locked
BlueScreen/Shutdown during sleep mode RRS feed

  • Question

  • Using W7 SP1 Dell Studio Xps, i7-920, Radeon HD5770 video, 6 gig memory    

    Basically starting about a month ago this PC started crashing while on sleep mode, either auto or forced; Just last night I learned how to use the MS debugger to read the memory.dmp file, which points to an error with 'ksthunk.sys file apparently associated with audiodg.exe.

    All driver are up to date and last night I upgraded my M-Audio 2496 audio card to the latest drivers, but system crashed again today, after checking the memory.dmp again I see the same error.

    So I need some advice on how to upgrade or check into this 'ksthunk.sys file that apparently is causing this new issue.

    I activated my 'LIVE' account and uploaded the latest minidump file there,included below and the debugger results of latest memory.dmp

    Thanks for any advice.

    https://skydrive.live.com/redir.aspx?cid=b52783e0bb11c4de&resid=B52783E0BB11C4DE!129

    Probably caused by : ksthunk.sys ( ksthunk+62e )

    Followup: MachineOwner
    ---------

    3: kd> nt !_KPRCB
           ^ Syntax error in 'nt !_KPRCB'
    3: kd> NT!_KPRCB
           ^ Syntax error in 'NT!_KPRCB'
    3: kd> nt!_kprcb
           ^ Syntax error in 'nt!_kprcb'
    3: kd>
    3: kd> .reload
    Loading Kernel Symbols
    ...............................................................
    .........................................................Page 154acc not present in the dump file. Type ".hh dbgerr004" for details
    .......
    Page 1533d1 not present in the dump file. Type ".hh dbgerr004" for details
    .........Page 14de3f not present in the dump file. Type ".hh dbgerr004" for details
    .........................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 000007ff`fffd7018).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    ......
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800032d2c0e, Address of the instruction which caused the bugcheck
    Arg3: fffff8800b527df0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------

    Page 154acc not present in the dump file. Type ".hh dbgerr004" for details

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    nt!KiSignalSynchronizationObject+4e
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx

    CONTEXT:  fffff8800b527df0 -- (.cxr 0xfffff8800b527df0)
    rax=850fe48445ffffff rbx=fffff8800b5288b8 rcx=59840fc00000163d
    rdx=fffff8800b5288b0 rsi=fffff8800b5288b0 rdi=59840fc00000163d
    rip=fffff800032d2c0e rsp=fffff8800b5287d0 rbp=0000000000000000
     r8=0000000000000000  r9=00000000c0000005 r10=fffff8800b528980
    r11=fffff8800b5289a8 r12=fffff800032cf021 r13=fffff880031d5180
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz ac po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
    nt!KiSignalSynchronizationObject+0x4e:
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx ds:002b:850fe484`45ffffff=????????????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  audiodg.exe

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff800032cfca6 to fffff800032d2c0e

    STACK_TEXT: 
    fffff880`0b5287d0 fffff800`032cfca6 : 00000000`00000000 fffffa80`07aebc80 00000000`00000000 00000000`00000000 : nt!KiSignalSynchronizationObject+0x4e
    fffff880`0b528820 fffff880`063ef62e : fffffa80`00000000 fffffa80`00000000 fffffa80`07aebc00 00000000`022afb70 : nt!KeSetEvent+0x106
    fffff880`0b528890 fffff800`032cf021 : fffff880`0b5288b8 fffffa80`07aebc80 fffffa80`0a969010 fffff880`063efc21 : ksthunk!CKernelFilterDevice::DeferIrpCompletion+0x12
    fffff880`0b5288c0 fffff880`063ef94c : 00000000`00000001 fffffa80`0a969200 fffffa80`07aebc80 00000000`00000000 : nt!IopfCompleteRequest+0x341
    fffff880`0b5289b0 fffff800`035e6a97 : fffffa80`05a2d070 fffff880`0b528ca0 fffffa80`c0000005 fffffa80`05a2d070 : ksthunk!CKernelFilterDevice::DispatchIrp+0x244
    fffff880`0b528a10 fffff800`035e72f6 : fffff683`ff7f2128 00000000`00000239 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
    fffff880`0b528b40 fffff800`032caed3 : fffffa80`05661b60 0000007f`ffffffff fffff880`0b528bc8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
    fffff880`0b528bb0 00000000`77c9138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`022af9c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c9138a


    FOLLOWUP_IP:
    ksthunk!CKernelFilterDevice::DeferIrpCompletion+12
    fffff880`063ef62e b8160000c0      mov     eax,0C0000016h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: ksthunk

    IMAGE_NAME:  ksthunk.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bca93

    STACK_COMMAND:  .cxr 0xfffff8800b527df0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    Followup: MachineOwner
    ---------

    3: kd> lmvm ksthunk
    start             end                 module name
    fffff880`063ef000 fffff880`063f4200   ksthunk    (pdb symbols)          c:\symbols\ksthunk.pdb\A58068C2E5CB41E6B685D3866CA394141\ksthunk.pdb
        Loaded symbol image file: ksthunk.sys
        Image path: \SystemRoot\system32\drivers\ksthunk.sys
        Image name: ksthunk.sys
        Timestamp:        Mon Jul 13 20:00:19 2009 (4A5BCA93)
        CheckSum:         0000AF92
        ImageSize:        00005200
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

     

     

     



    • Edited by Mackado Thursday, November 24, 2011 3:18 AM missing info
    Thursday, November 24, 2011 3:06 AM

Answers

  • Hi,

    Please understanding that to solid troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump and analyze the related source code if needed. Unfortunately, debugging is beyond what we can do in the forum. I'd like to recommend you contact Microsoft Customer Support Service for assistance so that this problem can be resolved efficiently. Please visit here: http://support.microsoft.com/contactus

    Regards,

    Miya


    This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Miya Yao Friday, December 2, 2011 5:47 AM
    Friday, November 25, 2011 8:07 AM

All replies

  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800032d2c0e, Address of the instruction which caused the bugcheck
    Arg3: fffff8800b527df0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.
    Debugging Details:
    ------------------
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    FAULTING_IP: 
    nt!KiSignalSynchronizationObject+4e
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx
    CONTEXT:  fffff8800b527df0 -- (.cxr 0xfffff8800b527df0)
    rax=850fe48445ffffff rbx=fffff8800b5288b8 rcx=59840fc00000163d
    rdx=fffff8800b5288b0 rsi=fffff8800b5288b0 rdi=59840fc00000163d
    rip=fffff800032d2c0e rsp=fffff8800b5287d0 rbp=0000000000000000
     r8=0000000000000000  r9=00000000c0000005 r10=fffff8800b528980
    r11=fffff8800b5289a8 r12=fffff800032cf021 r13=fffff880031d5180
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz ac po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
    nt!KiSignalSynchronizationObject+0x4e:
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx ds:002b:850fe484`45ffffff=????????????????
    Resetting default scope
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x3B
    PROCESS_NAME:  audiodg.exe
    CURRENT_IRQL:  2
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800032d2c0e
    STACK_TEXT:  
    fffff880`0b5287d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSignalSynchronizationObject+0x4e
    FOLLOWUP_IP: 
    nt!KiSignalSynchronizationObject+4e
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx
    SYMBOL_STACK_INDEX:  0
    SYMBOL_NAME:  nt!KiSignalSynchronizationObject+4e
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3
    STACK_COMMAND:  .cxr 0xfffff8800b527df0 ; kb
    FAILURE_BUCKET_ID:  X64_0x3B_nt!KiSignalSynchronizationObject+4e
    BUCKET_ID:  X64_0x3B_nt!KiSignalSynchronizationObject+4e
    Followup: MachineOwner
    ---------------------------------------------------------------------------------------------------------------------------------------------------------

    The following actions might prevent an error like this from happening again:

    1. Download and install updates and device drivers for your computer from Windows Update.
    2. Scan your computer for computer viruses.
    3. Check your hard disk for errors.

     

    Regards,

     


    MCP | MCTS | MCITP
    Thursday, November 24, 2011 9:16 AM
  • Thanks, I read that article on Bug Check 0x3b that points to the video card driver, I went over to ATI  and did have a newvery recent  update I didn't know about , let's hope is just that, 'cause windows Update is active and everything AFAIK is up to date. Virus scan is on using latest virus definitions, as well as Malware scanner. Haven't ran the HDD scanner lately, I will do that to be safe..Thanks ..
    Thursday, November 24, 2011 6:42 PM
  • Probably caused by : ksthunk.sys ( ksthunk+62e )

    Followup: MachineOwner
    ---------


    3: kd> .reload
    Loading Kernel Symbols
    ...............................................................
    .........................................................Page 154acc not present in the dump file. Type ".hh dbgerr004" for details
    .......
    Page 1533d1 not present in the dump file. Type ".hh dbgerr004" for details
    .........Page 14de3f not present in the dump file. Type ".hh dbgerr004" for details
    .........................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 000007ff`fffd7018).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    ......
    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800032d2c0e, Address of the instruction which caused the bugcheck
    Arg3: fffff8800b527df0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------

    Page 154acc not present in the dump file. Type ".hh dbgerr004" for details

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP: 
    nt!KiSignalSynchronizationObject+4e
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx

    CONTEXT:  fffff8800b527df0 -- (.cxr 0xfffff8800b527df0)
    rax=850fe48445ffffff rbx=fffff8800b5288b8 rcx=59840fc00000163d
    rdx=fffff8800b5288b0 rsi=fffff8800b5288b0 rdi=59840fc00000163d
    rip=fffff800032d2c0e rsp=fffff8800b5287d0 rbp=0000000000000000
     r8=0000000000000000  r9=00000000c0000005 r10=fffff8800b528980
    r11=fffff8800b5289a8 r12=fffff800032cf021 r13=fffff880031d5180
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz ac po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
    nt!KiSignalSynchronizationObject+0x4e:
    fffff800`032d2c0e 488908          mov     qword ptr [rax],rcx ds:002b:850fe484`45ffffff=????????????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  audiodg.exe

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff800032cfca6 to fffff800032d2c0e

    STACK_TEXT:  
    fffff880`0b5287d0 fffff800`032cfca6 : 00000000`00000000 fffffa80`07aebc80 00000000`00000000 00000000`00000000 : nt!KiSignalSynchronizationObject+0x4e
    fffff880`0b528820 fffff880`063ef62e : fffffa80`00000000 fffffa80`00000000 fffffa80`07aebc00 00000000`022afb70 : nt!KeSetEvent+0x106
    fffff880`0b528890 fffff800`032cf021 : fffff880`0b5288b8 fffffa80`07aebc80 fffffa80`0a969010 fffff880`063efc21 : ksthunk!CKernelFilterDevice::DeferIrpCompletion+0x12
    fffff880`0b5288c0 fffff880`063ef94c : 00000000`00000001 fffffa80`0a969200 fffffa80`07aebc80 00000000`00000000 : nt!IopfCompleteRequest+0x341
    fffff880`0b5289b0 fffff800`035e6a97 : fffffa80`05a2d070 fffff880`0b528ca0 fffffa80`c0000005 fffffa80`05a2d070 : ksthunk!CKernelFilterDevice::DispatchIrp+0x244
    fffff880`0b528a10 fffff800`035e72f6 : fffff683`ff7f2128 00000000`00000239 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
    fffff880`0b528b40 fffff800`032caed3 : fffffa80`05661b60 0000007f`ffffffff fffff880`0b528bc8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
    fffff880`0b528bb0 00000000`77c9138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`022af9c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c9138a


    FOLLOWUP_IP: 
    ksthunk!CKernelFilterDevice::DeferIrpCompletion+12
    fffff880`063ef62e b8160000c0      mov     eax,0C0000016h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: ksthunk

    IMAGE_NAME:  ksthunk.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bca93

    STACK_COMMAND:  .cxr 0xfffff8800b527df0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    Followup: MachineOwner
    ---------

    3: kd> lmvm ksthunk
    start             end                 module name
    fffff880`063ef000 fffff880`063f4200   ksthunk    (pdb symbols)          c:\symbols\ksthunk.pdb\A58068C2E5CB41E6B685D3866CA394141\ksthunk.pdb
        Loaded symbol image file: ksthunk.sys
        Image path: \SystemRoot\system32\drivers\ksthunk.sys
        Image name: ksthunk.sys
        Timestamp:        Mon Jul 13 20:00:19 2009 (4A5BCA93)
        CheckSum:         0000AF92
        ImageSize:        00005200
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

     

    --------------------------------------------------------

    Bug Check Code 0x3B: http://msdn.microsoft.com/en-us/library/ff558949(v=VS.85).aspx

    Your BSOD was caused by ksthunk.sys driver: http://www.file.net/process/ksthunk.sys.html

    Please start by updating it. If this does not help, uninstall it or contact its developer Technical Support.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    Thursday, November 24, 2011 9:19 PM
  • Yes Vegan Fanatic, my Radeon is now running ver-11.11.

     

    But after reboot, W7 went into auto sleep mode and it was 'shutdown' after my return again.

    Checked my new MEMORY.DMP with MS debugger and I get the same error again with KSTHUNK.SYS

    MRx , Previously to coming here I found online a site with an KSTHUNK.SYS upgrade/download, but I didn't use it because i don't trust this unknown sites.

    Your link takes me to an unknown page (to me) FILE.NET and I can't tell exactly who's running this page and it's "Registry utils scanner" , and not wanting to make matters worse for me with an malware infection , I ask of previous users ..

     

    Is File.net "scan for errors" scan tool safe to use?  and how exactly do I download the ksthunk.sys upgrade?

     

    here is the minidump file in Skydrive, it is the latest file of course.

    https://skydrive.live.com/redir.aspx?cid=b52783e0bb11c4de&resid=B52783E0BB11C4DE!129

     

    And here's the new/latest debugger memory.dmp crash file after the Radeon Video upgrade.

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\MEMORY3.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: C:\Symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`0321f000 PsLoadedModuleList = 0xfffff800`03464670
    Debug session time: Thu Nov 24 15:40:47.559 2011 (UTC - 5:00)
    System Uptime: 0 days 1:52:39.590
    Loading Kernel Symbols
    ...............................................................
    .........................................................Page 14d954 not present in the dump file. Type ".hh dbgerr004" for details
    ......Page 14c0c4 not present in the dump file. Type ".hh dbgerr004" for details
    .
    .........Page 147cd5 not present in the dump file. Type ".hh dbgerr004" for details
    .........................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 000007ff`fffdf018).  Type ".hh dbgerr001" for details
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 3B, {c0000005, fffff800032a2c0e, fffff8800cbe1df0, 0}

    Page 14d954 not present in the dump file. Type ".hh dbgerr004" for details
    Probably caused by : ksthunk.sys ( ksthunk!CKernelFilterDevice::DeferIrpCompletion+12 )

    Followup: MachineOwner
    ---------

    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800032a2c0e, Address of the instruction which caused the bugcheck
    Arg3: fffff8800cbe1df0, Address of the context record for the exception that caused the bugcheck
    Arg4: 0000000000000000, zero.

    Debugging Details:
    ------------------

    Page 14d954 not present in the dump file. Type ".hh dbgerr004" for details

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    nt!KiSignalSynchronizationObject+4e
    fffff800`032a2c0e 488908          mov     qword ptr [rax],rcx

    CONTEXT:  fffff8800cbe1df0 -- (.cxr 0xfffff8800cbe1df0)
    rax=850fe48445ffffff rbx=fffff8800cbe28b8 rcx=59840fc00000163d
    rdx=fffff8800cbe28b0 rsi=fffff8800cbe28b0 rdi=59840fc00000163d
    rip=fffff800032a2c0e rsp=fffff8800cbe27d0 rbp=0000000000000000
     r8=0000000000000000  r9=00000000c0000005 r10=fffff8800cbe2980
    r11=fffff8800cbe29a8 r12=fffff8000329f021 r13=fffff880009b2180
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz ac po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
    nt!KiSignalSynchronizationObject+0x4e:
    fffff800`032a2c0e 488908          mov     qword ptr [rax],rcx ds:002b:850fe484`45ffffff=????????????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x3B

    PROCESS_NAME:  audiodg.exe

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff8000329fca6 to fffff800032a2c0e

    STACK_TEXT: 
    fffff880`0cbe27d0 fffff800`0329fca6 : 00000000`00000000 fffffa80`07f27f80 00000000`00000000 00000000`00000000 : nt!KiSignalSynchronizationObject+0x4e
    fffff880`0cbe2820 fffff880`04d0262e : fffffa80`00000000 fffffa80`00000000 fffffa80`07f27f00 00000000`00ddfb90 : nt!KeSetEvent+0x106
    fffff880`0cbe2890 fffff800`0329f021 : fffff880`0cbe28b8 fffffa80`07f27f80 fffffa80`0b1cc780 fffff880`04d02c21 : ksthunk!CKernelFilterDevice::DeferIrpCompletion+0x12
    fffff880`0cbe28c0 fffff880`04d0294c : 00000000`00000001 fffffa80`0b1cca00 fffffa80`07f27f80 00000000`00000000 : nt!IopfCompleteRequest+0x341
    fffff880`0cbe29b0 fffff800`035b6a97 : fffffa80`05e82ca0 fffff880`0cbe2ca0 fffffa80`c0000005 fffffa80`05e82ca0 : ksthunk!CKernelFilterDevice::DispatchIrp+0x244
    fffff880`0cbe2a10 fffff800`035b72f6 : fffff683`ff7effa8 00000000`0000026d 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
    fffff880`0cbe2b40 fffff800`0329aed3 : fffffa80`05dd6b60 0000007f`ffffffff fffff880`0cbe2bc8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
    fffff880`0cbe2bb0 00000000`778a138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`00ddf9e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778a138a


    FOLLOWUP_IP:
    ksthunk!CKernelFilterDevice::DeferIrpCompletion+12
    fffff880`04d0262e b8160000c0      mov     eax,0C0000016h

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: ksthunk

    IMAGE_NAME:  ksthunk.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bca93

    STACK_COMMAND:  .cxr 0xfffff8800cbe1df0 ; kb

    FAILURE_BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    BUCKET_ID:  X64_0x3B_ksthunk!CKernelFilterDevice::DeferIrpCompletion+12

    Followup: MachineOwner

    4: kd> lmvm ksthunk
    start             end                 module name
    fffff880`04d02000 fffff880`04d07200   ksthunk    (pdb symbols)          c:\symbols\ksthunk.pdb\A58068C2E5CB41E6B685D3866CA394141\ksthunk.pdb
        Loaded symbol image file: ksthunk.sys
        Image path: \SystemRoot\system32\drivers\ksthunk.sys
        Image name: ksthunk.sys
        Timestamp:        Mon Jul 13 20:00:19 2009 (4A5BCA93)
        CheckSum:         0000AF92
        ImageSize:        00005200
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

     

    Thanks again

     

     



    • Edited by Mackado Thursday, November 24, 2011 10:19 PM missing info
    Thursday, November 24, 2011 10:10 PM
  • Vegan, ran MEMTEST V.4.20 for a few hours like three times, no errors 

     

    Any advice related to the File.net site's scan KSTHUNK.SYS solution posted above by Mr x?

    Friday, November 25, 2011 6:37 AM
  • Hi,

    Please understanding that to solid troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump and analyze the related source code if needed. Unfortunately, debugging is beyond what we can do in the forum. I'd like to recommend you contact Microsoft Customer Support Service for assistance so that this problem can be resolved efficiently. Please visit here: http://support.microsoft.com/contactus

    Regards,

    Miya


    This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Miya Yao Friday, December 2, 2011 5:47 AM
    Friday, November 25, 2011 8:07 AM