I have been getting random BSOD's

[Zoidbort]

So over the past 3 weeks I have been getting random BSOD's and at first my SABNDZB was having issues so I uninstalled it and all seemed stable but suddenly 3 days ago I started getting BSOD's again.
No issues for hours in Safe Mode (points to me that it is a driver more so than hardware but) but when in standard boot it seems to go to a BSOD at random times within 1-2 hours of boot up.
After enabling all the goodies and running verifier it posted, upon boot up, an error in the hidclass.sys file.
Now that seems generic after reading here so I have attached the zip for a peek.
Cheers in advance for the help!

 

[Zoidbort]

Sorry Mods for posting in a similar previous post.
Thanks for putting it into my own thread.

 

[Arc]

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Follow it manually in the default path: C:\Windows\Minidump or %SystemRoot%\Minidump.

We need to see the crahsdumps.

Anyway, hidclass is USB related.

For the port, first, uninstall and reinstall the USB ports drivers.

1. Right click on Computer icon > manage. It will open the computer management window.
2. Click on "Device Manager" in the left pane, it will list all installed devices up.
3. Expand "USB Serial Bus Controllers" by clicking on the triangle in front of it.
4. Click on one item to select, then right click and uninstall.
5. Do the same for all.
6. Restart the computer.
7. At restart, windows will auto configure the appropriate drivers.

And, Disable USB Selective Suspense too.
USB Selective Suspend - Turn On or Off


For the devices, first, detach all the USB devices other than the keyboard and mouse.
Then, Update the drivers for them all, including the keyboard and mouse, if any third party drivers are installed for them.

 

[Zoidbort]

Woke up this morn and did the USB removal...no BSOD all day while I was at work.
I had my CCleaner clean out dump files so I haven't any to upload but I will as soon as a new BSOD appears.
Cheers for the reply and help mate!

 

[Zoidbort]

Well that was a nice 20 hours of peace but it came back overnight.
This time a new error...boot.ini issue from a little reading I did.
Will run a chkdsk /r now.
Dump included.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\Windows\Minidump\112212-13837-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0364a000 PsLoadedModuleList = 0xfffff800`0388e670
Debug session time: Thu Nov 22 05:02:33.559 2012 (UTC - 8:00)
System Uptime: 0 days 22:26:24.026
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa00036cbe7a, 2, 8, fffffa00036cbe7a}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+7efc0 )

Followup: MachineOwner
---------

 

[Arc]

I have to analyze the dump myself, in my own way ..... to suggest anything.

 

[Zoidbort]

Cool, thanks very much for the help.
Check Disk was running when I left for work.

 

[Zoidbort]

Got another one...all was well for the past 35 hours or so...PC was asleep.
Memory Management

Loading Dump File [H:\Windows\Minidump\112412-18142-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0xfffff800`0360b000 PsLoadedModuleList = 0xfffff800`0384f670
Debug session time: Fri Nov 23 23:00:30.784 2012 (UTC - 8:00)
System Uptime: 1 days 16:06:03.877
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8008dfbe80, ffff, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff8000360b000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800036f5b50 to fffff80003689fc0

STACK_TEXT:  
fffff880`0bd658d8 fffff800`036f5b50 : 00000000`0000001a 00000000`00041790 fffffa80`08dfbe80 00000000`0000ffff : nt+0x7efc0
fffff880`0bd658e0 00000000`0000001a : 00000000`00041790 fffffa80`08dfbe80 00000000`0000ffff 00000000`00000000 : nt+0xeab50
fffff880`0bd658e8 00000000`00041790 : fffffa80`08dfbe80 00000000`0000ffff 00000000`00000000 fffff800`037882c1 : 0x1a
fffff880`0bd658f0 fffffa80`08dfbe80 : 00000000`0000ffff 00000000`00000000 fffff800`037882c1 fffffa80`14aec2b0 : 0x41790
fffff880`0bd658f8 00000000`0000ffff : 00000000`00000000 fffff800`037882c1 fffffa80`14aec2b0 00000000`00000000 : 0xfffffa80`08dfbe80
fffff880`0bd65900 00000000`00000000 : fffff800`037882c1 fffffa80`14aec2b0 00000000`00000000 fffff680`003ffef8 : 0xffff


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+7efc0
fffff800`03689fc0 48894c2408      mov     qword ptr [rsp+8],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+7efc0

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner

 

[Arc]

If you dont supply the dump, how can I see it? I told you that I want to analyze it at my own to infer anything.

:ar: Blue Screen of Death (BSOD) Posting Instructions

 

[Zoidbort]

Ah sorry, dmp file zipped and added.

 

[Arc]

:ar: Blue Screen of Death (BSOD) Posting Instructions generates more files than a dump.

STOP 0x0000001A: MEMORY_MANAGEMENT
Usual causes: Device driver, memory, kernel (source: Carrona.org)

Your crash dumps are not showing any finite probable cause. In such a situation, it is better to enable Driver Verifier to monitor the drivers.

Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

Test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight, per RAM module per slot.

Let us know the results, with the subsequent crash dumps, if any.

 

[Zoidbort]

Verifier enabled again...reboot, BSOD hidsys again

Attached...will run memtest all day as I have to head to Vancouver for the day.

 

[Arc]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23b, fffff88006fb1710, fffff9801a172cf0, 0}

Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpMajorHandler+0 )

Followup: MachineOwner
---------

Check your USB ports as directed.
For the port, first, uninstall and reinstall the USB ports drivers.

1. Right click on Computer icon > manage. It will open the computer management window.
2. Click on "Device Manager" in the left pane, it will list all installed devices up.
3. Expand "USB Serial Bus Controllers" by clicking on the triangle in front of it.
4. Click on one item to select, then right click and uninstall.
5. Do the same for all.
6. Restart the computer.
7. At restart, windows will auto configure the appropriate drivers.

And, Disable USB Selective Suspense too.
USB Selective Suspend - Turn On or Off

For the devices, first, detach all the USB devices other than the keyboard and mouse.
Then, Update the drivers for them all, including the keyboard and mouse, if any third party drivers are installed for them.

 

[Zoidbort]

Cheers mate but did that already as you previously stated above....happened again so unless the new drivers are the issue I am not so sure that is the root if the problem?
Unless it is a peripheral that I have plugged in?
What do you think?

 

[Arc]

I think it is any USB device that is causing the problem.

upload your MSINFO32.nfo file.

1. Click on the start button
2. Type "msinfo32" (without quotes) in the search bar of the start menu, click the resulting link. It will open the System Information window.
3. File>Save. In the "File Name" filed, put "MSINFO32" (without Quote), give the save location to desktop, and click the "save" button.
4. Give the time for processing, it will save a .nfo file on your desktop.
5. Zip it, and upload it following the instruction.

 

[Zoidbort]

Ran Memtest for 17 hours yesterday, no errors.

NFO attached.

 

[Arc]

You have a lot of USB devices ... LAN card, KeyBoard, Mouse, Hard Disc, LifeCam Cinema ....

Too hard to determine which of them is causing the issue.

Anyway, update the LAN card driver, from Ralink-A MEDIATEK COMPANY. See what is the situation then?

 

[Zoidbort]

Don't think I have anything Ralink made on my PC.
LAN is Realtek Gigabit but I am updating it now.

 

[Arc]

OK, I cannot verify it physically, just said it based on the msinfo data, compared with driver referrence table, carrona.org. If it differs from the physical verification, you know your hardware, adjust instructions accordingly.