Win 7 x64 BSoD

[freelancer91]

On Christmas Day I had what I thought was a fluke BSoD. I was away from the computer when it happened. I check out the minidump folder with windbg but couldn't see anything to indicate hardware problems so I ignored it. Then this evening I got another one, this time while I was at the computer. It happened while I was playing minecraft. Before it went to the standard blue screen, it showed a different blue screen that said (among some other stuff that I didn't pick up on in the second that it showed) "hardware malfunction". It then went to the regular blue screen and then restarted. When I was trying to put together a zip file with all of the info required to troubleshoot, I ran into another interesting problem. I couldn't create a system health report. I have instead included a screen shot of what the performance monitor told me.

System information:

Windows 7 Ultimate x64 Retail

Age of Hardware: Varies, but the original parts that still remain (motherboard, CPU, RAM) were purchased in late 2008. I have since upgraded the graphics card and replaced the PSU, as well as transplanted the system to a new computer case and added watercooling. I moved the system to a boot SSD last spring with the original HDD serving as a data storage drive for larger things (I have the User Folder symlinked to the HDD.)

Age of install: I reinstalled the OS last spring when I moved the system to the Boot SSD.

Components:

Motherboard: Intel DX48BT2
CPU: Intel QX9770 Core 2 Extreme 3.2GHz
RAM: 8GB (4*2GB) of OCZ Gold Series DDR3 1333MHz
Storage:
OCZ 30GB Vertex SSD (this holds the OS except for the User folder. It also holds the smaller programs I have installed)
Samsung HD103UJ 1TB HDD (this contains larger installed programs, the User folder, and the paging file)
Power Supply: Rosewill Bronze Series 1000W
Optical Drive: HP dvd1140
Graphics card: GTX 295 (single PCB)

 

[1Bowtie]

Usually when it happens while playing a game it's caused by the video card and the game a conflict of some kind, another possibility is heat, just a couple things to check

 

[freelancer91]

Usually when it happens while playing a game it's caused by the video card and the game a conflict of some kind, another possibility is heat, just a couple things to check

But that wouldn't explain it happening when I was away from the computer (overnight). I seriously doubt heat is the problem, as this is a watercooled rig.

 

[Capt.Jack Sparrow]

Hello and Welcome !

Seems like few issues. Where did you get your copy of Windows ? Because there is no Symbols for the Windows kernel.

Then there is

127.0.0.1 activate.adobe.com

entered to Host file to block the Adobe Activation.

Also I happen to find KMService.exe running which is reported as a Trojan used for Office 2010 activation.

Bugcheck:

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80003405000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c08914e

EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+17c952f0090dfdc
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003483c3e to fffff8000348c110

STACK_TEXT:  
fffff800`04adbe18 fffff800`03483c3e : fffffa80`736c7472 00000000`00000000 fffffa80`0a22f300 fffff800`034b3c40 : nt+0x87110
fffff800`04adbe20 fffffa80`736c7472 : 00000000`00000000 fffffa80`0a22f300 fffff800`034b3c40 00000000`00000000 : nt+0x7ec3e
fffff800`04adbe28 00000000`00000000 : fffffa80`0a22f300 fffff800`034b3c40 00000000`00000000 fffff800`034bcdfd : 0xfffffa80`736c7472


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+87110
fffff800`0348c110 4883ec28        sub     rsp,28h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+87110

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntoskrnl.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

 

[CarlTR6]

I am afraid that I cannot read your dumps. It looks like your are running Windows SP1 and the symbols for SP1 are not available yet.

Windows 7 Kernel Version 7601 (Service Pack 1.178) MP (4 procs) Free x64

The dumps appear to indicate a driver problem. I find the following out of date drivers loaded on your system. Update these drivers.

adfs.SYS Thu Jun 26 16:52:37 2008 - Adobe File System Driver. Adobe. There is no update for this driver. Rename it (see note below).

e1e6032e.sys Tue Mar 24 14:17:23 2009 - Intel PRO/1000 Adapter NDIS 6 deserialized driver. http://downloadcenter.intel.com/Default.aspx

netr28ux.sys Mon May 25 00:38:17 2009 - Ralink RT2870 series USB 802.11n Wireless Adapter Driver (you may have a different manufacturer). Ralink corp..

PTSimBus.sys Wed Jun 17 22:20:48 2009 - PenTablet Bus enumerator, PenTablet Driver.

   Note

Renaming drivers: [FONT=&quot]create a restore point, using Windows Explorer, navigate to C:\Windows\System32\Drivers, locate the driver files, and rename them from .sys to .old. Reboot and the drivers will not load. This will break whatever software or hardware these drivers are associated with.[/FONT]

[FONT=&quot]
This is the best I can do without being able to properly view the dumps.

[/FONT]

 

[freelancer91]

Correct, I am running SP1. I got Windows 7 as part of the MSDNAA program at the University of Illinois (open to all engineering students). I upgraded to SP1 later on. As for symbols, the other day I was trying to make room on my boot SSD when I came across a rather large installation of debugging symbols. I decided to remove them since I was low on space. I figured they were part of something I had added when I installed windows debugging tools.

As for the KMService and the adobe host file modification, those were when I was evaluating Office 2010 and CS5. Those are rather large purchases to make without evaluating the program for an extensive period of time (I only use them occasionally.) Be assured that I went on to purchase both products. Adobe products frequently update on this computer. I seem to have forgotten to remove the service and the host file entry after I purchased my license keys. I will do that now, but I seriously doubt either will improve the situation.

I'm beginning to wonder if its just that time of year again when I should just get a fresh start with my OS. It seems like every OS out there eventually develops problems that can only easily be fixed by reinstalling the OS. I'm not looking forward to it, since my symlink setup was not easy to do.

 

[CarlTR6]

I know from experience that the first three drivers listed have created problems for others. Obviously, troubleshooting is a process of elimination when the exact cause is unknown. I have not been able to discover exactly what adfs.SYS does or which Adobe software/utility it belongs to.

Regarding the symbols, to the best of my knowledge the symbols for SP1 have not been released yet.