Win7 32-bit Crashing Since Jan 2010

[CarlTR6]

I'm glad to see your system files are good to go. Replace your mouse first. You don't have to replace them both at the same time. That one is the oldest driver.

I like your fix for BSOD's - leave the computer off!

 

[ttran]

I like your fix for BSOD's - leave the computer off!

that's funny....

 

[gedafe]

Carl and Tran,

Computer ran fine for four days, and then another BSOD. The minidump is attached, but I'm guessing, as usual, it's pointing to the same thing.

Also, I haven't gotten a new mouse yet... maybe sometime next week.

 

[ttran]

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

 BugCheck 4E, {2, 236ce, cf77f, 29}
 
 Probably caused by : memory_corruption (  nt!MiUnlinkPageFromLockedList+51 )
 
 Followup: MachineOwner
 ---------

U've said you ran memtestx86 for at least 7 passes without any error-->eliminate this
As you can see in the quote I put above, the other potential cause here is only device drivers. Again, if you can update the Gigabyte driver, it would be great, re-install it.
The mouse & keyboard would be important too, as Carl mentioned before when he was eliminating things for you.
If replace the mouse doesn't solve the BSODs, we will go to the next step: Driver Verifier

Regard,

Tuan

 

[CarlTR6]

I agree with Tuan. We know some of the drivers are old. These should be updated before you run Driver Verifier. On the other hand, you can run Driver Verifier and see which drivers it BSOD's on. Be sure to print out the instructions before you turn Driver Verifier on.

 

[gedafe]

Tuan/Carl,

Sounds good--I still don't have a new mouse or keyboard yet, but I'll re-run the driver verifier. The last time I did that, it crashed and looped a crash prior to every boot cycle. I don't think it's going to get further than that again, but I'll run it just in case.

Also, had another crash--this one happened prompted by the backup. As I indicated in a post awhile back, the BSOD's are usually random except when running a backup or a full antivirus scan. I'm not sure what processes are different in these two cases, but backups and full scans always crash the computer.

Attached is the newest minidump from the crash caused by the backup. I'll re-post after the driver verifier executes.

Thanks

 

[ttran]

I suggest you to run 2 things:
http://www.sevenforums.com/tutorials/433-disk-check.html
And,
HD Diagnostic

The dmp file you just posted was still memory corruption, the process running at that time is window defender. However, with what you described, I would like you to process those 2 checks:sarc:

Will see how Carl think about this...

 

[CarlTR6]

This dump is another stop error 1A and blames memory corruption. The dump does not really tell us very much.

STOP 0x0000001A: MEMORY_MANAGEMENT
Usual causes: Device driver, memory, kernel

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_070410-18844-01.zip\070410-18844-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e4e000 PsLoadedModuleList = 0x82f96810
Debug session time: Sun Jul  4 21:52:54.987 2010 (GMT-4)
System Uptime: 0 days 8:32:05.892
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols
Loading unloaded module list
..........
1: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {411, c00c77f0, 23613824, c00c772f}

Probably caused by : memory_corruption ( nt!MiLockTransitionLeafPage+115 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00000411, The subtype of the bugcheck.
Arg2: c00c77f0
Arg3: 23613824
Arg4: c00c772f

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_411

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 82f0bf0b to 82f2ad10

STACK_TEXT:  
9c627b7c 82f0bf0b 0000001a 00000411 c00c77f0 nt!KeBugCheckEx+0x1e
9c627bbc 82ee96a4 9c627c24 00000000 18efeae0 nt!MiLockTransitionLeafPage+0x115
9c627c0c 82ede95f 00000000 18efeae0 c00c77f0 nt!MiResolveTransitionFault+0x20
9c627c90 82ed5dd5 18efeae0 00000000 88c82528 nt!MiDispatchFault+0x61f
9c627d1c 82e94638 00000000 18efeae0 00000001 nt!MmAccessFault+0x25cc
9c627d1c 62a45a94 00000000 18efeae0 00000001 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f1f074 00000000 00000000 00000000 00000000 0x62a45a94


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiLockTransitionLeafPage+115
82f0bf0b cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiLockTransitionLeafPage+115

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cacf

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x1a_411_nt!MiLockTransitionLeafPage+115

BUCKET_ID:  0x1a_411_nt!MiLockTransitionLeafPage+115

Followup: MachineOwner
---------

I agree with Tuan; but run driver verifier again first so that we can, at least, rule out drivers.

 

[gedafe]

Carl/Tuan,

Ran driver verifier again--it appeared to have similar results as last time. It booted, got to the "Windows" logo screen and then BSOD. I ran it through 3 reboots, but weirdly, only one of the minidumps actually had any information in it. I've attached all three, but it looks like two of the files have 0kb in them.

-Fence

 

[CarlTR6]

The fact the Driver Verifier does not run long enough to generate dumps indicates a hardware or hardware related problem.

The dump that was generated is a stop error A.

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

The dump file pointed to MBfilt32.sys as the cause. This is a Realtek High Definition Audio Driver and it showed before in your dumps. Apparently Driver Verifier is not getting past this particular driver. The driver is up to date. I do find a driver related to your audio that is obsolete.

GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)

This driver is a CDRom Class Filter Driver or Filter Driver for 2k and XP or CD/DVD Class Filter Driver or CD DVD Filter or GEAR ASPI Filter Driver which belongs to the software GEAR.wrks or GEAR CDRom Filter or GEARAspi or GEARAspiWDM or Norton Ghost or MixMeister Studio Demo or MixMeister Pro or GEAR 32bit Driver Installer or MixMeister CD-R Drivers or Drive Image or Norton Save and Restore or CD DVD Filter or GearDrvs or iTunes or GEAR ASPI Filter Driver or GEAR driver installer for x by GEAR Software Inc (www.gearsoftware.com). It seems to be most frequently associated with GEAR Software disc copying service installed with iTunes and other CD / DVD burning software file.

I recommend that you uninstall the software this driver is associated with. Then navigate to c:\windows\system32\drivers and see if the driver is still there. If it is, rename it from gearaspiwdm.sys to gearaspiwdm.bak and reboot.

I find another obsolete driver that may be a contributing cause:

jraid.sys Wed May 27 01:39:24 2009 (4A1CD20C) - JMicron RAID Driver Driver

Try to update this driver to the latest version. Windows 7 generally does not like older drivers and they can cause hardware conflicts including memory corruption. I have not worked with RAID before. There are others here who have much experience with RAID and I hope one of them will drop by and offer advice.

Here is the actual dump:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_verifier dumps.zip\070510-21590-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL]http://msdl.microsoft.com/download/symbols[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e02000 PsLoadedModuleList = 0x82f4a810
Debug session time: Mon Jul  5 12:35:51.992 2010 (GMT-4)
System Uptime: 0 days 0:00:25.256
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 2, 0, 82e3ea5b}

*** WARNING: Unable to verify timestamp for MBfilt32.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt32.sys
Probably caused by : MBfilt32.sys ( MBfilt32+1641 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82e3ea5b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82f6a718
Unable to read MiSystemVaType memory at 82f4a160
 00000016 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiSignalNotificationObject+18
82e3ea5b 807f1601        cmp     byte ptr [edi+16h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  883d2c44 -- (.trap 0xffffffff883d2c44)
ErrCode = 00000000
eax=821e59bc ebx=00000000 ecx=2b81c902 edx=00000100 esi=821e59c4 edi=00000000
eip=82e3ea5b esp=883d2cb8 ebp=883d2cc4 iopl=0         nv up ei pl nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KiSignalNotificationObject+0x18:
82e3ea5b 807f1601        cmp     byte ptr [edi+16h],1       ds:0023:00000016=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e3ea5b to 82e4882b

STACK_TEXT:  
883d2c44 82e3ea5b badb0d00 00000100 00000000 nt!KiTrap0E+0x2cf
883d2cc4 82e6975d 88337120 8f560fdc 8cb04e70 nt!KiSignalNotificationObject+0x18
883d2ce8 8313bd4d 821e59bc 00000008 00000000 nt!KeSetEvent+0x98
883d2d08 a4301641 821e59bc 00000008 00000000 nt!VerifierKeSetEvent+0x58
WARNING: Stack unwind information not available. Following frames may be wrong.
883d2d1c 8313816f 00000000 8f560f48 821e59bc MBfilt32+0x1641
883d2d3c 831382d5 8f560f48 00000000 86398a70 nt!ViPendingCompleteAfterWait+0x5d
883d2d50 830106bb 82f41f34 a3bce452 00000000 nt!ViPendingWorkerThread+0x27
883d2d90 82ec20f9 831382ae 82f41f34 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt32+1641
a4301641 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt32+1641

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt32

IMAGE_NAME:  MBfilt32.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a72678e

FAILURE_BUCKET_ID:  0xA_VRF_MBfilt32+1641

BUCKET_ID:  0xA_VRF_MBfilt32+1641

Followup: MachineOwner
---------

3: kd> lmtsmn
start    end        module name
8edc3000 8edef000   1394ohci 1394ohci.sys Mon Jul 13 19:51:59 2009 (4A5BC89F)
858b0000 858f8000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
86164000 861be000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
8ebdb000 8ebed000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
a4360000 a436a680   Alpham1  Alpham1.sys  Mon Jul 23 03:56:57 2007 (46A45F49)
a4390000 a4394800   Alpham2  Alpham2.sys  Tue Mar 20 05:49:51 2007 (45FFAE3F)
859f7000 85a00000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
8df23000 8df37480   archlp   archlp.sys   Tue Jan 12 03:07:05 2010 (4B4C2DA9)
859d5000 859de000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
85800000 85823000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
944bf000 944dd000   AtiHdmi  AtiHdmi.sys  Thu May 06 05:19:48 2010 (4BE289B4)
8e62b000 8ebce000   atikmdag atikmdag.sys Thu May 27 12:44:23 2010 (4BFEA167)
8df4a000 8df82000   atikmpag atikmpag.sys Thu May 27 12:25:19 2010 (4BFE9CEF)
860d0000 860d7000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8df15000 8df23000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
856ab000 856b3000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
a691a000 a697e000   bthport  bthport.sys  Mon Jul 13 19:51:30 2009 (4A5BC882)
a6908000 a691a000   BTHUSB   BTHUSB.sys   Mon Jul 13 19:51:36 2009 (4A5BC888)
8df08000 8df14300   CBDisk   CBDisk.sys   Wed Jan 13 04:15:41 2010 (4B4D8F3D)
a55b0000 a55ce000   cdd      cdd.dll      unavailable (00000000)
86087000 860a6000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
856f5000 857a0000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
86030000 86055000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
856b3000 856f5000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
85ba0000 85bfd000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8ebce000 8ebdb000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
a4315000 a4322000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8de8c000 8def0000   csc      csc.sys      Mon Jul 13 19:15:08 2009 (4A5BBFFC)
a43ac000 a43c8400   cxbu0wdm cxbu0wdm.sys Mon Jan 25 09:56:25 2010 (4B5DB119)
8def0000 8df08000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8de80000 8de8c000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
85dcb000 85ddc000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
9450c000 94525000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
a432d000 a4336000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
a4322000 a432d000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
a4336000 a4347000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
a430b000 a4315000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
8ec14000 8eccb000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 20:48:33 2009 (4AC54DE1)
8eccb000 8ed04000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:25:25 2009 (4A5BC265)
85600000 85611000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
857c6000 857fa000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
85a0e000 85a17000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
85d99000 85dcb000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
85f70000 85fa1000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
8edf9000 8edfe280   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
83212000 83249000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
8ed04000 8ed23000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
a4376000 a4389000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
a4389000 a438f480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
a436b000 a4376000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
85e10000 85e18000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
8df38000 8df4a000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
859de000 859f7000   jraid    jraid.sys    Wed May 27 01:39:24 2009 (4A1CD20C)
8ebed000 8ebfa000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
a4395000 a43a1000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80bb7000 80bbf000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
94428000 9445c000   ks       ks.sys       Mon Jul 13 19:45:13 2009 (4A5BC709)
85b8d000 85ba0000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
85d07000 85d2c000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
a6988000 a69a3000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
a68c6000 a6907d80   lvrs     lvrs.sys     Fri May 14 17:51:39 2010 (4BEDC5EB)
a622d000 a68b1e80   lvuvc    lvuvc.sys    Fri May 14 17:52:03 2010 (4BEDC603)
a4300000 a430b000   MBfilt32 MBfilt32.sys Thu Jul 30 23:39:58 2009 (4A72678E)
85622000 8569a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
85d59000 85d99000   MDFSYSNT MDFSYSNT.sys Thu Feb 04 11:52:09 2010 (4B6AFB39)
85823000 8582e000   MDPMGRNT MDPMGRNT.sys Fri Jan 22 12:20:25 2010 (4B59DE59)
a43a1000 a43ac000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
8dfea000 8dff7000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
a43e2000 a43ed000   mouhid   mouhid.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
859bf000 859d5000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
860a6000 860c9000   MpFilter MpFilter.sys Sat Mar 20 00:03:26 2010 (4BA4490E)
86129000 86134000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
85901000 85909000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
85b62000 85b8d000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
8de76000 8de80000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
85e00000 85e10000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
85c12000 85cc9000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
8ec09000 8ec14000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
8df82000 8dfa4000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
944ae000 944bf000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
85e18000 85e26000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
861be000 861f0000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
85cc9000 85d07000   NETIO    NETIO.SYS    Mon Jul 13 19:12:35 2009 (4A5BBF63)
94525000 945f9000   netr28u  netr28u.sys  Fri Feb 12 04:40:05 2010 (4B7521F5)
86134000 86142000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
8de6c000 8de76000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
82e02000 83212000   nt       ntkrpamp.exe Sat Feb 27 02:33:35 2010 (4B88CACF)
85a33000 85b62000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
860c9000 860d0000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
86000000 8601f000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
8593e000 8594f000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
85909000 85933000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
859aa000 859b1000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
859b1000 859bf000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
85a00000 85a0e000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
944dd000 9450c000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
8569a000 856ab000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
8e600000 8e618000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
8dfa4000 8dfbc000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
8dfbc000 8dfd3000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
8dfd3000 8dfea000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
8de2b000 8de6c000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
8e618000 8e622000   rdpbus   rdpbus.sys   Mon Jul 13 20:02:40 2009 (4A5BCB20)
86111000 86119000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
86119000 86121000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
86121000 86129000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
85d2c000 85d59000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
8ed7d000 8edc3000   Rt86win7 Rt86win7.sys Mon Mar 22 05:56:53 2010 (4BA73EE5)
a4009000 a42ff340   RTKVHDA  RTKVHDA.sys  Tue Jun 08 05:06:12 2010 (4C0E0804)
a43d4000 a43e0000   scfilter scfilter.sys Mon Jul 13 19:33:50 2009 (4A5BC45E)
857a0000 857c6000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
8edef000 8edf9000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
85ddc000 85df6000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
a43c9000 a43d4000   SMCLIB   SMCLIB.SYS   Mon Jul 13 19:45:28 2009 (4A5BC718)
85fe9000 85ff1000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
8ebfa000 8ebfb380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
85e27000 85f70000   tcpip    tcpip.sys    Mon Jul 13 19:13:18 2009 (4A5BBF8E)
86159000 86164000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
86142000 86159000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
85c00000 85c10000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
a5580000 a5589000   TSDDD    TSDDD.dll    unavailable (00000000)
9445c000 9446a000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
a68b2000 a68c5b00   usbaudio usbaudio.sys Mon Jul 13 19:51:23 2009 (4A5BC87B)
a4347000 a435e000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
a435e000 a435f700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
8ed23000 8ed32000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
9446a000 944ae000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
8ed32000 8ed7d000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
85933000 8593e000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
860d7000 860e3000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
860e3000 86104000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
85fa1000 85fa9380   vmstorfl vmstorfl.sys Mon Jul 13 19:28:44 2009 (4A5BC32C)
8594f000 8595f000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8595f000 859aa000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
85faa000 85fe9000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
a697e000 a6988000   vwifibus vwifibus.sys Mon Jul 13 19:52:02 2009 (4A5BC8A2)
8601f000 86030000   vwififlt vwififlt.sys Mon Jul 13 19:52:03 2009 (4A5BC8A3)
85a17000 85a2a000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
86104000 86111000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
85831000 858a2000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
858a2000 858b0000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
861f0000 861f7000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
a43e0000 a43e1a80   whfltr2k whfltr2k.sys Thu Jan 25 10:45:01 2007 (45B8D07D)
a5320000 a556a000   win32k   win32k.sys   unavailable (00000000)
8ec00000 8ec09000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:19:16 2009 (4A5BC0F4)
858f8000 85901000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
a69a3000 a69bd000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)

Unloaded modules:
86055000 86062000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
86062000 8606d000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
8606d000 86076000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
86076000 86087000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

After you update the above drivers or uninstall the software, reboot and see where you stand. I am hoping that taking care of the audio problem will help your system. Then turn Driver Verifier back on and let's see what shows up. You have not yet gotten a real run of Driver Verifier.

If this does not help and the sound driver shows up again, I am going to suggest installing a new sound card and disabling the onboard sound card.

 

[gedafe]

Carl,

Just some updates:

I relabeled the GEARAspiWDM.sys to .bak, because I couldn't find the program that used it.

I also am having trouble finding an update to jraid.sys online.

I ordered a microsoft mouse and keyboard today--I should have them by the end of the week.

I'm not sure what to do about the MBfilt32.sys, due to the fact that the sound is embedded in the MOBO--I do not have a separate sound card.

As soon as I find an update to the jraid.sys, I'll redo the driver verifier and post the minidumps.

 

[CarlTR6]

Good job on renaming GEARAspiWDM.sys to .bak. That takes care of that one.

I have been reading about a RAID and viewing other threads on different sites regarding RAID problems. I don't know much about RAID having never used it. I found out that RAID is notorious for causing BSOD's in Win 7 and updated drivers are critical. Did you follow this link to see if there is an updated jraid.sys, Driver? I have a suspicion that this may be a major source of your problem.

Did you check MSI and/or Intel for an update to MBfilt32.sys?

Glad you have a mouse and keyboard on the way.

Edited to add: Try this link for MSI: http://www.msi.com/index.php?func=downloadindex

 

[gedafe]

Carl,

I updated jraid.sys to the latest MSI update.

I also ran verifier.exe--amazingly, it got to the login screen and allowed me to login, but soon afterwards BSOD. I've attached the four minidumps. I think we may be getting along further than before--I never could get to the login screen, much less be able to login.

Still can't find an update for mbfilt32.sys though.

What's next?

 

[CarlTR6]

I did notice jraid.sys was updated. Good work.

Only two of the dmps were good; the first and last ones had 0 bytes.

STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL ]

Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

STOP 0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION

Usual causes: Device driver

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_Minidumps.zip\070510-23899-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e15000 PsLoadedModuleList = 0x82f5d810
Debug session time: Mon Jul  5 22:11:57.526 2010 (GMT-4)
System Uptime: 0 days 0:00:52.806
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
...........
0: kd> !analyze
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 98, ab7f2430, a340c6a3}

Unable to load image \SystemRoot\system32\DRIVERS\whfltr2k.sys, Win32 error 0n2
*** ERROR: Module load completed but symbols could not be loaded for whfltr2k.sys
[B]Probably caused by : whfltr2k.sys[/B] ( whfltr2k+6a3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
[B]A device driver attempting to corrupt the system has been caught.[/B]  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 000000f6, Referencing user handle as KernelMode.
Arg2: 00000098, Handle value being referenced.
Arg3: ab7f2430, Address of the current process.
Arg4: a340c6a3, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  [B]wh_exec.exe[/B]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 83149f03 to 82ef1d10

STACK_TEXT:  
b057da5c 83149f03 000000c4 000000f6 00000098 nt!KeBugCheckEx+0x1e
b057da7c 8314e766 00000098 ab7f2430 89aa6d48 nt!VerifierBugCheckIfAppropriate+0x30
b057db10 830392b4 00000098 af3b2fd8 00000000 nt!VfCheckUserHandle+0x14f
b057db44 8303916e 00000098 00000000 00000000 nt!ObReferenceObjectByHandleWithTag+0x13b
b057db68 83157736 00000098 00000000 00000000 nt!ObReferenceObjectByHandle+0x21
b057db90 a340c6a3 00000098 00000000 00000000 nt!VerifierObReferenceObjectByHandle+0x21
WARNING: Stack unwind information not available. Following frames may be wrong.
b057dbdc 831446c3 0eaecb28 003b2f68 89bf4a00 [B]whfltr2k[/B]+0x6a3
b057dc00 82e51473 00000000 af3b2f68 88aecb28 nt!IovCallDriver+0x258
b057dc14 83052f2e 89bf4a00 af3b2f68 af3b2fd8 nt!IofCallDriver+0x1b
b057dc34 8306fd11 88aecb28 89bf4a00 00000000 nt!IopSynchronousServiceTail+0x1f8
b057dcd0 830724ec 88aecb28 af3b2f68 00000000 nt!IopXxxControlFile+0x6aa
b057dd04 82e5844a 00000060 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b057dd04 770664f4 00000060 00000000 00000000 nt!KiFastCallEntry+0x12a
016dff18 00000000 00000000 00000000 00000000 0x770664f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
whfltr2k+6a3
a340c6a3 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  whfltr2k+6a3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: whfltr2k

IMAGE_NAME:  [B]whfltr2k.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  45b8d07d

FAILURE_BUCKET_ID:  0xc4_f6_VRF_[B]whfltr2k[/B]+6a3

BUCKET_ID:  0xc4_f6_VRF_whfltr2k+6a3

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp3_Minidumps.zip\070510-22479-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.x86fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0x82e55000 PsLoadedModuleList = 0x82f9d810
Debug session time: Mon Jul  5 22:10:20.783 2010 (GMT-4)
System Uptime: 0 days 0:00:19.673
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {16, 2, 0, 82e91a5b}

*** WARNING: Unable to verify timestamp for MBfilt32.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt32.sys
[B]Probably caused by : MBfilt32.sys[/B] ( MBfilt32+1641 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000016, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82e91a5b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82fbd718
Unable to read MiSystemVaType memory at 82f9d160
 00000016 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiSignalNotificationObject+18
82e91a5b 807f1601        cmp     byte ptr [edi+16h],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  881c6c44 -- (.trap 0xffffffff881c6c44)
ErrCode = 00000000
eax=82bc59bc ebx=00000000 ecx=2b9fdf02 edx=00000100 esi=82bc59c4 edi=00000000
eip=82e91a5b esp=881c6cb8 ebp=881c6cc4 iopl=0         nv up ei pl nz ac pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010217
nt!KiSignalNotificationObject+0x18:
82e91a5b 807f1601        cmp     byte ptr [edi+16h],1       ds:0023:00000016=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e91a5b to 82e9b82b

STACK_TEXT:  
881c6c44 82e91a5b badb0d00 00000100 00000000 nt!KiTrap0E+0x2cf
881c6cc4 82ebc75d 807c3120 933c4fdc 8affe1f8 nt!KiSignalNotificationObject+0x18
881c6ce8 8318ed4d 82bc59bc 00000008 00000000 nt!KeSetEvent+0x98
881c6d08 a4119641 82bc59bc 00000008 00000000 nt!VerifierKeSetEvent+0x58
WARNING: Stack unwind information not available. Following frames may be wrong.
881c6d1c 8318b16f 00000000 933c4f48 82bc59bc MBfilt32+0x1641
881c6d3c 8318b2d5 933c4f48 00000000 86199478 nt!ViPendingCompleteAfterWait+0x5d
881c6d50 830636bb 82f94ee0 a383b235 00000000 nt!ViPendingWorkerThread+0x27
881c6d90 82f150f9 8318b2ae 82f94ee0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt32+1641
a4119641 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt32+1641

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt32

IMAGE_NAME: [B] MBfilt32.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  4a72678e

FAILURE_BUCKET_ID:  0xA_VRF_MBfilt32+1641

BUCKET_ID:  0xA_VRF_MBfilt32+1641

Followup: MachineOwner
---------

The first dump with error code C4 points to whfltr2k.sys as the cause. That is one of your mouse drivers.

The second dump with error code points to MBfilt32.sys as the cause. That is your Realtek High Definition Audio Driver. I want to point out that the driver may not be at fault; it may be the chip itself. However, whfltr2k.sys is a 2007 driver and very obsolete.I have suspected this driver from the start.

I see two options: (1) update the drive; or (2) install a new sound card and disable the onboard sound.

Realtek or the MSI website. MSI would be better if you can find an update there.

Next, we wait for your new mouse and keyboard. You can turn off Driver Verifier.

 

[gedafe]

Carl,

Still waiting on the mouse and keyboard. They shipped on Tue and Wed, so I'm hoping to have them tomorrow. However, while I've been waiting, I had another BSOD (attached). Don't really think it's going to be any different than the ones we've been seeing.

-Fence

 

[ttran]

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

This time memory corruption is blamed. however, as you can see in the quote, this can be driver issue. And we have been discussing so far that this can be due to your mouse driver. So, let's wait for new mouse to come.

Have you followed the instruction about Audio driver that Carl suggest?

Also, in looking through your drivers, I see that you have this out of date drivers, I don't know if Carl ever mentioned this to you. But please update them if possible:

9a176000 9a180680   Alpham1  Alpham1.sys  Mon Jul 23 14:56:57 2007 (46A45F49)
9a1a6000 9a1aa800   Alpham2  Alpham2.sys  Tue Mar 20 16:49:51 2007 (45FFAE3F)

I guess they belong to Ideazon ZBoard??
http://www.steelseries.com/download
Regard,

Tuan

 

[gedafe]

Tuan,

I'm thinking it's got to be a driver thing. I ran memtest all day today: 13 passes clean with no errors.

Still no luck on the keyboard and mouse though--apparently, they are still en-route to me via USPS. Oh well, I guess I'll wait until Monday. If/when I get the new microsoft keyboard/mouse, I should be able to get rid of several of the older drivers: alpham 1 and 2 (steelseries keyboard),whfltr2k (gigabyte mouse).

The only ones left will be the HD audio driver.

I guess we'll see come Monday...

-Fence

 

[Jonathan_King]

Driver Verifier flagged your mouse drivers as the cause. It is therefore highly likely that either the mouse itself is faulty, or the drivers are buggy/incompatible.

 

[CarlTR6]

I think Jonathan is spot on. Let's wait until you get your mouse and keyboard installed and see what happens.

 

[gedafe]

Carl/Tuan/Jonathan,

Just wanted to update you: I've had my new keyboard and mouse since Tuesday, and so far, no BSOD's. Knock on wood for no more. Thanks for all the help! Hopefully, I won't have to come back for more problem solving on this issue.

Thanks again!

-Fence