locked
Please help with BSOD – MiniDump RRS feed

  • Question

  •             I have been having (seemingly) random BSOD failures resulting in reboot, and an eventual “Missing operating system” message.  Fortunately, I have so far been able to do a Ctrl-Alt-Del from that and do a normal reboot and operate (for a while) as if nothing was wrong. 

                I usually miss the error message on the BSOD, but last time I saw it and it was APC_INDEX_MISMATCH.  I know this is a common one and it is often caused by drivers.  I have looked at what others have done who have had similar problems, and based on that I have done the following:

                I executed “sfc /scannow”.  It found nothing. 

                I updated to the latest BIOS and the latest video drivers.

                I have a RAID 10 array on an Intel DP55WG mother board (I7-860 processor).  I have the latest RAID software.  After each crash, I run a verify on the array.  I always find a dozen or so errors, but I don’t know if they were there before the crash and I don’t know if they had anything to do with the crash.

                I ran extensive RAM tests (7 passes on 8 Gb) with MemTest86+ and found no errors or ECC errors.

                I have run chkdsk several times.  No errors were identified.

                I am not overclocking or using an XMP profile.

                The next common suggestion seems to be to send in a MiniDump file.  I uploaded my last 5 MiniDump files to SkyDrive in a folder called BSOD crashes and I am hoping someone can make sense out of them.  I gave permission to everyone.  Here is the link: http://cid-6d29125a814dd877.office.live.com/browse.aspx/BSOD%20Crashes?uc=5 .

                Please help!


    Gary Burton
    Sunday, January 9, 2011 8:55 AM

Answers

  •     I am still looking for a solution, but it may take a long time to resolve and I don't want to ask you to keep this open.  I will mark it as answered, and post again if I think it will help or if I can identify a concrete solution.
    Gary Burton
    • Marked as answer by techniq1 Tuesday, January 18, 2011 4:10 AM
    Tuesday, January 18, 2011 4:10 AM

All replies

  • APC_INDEX_MISMATCH (1)
    This is a kernel internal error. The most common reason to see this
    bugcheck is when a filesystem or a driver has a mismatched number of
    calls to disable and re-enable APCs.

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt!KiBugCheckDispatch+0x69
    nt!KiSystemServiceExit+0x245
    0x7746012a

     

    Remarks

    This is a kernel internal error. This error occurs on exit from a system call. A possible cause for this bug check is when a file system or driver has a mismatched sequence of system calls to enter or leave guarded or critical regions . For example, each call to KeEnterCriticalRegion must have a matching call to KeLeaveCriticalRegion . If you are developing a driver, you can use Static Driver Verifier , a static analysis tool available in the Windows Driver Kit, to detect problems in your code before you ship your driver. Run Static Driver Verifier with the CriticalRegions rule to verify that your source code uses these system calls in correct sequence.



    Please follow the advice and activate driver verifier:

    http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

    http://support.microsoft.com/?kbid=244617

    when you get a new BSOD, boot to safe mode, disable driver verifier, reboot to normal mode and upload the newest dmp file from the folder C:\Windows\Minidump to your public SkyDrive.


    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005,

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - access violation

    STACK_TEXT: 
    atikmdag +0x90817

           
        Loaded symbol image file: atikmdag.sys
        Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
        Image name: atikmdag.sys
        Timestamp:        Fri Nov 26 03:46:44 2010


    update the ATI Catalyst driver.

    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, January 9, 2011 2:19 PM
  • Thanks!

                I really appreciate your response, although I am having some trouble following it.  You seem to be on a good track.  Please bear with me.  I am not a driver developer.  I am a user with some programming experience, but I don’t program in C.  I am smarter than the average user, but I am easily snowed by someone at your level.  Under those conditions, do you still recommend my using Driver Verifier?  I almost downloaded it, and then I decided to check with you first.  It seems to be free.  Is that correct?

     

                I just installed BlueScreenView and that looks like it could be very helpful, but your response seems to have more information.  For clarification, when you have a few lines following a label like “STACK_TEXT:….”, does that refer to my most recent dump file?  How can I use the information you provided?

     

                I updated the ATI Catalyst driver just one day before my last APC_INDEX_MISMATCH crash and I had the same crashes before the update, so an update won’t give me a fix.  I also searched for “atikmdag.sys” and could only find “atikmdag.sy_”.  I though an “.sy_” file is an installation file and not executable.  I must be wrong.  Anyway, there are many versions of that.  The latest is 11/25/10, so it apparently isn’t changed in the latest video driver update.

     

                BluesScreenView shows that 2 of my last 8 BSOD crashes resulted in different bug checks.  The first crash on 1/8 was a SYSTEM_SERVICE_EXCEPTION, and the one on 12/13 (which I haven’t uploaded to SkyDrive yet) was a PAGE_FAULT_IN_NONPAGED_AREA.  I just wanted to point that out in case you think it’s worth pursuing.  It seems to me that we have enough confusion now, and maybe these crashes will also go away once I solve the APC_INDEX_MISMATCH bug checks.  Since 6 of the 8 crashes were due to the index mismatch, I am very encouraged by the hope that it is a driver problem instead of a motherboard problem.

     

                Again.  Please bear with me.  I am teachable and I really need the help.

     


    Gary Burton
    Sunday, January 9, 2011 10:55 PM
  •  

                I just installed BlueScreenView and that looks like it could be very helpful, but your response seems to have more information.   For clarification, when you have a few lines following a label like “STACK_TEXT:….”, does that refer to my most recent dump file?  How can I use the information you provided?

    The callstack is the order in which the functions are called. You can see this in WinDbg. Which driver verifier enabled I'm maybe able to see more details.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Monday, January 10, 2011 3:02 PM
  • OK.  Here is what I have done. 

            I executed “Verifier.exe”.  I selected “Create Standard Settings” on the first page.  On the second page I selected “Automatically select all drivers installed on this computer.”  Then I rebooted, and couldn’t get back into Windows normal mode.  I booted into Safe mode and executed “verifier /reset”.  Then I was able to boot into normal mode again.

            I tried it again, but this time selected only “atikmdag.sys” for monitoring, since that was the most suspicious one.  I was able to boot into normal mode, but for some reason my antivirus program (Vipre) control screen launched automatically.  That’s a mystery, but I’m not sure it makes sense to chase it.  I looked at Verifier’s settings.  All tests were enabled for that driver except “Force pending I/O requests”, “Low resources simulation”, and “IRP Logging”

            Next, I looked at BlueScreenView to check the BSOD crashes that occurred when I tried to select all drivers.  These were all DRIVER_VERIFIER_DETECTED_VIOLATION errors caused by a program called Universal Shield, which password-protects selected folders.  I see this as an anomaly.  These crashes are entirely different from anything that has caused me trouble so far.

            Driver verify is still running.  I’m not having a problem now, but it doesn’t occur frequently anyway so that doesn’t prove much. 

            I’m learning something valuable, and I appreciate your patience.  Please suggest a next step.

     


    Gary Burton
    Tuesday, January 11, 2011 2:09 AM
  • ok, remove the tool "Universal Shield" and look if this fixed the crashes.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 11, 2011 4:34 PM
  •             I uninstalled Universal Shield.  On the next boot attempt I had a similar problem, but this time the driver identified was ACFVA65.SYS which works with my modem.  I updated the modem driver and still had the problem, so I uninstalled my modem and removed it. 

                The next boot attempt with Verifier enabled produced another DRIVER_VERIFIER_DETECTED_VIOLATION crash.  This time BlueScreenView identified “variable64.sys” as the culprit. 

                I see from some blogs that there have been some problems with this driver in conflict with the Intel DP55WG motherboard when Intel’s hardware monitor (Intel Desktop Utilities) is installed.  I have that motherboard and with Intel Desktop Utilities (latest version) installed.  One of the blogs said that Intel invented “variable64.sys”, but BlueScreenView attributes it to Microsoft Windows Server 2003.  I never installed Windows Server on my system.  This looks very encouraging in terms of a possible answer, but the symptoms described on the blogs are not a close match to the ones I am seeing.  I’m afraid to delete or rename “variable64.sys” because I could wind up in a box I can’t climb out of – even in safe mode.

                I uninstalled Intel Desktop Utilities, and I was finally able to boot into Windows normally with verifier enabled.  My computer is much slower, but I can understand why it would be.  I can operate this way for a day or two, but since the crashes were infrequent anyway I’m wondering what to do next.  My conflict could still be with Universal Shield, my modem driver, Intel Desktop Utilities, or something still unidentified.  Will an active Verifier show me a message when a conflict occurs?


    Gary Burton
    Tuesday, January 11, 2011 11:14 PM
  •         

                I uninstalled Intel Desktop Utilities, and I was finally able to boot into Windows normally with verifier enabled.  My computer is much slower, but I can understand why it would be.


    Gary Burton
    this is caused by the DriverVerifier. This slows down Windows a bit. If you don't get crashes the next days it was the incomatibility of the Intel Utilities and the other driver. If your PC is now stable, disable driver verifier.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, January 12, 2011 1:57 PM
  •             Thanks again!

                Please help me understand how you know it would be the incompatibility with Intel Desktop Utilities.  My experiments here have shown the same Verifier problems with Universal Shield, and my modem driver.  All of those crashes were linked with the DRIVER_VERIFIER_DETECTED_VIOLATION bug check, and they only occurred during my boot into normal mode with Verifier enabled.

                The BSOD crashes that I originally launched this investigation were substantially different.  They happened after a successful boot (without Verifier enabled).  The crashes were attributed by BlueScreenView to bug check APC_INDEX_MISMATCH and the cause was attributed to one of my video card drivers, atikmdag.sys. 

                But updating the video driver didn’t fix the problem.  Also the crashes were infrequent even though the video drivers are running constantly.  That led me (and I think you also) to wonder if some other driver was causing the problem.  I thought we went this route to have Verifier monitor all drivers during normal operation to positively identify the offending driver, like I'm doing now.  That’s why I asked if Verifier would give me some indication if a driver error is found while I operate this way.

                My machine is extremely slow now, so I hope this doesn’t go on too long.  If I get a solution to this, however, it will be well worth putting up with it and I really do appreciate your help.


    Gary Burton
    Wednesday, January 12, 2011 10:11 PM
  •             Andre’, I just got more information.  It looks like I will be able to wrap this up soon.

                With Verifier enabled, Universal Shield uninstalled, my modem uninstalled, and Intel Desktop Utilities uninstalled, I just got another crash.  It happened when my monitor was asleep, but I don’t think the computer was in the sleep state yet.  I moved the mouse to see my monitor, and that’s when I got the crash.  I didn’t see the BSOD, but I may have missed it.

                I didn’t get any information from Verifier, but that may be because I don’t know how to retrieve it.  I went back to BlueScreenView and the bug check was SYSTEM_SERVICE_EXCEPTION.  When I get bug check APC_INDEX_MISMATCH, ntoskrnl.exe is identified by BlueScreenView as the cause but atikmdag.sys is shown as loaded.  When I get bug check SYSTEM_SERVICE EXCEPTION, atikmdag.sys is the identified cause and is referenced just after ntoskrnl.exe.  I don’t have the latest SYSTEM_SERVICE_EXCEPTION dump file in SkyDrive, but it is just like 010811-23524-01.dmp.  APC_SERVICE_MISMATCH dump is 010811-30841-01.dmp.

                I will leave Verifier enabled hoping that you can tell me a way to get some information from it.  I expect I will be getting back to ATI with this data, but I would like to get the benefit of your comments first.


    Gary Burton
    Wednesday, January 12, 2011 11:27 PM
  • can you upload the latest dumps, please?

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by techniq1 Thursday, January 13, 2011 3:45 PM
    • Unmarked as answer by techniq1 Sunday, January 16, 2011 7:02 AM
    Thursday, January 13, 2011 2:21 PM
  •             Actually, I can’t.  I can’t add files to Skydrive in either IE8 or Firefox.  I had this problem before, but was eventually able to do it with Firefox.  IE8 says there is a problem with the website.  That’s probably true because I’m not having problems with any other sites.  Fortunately, I don’t think it is necessary for 2 reasons:

    *          The two dumps I mentioned in my previous post cover the fault I was originally fighting.  The new dumps that apply to my original problem seem to be identical to the ones mentioned.  The other dumps occurred during boot with Verify enabled and the incompatible drivers installed.  I don't think they are relevant.

    *          My problem may have been solved.  It occurred to me that to the best of my recollection, the BSOD crashes only occurred after I had just done something with the mouse.  My mouse drivers were out of date and I updated them.

     

                I don’t think you should invest more time in this now.  I will mark this problem as solved, but if the crashes come back I hope you will be open to helping me again.  In that case, I will just unmark it unsolved and reply to your last post.  I know a lot more now – thanks to you, and I won’t have to bother you so much next time.

                I still have one burning question though.  I have been asking how to get information out of Verifier.  After a crash and the reboot that follows, there is always a box saying that “Windows has recovered from an unexpected….”.  I have been just clicking that off because it never gave me any useful information in the past, but last time I noticed that there were some details I could view.  Before I clicked it off, I wrote down the name of an XML file that was mentioned in that view hoping to view it later.  But the file wasn’t on my disk.  Similar files were in the folder mentioned in the message; but when I tried to open them, I got “Access denied.” 

    *          Is that where the Verifier information is that I have been looking for?

    *          How can I view those xml files?


    Gary Burton
    Thursday, January 13, 2011 3:44 PM
  •            

    *          My problem may have been solved.   It occurred to me that to the best of my recollection, the BSOD crashes only occurred after I had just done something with the mouse.  My mouse drivers were out of date and I updated them.

     

    The XML is generated by the WER service and contains the file version of all loaded drivers. You can view the XMl by opening the technical details of the crash ad select "View temporary files". If you submit the crash to MS, the XML is gone. You have to store the file somewhere else.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, January 13, 2011 3:52 PM
  •     Great!  I now have a good troubleshooting tool.  This was a worth-while effort on my part for that reason alone.  It should also cut down on the number of posts I have to make in the future.

        Thanks, again!


    Gary Burton
    Thursday, January 13, 2011 9:38 PM
  •                I was afraid this would happen.  I have to ask for your help again.  My old crash came back.  The new mouse driver wasn’t a fix.  I deleted most my old dump files from SkyDrive, which is still only partially working.  I left 122710-21138-01.dmp because it was the last APC_INDEX_MISMATCH even though there is no XML file to go with it.  Then I uploaded the new dump file (SYSTEM_SERVICE_EXCEPTION) along with its corresponding XML file.  Unfortunately, Verifier wasn’t running at the time. 

                   I have Verifier running now, but no crash yet.  I selected all running non-Microsoft drivers except the ones that would not allow me to boot in normal mode.  I’m sure none of those drivers are the culprit because I got the crash with them all uninstalled.  I didn’t select the Microsoft drivers because selecting too many drivers previously slowed me down to a snail’s pace, and I didn’t think any MS drivers would be the culprit.  My running speed is acceptable now.

                   I have another problem which developed recently, but I’m not asking you to solve it.  I mention it only in case you see a correlation that might provide a clue to the BSOD problem:

                   When I try to adjust my power settings I have been getting “Your power plan information is unavailable…” and then I have no ability to adjust power settings.  I found several articles about this problem (which is apparently common) and applied several cures – all of which are known to work under certain conditions, but not others.  Right now, I can adjust the power options, but I have 2 computers on my home network and neither one will go to sleep automatically unless I shut down the other one.  They seem to keep each other awake.  I have updated my network drivers, and checked my settings.  I didn’t do much else because the BSOD crash returned.

                   Please check my SkyDrive uploads when you get a chance.  Link: http://skydrive.live.com/home.aspx?wa=wsignin1.0&sa=502683147

                   Question 1:  Since I get an XML file after a crash whether Verifier is running or not, I’m back to wondering how I get information out of Verifier.  I have been reading about it, and it looks like you can use “Verifier /query” and “Verifier /log” at the command line, but it looks like a developer’s tool and is a little over my head.  Will you guide me when the time comes?

                   Question 2:  I can view the XML file with NotePad, but I’m having trouble interpreting it.  Are the entries there in the order of execution (last at the bottom) or in reverse order of execution (last at the top)?


    Gary Burton
    Sunday, January 16, 2011 7:07 AM
  • SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005,

    STACK_TEXT: 
    atikmdag +0x90817
    0xfffffa80`0acf9520


        Loaded symbol image file: atikmdag.sys
        Image path: atikmdag.sys
        Image name: atikmdag.sys
        Timestamp:        Fri Nov 26 03:46:44 2010

    try a different ATI/AMD catalyst driver.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Sunday, January 16, 2011 3:25 PM
  •             The only one that exists is the one I just uninstalled when I installed the current one.  I had this problem when the old one was installed also.

                I will unload Verifier and look for more clues.  Thanks for your efforts.


    Gary Burton
    Sunday, January 16, 2011 11:41 PM
  • Hi techniq1,

     

    Did your issue can be solved by the solution of Andre.Ziegler? Please feel free to give me any update. And I will mark his reply as an answer.

     

    Thanks for your understanding and cooperation!

     

    Regards,

    Leo   Huang

    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, January 18, 2011 1:10 AM
  •     I am still looking for a solution, but it may take a long time to resolve and I don't want to ask you to keep this open.  I will mark it as answered, and post again if I think it will help or if I can identify a concrete solution.
    Gary Burton
    • Marked as answer by techniq1 Tuesday, January 18, 2011 4:10 AM
    Tuesday, January 18, 2011 4:10 AM