Multiple BSOD issues

[einhager]

I was hoping someone could help me figure this out. I started experiencing BSODs a few weeks ago, from IRQL_NOT_LESS_OR_EQUAL, PFN_LIST_CORRUPT to MEMORY_MANAGEMENT. Often times lately my computer would just freeze and I have to manually restart my computer but mostly its been BSODs.

I've ran tests using MemTest86+ & Windows Memory Diagnostics with the same result after multiple passes with all sticks in and single sticks, All my RAM are coming up as okay.

Any help would be very much appreciated. I've provided a zip containing required files from the BSOD posting instructions & system health report. You can view my computer specs to the side under "My System Spec".

Thanks.

 

[zigzag3143]

I was hoping someone could help me figure this out. I started experiencing BSODs a few weeks ago, from IRQL_NOT_LESS_OR_EQUAL, PFN_LIST_CORRUPT to MEMORY_MANAGEMENT. Often times lately my computer would just freeze and I have to manually restart my computer but mostly its been BSODs.

I've ran tests using MemTest86+ & Windows Memory Diagnostics with the same result after multiple passes with all sticks in and single sticks, All my RAM are coming up as okay.

Any help would be very much appreciated. I've provided a zip containing required files from the BSOD posting instructions & system health report. You can view my computer specs to the side under "My System Spec".

Thanks.

Nice self help and systems specs thanks +1

Most of these are related to memory but are basically all over the map. Since you appear to have run memtest I would move on to driver verifier to find the offending software,

These crashes were caused by memory corruption/exception (probably a driver).


* If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

* If you have raid update its Driver.



Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

 

[einhager]

Hiya,

Computer crashed as soon I rebooted with Verifier on, HIDCLASS.SYS seems to be the issue. Can you confirm whether or not i need to replace it?

Provided the minidumps after attempting 3 times to load windows.

 

[einhager]

Updated drivers and HIDCLASS.SYS but still getting BSODs and computer freezes, but not in quick succession after reboots.

Here's another BSOD dump & system health report.

 

[einhager]

What's the diagnosis? Has anybody looked at the recent attachments to give me a better idea at what to look for and/or replace to fix my BSOD issues?

 

[writhziden]

[list=1]
[*]

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\BSODDmpFiles\einhager\Windows_NT6_BSOD_jcgriff2\021112-19999-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0340a000 PsLoadedModuleList = 0xfffff800`0364f670
Debug session time: Sat Feb 11 08:24:40.593 2012 (GMT-7)
System Uptime: 0 days 0:01:07.546
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff6800039f408, 6e500004ed549025, fffff6800019f408}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+330bc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff6800039f408
Arg3: 6e500004ed549025
Arg4: fffff6800019f408

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  Steam.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000342e3f6 to fffff80003486c40

STACK_TEXT:  
fffff880`0a781678 fffff800`0342e3f6 : 00000000`0000001a 00000000`00000403 fffff680`0039f408 6e500004`ed549025 : nt!KeBugCheckEx
fffff880`0a781680 fffff800`034b8bb7 : 00000000`00000000 fffff680`0039f8e0 fffffa80`16026b30 00000980`00000001 : nt! ?? ::FNODOBFM::`string'+0x330bc
fffff880`0a781830 fffff800`034ba569 : 00000000`00000000 00000000`74042fff fffffa80`00000000 00000000`000000c0 : nt!MiDeleteVirtualAddresses+0x41f
fffff880`0a7819f0 fffff800`0379e221 : fffffa80`1670fc00 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0a781b10 fffff800`0379e623 : 00000000`00000000 00000000`73e80000 fffffa80`00000001 fffffa80`16116660 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0a781bd0 fffff800`03485ed3 : fffffa80`16020060 fffff880`0a781ca0 fffffa80`16026b30 00000000`00008000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0a781c20 00000000`774215ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774215ba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+330bc
fffff800`0342e3f6 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+330bc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_403_VRF_nt!_??_::FNODOBFM::_string_+330bc

BUCKET_ID:  X64_0x1a_403_VRF_nt!_??_::FNODOBFM::_string_+330bc

Followup: MachineOwner
---------
[*]
Loading Dump File [F:\BSODDmpFiles\einhager\Windows_NT6_BSOD_jcgriff2\021112-22401-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0345d000 PsLoadedModuleList = 0xfffff800`036a2670
Debug session time: Sat Feb 11 08:19:01.830 2012 (GMT-7)
System Uptime: 0 days 0:23:49.782
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {9, 2, 1, fffff80003608617}

Probably caused by : NETIO.SYS ( NETIO!WfpPoolAllocNonPaged+17 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff80003608617, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR:  0xC5_2

CURRENT_IRQL:  2

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03608617 48895808        mov     qword ptr [rax+8],rbx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800b3725a0 -- (.trap 0xfffff8800b3725a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8018231af0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003608617 rsp=fffff8800b372730 rbp=0000000000001000
 r8=0000000000000000  r9=fffff800036644b0 r10=fffff80003664348
r11=0000000000000010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`03608617 48895808        mov     qword ptr [rax+8],rbx ds:00000000`00000009=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034d91e9 to fffff800034d9c40

STACK_TEXT:  
fffff880`0b372458 fffff800`034d91e9 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0b372460 fffff800`034d7e60 : fffff6fb`7dbf0000 fffff880`0b372670 22f00000`037ea860 fffff800`036644b0 : nt!KiBugCheckDispatch+0x69
fffff880`0b3725a0 fffff800`03608617 : 00000000`00000000 fffff800`03505830 fffffa80`19f3b060 fffff800`03970a01 : nt!KiPageFault+0x260
fffff880`0b372730 fffff880`017a2267 : 00000000`00000000 fffff880`0b372870 00000000`0000002e 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`0b372820 fffff880`017ac916 : fffffa80`1844a010 fffffa80`16b1cca0 00000000`0000002e 00000000`00010e5c : NETIO!WfpPoolAllocNonPaged+0x17
fffff880`0b372850 fffff880`017ac797 : fffffa80`12dac080 fffffa80`1a39b5f0 00000000`00000002 fffff880`0b370004 : NETIO!AddFilterToFilterHashtable+0x56
fffff880`0b3728a0 fffff880`017adedf : 00000000`00000038 00000000`000000a8 fffffa80`16b1cca0 fffffa80`170ce240 : NETIO!AddFilterToIndex+0xe7
fffff880`0b372910 fffff880`0187000c : fffffa80`1844a010 fffff980`223762a0 00000000`00000004 fffffa80`146ecab0 : NETIO!IoctlKfdBatchUpdate+0x19f
fffff880`0b372970 fffff800`0397fc16 : fffffa80`1844a010 00000000`00000002 fffffa80`146ecab0 fffffa80`12e82698 : tcpip!KfdDispatchDevCtl+0xac
fffff880`0b3729b0 fffff800`037f4a97 : fffffa80`14f793d0 fffff880`0b372ca0 fffffa80`14f793d0 fffffa80`1736d680 : nt!IovCallDriver+0x566
fffff880`0b372a10 fffff800`037f52f6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0b372b40 fffff800`034d8ed3 : 00000000`00000000 fffff800`037c2b5c 00000000`0b372ca0 fffffa80`14fb71f0 : nt!NtDeviceIoControlFile+0x56
fffff880`0b372bb0 00000000`76da138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0237e518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76da138a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!WfpPoolAllocNonPaged+17
fffff880`017a2267 488903          mov     qword ptr [rbx],rax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  NETIO!WfpPoolAllocNonPaged+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381

FAILURE_BUCKET_ID:  X64_0xC5_2_VRF_NETIO!WfpPoolAllocNonPaged+17

BUCKET_ID:  X64_0xC5_2_VRF_NETIO!WfpPoolAllocNonPaged+17

Followup: MachineOwner
---------


[/list]

1. Possible causes are Memory problems... Drivers...
2. Possible causes are Drivers... and most likely your network drivers.

Even though you have already done so, test the memory again. Sometimes memory errors will not show up on the first run or even the first few runs. If the memory is gradually failing or there is just a voltage problem, it may take a few tests to determine there are errors.

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).



Update your network adapter drivers using the Intel® Driver Update Utility.



Disable Verifier if you have not already done so and see if the system is more stable.