Need help diagnosing BSOD (Windows 7)

Discussion in 'Software' started by Hellsrage, Jul 5, 2014.

  1. Hellsrage

    Hellsrage Private E-2

    I've been getting BSOD regularly on my rig but have been putting off figuring out what's causing it but I'm tired of it happening.

    My PC:
    Windows 7 64bit (Home Premium)
    FX-8350 OC @4.6GHz
    GA-990FXA-UD3 Rev. 3.0 (Biggest mistake ever.)
    16GB RAM @1600mhz
    Radeon HD 7950 @1050/1250
    120GB SSD(boot drive)/2TB Storage Drive

    I'm no stranger to BSOD on my rig, they have plagued me ever since I started OC on my motherboard but on another tech forum someone narrowed down the problem and since *fixing* that problem I don't believe my MOBO is the BSOD anymore.

    I don't really know what info you need so do tell me if the following is useless.
    (Events from Windows 7 Event Viewer)
    Event ID: 1001
    The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000000004, 0x0000000000000002, 0x0000000000000001, 0xfffff80001c83e65). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 070514-16068-01.

    Event ID: 219
    The driver \Driver\WUDFRd failed to load for the device USB\Vid_22b8&Pid_4362&Mi_00\6&2c47ce84&0&0000.

    Event ID: 3
    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

    I'm not sure what to attach but I'll attach the mini dump and what I think is a log for the memory dump. If you have any idea what's causing it please let know.
     

    Attached Files:

  2. Hellsrage

    Hellsrage Private E-2

    Alright, don't think I could attach the mini dump file. I used WinDbg on the latest dump (today) here is the text.


    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Windows\Minidump\070514-16068-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*[url]http://msdl.microsoft.com/download/symbols[/url]
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
    Machine Name:
    Kernel base = 0xfffff800`01c0b000 PsLoadedModuleList = 0xfffff800`01e4e890
    Debug session time: Sat Jul  5 17:17:32.066 2014 (UTC - 7:00)
    System Uptime: 0 days 8:45:10.566
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........................
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {4, 2, 1, fffff80001c83e65}
    
    *** WARNING: Unable to verify timestamp for win32k.sys
    *** ERROR: Module load completed but symbols could not be loaded for win32k.sys
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000004, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80001c83e65, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001eb8100
     0000000000000004 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!SwapContext_PatchXSave+b5
    fffff800`01c83e65 49896f04        mov     qword ptr [r15+4],rbp
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  System
    
    TRAP_FRAME:  fffff880020cda70 -- (.trap 0xfffff880020cda70)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000095
    rdx=0000000000187000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80001c83e65 rsp=fffff880020cdc00 rbp=fffff880020cdc70
     r8=fffffa800cd19918  r9=0000000000000000 r10=ffffffffffffff7f
    r11=fffff880020a5180 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    nt!SwapContext_PatchXSave+0xb5:
    fffff800`01c83e65 49896f04        mov     qword ptr [r15+4],rbp ds:5988:00000000`00000004=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80001c80169 to fffff80001c80bc0
    
    STACK_TEXT:  
    fffff880`020cd928 fffff800`01c80169 : 00000000`0000000a 00000000`00000004 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`020cd930 fffff800`01c7ede0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`020a5180 : nt!KiBugCheckDispatch+0x69
    fffff880`020cda70 fffff800`01c83e65 : fffff880`00000007 fffffa80`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
    fffff880`020cdc00 fffff800`01c7897d : fffff880`020a5180 fffff880`00000000 00000000`00000000 fffff880`04eea588 : nt!SwapContext_PatchXSave+0xb5
    fffff880`020cdc40 00000000`00000000 : fffff880`020ce000 fffff880`020c8000 fffff880`020cdc00 00000000`00000000 : nt!KiIdleLoop+0x10d
    
    
    STACK_COMMAND:  kb
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
        fffff80001c83db2 - nt!SwapContext_PatchXSave+2
    	[ 01:21 ]
        fffff80001c83e96 - nt!SwapContext_PatchXRstor+2 (+0xe4)
    	[ 09:29 ]
    2 errors : !nt (fffff80001c83db2-fffff80001c83e96)
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MEMORY_CORRUPTOR:  ONE_BIT_LARGE
    
    FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE
    
    BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE
    
    Followup: memory_corruption
    ---------
    This is one from yesterday.

    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Windows\Minidump\070414-15834-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*[url]http://msdl.microsoft.com/download/symbols[/url]
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
    Machine Name:
    Kernel base = 0xfffff800`01c19000 PsLoadedModuleList = 0xfffff800`01e5c890
    Debug session time: Fri Jul  4 17:18:32.114 2014 (UTC - 7:00)
    System Uptime: 0 days 8:38:02.614
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................
    Loading User Symbols
    Loading unloaded module list
    .........
    Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for atikmdag.sys
    *** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, fffff88005929dbb, fffff88008db2228, fffff88008db1a80}
    
    Probably caused by : atikmdag.sys ( atikmdag+c7dbb )
    
    Followup: MachineOwner
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88005929dbb, The address that the exception occurred at
    Arg3: fffff88008db2228, Exception Record Address
    Arg4: fffff88008db1a80, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    atikmdag+c7dbb
    fffff880`05929dbb 488b83a8060000  mov     rax,qword ptr [rbx+6A8h]
    
    EXCEPTION_RECORD:  fffff88008db2228 -- (.exr 0xfffff88008db2228)
    ExceptionAddress: fffff88005929dbb (atikmdag+0x00000000000c7dbb)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 00000000000006a8
    Attempt to read from address 00000000000006a8
    
    CONTEXT:  fffff88008db1a80 -- (.cxr 0xfffff88008db1a80)
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000000 rsi=00000000000f0000 rdi=0000000000000002
    rip=fffff88005929dbb rsp=fffff88008db2460 rbp=fffffa800f446060
     r8=0000000000000002  r9=000000f41f058000 r10=0000000000000000
    r11=fffff88008db2690 r12=fffffa800f433bc0 r13=fffffa800e6123c0
    r14=fffffa801144c010 r15=fffff88005862000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
    atikmdag+0xc7dbb:
    fffff880`05929dbb 488b83a8060000  mov     rax,qword ptr [rbx+6A8h] ds:002b:00000000`000006a8=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  00000000000006a8
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001ec6100
     00000000000006a8 
    
    FOLLOWUP_IP: 
    atikmdag+c7dbb
    fffff880`05929dbb 488b83a8060000  mov     rax,qword ptr [rbx+6A8h]
    
    BUGCHECK_STR:  0x7E
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88005929dbb
    
    STACK_TEXT:  
    fffff880`08db2460 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`1144c010 : atikmdag+0xc7dbb
    
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  atikmdag+c7dbb
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: atikmdag
    
    IMAGE_NAME:  atikmdag.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  53508a3c
    
    STACK_COMMAND:  .cxr 0xfffff88008db1a80 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+c7dbb
    
    BUCKET_ID:  X64_0x7E_atikmdag+c7dbb
    
    Followup: MachineOwner
    ---------
     
    Last edited: Jul 5, 2014
  3. plodr

    plodr MajorGeek Super Extraordinaire Moderator Staff Member

    1st one said memory then stated "This is usually caused by drivers using improper addresses".
    2nd one said "VISTA_DRIVER_FAULT" and since ati appears a number of times so it appears related to your graphics driver. Radeon HD 7950

    This Vid_22b8&Pid_4362 is a Motorola unit
    Source: http://www.driversdownloader.com/hardware-id/usb/vid_22b8&pid_4362

    Read post #6 in this thread for that error
    http://www.sevenforums.com/drivers/268212-driver-driver-wudfrd-failed-load-device-error.html
    The one hot link in post #5 doesn't load. The site might be gone.
     
  4. Hellsrage

    Hellsrage Private E-2

    Thank you for the info. I've downloaded and installed the latest Motorola Device Manager and applied the suggestion from post #6 on sevenforums.

    As for the GPU drivers, I figured out about that this morning, I went back and viewed all of my minidumps and atikmdag.sys showed up in almost all of them. I've done a clean install of the current 14.4CCC drivers and manually updated atikmdag.sys so hopefully that fixes it if not I'll go back and try other suggested fixes I found here.
     
  5. Hellsrage

    Hellsrage Private E-2

    Well, I had another BSOD but I think this was do to me leaving a modded version of Assassins Creed open in the background while I went AFK. I came back to blue screens on both my monitors.

    Code:
    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Windows\Minidump\070614-15834-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
    Machine Name:
    Kernel base = 0xfffff800`01c0e000 PsLoadedModuleList = 0xfffff800`01e51890
    Debug session time: Sun Jul  6 14:48:38.416 2014 (UTC - 7:00)
    System Uptime: 0 days 1:53:10.932
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................
    Loading User Symbols
    Loading unloaded module list
    .......................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {3, 2, 1, fffff80001c86e65}
    
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    7: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000003, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80001c86e65, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001ebb100
     0000000000000003 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nt!SwapContext_PatchXSave+b5
    fffff800`01c86e65 49896f04        mov     qword ptr [r15+4],rbp
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  AssassinsCreed
    
    TRAP_FRAME:  fffff8800ae6b630 -- (.trap 0xfffff8800ae6b630)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=00000000000000a9
    rdx=000000008c742000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80001c86e65 rsp=fffff8800ae6b7c0 rbp=fffff8800ae6bc70
     r8=fffffa80109560e8  r9=0000000000000000 r10=ffffffffffffff7f
    r11=fffff880020a5180 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    nt!SwapContext_PatchXSave+0xb5:
    fffff800`01c86e65 49896f04        mov     qword ptr [r15+4],rbp ds:a466:00000000`00000004=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80001c83169 to fffff80001c83bc0
    
    STACK_TEXT:  
    fffff880`0ae6b4e8 fffff800`01c83169 : 00000000`0000000a 00000000`00000003 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`0ae6b4f0 fffff800`01c81de0 : fffff880`020a5180 fffffa80`10f94530 fffff880`020b00c0 fffff880`020a5180 : nt!KiBugCheckDispatch+0x69
    fffff880`0ae6b630 fffff800`01c86e65 : fffff880`00000007 fffff800`00000000 fffffa80`10f94638 00001f80`00000000 : nt!KiPageFault+0x260
    fffff880`0ae6b7c0 fffff800`01c86a8a : fffff880`0ae6ba88 00000000`03f4f118 00000000`00000001 fffff800`01fa812d : nt!SwapContext_PatchXSave+0xb5
    fffff880`0ae6b800 fffff800`01c795f2 : fffff800`01c8ef4c fffffa80`10f94530 fffffa80`00000000 fffff800`021fab7f : nt!KiSwapContext+0x7a
    fffff880`0ae6b940 fffff800`01c8a99f : 00000000`00000198 ffff73aa`b79eefce 00000000`00000000 00000000`03f4f170 : nt!KiCommitThreadWait+0x1d2
    fffff880`0ae6b9d0 fffff800`01f7a6fe : 00000000`001dc400 fffff880`00000006 00000000`00000001 fffff800`01f6e200 : nt!KeWaitForSingleObject+0x19f
    fffff880`0ae6ba70 fffff800`01c82e53 : fffffa80`10f94530 00000000`00000198 00000000`00000000 fffffa80`0fbeca60 : nt!NtWaitForSingleObject+0xde
    fffff880`0ae6bae0 00000000`73b22e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`03f4f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73b22e09
    
    
    STACK_COMMAND:  kb
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
        fffff80001c86db2 - nt!SwapContext_PatchXSave+2
    	[ 01:21 ]
        fffff80001c86e96 - nt!SwapContext_PatchXRstor+2 (+0xe4)
    	[ 09:29 ]
    2 errors : !nt (fffff80001c86db2-fffff80001c86e96)
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MEMORY_CORRUPTOR:  ONE_BIT_LARGE
    
    FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE
    
    BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT_LARGE
    
    Followup: memory_corruption
    ---------
    
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds