Solved Random BSOD

[fredbv]

Hi there... someone plaese help!

I'm getting random BSOD.

I've done memtest... 8 passes all OK.
I've run HD Pro... all OK.
I believe all drivers and firmware is up to date.

Just from what I can see it appears a service is unable to start... but I don't know which one or why.

I've attached a zip file wihich includes sys info, event info, dump file etc.

I'd really appreciate some assistance here!

Thanks

Fred

 

[mgorman87]

Please upload a jcgriff2 report
http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Your single crash doesn't tell me much.

Lets start off by enabling driver verifier

http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

Security Processor Loader Driver    ROOT\LEGACY_SPLDR\0000    This device is not present, is not working properly, or does not have all its drivers installed.

Please check under device manager for this and try to update it. You may have to show hidden devices. It's under non plug and play drivers

BSOD BUGCHECK SUMMARY

[FONT=lucida console]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  2 18:02:20.867 2012 (UTC - 5:00)
System Uptime: 0 days 1:12:14.383
Probably caused by : win32k.sys ( win32k!zzzLockDisplayAreaAndInvalidateDCCache+106 )
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR:  0x3B
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x3B_win32k!zzzLockDisplayAreaAndInvalidateDCCache+106
BiosReleaseDate = 02/15/2011
SystemManufacturer = ASUSTeK Computer Inc.
SystemProductName = G53SW
CPUID:        "Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: 1995
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/FONT]

 

[fredbv]

Thanks... but...

Many thanks for your prompt reply.

I checked Security Processor Loader Driver and it was not working... but on restart it now appears to work fine. When I right click on it and look at properties there is no option to update driver... seems there is only an uninstall option.

Could it be that a depenedent device/service is not working properly?

Also, I have run verifier before but I don't knwo how to access the data after a BSOD.

Thanks

Fred

 

[mgorman87]

When you run verifier it will BSOD if it finds a bad driver. Once it BSOD, you are to upload a new report here so I can take a look at it

 

[fredbv]

Which report?

Thanks... but which report/file would you like me to upload?

 

[mgorman87]

The jcgriff2 report

 

[fredbv]

Apologies for my ignorance... but where would this be located?

 

[mgorman87]

http://www.sevenforums.com/showthread.php?t=96879

 

[fredbv]

Thanks... here is the jcgriff2 report.

 

[mgorman87]

Are you running any system cleaners like CCleaner because I don't see any minidumps in your report? System cleaners will delete the important minidumps.

Looking through your event logs, you have lots of BSOD, but none of the minidumps are there.

Check in C:\windows\minidump for any files and upload them here.

I see the security loader is fixed, but now there is an error about your Bluetooth. Have you disabled or uninstalled it? Do you use it?

Event[363]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2012-02-03T10:47:08.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: VP2011
  Description: 
Fault bucket X64_0xDE_nt!MmPurgeSection+fffffffffffe8dcd, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\020312-5350-01.dmp
C:\Users\user\AppData\Local\Temp\WER-7737-0.sysdata.xml
C:\Users\user\AppData\Local\Temp\WER5FEA.tmp.WERInternalMetadata.xml

These files may be available here:
C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_05948a35

Analysis symbol: X64_0xDE_nt!MmPurgeSection+fffffffffffe8dcd
Rechecking for solution: 0
Report Id: 020312-5350-01
Report Status: 0

STOP 0x000000DE: POOL_CORRUPTION_IN_FILE_AREA

Usual causes: Device driver, ?Memory


If you haven't, please enable driver verifier following the instructions I posted earlier.

 

[fredbv]

Here is a zip file with dump files.

With the bluetooth, it has been like that since I purchased the notebook. I've tried everything to get it working.. unistall/reinstall, update drivers, stop/start... However, it never seemed to cause any issues... probably because I don't use any bluetooth devices. I've had online chat support from Asus with no luck. The only option is to take it in for a warranty repair... two weeks minimum without my computer!

I googled BSOD with Crucial M4 SSD and found advice to the effect of turning off Link State Power Management under advanced options power settings. I've done this, and to date no BSOD. Really not sure if this is the solution... hopefully you can provide some light after looking at the minidump files.

Again, thanks for your help.

 

[fredbv]

Latest BSOD

Hi, I have attached dump file and jcgriff2 report from the latest BSOD.

This may be the best chance yet to find the problem.

Thanks

Fred

 

[mgorman87]

All the crashes are inconclusive. Have you enabled driver verifier yet? None of these are driver verified enabled crashes.

First, uninstall any ASUS software you have on your computer as it has caused issues before.

Next, go to the ASUS site and download the following things - ASUSTeK Computer Inc. - Notebooks- ASUS G53SW

Chipset
ATK
USB

The error about your security loader is back

Please run a system file check - http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

BSOD BUGCHECK SUMMARY

[font=lucida console]
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Sun Feb  5 17:35:09.433 2012 (UTC - 5:00)
System Uptime: 0 days 0:16:13.949
Probably caused by : ndis.sys ( ndis!ndisQueuedCheckForHang+1a5 )
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xA_ndis!ndisQueuedCheckForHang+1a5
BiosReleaseDate = 02/15/2011
SystemManufacturer = ASUSTeK Computer Inc.
SystemProductName = G53SW
CPUID:        "Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: 1995
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  2 21:01:53.224 2012 (UTC - 5:00)
System Uptime: 0 days 0:00:36.739
*** WARNING: Unable to verify timestamp for intelppm.sys
*** ERROR: Module load completed but symbols could not be loaded for intelppm.sys
Probably caused by : intelppm.sys ( intelppm+2f68 )
PROCESS_NAME:  System
BUGCHECK_STR:  0xD1
FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_intelppm+2f68
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  2 18:33:20.001 2012 (UTC - 5:00)
System Uptime: 0 days 0:11:03.406
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2d8a1 )
BUGCHECK_STR:  0xDE
PROCESS_NAME:  MsMpEng.exe
FAILURE_BUCKET_ID:  X64_0xDE_nt!_??_::FNODOBFM::_string_+2d8a1
BiosReleaseDate = 02/15/2011
SystemManufacturer = ASUSTeK Computer Inc.
SystemProductName = G53SW
CPUID:        "Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: 1995
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Debug session time: Thu Feb  2 18:02:20.867 2012 (UTC - 5:00)
System Uptime: 0 days 1:12:14.383
Probably caused by : win32k.sys ( win32k!zzzLockDisplayAreaAndInvalidateDCCache+106 )
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR:  0x3B
PROCESS_NAME:  csrss.exe
FAILURE_BUCKET_ID:  X64_0x3B_win32k!zzzLockDisplayAreaAndInvalidateDCCache+106
BiosReleaseDate = 02/15/2011
SystemManufacturer = ASUSTeK Computer Inc.
SystemProductName = G53SW
CPUID:        "Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz"
MaxSpeed:     2000
CurrentSpeed: 1995
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

 

[fredbv]

Thanks very much for the detailed info.

1. I have run sfc /scannow and there are no errors
2. I have downloded and installed all latest Asus updates (did this a while ago)
3. I have unistalled VSO CopytoDVD software
4. Whilst is appears Carbonite has crashed, my last couple of BSOD I had it paused I had turned off verifer so I didn't get the info for these last few BSOD.
5. I have re-started verifier

The module GEARAspiWDM.sys is still there... I noticed in the drivers when starting verifier.... but it doesn't come up when I search C: What device(s) use this?

Finally, I have been googling BSOD for Asus notebooks and found some common probs with Atheros drivers. is it an idea rolling back the driver on Atheros AR9002WB 1NG Wireless Network Adapter.... if yes, how do I do this?

Your help is appreciated.

 

[mgorman87]

The GEARAspiWDM is part of itunes or it is a cd rom filter if you don't have itunes installed. you don't need to worry about it. And you can roll back drivers through device manager when you go to the device properties.

You did as i said and removed all asus software and then installed the three things i listed?

 

[fredbv]

Followed instructions

Thanks for info re itunes.

I have been to Asus support website and have checked that I have all latest updates for chipset, ATK and USB.... done. I've also checked all other updates.

I'm not sure which Asus software I have installed and which is safe to unistall....

To roll back a driver though I will need an older version... this is my prob... where do I get an older driver for the Atheros AR9002WB 1NG Wireless Network Adapter... I find the Atheros website very difficult to navigate... they don'y appear to have drivers to download... I keep finding third part sites which do not appear at all trustworthy.

Since unistalling VSO CopytoDVD (yesterday) I have not had a BSOD.... fingers crossed that this was the culprit.

Again, your assistance has been very much apppreciated. Many thanks.

 

[fredbv]

GOT IT !!! Here is the jgriff2 report with verifier running. I have also provided minidump file and sysinfo.

I was using IE Explorer when the last BSOD occurred.

Really hoping that this provides an answer!!!

 

[fredbv]

Answer Random BSOD

I beleive I have found the issue, and my info , may assist others.

The issue is the Realtek High Definition Audio device and the associated realtek driver MBfilt64.sys

I have an Asus G53SW with Win 7 64bit

When I disbale this device through device manager, under sound video and game controllers, and the try to enable, I get BSOD.

Updated drivers using Slimdriver. Also ran memtest and HD Pro and found errors.

Then, action I have taken:

1. Go to C:\windows\system32\drivers\ find the file MBfilt64.sys and rename to MBfilt64.old

2. Open device manager, by typing "device manager' in the Start search programs and file.

3. Under sound video and game controllers, I selected Reaktek High Definition Audio. I disbaled the device by right click select "disable". Then right click on it again, and select properties > driver tab > unistall driver (advanced) > check delete driver software for this device.

4. I then restarted. Windows 7 reinstalls Realtek Audio, with Microsoft drivers (I presume), as the driver MBfilt64.sys is no longer in the drivers folder.

So far no more BSOD.

Hope this helps and I will repost if this do not solve my BSOD.

Again, thanks for your help.

Cheers

Fred

 

[ePeen]

I beleive I have found the issue, and my info , may assist others.

The issue is the Realtek High Definition Audio device and the associated realtek driver MBfilt64.sys

I have an Asus G53SW with Win 7 64bit

When I disbale this device through device manager, under sound video and game controllers, and the try to enable, I get BSOD.

Updated drivers using Slimdriver. Also ran memtest and HD Pro and found errors.

Then, action I have taken:

1. Go to C:\windows\system32\drivers\ find the file MBfilt64.sys and rename to MBfilt64.old

2. Open device manager, by typing "device manager' in the Start search programs and file.

3. Under sound video and game controllers, I selected Reaktek High Definition Audio. I disbaled the device by right click select "disable". Then right click on it again, and select properties > driver tab > unistall driver (advanced) > check delete driver software for this device.

4. I then restarted. Windows 7 reinstalls Realtek Audio, with Microsoft drivers (I presume), as the driver MBfilt64.sys is no longer in the drivers folder.

So far no more BSOD.

Hope this helps and I will repost if this do not solve my BSOD.

Again, thanks for your help.

Cheers

Fred

Very impressive, and good one on posting your methods.... that will help many people that may Google their similar issue