Random Restarts 4 Dump Files Posted

[Malkirion]

Random Restarts -Attachment Fixed-

I've been having this problem for months, but I've never been able to figure it out. I originally thought it was a problem with my C drive running out of space due to an oversized pagefile.sys and hibernate.sys, but I fixed those issues recently and it's still occurring. If anyone can give me some feedback on what could be causing this I'd appreciate it. If you need additional information please leave a post and I'll respond to it as fast as I can.

Thank you for the help in advance,

Malk



Edit: Sorry for some reason they weren't showing up...

 

[Arc]

No files are there.

• Blue Screen of Death (BSOD) Posting Instructions.
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[Malkirion]

Sorry, for some reason it wasn't showing up when I added it to attachments, I redid it with advance settings and it's posted now.

Thank you,
Malkirion

 

[x BlueRobot]

[COLOR=Red]BugCheck F4[/COLOR], {3, [COLOR=SeaGreen]fffffa8008d219a0[/COLOR], fffffa8008d21c80, fffff800039cc350}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

From the call stack, the process referenced a memory address, which caused the thread to have a page fault, although, the page fault couldn't handed and processed by the thread as a result of some kind of I/O error.

6: kd> [COLOR=SeaGreen]!process fffffa8008d219a0 3[/COLOR]
GetPointerFromAddress: unable to read from fffff800038fd000
PROCESS fffffa8008d219a0
    SessionId: none  Cid: 02c8    Peb: 7fffffd3000  ParentCid: 02b8
    DirBase: 1d5596000  ObjectTable: fffff8a00ed363d0  HandleCount: <Data Not Accessible>
    Image: csrss.exe
    VadRoot fffffa800a9a4f80 Vads 319 Clone 0 Private 2743. Modified 25193. Locked 0.
    DeviceMap fffff8a000008b30
    Token                             fffff8a00ed2e060
    ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
    ElapsedTime                       00:00:00.000
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.000
    QuotaPoolUsage[PagedPool]         465848
    QuotaPoolUsage[NonPagedPool]      52400
    Working Set Sizes (now,min,max)  (4468, 50, 345) (17872KB, 200KB, 1380KB)
    PeakWorkingSetSize                9750
    VirtualSize                       176 Mb
    PeakVirtualSize                   335 Mb
    PageFaultCount                    197972983
    MemoryPriority                    BACKGROUND
    BasePriority                      13
    CommitCharge                      3024

        *** Error in reading nt!_ETHREAD @ fffffa8008d72b50

STACK_TEXT:  
fffff880`095dee38 fffff800`03a53d22 : 00000000`000000f4 00000000`00000003 fffffa80`08d219a0 fffffa80`08d21c80 : nt!KeBugCheckEx
fffff880`095dee40 fffff800`03a0008b : ffffffff`ffffffff fffffa80`09420060 fffffa80`08d219a0 fffffa80`08d219a0 : nt!PspCatchCriticalBreak+0x92
fffff880`095dee80 fffff800`03980144 : ffffffff`ffffffff 00000000`00000001 fffffa80`08d219a0 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17486
fffff880`095deed0 fffff800`036c4e93 : fffffa80`08d219a0 [COLOR=Red]fffff800`c0000006[/COLOR] fffffa80`09420060 00000000`02940c00 : nt!NtTerminateProcess+0xf4
fffff880`095def50 fffff800`036c1450 : fffff800`0371081f fffff880`095dfa38 fffff880`095df790 fffff880`095dfae0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`095df0e8 fffff800`0371081f : fffff880`095dfa38 fffff880`095df790 fffff880`095dfae0 00000000`02941910 : nt!KiServiceLinkage
fffff880`095df0f0 fffff800`036c5282 : fffff880`095dfa38 00000000`00013600 fffff880`095dfae0 00000000`029413e8 : nt! ?? ::FNODOBFM::`string'+0x488e4
fffff880`095df900 fffff800`036c3dfa : 00000000`00000000 000007fe`fd56d8c0 00000000`77888d01 00000000`00013600 : nt!KiExceptionDispatch+0xc2
fffff880`095dfae0 00000000`77789c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 :[B] nt!KiPageFault[/B]+0x23a
00000000`02941330 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77789c12

6: kd> [COLOR=SeaGreen]!error fffff800`c0000006[/COLOR]
Error code: (NTSTATUS) 0xc0000006 (3221225478) - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

Run Memtest86+ for least 7-8 passes, and preferably overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

test|Slot1|Slot2
RAM1| Error | Error
RAM2|Good|Good

It is a RAM, a bad RAM.

But if you have got a result like that:

test|Slot1|Slot2
RAM1| Error |Good
RAM2| Error |Good

It is a motherboard issue. The particular slot is bad.

 

[x BlueRobot]

Could you also post a screenshot of Task Manager Performance tab?

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[Malkirion]

Well I was running a lot of programs and I left the computer to run them overnight, but the cpu usage wasn't showing but 3-17% cpu usage with all the programs running.

 

[x BlueRobot]

The process has already gone beyond it's maximum working set, which it is technically allowed to do, if there is enough free memory available to use. From your system, there is only seems to be around 35MB of physical memory, therefore the page fault may not have been able to occur because of this. Although, the Working Set Manager should have begun some working set trimming to free some memory.

This is just a assumption I've got, I could be wrong, does this bugcheck occur in certain memory consuming situations?

Make sure to run the MemTest86+.

 

[Malkirion]

I ran the full memtest off a burnt CD, it got to pass 7 with no errors. Any ideas?

Malkirion

Edit: It does seem to be during memory consuming times. It doesn't usually do it though until I've gone to sleep. The crashes usually happen during the night when I wake up to a black error page (the computer won't automatically boot back up, I usually have to turn it off when it comes to that error page and then turn off and turn back on the computer). I've started to have programs that I needed to run 24/7, so I've been letting the comp run overnight with them. This crash issue has been going on before I started doing that. Though, this could possibly be an unrelated crash to the ones I was having before... What would you recommend to prevent it from crashing in high memory consuming situations? More RAM? Or are there settings I can adjust to prevent it from crashing?

 

[x BlueRobot]

What does it say on the black error page? Programs running constantly can lead to memory leaks.

Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:

• http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

   Information

Additional Help - http://www.sevenforums.com/crash-lo...-driver-verifier-identify-issues-drivers.html

 

[Malkirion]

I encountered two crashes with the verifier. The first was caused by my peerblock program so I disabled it at startup to see if there were any other problems and I got "HIDCLASS.sys FFFF8800448710 base at FFFFF88004446000, Date Stamp 4ce7a665." I included a new SF rar with the new crash dumps in it. Hopefully this helps out, if not, I can try the verifier again to see if anything else comes up.


Thank you,
Malkirion

 

[Malkirion]

bump

 

[x BlueRobot]

Sorry for the slow reply, I've been busy,

[COLOR="Red"]BugCheck C9[/COLOR], {7, fffff8800a6daa10, fffff9800170cee0, 0}

*** WARNING: Unable to verify timestamp for pbfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for pbfilter.sys
Probably caused by : [COLOR="Red"]pbfilter.sys[/COLOR] ( pbfilter+2a10 )

1: kd> [COLOR="SeaGreen"]lmvm pbfilter[/COLOR]
start             end                 module name
fffff880`0a6d8000 fffff880`0a6e1000   pbfilter T (no symbols)           
    Loaded symbol image file: pbfilter.sys
    Image path: \??\X:\Program Files\PeerBlock\pbfilter.sys
    Image name: pbfilter.sys
    Timestamp:        [COLOR="Red"]Sun Nov 07 02:23:54 2010[/COLOR] (4CD60DBA)
    CheckSum:         0000D4D3
    ImageSize:        00009000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Peerblock program does seems to be causing problems, you could find a later version from here - PeerBlock

 

[Malkirion]

No worries, I just bumped because it was moving down the third page. I'll try only running it at certain times; I'm using the latest version (1.1) at the minute and unfortunately they haven't updated in a while. Do you know what a crash caused by HIDCLASS.sys would mean? I ran the device verifier after disabling and not running peerblock and got the last crash due to the hidclass.sys driver.

Sincerely,

Malkirion

 

[x BlueRobot]

HIDCLASS.sys is a Windows library file, it may have been referenced, because the Peerblock program could have potentially been using it.

 

[Malkirion]

I copied the black screen that comes up that I was telling you about earlier. It says "Windows failed to start. A recent hardware or software change might be the cause." "Status: 0xc000000e" "Info: The boot section failed because a required device is inaccessible." Now once I turn off the computer and turn it back on the computer boots up normally besides a "windows fail to start" page that asks me if I want to boot into safe mode or start normally.

I've tried two things since we last talked. I eliminated the use of peerblock to rule that out as a problem and I bought more ram (now at 16gb) so that a lack of memory could be ruled out as a factor. I've included a new SF folder the last crash happened last night. It seems that these crashes almost always happen overnight, but I can't figure out what would do that because I don't have the computer on sleep or hibernate and all I have the computer do is turn off the monitors after 15 minutes. I've only had it once do it while I was actually on the computer, the rest of the time it's at night or after I've left it idle for a little while ie. gone to the shower and came back.

Any advice you can give me is helpful, you've already been a big help so far.

Thanks,
Malkirion

 

[x BlueRobot]

[COLOR=Red]BugCheck F4[/COLOR], {3, [COLOR=SeaGreen]fffffa800d99d6a0[/COLOR], fffffa800d99d980, fffff800039ca350}

----- ETW minidump data unavailable-----
Probably caused by : csrss.exe

4: kd> [COLOR=SeaGreen]!error 0xc0000006[/COLOR]
Error code: (NTSTATUS) 0xc0000006 (3221225478) - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

Okay, it seems we are dealing with some kind of I/O error, and since your operating system doesn't seem to boot normally, then they're must be some I/O failure somewhere.

4: kd> [COLOR="SeaGreen"]k[/COLOR]
Child-SP          RetAddr           Call Site
fffff880`0279ee38 fffff800`03a51d22 nt!KeBugCheckEx
fffff880`0279ee40 fffff800`039fe08b nt!PspCatchCriticalBreak+0x92
fffff880`0279ee80 fffff800`0397e144 nt! ?? ::NNGAKEGL::`string'+0x17486
fffff880`0279eed0 fffff800`036c2e93 nt!NtTerminateProcess+0xf4
fffff880`0279ef50 fffff800`036bf450 nt!KiSystemServiceCopyEnd+0x13
fffff880`0279f0e8 fffff800`0370e81f nt!KiServiceLinkage
fffff880`0279f0f0 fffff800`036c3282 nt! ?? ::FNODOBFM::`string'+0x488e4
fffff880`0279f900 fffff800`036c1dfa [COLOR="Red"]nt!KiExceptionDispatch+0xc2[/COLOR]
fffff880`0279fae0 00000000`76e09c12 [COLOR="Red"]nt!KiPageFault+0x23a[/COLOR] <-- I/O Error
00000000`00a51630 00000000`00000000 0x76e09c12

Obviously, as the error already suggested, a form of data from attempted to read from the disk into physical memory, however, this operation couldn't complete.

-------------------------------------------------------------------

Run some hard-drive diagnostics and follow these steps:

• Hard Drive Diagnostic Procedure

Find your hard-drive manufacturer and run their tests.

Additional Tests:

• SeaTools for DOS | Seagate
• CrystalDiskInfo - Software - Crystal Dew World

Post a screenshot of Crystal Disk Info summary:

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

If you have an SSD, make sure the following are up to date:

• SSD firmware
• BIOS Version
• Chipset Drivers
• Hard disk controller drivers/SATA drivers
• If you have a Marvell IDE ATA/ATAPI device, make sure the drivers are up to date from the Intel site or Marvell site and not from your motherboard/vendor support site.

Check for any file system errors and bad sectors using Option #2 of:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Use this command with Disk Check:

chkdsk C: /f /r