Solved Sporadic shutdowns. No BSOD until capture card removed, then get BSOD.

[jivex5k]

Hey guys,
Getting a weird problem with a machine that would shut down after anywhere from 3 hours to a full week.
It wasn't dumping the memory until I removed a capture card. Now it finally has dumped the memory and I'm hoping to gain some insight on the issue.
I ran memtest86++ for a full night with no errors.

There is some hardware damage near the storage drives, but they are only used to host the video and not the OS

The specs are:
Windows 7 Embedded 64 bit installed with compatibility profile selected.
OS on WD 2.5" 250GB Scorpio Blue WD2500LPVT
4 3.5" WD 3TB WD30EURS
1 3.4" WD 2TB WD20EURS
Silicon Image SATA card si3114
ASRock z77 motherboard
Intel Core i7-3770
4GB DDR3 1333 RAM
Silverstone 500W PSU
4 Nuuo SCB7016 Capture Cards
1 Samsung 22X DVD Burner

Thanks in advance for any insight! Also, if you guys have any tips on how to analyze these dumps it would be awesome. I'd love to be able to look at these files, I had a setup before with WinDBG but I was never able to garner the same information as these forums.

 

[koolkat77]

No antivirus?

Use Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other security software:

Microsoft Security Essentials - Free Antivirus for Windows

Malwarebytes - Free

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Scan with Kaspersky TDSSKiller:Anti-rootkit utility TDSSKiller

ESET online scanner: Free Online Virus Scanner | ESET

Run a System file check (SFC): http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your Hard Drive(s): http://www.sevenforums.com/tutorials/433-disk-check.html

For your BSOD, Please follow the instructions that were given by Dsprague in this thread: http://www.sevenforums.com/bsod-hel...-occasionally-while-running-dvr-software.html


Dump Output

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Usra\Downloads\jivex5k\SF_10-03-2014\031014-39561-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer EmbeddedNT SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02a14000 PsLoadedModuleList = 0xfffff800`02c576d0
Debug session time: Tue Mar 11 03:03:23.874 2014 (UTC + 6:00)
System Uptime: 0 days 0:18:29.718
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff88084c119b3, 2, 1, fffff88004e1e4eb}

Unable to load image scb7000.sys, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for scb7000.sys
Probably caused by : scb7000.sys ( scb7000+4eb )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff88084c119b3, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88004e1e4eb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc1100
GetUlongFromAddress: unable to read from fffff80002cc11c0
 fffff88084c119b3 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
scb7000+4eb
fffff880`04e1e4eb 893c01          mov     dword ptr [rcx+rax],edi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  MainConsole.ex

TRAP_FRAME:  fffff8801f5de620 -- (.trap 0xfffff8801f5de620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000707f7983 rbx=0000000000000000 rcx=fffff8801441a030
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004e1e4eb rsp=fffff8801f5de7b0 rbp=0000000000000001
 r8=000000000000017d  r9=0000000000000000 r10=000000000022201c
r11=fffff880144275a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
scb7000+0x4eb:
fffff880`04e1e4eb 893c01          mov     dword ptr [rcx+rax],edi ds:fffff880`84c119b3=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a89169 to fffff80002a89bc0

STACK_TEXT:  
fffff880`1f5de4d8 fffff800`02a89169 : 00000000`0000000a fffff880`84c119b3 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`1f5de4e0 fffff800`02a87de0 : fffff880`1441bb00 fffff880`1f5de6a0 fffffa80`07cf8ae8 fffff880`1441bb00 : nt!KiBugCheckDispatch+0x69
fffff880`1f5de620 fffff880`04e1e4eb : fffffa80`07cf8ae8 fffffa80`099f5760 00000000`0000d570 fffff880`1441bb00 : nt!KiPageFault+0x260
fffff880`1f5de7b0 fffffa80`07cf8ae8 : fffffa80`099f5760 00000000`0000d570 fffff880`1441bb00 00000000`00000000 : scb7000+0x4eb
fffff880`1f5de7b8 fffffa80`099f5760 : 00000000`0000d570 fffff880`1441bb00 00000000`00000000 fffff880`04e22a71 : 0xfffffa80`07cf8ae8
fffff880`1f5de7c0 00000000`0000d570 : fffff880`1441bb00 00000000`00000000 fffff880`04e22a71 00000000`00000026 : 0xfffffa80`099f5760
fffff880`1f5de7c8 fffff880`1441bb00 : 00000000`00000000 fffff880`04e22a71 00000000`00000026 fffffa80`05010630 : 0xd570
fffff880`1f5de7d0 00000000`00000000 : fffff880`04e22a71 00000000`00000026 fffffa80`05010630 fffffa80`07cf6180 : 0xfffff880`1441bb00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
scb7000+4eb
fffff880`04e1e4eb 893c01          mov     dword ptr [rcx+rax],edi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  scb7000+4eb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: scb7000

IMAGE_NAME:  scb7000.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e0aecdb

FAILURE_BUCKET_ID:  X64_0xD1_scb7000+4eb

BUCKET_ID:  X64_0xD1_scb7000+4eb

Followup: MachineOwner
---------

6: kd> lmvm scb7000
start             end                 module name
fffff880`04e1e000 fffff880`04e27f00   scb7000    (no symbols)           
    Loaded symbol image file: scb7000.sys
    Image path: scb7000.sys
    Image name: scb7000.sys
    Timestamp:        Wed Jun 29 15:14:03 2011 (4E0AECDB)
    CheckSum:         000157E2
    ImageSize:        00009F00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

 

[jivex5k]

Thanks, I'll use those tools.
Looks like the dump is referencing a capture card, I'm going to re-install the capture card drivers as well.

 

[jivex5k]

Alright turns out it was 2 bad cards. All scans turned up negative, it's virus free.
Thanks for the help, your post helped me identify there was a second card acting up.