BSOD only on Shutdown

I have been getting a problem with BSOD - but only on shutdown and only when the PC has been off for about a day. On hibernate or a reboot soon after shutdown there appears to be no problem. After a few reboots from shutdown the BSOD usually goes away.

Last week the event log showed a few entries for a corrupt disk. After a break of about 2 days the latest BSOD has not gone away - it is now a permanent feature all of the time.

I restored from a full windows backup + system image taken before the weekend break. All was well for about 5 minutes then the BSOD returned.

I captured a few minidumps taken before the restore and all showed a different BUG STRING CHECK. Almost all referenced ntoskrnl.exe. The latest one showed MEMORY_MANAGEMENT for the BUG STRING CHECK (first time that has appeared). Unfortunately the restore wiped out previous minidumps so I only have the last one (attached).

chkdsk shows no errors, a memory check shows no errors and all the drives report OK SMART data. All the virus checks report no infections (Windows Essentials, MalwareBytes, HijackThis and Advanced System Care 5). I am tempted towards thinking there may be a problem with the system HD after all, or if not that, then perhaps with the SATA port itself. However running in safe mode is rock solid - which suggests a driver problem. I can perform a full backup in safe mode - which suggests the hardware is fine.

I have finally realised I am out of my depth here... None of the current forum posts have proved useful so I shall be grateful for any pointers and suggestions as to what I can check and how and where to proceed next.

Thanks,
Ric

 

Hi,

I spoke too soon. The Windows 7 64 bit system crashed in safe mode whilst doing a backup of files. Here is another minidump file and a second with verifier.exe running.

Ric

 

Hi my friend , welcome to MG's :major

Is there an error message like 0x1A ? First thought of me is checking your memory helped by this tool

http://majorgeeks.com/Memtest86_d4226.html

for 6 hours at least ensuring that your memory is good or not !! :wave

 

Chkdsk /r needs to be run on the drive, followed by SFC /scannow. Hard drive diags too http://www.carrona.org/initdiag.html

Seeing many different BSOD's can mean a hardware problem like RAM, PSU (which can kill a hard drive), etc. but could mean a bad driver, having only 1 dump to check makes it very hard to be sure. Safe Mode stresses the hardware less, basic drivers don't utilise all the hardware optimally.


*** 3rd PARTY DRIVER LIST ***
Any 3rd party driver prior to 2011 needs to be updated, if it's a utility driver or security driver, uninstalling during testing is best. Drivers in red are my best guesses as to the most likely driver to be implicated generally.

Code:

[font=lucida console][B][COLOR="Red"]ALSysIO64.sys[/COLOR][/B] Sun Apr 19 20:41:04 2009 (49EB7E50)

[B]ASACPI.sys[/B]    Thu Jul 16 04:31:29 2009 (4A5E9F11)

[B][COLOR="Red"]AsIO.sys[/COLOR][/B]      Mon Apr 06 08:21:08 2009 (49D9AD64)

AtihdW76.sys  Thu Feb 23 12:30:12 2012 (4F463154)

MpFilter.sys  Fri Mar 09 11:05:26 2012 (4F59E3F6)

Rt64win7.sys  Fri Jun 10 07:33:15 2011 (4DF1BAAB)

[B]amdxata.sys[/B]   Fri Mar 19 16:18:18 2010 (4BA3A3CA)

atikmdag.sys  Fri Apr 06 02:48:25 2012 (4F7E4B69)

atikmpag.sys  Fri Apr 06 02:10:44 2012 (4F7E4294)
[B]
jraid.sys[/B]     Fri Jul 17 16:31:50 2009 (4A609966)

mbam.sys      Tue Mar 20 16:04:48 2012 (4F68AAA0)

[B]viahduaa.sys[/B]  Fri Jul 10 04:07:01 2009 (4A56B055)[/font]

Code:

[font=lucida console][url=http://sysnative.com/drivers/driver.php?id=ALSysIO64.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=ALSysIO64.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=ASACPI.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=ASACPI.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=AsIO.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=AsIO.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=AtihdW76.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=AtihdW76.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=MpFilter.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=MpFilter.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=Rt64win7.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=Rt64win7.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=amdxata.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=amdxata.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=atikmdag.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=atikmdag.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=atikmpag.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=atikmpag.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=jraid.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=jraid.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=mbam.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=mbam.sys[/url]
[url=http://sysnative.com/drivers/driver.php?id=viahduaa.sys]http[i]:[/i]//sysnative.com/drivers/driver.php?id=viahduaa.sys[/url][/font]

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[B]MEMORY_MANAGEMENT (1a)[/B]
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8004c00290
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

[B]DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT[/B]

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ef4b80 to fffff80002e891c0

STACK_TEXT:  
fffff880`08dd3958 fffff800`02ef4b80 : 00000000`0000001a 00000000`00041790 fffffa80`04c00290 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08dd3960 fffff800`02e759ef : fffffa80`00000000 00000000`09df0fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x355e4
fffff880`08dd3b20 fffff800`02e88453 : ffffffff`ffffffff 00000000`01efe910 00000000`01efe8d8 fffffa80`00008000 : nt!Nt[B]FreeVirtualMemory[/B]+0x61f
fffff880`08dd3c20 00000000`77c214fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01efe848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c214fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+355e4
fffff800`02ef4b80 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+355e4

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f76721c

[B]FAILURE_BUCKET_ID:  X64_0x1a_41790[/B]_nt!_??_::FNODOBFM::_string_+355e4

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+355e4

Followup: MachineOwner
---------

 

Hi, and thanks for the two very quick replies!

I have a few more files I want to back up and then shall begin the tests you recommend, probably starting with memtest to rule out (or in) any memory issues.

In fact the system just crashed again and I had the memtest CC in the tray so it booted up... Almost immediately I have lots of red stuff.... I have 12GB memory and cannot see from the output which chip(s) is(are) affected but the failing address is given as 6420.2 MB and 6420.8MB.

I have 4 sticks of RAM and already up to 17152 errors. 8GB was bought only last autumn too... I shall repeat with just 1 stick at a time and see if the problems are isolated.

I have a P7P55D PRO board and it has a MemOK! button - which I have never used. Would that be worth a try? Could it be a timing problem?

Ric

 

I've seen the use of the MemOK switch to lead to further problems, the memory timings really need to be set manually; also, if you're using say, 1600Mhz, drop down to 1300Mhz and test again.

Ideally, Memtest needs to be run on single sticks in the same slot for 7+ passes then test a known good stick in each of the remaining slots for a further 7+ passes to be reasonably sure that each stick/slot is good.

(I just noticed you'd posted 2 further dumps, I'll run a quick check on those now.)

EDIT: done, both later dumps show signs of corruption which could be down to a bad driver, memory or hardware:

BSOD BUGCHECK SUMMARY

Code:

[font=lucida console]
Loading Dump File [C:\Users\RoLY\_jcgriff2_\dbug\__Kernel__\052812-37159-01.dmp]
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Debug session time: Mon May 28 14:53:29.887 2012 (UTC + 1:00)
System Uptime: 0 days 1:49:52.761
BugCheck A, {fffff8800f2535e0, 2, 0, fffff8000227bef8}
*** WARNING: Unable to verify checksum for win32k.sys
Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+c8 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0xA
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  X64_0xA_nt!MiRestoreTransitionPte+c8
Bugcheck code 0000000A
Arguments fffff880`0f2535e0 00000000`00000002 00000000`00000000 fffff800`0227bef8
BiosVersion = 2003   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
MaxSpeed:     2670
CurrentSpeed: 2675
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\RoLY\_jcgriff2_\dbug\__Kernel__\052812-38563-01.dmp]
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Debug session time: Mon May 28 15:08:20.606 2012 (UTC + 1:00)
System Uptime: 0 days 0:02:34.543
BugCheck C1, {fffff980239a2fc0, fffff980239a20f7, 914040, 23}
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
Probably caused by : atikmdag.sys ( atikmdag+3c01f )
BUGCHECK_STR:  0xC1_23
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  dwm.exe
FAILURE_BUCKET_ID:  X64_0xC1_23_VRF_atikmdag+3c01f
Bugcheck code 000000C1
Arguments fffff980`239a2fc0 fffff980`239a20f7 00000000`00914040 00000000`00000023
BiosVersion = 2003   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
MaxSpeed:     2670
CurrentSpeed: 2675
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

[/FONT]

 

Hello Satrow,

Thanks for staying with me. I will run more exhaustive tests overnight and tomorrow but for now I want to test each stick in turn, then paired, then swap that pair between slots and repeat for the other pair of sticks. With all 4 sticks in I get thousands of errors so no point in going any further with that combination.

Currently the BIOS is set to failsafe defaults and I'm happy with that, not wishing to burn anything by overclocking, etc (wouldn't know what i was doing anyway). Preliminary results for stick 1 and stick 2 in slot 0 are good. No errors.

The memory is Kingston 995403 -199.A00LF AKA HyperX Genesis 4GB KHX1600C9D3X2k2/8GX the timings show up as 9-9-9-24 (1.65V)

The other pair of memory sticks are different - and I'd almost lay abet on the two types not matching as the source of the problem but it's still early days to say that for sure:

2 x GEIL 2GB PC3 12800 CL=9-9-9-28 GV34GB1600C9DC (1.6V).

A local shop did the initial build with the GEIL chips in Mar 2010. A friend sold on to me the 2x4GB chips last autumn saying they would be OK for my system. And sure enough the 4 have worked together for months with no BSOD. Only when shutting down for a > 1 day has a BSOD occurred and that has cleared on a reboot.

It will be interesting to repeat all the combinations (stick/slots) for longer and see where errors creep in.

But I still want to look at those drivers and check the disks as advised before making a conclusion.

The PSU by the way is 450W and I have 6HDs.

Ric

 

No worries,

So what CPU.GPU do you have, any bus-powered USB devices? What make/model# is the PSU?

 

Here are the specs:
P7P55D Pro Rev 1.xx + latest 2003 BIOS dated 2011-11-17
Intel I5 750
ATI Radeon 5700 + Dell 1091FP Monitor + Samsung SyncMaster 24" Monitor
Corsair VX 450W PSU
USB: Wireless Mouse - Technika H16BC1
USB: Gigabyte Bluetooth Dongle GN-BTD02
USB: Toshiba Stor-E 2GB HDD
APC UPS
Windows 76 64 Sp1

Latest:
all 4 memory modules check out singly OK as does port A1. Port B1 currently being tested and looking good so far.

Kingston 4GB is stated as 9-9-9-27
Geil 2GB is stated as 9-9-9-28
Memtest showing as 9-9-9-24
Is this right?

Ric

 

I really have no idea about RAM timings, as I suggested earlier, you may find that dropping the speed to 1333MHz might give you stability with 0 errors when all 4 slots are filled.

The VX series are very good quality but I would suspect that 450W isn't really enough for a quad-core and a decent PCI-E card and all the drives you have. I'd feel much more confident if it was a 550W VX.

 

I have checked out all 4 dimms - they come out clean (with the caveat of a not-so-extended test). I cannot check out slots individually for A2 and B2. It seems that the board requires A1 and B1 slots first to be populated. (Red light mem fault permanently on if nothing in A1/B1)

So I am checking 2GB each in A1 and B1 with 4GB in slot A2 and again the resilts are looking good - which makes me wonder if the original memory problem was a failure to seat them correctly... I shall leave them on this particular test overnight and then try all 4 tomorrow.

Thanks for all the help.
Ric

 

All 4 memory modules across 4 slots left running MemTest overnight. & hours later no errors reported, so maybe one or more of the modules was not seated correctly.

When testing slot A2 or B2 alone the system will not post. I did press the MemOK! button during these tests but the Memory warning LED stayed lit after trying options. (Manual says populate from A1 and B1 first so I guess testing individual slots other than A1 and B1 cannot be done.)

CHKDSK reported no errors other than USN repair. SFC reported no integrity violations - which now leaves me with thos old drivers. The two highlighted RED are from ASUS and it looks like most of their driver updates are stuck at 2009 / 2010.

I have removed the two smaller IDE drives and disabled the JMICRON controller in the BIOS. I shall install a SATA drive to replace the IDE's (which will be used only for XAMPP - I prefer it away from the main system). I note there is a JMICRON app in Control Panel --> Programs and see no reason why that shouldn't be uninstalled too.

One of the drivers was for an old CoreTemp and I have updated that to 1.0RC3. Seems to work OK.

Will try and work through the rest of the drivers - though Windows Update makes no further suggestions. I did once use a driver update service but removed it because it wanted to load all kinds of toolbars, search engines and so on and I just cannot get on with that. Is there a recommended utility/URL for checking for the most up-to-date drivers?

I suppose the real test will be to turn off the PC for 24hrs and see if the BSOD returns. Hopefully not.

Ric

 

Hi,

I have just completed testing all the drives and all are OK. Some of the drivers have been updated but I cannot find a replacement for all the highlighted ones. All 4 memory modules passed OK and were tested for just under 7 hours for their final test all running together.

Feeling confident I left the PC switched off this morning (the BSOD seems linked to the PC being switched off for a period rather than simply on standby) and decided this afternoon I'd do a full backup.

After about 8% the BSOD returned and I have attached the latest dump. As with the others there seems to be no consistent cause for the Stop. This one is SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION.

I am wondering now if the two types of memory are incompatible after all - a good test would be to use the Kingston 8GB only. Staring from "cool" after a shutdown might indicate a contact problem. I suspect this may have been the case for the initial memory faults; now I'm wondering if the CPU is seated 100%.

Any suggestions where to go from here?

Thanks,
Ric

 

another dump, same bugcheck... Windows had just opened and this happened a few minutes after logging in.

 

2x 0xC1's:

Driver Verifier gives 2 different reasons, memory corruption/driver, I'm not convinced it's memory yet, that's usually more random (but using just one pair for several days or so might prove telling):

Code:

[font=lucida console]
Loading Dump File [C:\Users\RoLY\_jcgriff2_\dbug\__Kernel__\053012-33306-01.dmp]
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Debug session time: Wed May 30 15:26:50.653 2012 (UTC + 1:00)
System Uptime: 0 days 0:19:00.590
BugCheck C1, {fffff9800a79cc10, fffff9800a79c737, 9903e8, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  svchost.exe
FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83
Bugcheck code 000000C1
Arguments fffff980`0a79cc10 fffff980`0a79c737 00000000`009903e8 00000000`00000032
BiosVersion = 2003   
BiosReleaseDate = 12/14/2010
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
MaxSpeed:     2670
CurrentSpeed: 2675
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\RoLY\_jcgriff2_\dbug\__Kernel__\053012-34351-01.dmp]
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Debug session time: Wed May 30 16:05:18.577 2012 (UTC + 1:00)
System Uptime: 0 days 0:26:33.514
BugCheck C1, {fffff980333cafe0, fffff980333ca6c7, db4020, 32}
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+9d9e )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  dwm.exe
FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_atikmpag+9d9e
Bugcheck code 000000C1
Arguments fffff980`333cafe0 fffff980`333ca6c7 00000000`00db4020 00000000`00000032[/FONT]

Of the current 3rd party drivers listed, the Rt64win7.sys needs updating, the 'owner' for AsIO.sys (pretty sure it's an ASUS utility) needs updating or uninstalling and the ASACPI.sys (on my system, it's been disabled since February) can be disabled - look for ATK0110 ACPI Utility in the non-plug and play section of Device Manager - View > Show hidden items to see it.

Code:

 [font=lucida console]
ALSysIO64.sys Sun Jul 10 01:27:45 2011 (4E18F201)

ASACPI.sys    Thu Jul 16 04:31:29 2009 (4A5E9F11)

AsIO.sys      Mon Apr 06 08:21:08 2009 (49D9AD64)

AtihdW76.sys  Thu Feb 23 12:30:12 2012 (4F463154)

MpFilter.sys  Fri Mar 09 11:05:26 2012 (4F59E3F6)

Rt64win7.sys  Fri May 22 15:52:30 2009 (4A16BC2E)

amdxata.sys   Fri Mar 19 16:18:18 2010 (4BA3A3CA)

atikmdag.sys  Fri Apr 06 02:48:25 2012 (4F7E4B69)

atikmpag.sys  Fri Apr 06 02:10:44 2012 (4F7E4294)

mbam.sys      Tue Mar 20 16:04:48 2012 (4F68AAA0)

viahduaa.sys  Wed Aug 04 08:51:53 2010 (4C591C19)[/font]