It bsod'ed again after serveral weeks of woring fine

[san]

Hello,

After serveral weeks of working fine my computer BSOD'ed again.

See this thread for the history of this problem

http://www.sevenforums.com/crashes-debugging/115060-bsod-happening-once-twice-every-week.html

I didnt change anything. That is I am not running NOD32 but Microsoft security essentials.

No new hardware was installed

Please help me. Thanks in advance

 

[san]

If anyone wants to take a look, much appreciated.

Thanks in advance

 

[CarlTR6]

Hi, san; sorry you are having trouble again. I will take a look.

Error code 1E, KMODE_EXCEPTION_NOT_HANDLED. Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS.

Kernel base = 0xfffff800`02c0f000 PsLoadedModuleList = 0xfffff800`02e43eb0
Debug session time: Sat Oct 16 06:27:14.371 2010 (GMT-4)
System Uptime: 0 days 0:25:20.526
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002f22229, 0, a0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002f22229, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 00000000000000a0, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!CmpFindSubKeyByNumber+95
fffff800`02f22229 418b8c24a0000000 mov     ecx,dword ptr [r12+0A0h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000000000a0

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eae0e0
 00000000000000a0 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88006971248 -- (.exr 0xfffff88006971248)
ExceptionAddress: fffff80002f22229 (nt!CmpFindSubKeyByNumber+0x0000000000000095)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000000000a0
Attempt to read from address 00000000000000a0

TRAP_FRAME:  fffff880069712f0 -- (.trap 0xfffff880069712f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8a000023010
rdx=fffff8a004e3a64c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f22229 rsp=fffff88006971480 rbp=fffff88006971630
 r8=0000000000000000  r9=fffff88006971630 r10=0000000000000005
r11=0000000000000011 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!CmpFindSubKeyByNumber+0x95:
fffff800`02f22229 418b8c24a0000000 mov     ecx,dword ptr [r12+0A0h] ds:1680:00000000`000000a0=????????
Resetting default scope

LOCK_ADDRESS:  fffff80002e7a460 -- (!locks fffff80002e7a460)

Resource @ nt!PiEngineLock (0xfffff80002e7a460)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
    Lock address  : 0xfffff80002e7a460
    Thread Count  : 0
    Thread address: 0x0000000000000000
    Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff80002cb6789 to fffff80002c75580

STACK_TEXT:  
fffff880`06970a78 fffff800`02cb6789 : 00000000`0000001e ffffffff`c0000005 fffff800`02f22229 00000000`00000000 : nt!KeBugCheckEx
fffff880`06970a80 fffff800`02c74bc2 : fffff880`06971248 00000000`00000000 fffff880`069712f0 fffff8a0`04ef4b4c : nt!KiDispatchException+0x1b9
fffff880`06971110 fffff800`02c7373a : 00000000`00000000 00000000`000000a0 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`069712f0 fffff800`02f22229 : 00000000`00000000 fffff880`06971630 fffff8a0`04ef4b4c fffff8a0`00023010 : nt!KiPageFault+0x23a
fffff880`06971480 fffff800`02f227b3 : 00000000`00000000 fffff880`06971860 fffff8a0`010d3258 00000000`00000000 : nt!CmpFindSubKeyByNumber+0x95
fffff880`06971500 fffff800`02f2251d : fffff8a0`00380298 fffff880`069716b0 fffffa80`05525501 fffff8a0`00000000 : nt!CmEnumerateKey+0x173
fffff880`06971630 fffff800`02c747d3 : fffffa80`054ed040 00000000`00000000 fffffa80`00000000 fffff8a0`0c1b4680 : nt!NtEnumerateKey+0x25b
fffff880`06971770 fffff800`02c70d70 : fffff800`02ee2a79 00000000`00000000 fffff880`06971b20 fffff8a0`01149c00 : nt!KiSystemServiceCopyEnd+0x13
fffff880`06971978 fffff800`02ee2a79 : 00000000`00000000 fffff880`06971b20 fffff8a0`01149c00 00000000`00000000 : nt!KiServiceLinkage
fffff880`06971980 fffff800`02ee3c8d : 00000000`00000002 00000000`00000000 fffff880`00000000 00000000`00000001 : nt!IopGetDeviceInterfaces+0x225
fffff880`06971af0 fffff800`02ee1aed : 00000000`00000002 00000000`00000000 00000000`00000000 fffff8a0`01149c00 : nt!PiGetInterfaceDeviceList+0x41
fffff880`06971b50 fffff800`02f172f0 : fffff8a0`01149c00 fffff800`00008000 fffff880`06971c01 fffff800`03141da0 : nt!PiControlGetInterfaceDeviceList+0x111
fffff880`06971bd0 fffff800`02c747d3 : fffffa80`057fcb60 00000000`01c7ec00 fffff880`06971ca0 00000000`01c7ec88 : nt!NtPlugPlayControl+0x100
fffff880`06971c20 00000000`774c0daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01c7ebc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c0daa


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002f22229 - nt!CmpFindSubKeyByNumber+95
    [ 48:41 ]
1 error : !nt (fffff80002f22229)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BYTE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption
---------

The dump points out memory corruption. All of your drivers seem to be up to date. Let's test your RAM to make sure it is not the problem. Follow the instructions in this tutorial: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html. Errors, if any, will show in red on your screen. Post your results.

If you do not get any RAM errors, enable Driver Verifier following the instructions in this tutorial: Driver Verifier - Enable and Disable. Use your computer normally while Driver Veririfier is running. Upload any dumps triggered by Driver Verifier.

If you have any questions, please ask.

 

[san]

thx I did memtest for 7 passes 0 errors came up

I will take a look at verifier

 

[CarlTR6]

Very good. I think it it is conflict somewhere.

 

[san]

the BSOD happend again on start up.

This time I had verifier enabled.

Will you please take a look at the reports.

Also do I need to do anything other to show verifier reports?

Thanks in advance

 

[san]

Now my system is gotten very unstable just got another BSOD when computer was idle. Should I disable verifier?

 

[CarlTR6]

Upload the BSOD. Driver Verifier will create a BSOD every time it finds a faulty driver. That is what it is supposed to do. Unfortunately, the dump you uploaded does not point to a specific driver even though it is a Driver Verifier enabled dump.

Edited to add: Since this BSOD happened during startup, that tends to indicate a hardware problem. Do you have access to another power supply unit you can try? A failing PSU can cause problems at startup.

 

[san]

Dont have another psu

 

[CarlTR6]

Do you have a computer store where you can buy one and return it if it is not the power supply causing the problem?

 

[san]

hello,

Below you can find the report on my second BSOD last night, of which I spoke earlier.

This BSOD didn't happen on start up but when the computer was idling.
Verifier was enabled at the time.

Maybe it helps to diagnose the problem.
I m pretty sure its not the PSU giving me BSOD.

Thanks in advance

 

[CarlTR6]

You can turn off Driver Verifier. It is not pointing to drivers; but the two BSOD's it has generated are pointing to system drivers and hardware. We will see how your system does with Driver Verifier turned off. The latest dump is inconclusive.

Error code 109, CRITICAL_STRUCTURE_CORRUPTION. Usual causes: Device driver, Breakpoint set with no debugger attached, Hardware (Memory in particular)

There are generally three different causes for this bug check:

• A driver has inadvertently, or deliberately, modified critical kernel code or data. Microsoft Windows Server 2003 with Service Pack 1 (SP1) and later versions of Windows for x64-based computers do not allow the kernel to be patched except through authorized Microsoft-originated hot patches. For more information, see
  
  Patching Policy for x64-based Systems.
• A developer attempted to set a normal kernel breakpoint using a kernel debugger that was not attached when the system was started. Normal breakpoints (bp) can only be set if the debugger is attached at start time. Processor breakpoints (ba) can be set at any time.
• A hardware corruption occurred. For example, the kernel code or data could have been stored in memory that failed.

Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c0c000 PsLoadedModuleList = 0xfffff800`02e40eb0
Debug session time: Wed Oct 20 14:01:52.881 2010 (GMT-4)
System Uptime: 0 days 0:24:08.051
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d898b675c5, 0, 38df6ea820c39d95, 101}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See [URL="http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx"]Patching Policy for x64-Based Systems: Information for Driver Developers[/URL]
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d898b675c5, Reserved
Arg2: 0000000000000000, Reserved
Arg3: 38df6ea820c39d95, Failure type dependent information
Arg4: 0000000000000101, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002c72580

STACK_TEXT:  
fffff880`033625d8 00000000`00000000 : 00000000`00000109 a3a039d8`98b675c5 00000000`00000000 38df6ea8`20c39d95 : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  BAD_STACK

Followup: MachineOwner
---------

Obviously, the dump points to hardware. I suggest you test your CPU and RAM with Prime. Read and follow the instructions in this tutorial:

http://www.sevenforums.com/tutorials/100352-cpu-stress-test-prime95.html

Run 3 separate tests, one on each of the setting (Blend, Small FFTs, Large FFTs). Post back with the results.