locked
Blue Screen about 0x03B RRS feed

  • Question

  • My desktop at random times will go "Blue Screen" on me with the following message.

    What needs to be done to correct the situation?

    ----------------------------------------------------------------------------------------------------------------------------------------------

    A problem has been detected and windows has been shut down to prevent damage to your computer.

     SYSTEM_SERVICE_EXCEPTION

    If this is the first time you’ve seen this Stop error screen,

    restart your computer. If this screen appears again, follow

    these steps:

     

    Check to make sure any new hardware of software is properly installed.

    If this is a new installation, ask your hardware or software manufacturer

    for any windows updates you might need.

     

    If problems continue, disable or remove any newly installed hardware or software. Disable

    BIOS memory options such as caching or shadowing. If you need

    to use Safe Mode to remove or disable components, restart your

    computer, press F8 to select Advance Startup Options, and then

    select Safe Mode.

     

    Technical information:

     

    *** STOP: 0x0000003B (0xFFFFFFFFC0000005, 0xFFFFF80004D0BA02, 0xFFFFF8800F3B17B0, 0x0000000000000000)

     

    -------------------------------------------------------------------------------------------------------------------------------------------------

    My minidump file.

    https://onedrive.live.com/redir?resid=dffa4ba5fe156b64!483&authkey=!AKs_ICiv818APOQ&ithint=file%2czip

    Friday, June 12, 2015 12:50 PM

Answers

  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)



    Wanikiya and Dyami--Team Zigzag

    Friday, June 12, 2015 1:15 PM
  • The crash is on npfs.SYS which is a Windows driver, looks like Chrome.exe is causing the crash. Does the crash only happen when Google Chrome is open? If so, I would try uninstalling and reinstalling.

    .

    .

    .

    Use !analyze -v to get detailed debugging information.

    BugCheck 19, {3, fffff80004e556f0, fffffa800abbc790, fffff80004e556f0}

    Probably caused by : Npfs.SYS ( Npfs!NpAddDataQueueEntry+184 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 0000000000000003, the pool freelist is corrupt.
    Arg2: fffff80004e556f0, the pool entry being checked.
    Arg3: fffffa800abbc790, the read back flink freelist value (should be the same as 2).
    Arg4: fffff80004e556f0, the read back blink freelist value (should be the same as 2).

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0x19_3

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    PROCESS_NAME:  chrome.exe

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff80004df74c3 to fffff80004cc0a40

    STACK_TEXT:  
    fffff880`0d9387c8 fffff800`04df74c3 : 00000000`00000019 00000000`00000003 fffff800`04e556f0 fffffa80`0abbc790 : nt!KeBugCheckEx
    fffff880`0d9387d0 fffff800`04cd4ac6 : 00000000`00000000 00000000`00000108 fffffa80`06fb70e0 fffff800`00000000 : nt!ExAllocatePoolWithTag+0x11a3
    fffff880`0d9388c0 fffff880`0541bd1c : 00000000`00001000 00000000`00000000 fffffa80`06fb70e0 fffffa80`06fb70e0 : nt!ExAllocatePoolWithQuotaTag+0x56
    fffff880`0d938910 fffff880`0541ecf4 : fffff880`0d938a30 fffff8a0`14d2a690 fffff880`00000000 fffffa80`00000000 : Npfs!NpAddDataQueueEntry+0x184
    fffff880`0d938970 fffff880`0541eab5 : fffffa80`06fb71b0 fffffa80`0abb3700 00000000`00000000 fffffa80`06fb70e0 : Npfs!NpCommonRead+0x150
    fffff880`0d9389f0 fffff800`04fc930b : 00000000`00000000 fffff800`04cd2701 00000000`15dc9cf0 fffffa80`0abb3750 : Npfs!NpFsdRead+0x51
    fffff880`0d938a50 fffff800`04faa1b3 : fffffa80`0abb3700 fffffa80`0abb3700 fffffa80`0abb3700 fffff880`045d5180 : nt!IopSynchronousServiceTail+0xfb
    fffff880`0d938ac0 fffff800`04cbfcd3 : fffffa80`0acc8060 00000000`00000000 00000000`00000001 00000000`08117d40 : nt!NtReadFile+0x631
    fffff880`0d938bb0 00000000`748f2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`052cefe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748f2e09


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Npfs!NpAddDataQueueEntry+184
    fffff880`0541bd1c 488bf8          mov     rdi,rax

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  Npfs!NpAddDataQueueEntry+184

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Npfs

    IMAGE_NAME:  Npfs.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc114

    FAILURE_BUCKET_ID:  X64_0x19_3_Npfs!NpAddDataQueueEntry+184

    BUCKET_ID:  X64_0x19_3_Npfs!NpAddDataQueueEntry+184

    Followup: MachineOwner
    ---------


    Friday, June 12, 2015 1:14 PM

All replies

  • The crash is on npfs.SYS which is a Windows driver, looks like Chrome.exe is causing the crash. Does the crash only happen when Google Chrome is open? If so, I would try uninstalling and reinstalling.

    .

    .

    .

    Use !analyze -v to get detailed debugging information.

    BugCheck 19, {3, fffff80004e556f0, fffffa800abbc790, fffff80004e556f0}

    Probably caused by : Npfs.SYS ( Npfs!NpAddDataQueueEntry+184 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 0000000000000003, the pool freelist is corrupt.
    Arg2: fffff80004e556f0, the pool entry being checked.
    Arg3: fffffa800abbc790, the read back flink freelist value (should be the same as 2).
    Arg4: fffff80004e556f0, the read back blink freelist value (should be the same as 2).

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0x19_3

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

    PROCESS_NAME:  chrome.exe

    CURRENT_IRQL:  2

    LAST_CONTROL_TRANSFER:  from fffff80004df74c3 to fffff80004cc0a40

    STACK_TEXT:  
    fffff880`0d9387c8 fffff800`04df74c3 : 00000000`00000019 00000000`00000003 fffff800`04e556f0 fffffa80`0abbc790 : nt!KeBugCheckEx
    fffff880`0d9387d0 fffff800`04cd4ac6 : 00000000`00000000 00000000`00000108 fffffa80`06fb70e0 fffff800`00000000 : nt!ExAllocatePoolWithTag+0x11a3
    fffff880`0d9388c0 fffff880`0541bd1c : 00000000`00001000 00000000`00000000 fffffa80`06fb70e0 fffffa80`06fb70e0 : nt!ExAllocatePoolWithQuotaTag+0x56
    fffff880`0d938910 fffff880`0541ecf4 : fffff880`0d938a30 fffff8a0`14d2a690 fffff880`00000000 fffffa80`00000000 : Npfs!NpAddDataQueueEntry+0x184
    fffff880`0d938970 fffff880`0541eab5 : fffffa80`06fb71b0 fffffa80`0abb3700 00000000`00000000 fffffa80`06fb70e0 : Npfs!NpCommonRead+0x150
    fffff880`0d9389f0 fffff800`04fc930b : 00000000`00000000 fffff800`04cd2701 00000000`15dc9cf0 fffffa80`0abb3750 : Npfs!NpFsdRead+0x51
    fffff880`0d938a50 fffff800`04faa1b3 : fffffa80`0abb3700 fffffa80`0abb3700 fffffa80`0abb3700 fffff880`045d5180 : nt!IopSynchronousServiceTail+0xfb
    fffff880`0d938ac0 fffff800`04cbfcd3 : fffffa80`0acc8060 00000000`00000000 00000000`00000001 00000000`08117d40 : nt!NtReadFile+0x631
    fffff880`0d938bb0 00000000`748f2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`052cefe8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748f2e09


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Npfs!NpAddDataQueueEntry+184
    fffff880`0541bd1c 488bf8          mov     rdi,rax

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  Npfs!NpAddDataQueueEntry+184

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Npfs

    IMAGE_NAME:  Npfs.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc114

    FAILURE_BUCKET_ID:  X64_0x19_3_Npfs!NpAddDataQueueEntry+184

    BUCKET_ID:  X64_0x19_3_Npfs!NpAddDataQueueEntry+184

    Followup: MachineOwner
    ---------


    Friday, June 12, 2015 1:14 PM
  • These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)



    Wanikiya and Dyami--Team Zigzag

    Friday, June 12, 2015 1:15 PM