All kinds of BSODs... freaking me OUT!

[themagpieswarble]

Hey everyone. For the past few weeks, my Windows 7 (64-bit) Media PC that I built has been giving me BSODs. Just for reference, here's my setup:

1. MI-008 Tower Black P4 Chassis with 250W
2. ASRock Socket FM1/AMD A75M-ITX
3. AMD A6-3650 APU with AMD Radeon 6530 HD
4. Patriot Memory Torqx 2 Series 32 GB
5. Kingston ValueRAM 4GB 1066MHz DDR3 (one stick)

The BSODs first started whenever I would stream Netflix or Youtube videos. Now, it's happening when downloading/unpacking large files onto my external harddrive (via SATA), when watching HD movies, and just tonight upon restarting my computer before it could even fully boot into Windows.

What I've tried/things to know:

1. Ran MemTest to 200% (which means two passes through, I suppose) and there were no errors at all
2. Uninstalled my graphic drivers and reinstalled the latest ones
3. Opened up my case, blew out any dust, everything looks okay
4. I've never OC'd this computer.. All BIOS settings are set to automatic/default
5. I can't think of any software/drivers that I had installed before this all started
6. No anti-virus installed

I've downloaded Bluescreen View and WhoCrashed. Not sure what information is best for you guys, but it looks like WhoCrashed captures the same amount of information as Bluescreen View but in a more digestable view. Here are the latest crashes:

On Tue 3/19/2013 4:31:12 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031813-22760-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C40)
Bugcheck code: 0xA (0x40, 0x2, 0x1, 0xFFFFF80002EABD30)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 3/19/2013 4:30:00 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031813-17612-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C40)
Bugcheck code: 0xA (0x40, 0x2, 0x1, 0xFFFFF80002E9FD30)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Tue 3/19/2013 4:26:57 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031813-25256-01.dmp
This was probably caused by the following module: dxgkrnl.sys (dxgkrnl+0x849E)
Bugcheck code: 0x50 (0xFFFFF80012C1CCB0, 0x8, 0xFFFFF80002E8C96E, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\drivers\dxgkrnl.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics Kernel
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation PAGE_FAULT_IN_NONPAGED_AREA



On Tue 3/19/2013 4:22:33 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031813-24070-01.dmp
This was probably caused by the following module: npfs.sys (Npfs+0x7F30)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF88002B85F30, 0xFFFFF88007959EA0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\drivers\npfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NPFS Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Mon 3/18/2013 12:25:08 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031813-81900-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C40)
Bugcheck code: 0x50 (0xFFFFF80001A7F078, 0x8, 0xFFFFF8000317082F, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 3/15/2013 5:06:00 AM GMT your computer crashed
crash dump file: C:\Windows\Minidump\031413-31808-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x75C40)
Bugcheck code: 0xA (0x3F, 0x2, 0x1, 0xFFFFF80002EDDD30)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

I'm going to try unseating my RAM stick and moving it to the other channel to see if that changes anything.

Let me know if you need any other information or if I should try anything else. I really appreciate everyone's help.

 

[satrow]

Hi,

Looks like it may be a bad driver, could you copy those dumps to your Desktop, zip them and upload the zip to somewhere publicly accessible like Skydrive?

I'll try to take a look at them once you've given a link.

 

[themagpieswarble]

Hi,

Looks like it may be a bad driver, could you copy those dumps to your Desktop, zip them and upload the zip to somewhere publicly accessible like Skydrive?

I'll try to take a look at them once you've given a link.

Thanks for the reply, Satrow! I rar'd all the dumps in the Windows/Minidump folder and uploaded it to filedropper. You can download the rar here:

MiniDump Archive

I really appreciate the help. I hope we can figure this out. Please let me know if you need any other information.

 

[satrow]

I see 2 known bad drivers loaded, AODDriver2.sys:
part of AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. Known BSOD issues in Win7 http://game.amd.com/us-en/drivers_overdrive.aspx <-- uninstall it (during stability testing, it's a good idea not to have any non-essential 3rd party drivers loaded).

Also: xusb21.sys Wed Apr 8 15:28:44 2009 (49DCB49C) XBox USB wireless controller BSOD issues in Win7 with 2009 driver (found in mid-2012) http://www.carrona.org/drivers/driver.php?id=xusb21.sys <-- uninstall and remove it, reboot, download the latest version and install it.

I'll try to drill a little deeper, there may well be other things that need some attention.

 

[themagpieswarble]

I see 2 known bad drivers loaded, AODDriver2.sys:
part of AMD Overdrive; also in EasyTune6 for Gigabyte motherboard. Known BSOD issues in Win7 http://game.amd.com/us-en/drivers_overdrive.aspx <-- uninstall it (during stability testing, it's a good idea not to have any non-essential 3rd party drivers loaded).

Also: xusb21.sys Wed Apr 8 15:28:44 2009 (49DCB49C) XBox USB wireless controller BSOD issues in Win7 with 2009 driver (found in mid-2012) http://www.carrona.org/drivers/driver.php?id=xusb21.sys <-- uninstall and remove it, reboot, download the latest version and install it.

I'll try to drill a little deeper, there may well be other things that need some attention.

Awesome! Thank you so much for the solutions so far. That's way more than I would've figured out on my own. I'll do this all tonight when I get home.

The Xbox controller thing is weird since I don't use an Xbox controller on my Media PC but I do use a PS3 controller with the MotionJoy software. Maybe they use the same driver to get the controller to work with the PC?

Anyway, thanks again. I'll get back to you later tonight after I try these two steps.

 

[themagpieswarble]

Oh, and also.. how do you recommend "uninstalling" drivers? Do you use a 3rd party program to do it?

 

[satrow]

Oh, and also.. how do you recommend "uninstalling" drivers? Do you use a 3rd party program to do it?

I do it manually, begin with the uninstaller, if it came with one, move onto sweeping out any folders, Device Manager (view Hidden devices, some can be uninstalled, others can be disabled), Autoruns, CCleaner, sometimes I trawl the Registry too ... you do need to be very careful going this route (good working backup and a fresh System Restore before you begin) - but you get to learn a lot! Do whatever you feel comfortable with, check currently loaded drivers and dates with Nirsoft's DriverView: http://www.nirsoft.net/utils/driverview.html


Ah yes, the 2009 version of the XBox drivers resides there , did you find a later version?

 

[themagpieswarble]

Okay, I don't feel super comfortable with manually uninstalling drivers but I'll give it my best shot. There isn't a third party software that does it all for you?

Here's where I think the Microsoft Driver is:

http://www.microsoft.com/hardware/en-us/d/xbox-360-wireless-controller-for-windows

However, it doesn't say what date the current driver was released. I want one later than the 2009 version which seems to be the problem, right?

 

[satrow]

Revo probably has the best reputation: http://www.revouninstaller.com/revo_uninstaller_free_download.html

That page looks like it has the 2009 version that I grabbed to check earlier, just uninstall it during testing. Let's get some stability first.

 

[themagpieswarble]

Sounds good. I'll just uninstall that driver completely and then I'll check Revo for getting rid of AODDriver2.sys.

 

[themagpieswarble]

Okay, I deleted those two drivers.. but I didn't really know what else to do. Revo Uninstaller only showed applications that I've installed and not drivers, so I didn't know how to use it to remove everything related to those drivers. I also don't know how to 'trawl' the registry for other things related to the drivers.

After deleting the two drivers, restarted my computer, opened Chrome, played a random YouTube video.. 3 seconds into the video, hard crash. No Blue Screen. Just hard crash, computer restarted itself after a second, and now I'm back at the login screen.

I opened up WhoCrashed to see if there was any dump report, but it didn't seem to grab anything. However, I double clicked on one of the reports in WhoCrashed to see it more in-depth and then got a new BSOD related by the Ntfs.sys file.

Good Lord. I can't even use my computer for more than a few minutes now to get the dump report without it blue screening or restarting on me. Maybe I should just reformat my main SSD drive and reinstall Windows 7. Getting pretty sick of this.

 

[themagpieswarble]

Here's the last 6 or so dump files that I've produced today including the last few ones in the past 30 minutes.

http://www.filedropper.com/minidump2

 

[satrow]

You'll need to uninstall the AODDriver2.sys via the AMD Overdrive (may be part of CCC?) or Gigabyte Easy Tune/ ... whatever, before you can uninstall it from Device Manager. It's still loaded in most of the latest dumps.

There's now a total of 2 dumps that may reflect some problems on your hard drive too, you'll need to run a full chkdsk and then 3x SFC /scannow to try to check and repair it.

It might be as well for you to carefully run the collection apps from this Post to collect as much relevant info as possible: http://www.sysnative.com/forums/bsod-crashes-kernel-debugging/68-blue-screen-death-bsod-posting-instructions-windows-8-7-vista.html

 

[themagpieswarble]

Uninstalled AMD Overdrive from the Control Panel (took a couple of BSODs to remove it) and it looks like AODDriver2.sys is gone for good now.

Ran a full CHKDSK on my SSD boot drive. No errors or bad file records found.

Ran SFC /scannow three times. No errors found.

I tried to run one of those programs listed on that sysnative site. I tried the BSOD file collection one 3 times now but it gave me a BSOD in the middle of scanning all 3 times. That's the pain in the ass of this, is I can't even collect information because I get blue screens randomly. I'm doing this in Safe Mode with Networking, p.s.

Not sure what to do at this point. Since that program isn't working, I'll just attach some more up to date mini-dumps for you. At least you can see if I got rid of those drivers properly. Here they are:

http://www.filedropper.com/minidump3

Maybe I'll try the below programs tomorrow:

· Run - Driver Verifier - Windows 8, 7 & Vista
· Run HDD Diagnostics - http://www.carrona.org/hddiag.html
· Test RAM - http://www.carrona.org/memdiag.html

 

[satrow]

No new dumps in that batch, sorry.

I think it's time to add a malware scan to that list: http://www.eset.com/home/products/online-scanner/

Let's try collecting some of that data manually; start Autoruns, hit ESC then go to Options > Filter options and check all boxes except Include empty locations. Hit Refresh (F5), wait for it to finish then Save as the default type (*.arn) and zip it.

Start > Run type MSInfo32 and hit Enter. Navigate to Software environment > Windows error reporting and wait for the right pane to fill with data then Save as the default type (*.nfo) and zip it.

Upload both zips (or both files in one zip/rar).

 

[themagpieswarble]

Here are the two diagnostic files zipped up:

http://www.filedropper.com/autorunsandwindowserrorreporting_1

I also ran the malware scanner you provided. It got to 99% with zero errors and then BSOD before it got to 100%. I figure that's enough to call it good?

Here's the BOD Log from WhoCrashed:

On Wed 3/20/2013 3:30:58 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\032013-12370-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0xC952F)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF9600011952F, 0xFFFFF880079A5B70, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

Let me know if you need any other info! Thank you so much for all your help!

 

[satrow]

Hmm, depends on what it was checking at 99% ... the logs show several Windows Defender crashes in recent days too.

That 0x3b may be graphics/driver -related. win32k.sys has had a lot of effort put into it by security/vulnerability researchers in the last year or so, are you sure Windows is fully updated?

Overall, I'm not convinced I can tell what's wrong here, I'd ask you to revisit Sysnative and ask the real experts there to work with you (they have some excellent malware people there too).

 

[themagpieswarble]

I'll double check my windows updates. Pretty sure I did all Windows Updates a few weeks ago though.

I'll head over to Sysnative and reference this post so they can see all my information and what I've tried so far.

Thanks for all your help satrow. I'll try to remember to come back here and let you know what the people at Sysnative find out.

 

[satrow]

I'm over there, too.

Follow the steps as best you can from the Sticky I pointed you to earlier, explain that the Collection App crashes and attach the zipped dumps plus Autoruns/MSInfo32 to your Post, that will give them a good starting point.

Good luck.

 

[themagpieswarble]

Yup, here's a link to the post I made:

http://www.sysnative.com/forums/bsod-crashes-kernel-debugging/5658-referred-here-toms-hardware-forums-blue-screen-death-mystery.html