Windows 7 BSOD - Windows 7 - Random

[brimmy]

I haven't really been able to determine anything that triggers them it just seems to be random and happens once or twice every day or two.

I have a feeling it's memory related...

 

[kaos]

minidump

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000311b78b, Address of the instruction which caused the bugcheck
Arg3: fffff8800536cfe0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
nt!MiUnsecureVirtualMemory+6b
fffff800`0311b78b 8b4540          mov     eax,dword ptr [rbp+40h]
CONTEXT:  fffff8800536cfe0 -- (.cxr 0xfffff8800536cfe0)
rax=0000000000000000 rbx=fffffa8009602060 rcx=0000868a3fffff06
rdx=fffffa8007499500 rsi=fffffa8007499500 rdi=0000000000800000
rip=fffff8000311b78b rsp=fffff8800536d9b0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000002028
r11=fffff8800536d9c0 r12=fffffa8007499718 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!MiUnsecureVirtualMemory+0x6b:
fffff800`0311b78b 8b4540          mov     eax,dword ptr [rbp+40h] ss:0018:00000000`00000040=????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  hon.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8000311b78b
STACK_TEXT:  
fffff880`0536d9b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiUnsecureVirtualMemory+0x6b

FOLLOWUP_IP: 
nt!MiUnsecureVirtualMemory+6b
fffff800`0311b78b 8b4540          mov     eax,dword ptr [rbp+40h]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!MiUnsecureVirtualMemory+6b
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34
STACK_COMMAND:  .cxr 0xfffff8800536cfe0 ; kb
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  X64_0x3B_nt!MiUnsecureVirtualMemory+6b
BUCKET_ID:  X64_0x3B_nt!MiUnsecureVirtualMemory+6b
Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002fbc0bf, fffff8800dfdd550, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )
Followup: Pool_corruption
---------
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002fbc0bf, Address of the instruction which caused the bugcheck
Arg3: fffff8800dfdd550, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP: 
nt!ExDeferredFreePool+233
fffff800`02fbc0bf 4c395008        cmp     qword ptr [rax+8],r10
CONTEXT:  fffff8800dfdd550 -- (.cxr 0xfffff8800dfdd550)
rax=0000000000000000 rbx=0000000000000000 rcx=fffff88003cae030
rdx=fffff900c069fdf0 rsi=fffff900c0699000 rdi=fffff900c067db70
rip=fffff80002fbc0bf rsp=fffff8800dfddf20 rbp=0000000000000001
 r8=fffff900c068d010  r9=fffff900c069ff50 r10=fffff900c069ff60
r11=0000000000000001 r12=fffff88003cadcc0 r13=0000000000000000
r14=0000000000000008 r15=0000000000000001
iopl=0         nv up ei ng nz ac po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
nt!ExDeferredFreePool+0x233:
fffff800`02fbc0bf 4c395008        cmp     qword ptr [rax+8],r10 ds:002b:00000000`00000008=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
PROCESS_NAME:  iexplore.exe
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff80002fbd4c1 to fffff80002fbc0bf
STACK_TEXT:  
fffff880`0dfddf20 fffff800`02fbd4c1 : 00000000`00000000 fffff900`c069d000 00000000`00000021 ffffffff`6e677247 : nt!ExDeferredFreePool+0x233
fffff880`0dfddfb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExFreePoolWithTag+0x411

FOLLOWUP_IP: 
nt!ExDeferredFreePool+233
fffff800`02fbc0bf 4c395008        cmp     qword ptr [rax+8],r10
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  nt!ExDeferredFreePool+233
FOLLOWUP_NAME:  Pool_corruption
IMAGE_NAME:  Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP:  0
MODULE_NAME: Pool_Corruption
STACK_COMMAND:  .cxr 0xfffff8800dfdd550 ; kb
FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233
BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233
Followup: Pool_corruption
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000008884, The subtype of the bugcheck.
Arg2: fffffa80013bfde0
Arg3: fffffa80013c00b0
Arg4: 0000000000000502
Debugging Details:
------------------

BUGCHECK_STR:  0x1a_8884
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  svchost.exe
CURRENT_IRQL:  2
LAST_CONTROL_TRANSFER:  from fffff80002f7dd46 to fffff80002ecf700
STACK_TEXT:  
fffff880`04ef48b8 fffff800`02f7dd46 : 00000000`0000001a 00000000`00008884 fffffa80`013bfde0 fffffa80`013c00b0 : nt!KeBugCheckEx
fffff880`04ef48c0 fffff800`02fdc575 : fffffa80`077a12e8 fffffa80`074dc000 00000000`00000000 00000000`00000000 : nt!MiRelinkStandbyPage+0xc6
fffff880`04ef4930 fffff800`032e1b44 : fffffa80`077a0000 fffff880`04ef4ca0 fffff880`04ef4a08 00000000`00000001 : nt!MmSetPfnListPriorities+0x175
fffff880`04ef4980 fffff800`0334286a : 00000000`00000020 00000000`00000000 fffffa80`077a0000 00000000`00000001 : nt!PfpPfnPrioRequest+0x84
fffff880`04ef49d0 fffff800`03346fae : 00000000`00000000 00000000`0286ba28 00000000`0000004f 00000000`00000001 : nt!PfSetSuperfetchInformation+0x199
fffff880`04ef4ab0 fffff800`02ece953 : fffffa80`099cfb60 00000000`0379ef50 fffffa80`00000000 fffffa80`00008000 : nt!NtSetSystemInformation+0xb91
fffff880`04ef4c20 00000000`77280daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0286b978 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77280daa

STACK_COMMAND:  kb
FOLLOWUP_IP: 
nt!MiRelinkStandbyPage+c6
fffff800`02f7dd46 cc              int     3
SYMBOL_STACK_INDEX:  1
SYMBOL_NAME:  nt!MiRelinkStandbyPage+c6
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  X64_0x1a_8884_nt!MiRelinkStandbyPage+c6
BUCKET_ID:  X64_0x1a_8884_nt!MiRelinkStandbyPage+c6
Followup: MachineOwner
---------

ok download a program called Memtest86+
this program will test your ram for faults

Take all the ram out of your pc except one,
stop at 7 passes ( the pass count in the middle not the top)
OR
untill you get errors ( red lines accross lower part of screen) + error count will increase
which ever comes first
if the RAM passes then this is ok, if the ram fails then put this to the side
You need to check all RAM you have and do the same as above
7 passes may take a few hours so be patient

 

[brimmy]

Oh yeah I forgot to add that.

I have tried to run memtest many times and when I do it crashes within 2 seconds of starting and just restarts my laptop.

 

[kaos]

but did youTake all the ram out of your pc except one,
stop at 7 passes ( the pass count in the middle not the top)
OR
untill you get errors ( red lines accross lower part of screen) + error count will increase
which ever comes first
if the RAM passes then this is ok, if the ram fails then put this to the side
You need to check all RAM you have and do the same as above
7 passes may take a few hours so be patient

if you crashing on 2 seconds then its faulty or fault board, take that stick out

 

[brimmy]

I'll try it with just 1 of the sticks in at a time.

 

[kaos]

Yup, if you have 4 sticks, and one is erroring you cant tell which is bad, so one at a time is the way

 

[brimmy]

Ok I tried both RAM sticks in both slots to no avail, still crashes just moments after starting, I can see the light blue memtest screen for just moments before it restarts and goes back to my BIOS and starts booting windows.

 

[kaos]

have you put the memtest86+ on a CD or USB?

 

[zigzag3143]

Just passing by and thought I would add a few things.

Your exception code (error code) is 3b and it often is
This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code..

Since the first parameter (c000000x5) means a memory exception (commonly called a double fault) it is usually caused by a driver (perhaps video?) which can be identified by running driver verifier.

Verifier often (though not always) will point directly at the offending driver and if it does we can repair/re-install, etc.

Here is how.

I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

 

[brimmy]

Sorry for not replying in a while, I've been on holidays.

Now I done verifier like you asked and after about 24 hours it crashed again with a Memory fault.

I uploaded the dump.Link Removed

 

[zigzag3143]

Sorry for not replying in a while, I've been on holidays.

Now I done verifier like you asked and after about 24 hours it crashed again with a Memory fault.

I uploaded the dump.View attachment 15585

Driver verified dmp blames hon.exe.

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: hon.exe

 

[brimmy]

This is a game I play, It may be graphics related? As this game is quite large and there isn't much about other people having the same problem, actually my last desktop played hon for 6 months without a BSOD.

Also I just had a BSOD attack where I BSOD'd 6 times in about 6 hours, I uploaded the dumps, they were various different error codes.

Link Removed


Also I thought I'd post a bit more about the BSOD's:
Once my computer restarts from a BSOD it usually is in the Window 7 classic theme (Non-areo) and my wireless adapater is off, to get it to go back to aero and get my wireless adapter back on i need to manually start the wireless adapter service, not sure how/why that fixes the whole aero thing, but it does

 

[faizanshakyboy]

Try re-installing the Windows again, hope it will work...

 

[zigzag3143]

This is a game I play, It may be graphics related? As this game is quite large and there isn't much about other people having the same problem, actually my last desktop played hon for 6 months without a BSOD.

Also I just had a BSOD attack where I BSOD'd 6 times in about 6 hours, I uploaded the dumps, they were various different error codes.

View attachment 15608


Also I thought I'd post a bit more about the BSOD's:
Once my computer restarts from a BSOD it usually is in the Window 7 classic theme (Non-areo) and my wireless adapater is off, to get it to go back to aero and get my wireless adapter back on i need to manually start the wireless adapter service, not sure how/why that fixes the whole aero thing, but it does

Memory management caused by your video driver. PLease do the following


1-Re-install video driver with newest using this method.

When upgrading your graphic driver you MUST remove all traces of the current driver. In order to do that we recommend using Link Removed


Phyxion.net - Driver Sweeper

When it is removed then download and install the fresh copy.



2-Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program.

Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.



Driver verifier

I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

 

[brimmy]

I managed to get memtest to run.

It was on pass 0 at 53% and the runtime was exactly 15 minutes it stopped and said "Unexpected interrupt - Halting CPU" and had 6,171,392 errors.

 

[nmsuk]

Hi,
Is there any chance of you getting cpu-z and posting shot of each tab including each memory slot. Memory corruption can be caused by either defective ram or slot or a lot of the time a misconfiguration of the memory timings or voltages and cpu-z will allow us to check that out.

 

[brimmy]

Link Removed due to 404 Error

 

[nmsuk]

Just looking at those and your memory timings are wrong

Can you go into your bios and set Tcl 9 Trcd 9 Trp 9 Tras 24 Trc 33 CR 2 and Memory freq to 1333(666) then see how it goes.

 

[brimmy]

I just went into my BIOS and couldn't find anything to do with memory timing, the BIOS seemed to be extremely limited in the amount of configuring you could do I'm not sure how to change the timing.

 

[nmsuk]

What motherboard do you have? Is this a oem system? Have you looked for a bios update?