Win7 32-bit Crashing Since Jan 2010

[ttran]

Look like Realtek High Definition Audio Driver (MBfilt32.sys) is causing problem. Please re-install audio driver

BugCheck A, {0, 2, 1, 82ea5f9c}

*** WARNING: Unable to verify timestamp for MBfilt32.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt32.sys
Probably caused by : MBfilt32.sys ( MBfilt32+1641 )

Followup: MachineOwner
---------

 

[CarlTR6]

I agree; Driver verifier is a little daunting at first, especially if your computer is having problems. Thanks for taking the plunge.

Your assessment of a loop appears to be right on target; these dmps are identical. The stop error code is A:

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL



Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility
BSOD Index

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidumps.zip\062610-23852-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e50000 PsLoadedModuleList = 0x82f98810
Debug session time: Sun Jun 27 02:38:34.208 2010 (GMT-4)
System Uptime: 0 days 0:00:26.457
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 82eb8f9c}

*** WARNING: Unable to verify timestamp for MBfilt32.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt32.sys
[COLOR=Red]Probably caused by : MBfilt32.sys[/COLOR] ( MBfilt32+1641 )

Followup: MachineOwner
---------

2: kd> !analyze -v

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82eb8f9c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82fb8718
Unable to read MiSystemVaType memory at 82f98160
 00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiSignalSynchronizationObject+1c
82eb8f9c 8901            mov     dword ptr [ecx],eax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  881cac3c -- (.trap 0xffffffff881cac3c)
ErrCode = 00000002
eax=00040000 ebx=873cf974 ecx=00000000 edx=0002edac esi=00040000 edi=8c8c8c98
eip=82eb8f9c esp=881cacb0 ebp=881cacc0 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nt!KiSignalSynchronizationObject+0x1c:
82eb8f9c 8901            mov     dword ptr [ecx],eax  ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82eb8f9c to 82e9682b

STACK_TEXT:  
881cac3c 82eb8f9c badb0d00 0002edac 0000000d nt!KiTrap0E+0x2cf
881cacc0 82eb7753 88100120 873cf96c 8f7cefdc nt!KiSignalSynchronizationObject+0x1c
881cace8 83189d4d 873cf96c 00000008 00000000 nt!KeSetEvent+0x8e
881cad08 a4d20641 873cf96c 00000008 00000000 nt!VerifierKeSetEvent+0x58
WARNING: Stack unwind information not available. Following frames may be wrong.
881cad1c 8318616f 00000000 8f7cef48 873cf96c MBfilt32+0x1641
881cad3c 831862d5 8f7cef48 00000000 86199d48 nt!ViPendingCompleteAfterWait+0x5d
881cad50 8305e6bb 82f8fefc a4d98267 00000000 nt!ViPendingWorkerThread+0x27
881cad90 82f100f9 831862ae 82f8fefc 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt32+1641
a4d20641 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt32+1641

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt32

IMAGE_NAME:  [COLOR=Red]MBfilt32.sys[/COLOR]

DEBUG_FLR_IMAGE_TIMESTAMP:  4a72678e

FAILURE_BUCKET_ID:  0xA_VRF_MBfilt32+1641

BUCKET_ID:  0xA_VRF_MBfilt32+1641

Followup: MachineOwner
---------

The dump indicates that MBfilt32.sys is the cause. This is a Realtek HD ALC 880 Audio CODECs v R2.32 for Windows 7 (32/64 bits). It may not be the actual cause; but let's check it out just in case.

Realtek HD ALC 880 Audio CODECs v R2.32 for Windows 7 (32/64 bits) - TechSpot Drivers

Realtek HD ALC 880 Audio CODECs v R2.49 for Win XP/2000/2003 (32/64 bits) June 11, 2010

Read the threads above and go to the Realtek site, download the latest package and install it. Then reboot.

I still see these older drivers in your dump file:

Alpham1.sys Mon Jul 23 03:56:57 2007 - ZBoards keyboard driver
Alpham2.sys Tue Mar 20 05:49:51 2007 - ZBoards keyboard driver
whfltr2k.sys Thu Jan 25 10:45:01 2007 - USB Mouse Lower filter driver, Gigabyte GM-M6800 Driver

You need to eliminate these as a cause of your problems by updating them or updating the hardware associated with them (keyboard and mouse).

Once you have updated Realtek, your keyboard drivers, and your mouse drivers (or update the keyboard and/or mouse), uninstall the old drivers or navigate to C:\Windows\System32\Drivers and rename them from xxx.sys to xxx.bak. Reboot. And let your system run. We will go from there.

 

[gedafe]

Gents,

I downloaded and installed the newest Realtek codec (R2.49). However, it re-installed the whfltr2k.sys from 2007. I also un-installed/re-installed the keyboard and mouse drivers with the latest ones dated 2009/10 from the Steelseries and Gigabyte websites. These too reinstalled the xxx.sys files.

I then changed the xxx.sys files to xxx.bak files and re-installed everything. Now, there are the xxx.sys files and xxx.bak files all dated 2007 in the driver folder--only difference is the timestamps are 2 hours later, but I'm not sure that really makes any difference.

When I remove the xxx.sys files, my mouse and keyboard stop working and sound goes away. Heh, luckily I had another travel mouse (not win 7 compliant--kept having to remove and reinsert it to keep it working) to rename the xxx.bak files back to xxx.sys. Then everything started working again.

The thing about the realtek driver is that my sound is embedded--it is not a card. So if the driver is the problem, does that mean I need a new motherboard? I've searched forums concerning it, and I can't seem to find anyone with a problem running win7 on their p55-gd65.

I haven't had a BSOD yet, but it's probably just a matter of time. What's next in the process?

--Oh, BTW Carl, I want to thank you for your family's service and sacrifice (gold star) to our country. I keep wanting to say that every time I see your banner. There are 3 in our family who are serving/have served to defend our country's freedoms as well.

 

[CarlTR6]

I should have been more clear in my instructions. I meant that if you upgraded your keyboard and mouse with replacements, you should rename those files. If you upgrade the drivers, you will be good to go. I'm sorry about that; I did not intend to cause more problems.

Possibly the Realtec driver will work with since you have updated your keyboard and mouse drivers. Make sure the mouse and keyboard drivers are the latest you can find.

Oh, BTW Carl, I want to thank you for your family's service and sacrifice (gold star) to our country. I keep wanting to say that every time I see your banner. There are 3 in our family who are serving/have served to defend our country's freedoms as well.

Thank you very much. And I thank those in your family for their service to our nation. Salute! There are four in my family who have served or are serving: my oldest daughter, my two sons, me and my stepson is still serving. We are all Army.

Back to the topic. Please post ASAP in you encounter another BSOD. Also let us know how your system is doing if you don't get any BSOD's.

 

[gedafe]

Carl,

Rock on! We're a tri-service family: Army, Navy, Air Force, Dad, brother, me respectively.

Ended up keeping the Alpham1, Alpham2, and whfltr2k so I could continue to have the keyboard and mouse work. I will switch them out when I can get a new keyboard and mouse.

BSOD still haunts my rig after I installed the new Realtek audio driver. Latest two minidumps attached. I attempted to do a backup when both happened.

 

[CarlTR6]

I thank you for your service, too. You all covered the branches well! My dad is a USCG WWII vet. He is still living. So counting him, I have five in my family.

Both this are error codes 1A

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

Neither of these dumps tell us anything we don't already know

Can you boot in the safe mode (F8) and do your back up?

 

[gedafe]

Yep, I got a backup covered--apparently, when I booted back up from the BSOD, the backup automatically started. This time it did not BSOD. Hmm, this debugging thing is rather tedious. What's next?

 

[CarlTR6]

Debugging is tedious. It is trial and error and perseverance. I tis that way even for a tech at a shop. Of course, the tech has the computer right in front of him/her and can watch for nuances and clues that we cannot see; so it goes faster.

Let's see how long you go before a BSOD and then we will look at the fresh dmp. One of the other BSOD team members may step in with an additional thought that I have missed in the mean time.

I think you might want to try a new mouse and keyboard so that we can totally eliminate those drivers as a factor.

 

[gedafe]

Carl,

Sounds good. It may be awhile (couple weeks maybe) before I get a new keyboard/mouse for $$-purposes. However, if I can get another one somehow before that, I'll give the replacement a try.

Just noticed another BSOD when I came home for my lunch break. Attached is the minidump. I have a feeling it won't show anything different from what's been coming up the last several minidumps.

Thanks for your continued help.

 

[Jonathan_King]

I suggest removing Kaspersky before purchasing new hardware. Keep the license key in case you ever want to install it again.

Run this removal tool: http://support.kaspersky.com/downloads/utils/kavremover10.zip

Replace it with MSE: http://www.microsoft.com/security_essentials

 

[gedafe]

Jonathan,

Kaspersky's gone and MSE's installed, but got another BSOD when trying to do a full scan. When Kaspersky did full scans or I tried to do a backup, this too usually caused the BSOD. Attached is the latest minidump, but I'm thinking it's still going to point to the same memory management error.

What do you think?

 

[CarlTR6]

You are correct -

STOP 0x0000001A: MEMORY_MANAGEMENT
Usual causes: Device driver, memory, kernel

However this dmp may have offered us a clue; it pointed to the file, standby.exe as the cause. Keep in mind that standby.exe could have been running or loaded and got the blame when something else actually caused the crash.

Standby.exe with description. Standby service is a process file from company Corel belonging to product Standby service.
In total there are 3 launchpoints for this file including "Running processes".
There are 4 different variations of the file in our database and the file is digitally signed from Corel Corporation.

I am not familiar with this program; but you might try uninstalling this software and see if that helps the problem. If the program is something that you frequently use, you can always reinstall it.

 

[gedafe]

Carl,

Thanks for the update--I deleted standby.exe, but I still got another BSOD today. Attached is the latest minidump.

Oh, it happened again sometime after I tried to do a full scan using MS/SE. Apparently, I can't do any full scan of the system, whether using MS/SE, Kaspersky (no longer installed), or doing a backup vis Win7.

-Fence

 

[CarlTR6]

This one is another error code 1A. Memory corruption is blamed.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {8886, 841df3b4, 84cdb0d0, 500}

Probably caused by : memory_corruption ( nt!MiUnlinkPageFromLockedList+51 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00008886, The subtype of the bugcheck.
Arg2: 841df3b4
Arg3: 84cdb0d0
Arg4: 00000500

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_8886

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  2

TRAP_FRAME:  a9087824 -- (.trap 0xffffffffa9087824)
ErrCode = 00000000
eax=00000000 ebx=89032030 ecx=a90878b4 edx=00000011 esi=ac68f800 edi=0000000f
eip=8308363c esp=a9087898 ebp=a90878d8 iopl=0         nv up ei ng nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
nt!CcMapData+0xae:
8308363c 8a0e            mov     cl,byte ptr [esi]          ds:0023:ac68f800=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82ed6026 to 82f18d10

STACK_TEXT:  
a908761c 82ed6026 0000001a 00008886 841df3b4 nt!KeBugCheckEx+0x1e
a908765c 82ed7bd5 00000000 82f704c0 84b34200 nt!MiUnlinkPageFromLockedList+0x51
a90876ac 82ee3e29 00000000 ac68f800 8db64478 nt!MiResolveTransitionFault+0x550
a90876f8 82ecc916 00000000 ac68f800 c0563478 nt!MiResolveProtoPteFault+0x3d8
a9087780 82ec2d76 ac68f800 00000000 82f704c0 nt!MiDispatchFault+0x5d6
a908780c 82e82638 00000000 ac68f800 00000000 nt!MmAccessFault+0x157c
a908780c 8308363c 00000000 ac68f800 00000000 nt!KiTrap0E+0xdc
a90878d8 8bc99a06 870b0e60 a9087910 00000400 nt!CcMapData+0xae
a9087900 8bc98f57 8575f330 865179d0 05c8f800 Ntfs!NtfsMapStream+0x4a
a908797c 8bc99949 8575f330 86d260d8 949e1250 Ntfs!NtfsReadMftRecord+0x7d
a90879a8 8bc9977d 8575f330 86d260d8 949e1250 Ntfs!NtfsReadFileRecord+0x31
a90879d8 8bcc2104 8575f330 949e1248 949e1250 Ntfs!NtfsLookupInFileRecord+0x11f
a9087ac4 8bc935f9 8575f330 00000001 00000000 Ntfs!NtfsUpdateFcbInfoFromDisk+0x6f
a9087bf4 8bca7381 8575f330 89863de0 adb7e918 Ntfs!NtfsOpenFile+0x4c4
a9087cdc 8bc2d210 8575f330 89863de0 aa2ab8bc Ntfs!NtfsCommonCreate+0xd84
a9087d1c 82eac11e aa2ab854 00000000 ffffffff Ntfs!NtfsCommonCreateCallout+0x20
a9087d1c 82eac215 aa2ab854 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x15a
aa2ab7b8 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkPageFromLockedList+51
82ed6026 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiUnlinkPageFromLockedList+51

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x1a_8886_nt!MiUnlinkPageFromLockedList+51

BUCKET_ID:  0x1a_8886_nt!MiUnlinkPageFromLockedList+51

Followup: MachineOwner
---------

The dmp points to msmpeng.exe which is part of MSE. This is the first time I have seen this. I will get additional help with this.

 

[CarlTR6]

Thanks, Ken; I appreciate the help.

gedafe, we might be at a stalemate until you can update your mouse and keyboard.

 

[CarlTR6]

Ken said that msmpeng.exe might have been caught up in the memory corruption or may have been the cause. He suggested that you might uninstall MSE and reinstall it in case it got corrupted.

MSE should not cause a crash since it is an MS application designed for MS OS's.

 

[gedafe]

Carl,

Thanks for the info. I uninstalled and then re-installed MS/SE. It runs a quick scan just fine. However, the computer still crashes when it tries to do a full scan. I don't know for certain, but I think you're probably going to see the same minidump problem in the attached/latest file.

Weird, no?
-----
And it crashed again after installing the MS/SE upgrade after the restart on the log on screen. That is the second minidump attached.

 

[CarlTR6]

gedafe, these latest two dumps are the same as those we have been seeing blaming memory corruption.

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

To recap (so I know where we are in this process)

1. You have removed Kaspersky and installed MSE eliminating that possible cause.

2. You have succesfully run memtest twice with no errors.

3. You have uninstalled Standby which was pointed to in an earlier dump.

4. You ran Driver Verifier although maybe not successfully. It got stuck in a loop.

5. I think I messed you up with your Gigabyte GM-M6800 Driver. If you can find a driver newer than whfltr2k.sys Jan 25 2007, please install it and lets eliminate that possibility.

6. That leaves the mouse and keyboard drivers as possibilities which you said in a couple of weeks you may be able to upgrade your keyboard and mouse.

To eliminate some other possibilities, I suggest that you run System File Check.

Open an elevated command prompt (run as Administrator).
At the prompt, type "sfc /scannow" without the quotes and press enter.
If sfc finds errors, it should correct hem. If this occurs run SFC three more times.
Post the results of SFC

After you have done these two things, reboot and let's see where we are.

 

[gedafe]

Carl,

Thanks for the recap--you're right: I have done all items 1 though 5, although I have not been able to find an update for whfltr2k.sys Jan 25 2007 anywhere online--it's the Gigabyte support website's latest, although it ships out with an executable that is dated 2009. Apparently, everything but the driver was updated by the company.

I have not had a chance or the extra $$ to get a new keyboard/mouse as of yet.

I ran scannow and it ran with the following message: "Windows Resource Protection did not find any integrity violations." I'm assuming this means that whatever it checked is ok?

Heh, I've had no BSODs yet today, but I've also had the computer turned off for a good 24 or so hours. There's a quick fix--don't want BSOD, keep the computer turned off. LOL

 

[ttran]

I ran scannow and it ran with the following message: "Windows Resource Protection did not find any integrity violations." I'm assuming this means that whatever it checked is ok?

Yep, it means your system files are ok