Solved Random BSOD's and Freezing on new build.

[MrSarge]

Short story for now, decided to downsize from eATX to mATX and even since has been a headache.

Will provide any information needed but atm I am posting from my laptop as the desktop just blue screened again while I was writing this post the first time.

Hardware;

Processor - Intel Core i7 2600k
Motherboard - ASRock Z77 Extreme4-M
Memory - G.Skill RipJaws X 16GB ( 4x4GB ) DDR3 1600Mhz
HDD - Seagate Barracuda
Power Supply - Corsair HX750

Random freezes requiring manual restart started happening shortly after the initial Windows installation. They would happen while playing Diablo 3, browsing with Firefox or while I was away from the computer. Event views produces a " kernel-power " error;

  [B]-[/B] [B]System[/B]     

    [B]-[/B] [B]Provider[/B]     


[  [B]Name[/B]]  Microsoft-Windows-Kernel-Power    


[  [B]Guid[/B]]  {331C3B3A-2005-44C2-AC5E-77220C37D6B4}
    

    
[B]EventID[/B] 41    

    
[B]Version[/B] 2    

    
[B]Level[/B] 1    

    
[B]Task[/B] 63    

    
[B]Opcode[/B] 0    

    
[B]Keywords[/B] 0x8000000000000002    

    [B]-[/B] [B]TimeCreated[/B]     


[  [B]SystemTime[/B]]  2012-11-26T00:14:36.548015900Z
    

    
[B]EventRecordID[/B] 9345    

    
[B]Correlation[/B]    

    [B]-[/B] [B]Execution[/B]     


[  [B]ProcessID[/B]]  4    


[  [B]ThreadID[/B]]  8
    

    
[B]Channel[/B] System    

    
[B]Computer[/B] Musketeer    

    [B]-[/B] [B]Security[/B]     


[  [B]UserID[/B]]  S-1-5-18

    [B]-[/B] [B]EventData[/B]     

[B]BugcheckCode[/B] 0    

[B]BugcheckParameter1[/B] 0x0    

[B]BugcheckParameter2[/B] 0x0    

[B]BugcheckParameter3[/B] 0x0    

[B]BugcheckParameter4[/B] 0x0    

[B]SleepInProgress[/B] false    

[B]PowerButtonTimestamp[/B] 0

Shortly after I started experiencing those I got my first BSOD. And the logs pointed to my USB SoundCards drivers, so I uninstalled them and have since gotten new ones.

Sorry if this isn't the correct format for BSOD's but as I said, I can get the proper stuff when instructed as right now I'm on my laptop, but these are from WhoCrashed that I sent to a friend.

[FONT=Segoe UI, Arial][SIZE=4][B]  Crash Dump Analysis[/B]  [/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000]Crash dump  directory: C:\Windows\Minidump[/COLOR][/SIZE][/FONT]

[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000]Crash dumps are enabled on your  computer.
[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][B]On  Sat 11/24/2012 7:12:11 AM GMT your computer crashed[/B]
crash dump file:  C:\Windows\Minidump\112412-20997-01.dmp
This was probably caused by the  following module: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=ntoskrnl.exe"]ntoskrnl.exe[/URL][/COLOR][/SIZE][/FONT] (nt+0x7EFC0) 
Bugcheck code: 0xA  (0x3C297D, 0x2, 0x1, 0xFFFFF8000329B24E)
Error: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=MSDN+bugcheck+IRQL_NOT_LESS_OR_EQUAL"]IRQL_NOT_LESS_OR_EQUAL[/URL][/COLOR][/SIZE][/FONT]
file path:  C:\Windows\system32\ntoskrnl.exe
product: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Microsoft® Windows® Operating System"]Microsoft® Windows® Operating System[/URL][/COLOR][/SIZE][/FONT]
company: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Microsoft Corporation"]Microsoft Corporation[/URL][/COLOR][/SIZE][/FONT]
description: NT Kernel &  System
Bug check description: This indicates that Microsoft Windows or a  kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This  appears to be a typical software driver bug and is not likely to be caused by a  hardware problem. 
The crash took place in the Windows kernel. Possibly this  problem is caused by another driver that cannot be identified at this time.  


[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][B]On  Sat 11/24/2012 7:12:11 AM GMT your computer crashed[/B]
crash dump file:  C:\Windows\memory.dmp
This was probably caused by the following module: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=mbfilt64.sys"]mbfilt64.sys[/URL][/COLOR][/SIZE][/FONT] (MBfilt64+0x1817) 
Bugcheck code: 0xA  (0x3C297D, 0x2, 0x1, 0xFFFFF8000329B24E)
Error: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=MSDN+bugcheck+IRQL_NOT_LESS_OR_EQUAL"]IRQL_NOT_LESS_OR_EQUAL[/URL][/COLOR][/SIZE][/FONT]
file path:  C:\Windows\system32\drivers\mbfilt64.sys
company: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Creative Technology Ltd."]Creative Technology Ltd.[/URL][/COLOR][/SIZE][/FONT]
description: Creative Audio  Driver
Bug check description: This indicates that Microsoft Windows or a  kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This  appears to be a typical software driver bug and is not likely to be caused by a  hardware problem. 
A third party driver was identified as the probable root  cause of this system error. It is suggested you look for an update for the  following driver: mbfilt64.sys (Creative Audio Driver, Creative Technology  Ltd.). 
Google query: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=mbfilt64.sys+Creative Technology Ltd.+IRQL_NOT_LESS_OR_EQUAL"]Creative Technology Ltd.  IRQL_NOT_LESS_OR_EQUAL[/URL][/COLOR][/SIZE][/FONT]


[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][B]On Sat 11/24/2012 7:12:08 AM GMT your computer  crashed[/B]
crash dump file: C:\Windows\Minidump\112412-21122-01.dmp
This  was probably caused by the following module: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Unknown"]Unknown[/URL][/COLOR][/SIZE][/FONT] () 
Bugcheck code: 0x0 (0x0, 0x0, 0x0,  0x0)
Error: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=MSDN+bugcheck+CUSTOM_ERROR"]CUSTOM_ERROR[/URL][/COLOR][/SIZE][/FONT]
A third party driver was identified as  the probable root cause of this system error. 
Google query: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=CUSTOM_ERROR"]CUSTOM_ERROR[/URL][/COLOR][/SIZE][/FONT]


[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][B]On Sat 11/24/2012 7:10:51 AM GMT your computer  crashed[/B]
crash dump file: C:\Windows\Minidump\112412-20966-01.dmp
This  was probably caused by the following module: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Unknown"]Unknown[/URL][/COLOR][/SIZE][/FONT] () 
Bugcheck code: 0x0 (0x0, 0x0, 0x0,  0x0)
Error: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=MSDN+bugcheck+CUSTOM_ERROR"]CUSTOM_ERROR[/URL][/COLOR][/SIZE][/FONT]
A third party driver was identified as  the probable root cause of this system error. 
Google query: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=CUSTOM_ERROR"]CUSTOM_ERROR[/URL][/COLOR][/SIZE][/FONT]


[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][B]On Sat 11/24/2012 6:50:57 AM GMT your computer  crashed[/B]
crash dump file: C:\Windows\Minidump\112412-24320-01.dmp
This  was probably caused by the following module: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=ksaud.sys"]ksaud.sys[/URL][/COLOR][/SIZE][/FONT] (0xFFFFF880068C7503) 
Bugcheck code: 0xD5  (0xFFFFF98004D4EC00, 0x0, 0xFFFFF880068C7503, 0x0)
Error: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=MSDN+bugcheck+DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL"]DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL[/URL][/COLOR][/SIZE][/FONT]
file path:  C:\Windows\system32\drivers\ksaud.sys
product: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Sound Blaster USB Audio"]Sound Blaster USB Audio[/URL][/COLOR][/SIZE][/FONT]
company: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=Creative Technology Ltd."]Creative Technology Ltd.[/URL][/COLOR][/SIZE][/FONT]
description: WDM USB Audio  Driver
Bug check description: This indicates that a driver has referenced  memory which was earlier freed.
This appears to be a typical software driver  bug and is not likely to be caused by a hardware problem. 
A third party  driver was identified as the probable root cause of this system error. It is  suggested you look for an update for the following driver: ksaud.sys (WDM USB  Audio Driver, Creative Technology Ltd.). 
Google query: [FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=ksaud.sys+Creative Technology Ltd.+DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL"]Creative Technology Ltd.  DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL[/URL][/COLOR][/SIZE][/FONT]
[/COLOR][/SIZE][/FONT]
[FONT=Segoe UI, Arial][SIZE=4][B]  Conclusion[/B]  [/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000]5 crash dumps  have been found and analyzed. 2 third party drivers have been identified to be  causing system crashes on your computer. It is strongly suggested that you check  for updates for these drivers on their company websites. Click on the links  below to search with Google for updates for these drivers: 

[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=ksaud.sys+Creative Technology Ltd.+Sound Blaster USB Audio"]ksaud.sys (WDM USB Audio Driver, Creative Technology  Ltd.)[/URL][/COLOR][/SIZE][/FONT]
[FONT=Segoe UI,  Arial][SIZE=2][COLOR=#000000][URL="http://www.google.com/search?q=mbfilt64.sys+Creative Technology Ltd."]mbfilt64.sys (Creative Audio Driver, Creative Technology  Ltd.)[/URL][/COLOR][/SIZE][/FONT]
[/COLOR][/SIZE][/FONT]

Both of the drivers on the bottom have been uninstalled / deleted from the system using the "autoruns" tool I found in another thread here while doing research on this. But as of now I am pretty stumped.

P.S. The logs above seem to be missing the newer BSOD occurrences... I guess it didn't dump them for some reason. What I have written down for those is 0x0000001e.

 

[MrSarge]

SF Diagnostics Dump ~

 

[koolkat77]

Avast! antivirus is contributing in your BSOD-s. Please uninstall it and use Microsoft Security Essentials (To Test).

fffff880`035391c0  fffff880`019f5000Unable to load image \??\C:\Windows\system32\drivers\aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
 aswMonFlt+0x1c000

• avast! Uninstall Utility | Download aswClear for avast! Removal

Recommended antivirus program for Windows 7 based on stability compared to others:-

• Microsoft Security Essentials - Free Antivirus for Windows
• Malwarebytes - The Free version
• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Click on the Start rb: ► Control Panel ► Programs ► Uninstall a program ► Uninstall everything related to; Creative Technology Sound Blaster USB Audio and Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver), restart the computer if prompted. Delete remnants of its drivers/older drivers using Driver Fusion/Sweeper

Get latest drivers from: Driver Reference Table and Driver Reference Table
Free up the start-up, nothing except the antivirus is usually needed.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Let us know the results.

BUG CHECK SUMMARY:

[FONT="Lucida Console"]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
STOP 0x000000D5: DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL  
Usual causes:  Device driver
BugCheck D5, {fffff98004d4ec00, 0, fffff880068c7503, 0}
*** WARNING: Unable to verify timestamp for ksaud.sys
*** ERROR: Module load completed but symbols could not be loaded for ksaud.sys
Could not read faulting driver name
Probably caused by : ksaud.sys ( ksaud+4503 )
Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL   
Usual causes:  Kernel mode driver, System Service, BIOS, Windows, 
Virus scanner, Backup tool, compatibility
BugCheck A, {3c297d, 2, 1, fffff8000329b24e}
*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
Probably caused by : MBfilt64.sys ( MBfilt64+1817 )
Followup: MachineOwner
---------
[/FONT]

 

[MrSarge]

Ok, uninstalled Avast! with the remover tool as instructed, and installed MSE.

Ran a full scan in MSE and MBAM ( separately ), and they came up clean.

MBAM log;

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.11.24.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Brandon :: MUSKETEER [administrator]

11/25/2012 7:22:01 PM
mbam-log-2012-11-25 (19-22-01).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 339564
Time elapsed: 12 minute(s), 15 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

System File Check;

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Uninstalled my Creative USB sound card last night and uninstalled all of the software, and then the drivers using driver sweeper.

And while looking at the startup I did notice some remnants of the Creative sound card software;

View attachment 243139

The Realtek drivers I did uninstall as per directed but that is the onboard device so it fetched new drivers right away.

Ran ChkDsk ( with both boxes checked ) last night and it became stuck at 16% on stage 5, let it run for 4 hours after that before I had to boot into my Linux drive to get some work done. I'll run another instance tomorrow after work if needed.

I'll post more dumps if the problem persists, usually doesn't take long. Thanks for the help so far and really hope this problem can be fixed easily

 

[koolkat77]

Thanks for posting the results.

Hope all goes well, good luck.

 

[MrSarge]

Well, so far it's been doing great. No freezes or BSOD's yet and normally it was several each day since the install. So I guess it's looking like it's solved.

Thanks for the help Koolkat

 

[koolkat77]

Thanks for the update, I usually suggest 1 week befor marking as solved.

Come back to this thread if there are any other issues

 

[MrSarge]

Ok, apparently had a random reboot within the last hour ( right before I woke up this morning ), and even viewer is again saying it was "kernel-power". Was running pretty smoothly until this.

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          12/1/2012 7:07:51 AM
Event ID:      41
Task Category: (63)
Level:         Critical
Keywords:      (2)
User:          SYSTEM
Computer:      Musketeer
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>41</EventID>
    <Version>2</Version>
    <Level>1</Level>
    <Task>63</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000002</Keywords>
    <TimeCreated SystemTime="2012-12-01T12:07:51.314015500Z" />
    <EventRecordID>12719</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>Musketeer</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="BugcheckCode">0</Data>
    <Data Name="BugcheckParameter1">0x0</Data>
    <Data Name="BugcheckParameter2">0x0</Data>
    <Data Name="BugcheckParameter3">0x0</Data>
    <Data Name="BugcheckParameter4">0x0</Data>
    <Data Name="SleepInProgress">false</Data>
    <Data Name="PowerButtonTimestamp">0</Data>
  </EventData>
</Event>

 

[koolkat77]

Uhmm no BSOD?

Upload a screenshot of the Summary tab using Speccy:

• Speccy - System Information - Free Download
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[MrSarge]

Ok, sorry for the late reply, I have been busy, but I believe that last reboot was just a power failure on our grid here as all of my Verizon Set Top Boxs were in download mode in the morning which usually only happens when we lose power.

Computer has been up now for nearly seven days ( according to task managers uptime ) without a single problem;

View attachment 245140

So I do believe it's pretty stable now, and thanks for your help koolkat

 

[koolkat77]

That's great, give it a week before marking as solved good luck!