Random BSOD's while PC is idel

[jrodriguez]

Good Evening,

I have a windows 7 user that is experiencing random BSOD's. The network management environment is Novell and Zenworks. The primary use of the pc Archictecture, Graphics using Autodesk products. and Google sketchup. I would like to see if someone can give me the results of the SF_Diagnostic tool I am sumitting to help me narrow down the cause of these crashes. The Video Card driver will be the first item that I will update, folowed by clean uninstal and reload of the ZCM (Zenworks agent). Currently the ATI 5770 is at ver. 8.723.0.0 dated 4/2010. Any assistance would be appreciated.

Thanks,

Specs >------------------------------------------------

These systems are; MS Windows 7 64-bit
CPU
Intel Core 2 Quad Q8300 @ 2.50GHz 40 °C
Yorkfield 45nm Technology
RAM
8.0GB Dual-Channel DDR2 @ 399MHz 6-6-6-18
Motherboard
XFX XFX Nforce 680i LT (Socket 775)
Graphics
@ 1680x1050
Mirage Driver
ATI Radeon HD 5700 Series
Hard Drives
500GB Seagate ST350041 0SV SCSI Disk Device (IDE)
Optical Drives
MagicISO Virtual DVD-ROM0000
LITE-ON DVDRW SHW-160P6S ATA Device
Audio
ATI High Definition Audio Device
---------------------------------------------------------------

 

[CarlTR6]

Hi jrodriguez; welcome to the forum.

Your three dumps give two error codes, 3B, SYSTEM_SERVICE_EXCEPTION, and 1A, MEMORY_MANAGEMENT. One of the 3B dumps shows 0xc0000005, memory corruption. You car see the usual causes of these errors in the links below.

BSOD Index

BSOD Index

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002f6a916, fffff88009d1ea70, 0}

Probably caused by : ntkrnlmp.exe ( nt!CmpAllocateKeyControlBlock+72 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002f6a916, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009d1ea70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!CmpAllocateKeyControlBlock+72
fffff800`02f6a916 48895808        mov     qword ptr [rax+8],rbx

CONTEXT:  fffff88009d1ea70 -- (.cxr 0xfffff88009d1ea70)
rax=fa800749464004c0 rbx=fffff80002e91040 rcx=fffff8a004084648
rdx=fffff88009d1f4a8 rsi=fffff8a000833010 rdi=0000000000000001
rip=fffff80002f6a916 rsp=fffff88009d1f440 rbp=0000000002870588
 r8=fffff8a008abb58c  r9=fffff8a00b4c75d0 r10=fffff8a0033e63a2
r11=0000000000000000 r12=0000000000000000 r13=ffffffffffffffff
r14=fffff8a008abb58c r15=fffff8a00b4c75d0
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!CmpAllocateKeyControlBlock+0x72:
fffff800`02f6a916 48895808        mov     qword ptr [rax+8],rbx ds:002b:fa800749`464004c8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f6a477 to fffff80002f6a916

STACK_TEXT:  
fffff880`09d1f440 fffff800`02f6a477 : 00000000`00000000 00000000`1f93dd2a fffff8a0`0a1fa024 fffff800`02f6f844 : nt!CmpAllocateKeyControlBlock+0x72
fffff880`09d1f470 fffff800`02f691b7 : fffff8a0`00833010 00000000`02870588 fffff8a0`08abb58c fffff8a0`0b4c75d0 : nt!CmpCreateKeyControlBlock+0xe8
fffff880`09d1f510 fffff800`02f65195 : fffff8a0`00000000 fffff8a0`02870588 fffff8a0`00833010 fffffa80`080d87b0 : nt!CmpDoOpen+0x387
fffff880`09d1f5d0 fffff800`02f84e84 : fffff800`02f64cc0 00000000`00000001 fffffa80`080d87b0 00000000`00000001 : nt!CmpParseKey+0x4d5
fffff880`09d1f8a0 fffff800`02f89e4d : fffffa80`080d87b0 fffff880`09d1fa00 00000000`00000040 fffffa80`06ff7420 : nt!ObpLookupObjectName+0x585
fffff880`09d1f9a0 fffff800`02f68dcc : 00000000`10a45d00 00000000`00000000 fffff8a0`04e3a701 fffff880`09d1fa68 : nt!ObOpenObjectByName+0x1cd
fffff880`09d1fa50 fffff800`02f6af0f : 00000000`054fd2e0 00000000`00020019 00000000`054fd368 00000000`00000000 : nt!CmOpenKey+0x28a
fffff880`09d1fba0 fffff800`02c8a993 : fffffa80`098f66a0 fffff880`09d1fc60 00000000`00000000 00000000`059af2ce : nt!NtOpenKeyEx+0xf
fffff880`09d1fbe0 00000000`77560caa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`054fd278 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77560caa


FOLLOWUP_IP: 
nt!CmpAllocateKeyControlBlock+72
fffff800`02f6a916 48895808        mov     qword ptr [rax+8],rbx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!CmpAllocateKeyControlBlock+72

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88009d1ea70 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!CmpAllocateKeyControlBlock+72

BUCKET_ID:  X64_0x3B_nt!CmpAllocateKeyControlBlock+72

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {80000003, fffff80002cc7780, fffff8800403ede0, 0}

Unable to load image ncfsd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ncfsd.sys
*** ERROR: Module load completed but symbols could not be loaded for ncfsd.sys
Probably caused by : ncfsd.sys ( ncfsd+c88e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 0000000080000003, Exception code that caused the bugcheck
Arg2: fffff80002cc7780, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800403ede0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

FAULTING_IP: 
nt!DbgBreakPoint+0
fffff800`02cc7780 cc              int     3

CONTEXT:  fffff8800403ede0 -- (.cxr 0xfffff8800403ede0)
rax=fffff80002d80730 rbx=fffffa80099608e0 rcx=fffff88003e2c860
rdx=fffffa80099608e0 rsi=0000000000000000 rdi=fffffa80099608e0
rip=fffff80002cc7780 rsp=fffff8800403f7b8 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff88002f64ac0
r11=fffff80002f8d600 r12=0000000000000000 r13=fffffa8000000000
r14=fffffa80099608e0 r15=0000000000000001
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000286
nt!DbgBreakPoint:
fffff800`02cc7780 cc              int     3
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  Revit.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff88003e2488e to fffff80002cc7780

STACK_TEXT:  
fffff880`0403f7b8 fffff880`03e2488e : 00000000`00000000 fffffa80`00000000 fffffa80`099608e0 fffff880`0403f830 : nt!DbgBreakPoint
fffff880`0403f7c0 00000000`00000000 : fffffa80`00000000 fffffa80`099608e0 fffff880`0403f830 fffff880`03e2c860 : ncfsd+0xc88e


FOLLOWUP_IP: 
ncfsd+c88e
fffff880`03e2488e ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  ncfsd+c88e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ncfsd

IMAGE_NAME:  ncfsd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49cd1b5d

STACK_COMMAND:  .cxr 0xfffff8800403ede0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_ncfsd+c88e

BUCKET_ID:  X64_0x3B_ncfsd+c88e

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff6800020c720, 82700000a746d867, fffff68000bfc720}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3c8 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff6800020c720
Arg3: 82700000a746d867
Arg4: fffff68000bfc720

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Revit.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d2d6c8 to fffff80002cbb740

STACK_TEXT:  
fffff880`093a0c68 fffff800`02d2d6c8 : 00000000`0000001a 00000000`00000403 fffff680`0020c720 82700000`a746d867 : nt!KeBugCheckEx
fffff880`093a0c70 fffff800`02cec381 : 00000000`00000000 fffff680`0020cf20 fffffa80`098c4b30 fffff880`093a12d0 : nt! ?? ::FNODOBFM::`string'+0x31ef2
fffff880`093a0e20 fffff800`02cfd0da : 00000000`00000000 00000000`419e4fff fffffa80`00000000 fffffa80`098c4b30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`093a0fe0 fffff800`02cba993 : ffffffff`ffffffff fffff880`093a12a0 fffff880`093a1308 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`093a10d0 fffff800`02cb6f30 : fffff960`000d51d8 00000000`00000001 fffff900`c00c5010 fffff900`c0953cd0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`093a1268 fffff960`000d51d8 : 00000000`00000001 fffff900`c00c5010 fffff900`c0953cd0 00000000`00000000 : nt!KiServiceLinkage
fffff880`093a1270 fffff960`000d5534 : ffffffff`00000000 fffff880`00000000 fffff900`c0953cd0 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`093a13c0 fffff960`00096645 : ffffffff`87051861 fffff900`c0953cd0 ffffffff`87051861 00000000`00000000 : win32k!bDeleteSurface+0x34
fffff880`093a13f0 fffff800`02cba993 : fffffa80`0ea756d0 fffff880`093a14a0 00000000`00000000 00000000`0012dee0 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`093a1420 000007fe`feb6118a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012e758 fffff800`02cb3080 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`feb6118a
fffff880`093a1840 00000000`00000000 : 00000000`000025ff fffff880`093a1b98 00000000`00000001 fffff900`c01d38f0 : nt!KiCallUserMode


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3c8
fffff960`000d51d8 e9b0010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`000d538d)

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c483f

FAILURE_BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3c8

Followup: MachineOwner
---------

Since drivers are mentioned in both of the usual causes, I will start with drivers. You have many out of date drivers on your system. In general, Win 7 does not like old drivers. They can and do cause memory corruption and crashes.

adfs.SYS Thu Jun 26 16:52:37 2008
ino_flpy.sys Wed Jun 06 20:15:46 2007
ino_fltr ino_fltr.sys Thu Oct 18 15:55:51 2007
mcdbus.sys Tue Feb 24 05:34:07 2009
nccache.sys Fri Mar 27 13:54:56 2009
NCFilter.sys Fri Mar 27 14:31:42 2009
ncfsd.sys Fri Mar 27 14:30:53 2009
ncioctl.sys Fri Mar 27 14:31:06 2009
nciom.sys Fri Mar 27 13:55:12 2009
ncp.sys Fri Mar 27 13:55:32 2009
ncpfsp.sys Fri Mar 27 13:55:47 2009
ncpl.sys Fri Mar 27 13:53:53 2009
NCRecognizer.sys Fri Mar 27 14:31:37 2009
NCUncFilter.sys Fri Mar 27 14:31:49 2009
ndm.sys Fri Mar 27 13:54:04 2009
ndmndap.sys Fri Mar 27 13:54:27 2009
nds4.sys Fri Mar 27 13:56:05 2009
ndslpp.sys Fri Mar 27 13:56:16 2009
niam.sys Fri Mar 27 13:56:31 2009
nicm.sys Fri Mar 27 13:53:33 2009
nipctl.sys Fri Mar 27 13:54:43 2009
nscm.sys Fri Mar 27 13:56:49 2009
nsns.sys Fri Mar 27 13:57:01 2009
nsvccost.sys Fri Mar 27 13:57:22 2009
nvstor.sys Wed May 20 02:45:37 2009
xtxplat.sys Fri Mar 27 13:57:53 2009

Update the older drivers starting with the ones dated 2007 and 2008. These are very obsolete.

How To Find Drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

If you need help with these drivers, please post.

 

[jrodriguez]

Thanks, I will get to work.

 

[CarlTR6]

You are very welcome. I should have told you that drivers dated prior to July 13, 2009 are obsolete for Win 7, generally speaking. I am about to sign off for the night. However, please post any questions or request for help. Others on the BSOD team will step in.

 

[jrodriguez]

I am going to call ca to obtain the current driver updates for
ino_flpy.sys Wed Jun 06 20:15:46 2007
ino_fltr ino_fltr.sys Thu Oct 18 15:55:51 2007

adfs.SYS Thu Jun 26 16:52:37 2008 is an adobe file system driver, I plan to run updates for that as well. circle back around and run the diagnostic tool once again.

Thanks,

 

[CarlTR6]

I am going to make a suggestion that you uninstall CA using their uninstall tool. Many third party antivirus programs cause crashes with Win 7. While I have not come across CA before (it is not widely used by individual users), antivirus programs are mentioned in the usual causes of one of your error codes. Also CA is not ranked very high in the latest AV comparison tests. For troubleshooting, download and install Microsoft Security Essentials. It will not conflict with Win 7. After you get your system stable, you can try CA again; but I recommend that you stick with MSE and Windows Firewall. There are sound reasons for this. It is due to the different security coding in Win 7 vs previous Windows OS versions. By completely uninstalling CA, you will eliminate one more potential cause of crashes. As old as those drivers are and considering CA is a third party security program, I feel strongly that it is a contributor to your crashes.

My suggestion for the Adobe software is to completely uninstall it using Revo uninstaller (free) and download and install the latest version of Adobe.

Once you have taken care of the drivers and uninstalled CA, run your system and let's see where you stand. This alone may solve the problem (if we are lucky ).

Here are the uninstall tools for CA (depending on your version):

Computer Associates 2007/2008 (all products) > Info > Tool

Computer Associates 2009 (all products) > Info > Tool

 

[jrodriguez]

I had CA Tech support help verify that these files, currently show to have the most current file revision
ino_flpy.sys, Version 5.0.6100.114, Wed Jun 06 20:15:46 2007
ino_fltr ino_fltr.sys, Version 5.0.6100.169, Thu Oct 18 15:55:51 2007

As a way of assisting in troubleshooting, we are diabling all CA Antivirus / IT products from the startup from this pc, and will wait to see if we get a repeat behavior, to then collect a new .dmp file for further analysis. CA believes that all of their files are up to date.

 

[jrodriguez]

Thanks Carl, It seems that you were typing a reply back at the same time I was typing last. I will follow your recommendation and report back. Thanks, Again for the support.

 

[CarlTR6]

You are very welcome. I was going to tell you that disabling will not work. Even when disabled, some parts of security suites still load and that includes drivers. Security suites are very complex programs and are almost rootkits, albeit good rootkits. This is why we recommend using the manufacturers' removal tools to uninstall them.

If 2007 is the latest drivers CA has, that software version is not Windows 7 compatible. The date for Win 7 compatible drivers is July 13, 2009 and later (there are exceptions).