpvUtilTestStartedPdoStack+0x12
fffff880`0370f720 fffff800`038c2164 : fffffa80`10b15d90 fffffa80`10b15d90 fffffa80`0cdaeb80 00000000`00000001 : nt!PipProcessStartPhase3+0x55c
fffff880`0370f810 fffff800`038c264c : fffff800`036d4500 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PipProcessDevNodeTree+0x264
fffff880`0370fa80 fffff800`035d57f2 : 00000001`00000003 00000000`00000000 00000000`32706e50 00000000`00000084 : nt!PiProcessStartSystemDevices+0x7c
fffff880`0370fad0 fffff800`034dc251 : fffff800`035d54f0 fffff800`037cad01 fffffa80`0cd96600 fffffa80`0cd96660 : nt!PnpDeviceActionWorker+0x302
fffff880`0370fb70 fffff800`03770ede : 00000000`00000000 fffffa80`0cd96660 00000000`00000080 fffffa80`0cd6f840 : nt!ExpWorkerThread+0x111
fffff880`0370fc00 fffff800`034c3906 : fffff880`03365180 fffffa80`0cd96660 fffff880`0336ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0370fc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  .bugcheck ; kb

SYMBOL_NAME:  HIDCLASS!HidpMajorHandler+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: HIDCLASS

IMAGE_NAME:  HIDCLASS.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7a665

FAILURE_BUCKET_ID:  X64_0xc9_23b_VRF_HIDCLASS!HidpMajorHandler+0

BUCKET_ID:  X64_0xc9_23b_VRF_HIDCLASS!HidpMajorHandler+0

Followup: MachineOwner
---------

This one didn't help me much either.

Unplug and safely remove any USB device from your system.

This tutorial USB Selective Suspend - Turn On or Off may help:
To Disable Selective Suspend:
1. open the control panel
2. go to power options (you may have to set view to small icons)
3. click change plan settings
4. in the window that opens:
5. click change plan settings
6. click change advanced power settings, expand usb and ensure usb selective suspend is disabled.

Start up
Keep less stuff at the start-up. Only anti-virus, this helps avoid driver conflicts and improves time to log in to windows.

Performing a Clean Startup
Startup Programs - Change

After that please proceed with steps on replacing hardware one by one following the 124 thread.

You can read more on this error and what to try here... Stop 0x124 - what it means and what to try: Stop 124 - What it means and what to try.

bigfatron · Jul 7, 2013

Still cannot get it to boot successfully with verifier active.

Latest flurry of dumps attached, including ones where I had Windows running again without verifier and with nothing but a mouse and keyboard attached.

The USB suspend thing has always been disabled by the way.

Arc · Jul 7, 2013

Disable verifier. Enable it again. During enabling, make it sure that you are not selecting any driver provided by "microsoft" and "unknown".

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

Right click on "my computer" icon and click "manage" on the context menu.
It will open the "computer management" window.
Select "Device Manager" in the left pane, It will list all the existing devices up.
Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
Select one Intel device item under it, right click, uninstall.
Continue the process for all Intel items under "IDE ATA/ATAPI controllers"
Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Make it sure that the Samsung 830 SSD is running with the up-to-date firmware.

And, try to observe if it is BSODing when the LifeCam is unplugged too.

Let us know the results.

bigfatron · Jul 7, 2013

Arc said:
Disable verifier. Enable it again. During enabling, make it sure that you are not selecting any driver provided by "microsoft" and "unknown".

Get rid of intel rapid storage. First uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

Right click on "my computer" icon and click "manage" on the context menu.

It will open the "computer management" window.

Select "Device Manager" in the left pane, It will list all the existing devices up.

Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.

Select one Intel device item under it, right click, uninstall.

Continue the process for all Intel items under "IDE ATA/ATAPI controllers"

Now restart the computer. At restart, windows will auto configure the appropriate native system driver.

Make it sure that the Samsung 830 SSD is running with the up-to-date firmware.

And, try to observe if it is BSODing when the LifeCam is unplugged too.

Let us know the results.

LifeCam hasn't been plugged in since I installed it when I built the machine a couple of weeks ago.

Uninstalled the RST drivers as you said. It BSODed on one of the subsequent reboot cycles (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED in fltmgr.sys) but has come up again now.

SSD is current firmware and has been throughout this process.

Regarding verifier, when it was failing on boot I did follow the steps as suggested in the tutorial (no Microsoft or unknown drivers).

Arc · Jul 7, 2013

RST is removed? Reboot the computer again to see if it BSODs again or not? In not, post the SF Diag tool output again after one more BSOD.

bigfatron · Jul 7, 2013

Arc said:
RST is removed? Reboot the computer again to see if it BSODs again or not? In not, post the SF Diag tool output again after one more BSOD.

My error, I must've forgot to specify 'delete the driver' when I removed the device in Device Manager. It is gone now anyway and its using the MS AHCI driver. I'll report back as and when there are further errors.

And thanks a lot for both you guys helping me out on this, its highly appreciated.

bigfatron · Jul 7, 2013

Still crashing. Latest BSOD dumps attached. The most recent one will be the one I've had since totally getting shot of the Intel Rapid Storage driver.

EDIT: And it went pop again almost straight after I posted this. I can post that too if you want.

EDIT2: As a footnote its not been crash-free since ditching the Intel drivers for the Microsoft AHCI driver but its been alot better.

Driver Verifier still crashes on startup by the way. And I did notice in the driver list when trying that again that iastora.sys and iastorf.sys are still on the list. Should these still be there?

Arc · Jul 8, 2013

Scan the system for possible virus infection with the following programs.

bigfatron · Jul 8, 2013

All clear on the virus front. Ran both of those and nothing came up. I'd also done previous full scans in previous days with various AV packages anyway.

Arc · Jul 8, 2013

In that situation, you try to format the disc and go for a http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html.

If it is a driver related issue, a clean reinstall as per the said process is expected to overcome it.

bigfatron · Jul 8, 2013

Arc said:
In that situation, you try to format the disc and go for a http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html.

If it is a driver related issue, a clean reinstall as per the said process is expected to overcome it.

I was hoping you weren't going to say this! Only just spent days going through getting everything setup again as it is :cry:

By the way, would you suggest avoiding the Intel RST drivers and just going with the MS AHCI ones?

Arc · Jul 8, 2013

It is good to spend time on customizing an installation other than spending time on searching the reasons of a crash when we are not getting it. Isn't it?

msahci never fails and generates BSODs, so it is safer to use the generic storage controller over Intel RST IMO.

bigfatron · Jul 9, 2013

Arc said:
It is good to spend time on customizing an installation other than spending time on searching the reasons of a crash when we are not getting it. Isn't it?

msahci never fails and generates BSODs, so it is safer to use the generic storage controller over Intel RST IMO.

Ha ha, very true.

Managed to get the OS back on, patched and a couple of apps installed before having to call it a night. So far so good at least and the reinstall wasn't so bad as most of my data has been relocated off the system volume now anyway so didn't have too much to backup prior to wiping down.

The installation actually ended up with an Intel AHCI driver on it which I presume came from the chipset driver install. Its not caused a problem as yet though and i've not touched the full RST installer, so i'll see how that goes and switch to the Microsoft driver if required. I'll report back either if it goes bump again or if all is still well in a couple of days.

Thanks again.

Solved Erratic BSOD issue with new build

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

New member

My Computer

Similar threads