locked
Windows 7 Home Premium Bugcheck 3b RRS feed

  • Question

  • I've started to get bugcheck restarts recently on a desktop running Window 7 Home Premium 64-bit OS that has been totally reliable for a couple of years now.  I've also run extensive hardware diagnostics, and not found any problems, but software can use the hardware in different ways than diagnostics, so diagnostics don't always tell the story.  

    The only interesting thing that I've noticed is that the bugchecks always happen when I've walked away and left the system on, so it is essentially "idle".  Which seems odd to me, but that's the way it happens...

    Anyways, here's the Windbg output from the bugchecks afterwards, any help with it would be greatly appreciated.  I hope that this is okay in this forum, I didn't see a better one to ask in.

    Thanks so much for any pointers or ideas about what kind of problem this might be.

    -Roger

    ========================================================

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

     

     

    Loading Dump File [C:\Windows\MEMORY_07212010.DMP]

    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is: 

    Windows 7 Kernel Version 7600 MP (4 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS Personal

    Built by: 7600.16539.amd64fre.win7_gdr.100226-1909

    Machine Name:

    Kernel base = 0xfffff800`02863000 PsLoadedModuleList = 0xfffff800`02aa0e50

    Debug session time: Thu Jul 22 00:00:23.915 2010 (UTC - 7:00)

    System Uptime: 0 days 14:36:44.679

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    .......................

    Loading User Symbols

    PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details

    Loading unloaded module list

    ......

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    Use !analyze -v to get detailed debugging information.

     

    BugCheck 3B, {c0000005, fffff800028b3414, fffff880061e9870, 0}

     

    Probably caused by : fileinfo.sys ( fileinfo!FIStreamGet+52 )

     

    Followup: MachineOwner

    ---------

     

    2: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    SYSTEM_SERVICE_EXCEPTION (3b)

    An exception happened while executing a system service routine.

    Arguments:

    Arg1: 00000000c0000005, Exception code that caused the bugcheck

    Arg2: fffff800028b3414, Address of the instruction which caused the bugcheck

    Arg3: fffff880061e9870, Address of the context record for the exception that caused the bugcheck

    Arg4: 0000000000000000, zero.

     

    Debugging Details:

    ------------------

     

     

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

     

    FAULTING_IP: 

    nt!FsRtlLookupPerStreamContextInternal+7c

    fffff800`028b3414 48396810        cmp     qword ptr [rax+10h],rbp

     

    CONTEXT:  fffff880061e9870 -- (.cxr 0xfffff880061e9870)

    rax=0000000008077462 rbx=fffff8a000f8d7a0 rcx=fffff8a000f8d7d8

    rdx=0000000000000011 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff800028b3414 rsp=fffff880061ea240 rbp=fffffa8007037800

     r8=0000000000000000  r9=fffff880061ea310 r10=0000000000000000

    r11=fffff880061ea408 r12=0000000000000000 r13=0000000000000001

    r14=fffff880061ea418 r15=fffff880061ea458

    iopl=0         nv up ei pl nz ac pe cy

    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010213

    nt!FsRtlLookupPerStreamContextInternal+0x7c:

    fffff800`028b3414 48396810        cmp     qword ptr [rax+10h],rbp ds:002b:00000000`08077472=????????????????

    Resetting default scope

     

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

     

    BUGCHECK_STR:  0x3B

     

    PROCESS_NAME:  sched.exe

     

    CURRENT_IRQL:  0

     

    LAST_CONTROL_TRANSFER:  from fffff8800100f32e to fffff800028b3414

     

    STACK_TEXT:  

    fffff880`061ea240 fffff880`0100f32e : fffffa80`05ae2ce0 fffff880`061ea3a0 fffffa80`07037800 fffff880`01229734 : nt!FsRtlLookupPerStreamContextInternal+0x7c

    fffff880`061ea280 fffff880`0101ad31 : fffffa80`07037800 fffff880`0122ef30 fffffa80`05ae7bb0 00000000`00000001 : fltmgr!FltpGetStreamListCtrl+0x8e

    fffff880`061ea2e0 fffff880`01060052 : 00000000`00000000 fffff140`11068587 fffff880`061ea520 fffff880`012ccbfb : fltmgr!FltGetStreamContext+0x21

    fffff880`061ea310 fffff880`0105eb07 : fffff140`11068587 00000000`00000000 00000000`00000000 00000000`00000000 : fileinfo!FIStreamGet+0x52

    fffff880`061ea380 fffff880`0100f242 : 00000000`00000000 00000000`00000000 fffffa80`06252868 00000000`00000000 : fileinfo!FIPostCreateCallback+0xf3

    fffff880`061ea410 fffff880`0100e38b : fffffa80`07567030 fffffa80`05a86e80 fffffa80`05ff1bb0 fffffa80`05ff1dd0 : fltmgr!FltpPerformPostCallbacks+0x392

    fffff880`061ea4e0 fffff880`0102d2b9 : fffffa80`06252510 fffffa80`07037800 fffffa80`06252500 fffffa80`05fddde0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x39b

    fffff880`061ea570 fffff800`02bd7777 : 00000000`00000045 fffff800`02bd71d0 fffff880`061ea9d0 00000000`00000000 : fltmgr!FltpCreate+0x2a9

    fffff880`061ea620 fffff800`02bcda64 : fffffa80`05f818c0 00000000`00000000 fffffa80`06297610 fffffa80`08367001 : nt!IopParseDevice+0x5a7

    fffff880`061ea7b0 fffff800`02bd2b76 : fffffa80`06297610 fffff880`061ea930 7fffffff`00000040 fffffa80`05437080 : nt!ObpLookupObjectName+0x585

    fffff880`061ea8b0 fffff800`02bb81ca : fffff8a0`00f9e8d0 00000000`00ebe7f8 fffffa80`04e0c901 0000007c`50007cf0 : nt!ObOpenObjectByName+0x306

    fffff880`061ea980 fffff800`028d2853 : 00000000`00000008 00000000`009d2ad8 fffffa80`083d0060 fffffa80`083c3a90 : nt!NtQueryAttributesFile+0x149

    fffff880`061eac20 00000000`778e012a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

    00000000`00ebe7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778e012a

     

     

    FOLLOWUP_IP: 

    fileinfo!FIStreamGet+52

    fffff880`01060052 8bd8            mov     ebx,eax

     

    SYMBOL_STACK_INDEX:  3

     

    SYMBOL_NAME:  fileinfo!FIStreamGet+52

     

    FOLLOWUP_NAME:  MachineOwner

     

    MODULE_NAME: fileinfo

     

    IMAGE_NAME:  fileinfo.sys

     

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc481

     

    STACK_COMMAND:  .cxr 0xfffff880061e9870 ; kb

     

    FAILURE_BUCKET_ID:  X64_0x3B_fileinfo!FIStreamGet+52

     

    BUCKET_ID:  X64_0x3B_fileinfo!FIStreamGet+52

     

    Followup: MachineOwner

    ---------


    Friday, July 23, 2010 7:01 AM

Answers

  • fileinfo.sys is the FileInfo Filter Driver. This error may indicate a
    possible issue with the file system or the hard disk. I would recommend
    running the following from an administrative command prompt,
     
    chkdsk /F /R
     
    Are all of the drivers for the system up to the latest versions?
     

    -- Mike Burr
    • Marked as answer by Linda Yan Friday, July 30, 2010 1:38 AM
    Friday, July 23, 2010 3:22 PM
  • You can try Last Known Good Configuration and see if the issue can be fixed. If the issue persists, please test each RAM module independently and see if the issue is RAM related.

     

    Besides, please disable Screen Saver, Sleep Mode and change the power plan to High Performance to test the issue. If the issue still exists, run System File Checker to troubleshoot the issue.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Linda Yan Friday, July 30, 2010 1:38 AM
    Monday, July 26, 2010 7:49 AM

All replies

  • fileinfo.sys is the FileInfo Filter Driver. This error may indicate a
    possible issue with the file system or the hard disk. I would recommend
    running the following from an administrative command prompt,
     
    chkdsk /F /R
     
    Are all of the drivers for the system up to the latest versions?
     

    -- Mike Burr
    • Marked as answer by Linda Yan Friday, July 30, 2010 1:38 AM
    Friday, July 23, 2010 3:22 PM
  • Mike,

    Thanks...I'll try the chkdsk thing.  

    Is there a reasonable way to check that all drivers are up to date?  Like better than going to the device manager and going through all the devices on my system and checking each driver for updates?  Or is that how this would be done?  

    Unfortunately, I can't really correlate these bugcheck restarts with anything that I've done, or with any specific piece of software being updated, since I haven't done any updates that I know of lately other than Microsoft updates.  Windows 7 (64-bit OS) has been running happily on my desktop for a couple of months now, with lots of use (I work from home 2 days a week).

    One more piece of information, just after this started happening, I did a system restore to back before it first happened.  The dump analysis that you're looking at is from this happening most recently (after the system restore).  So system restore didn't help much, if at all.

    Thanks.

    -Roger

     

    Friday, July 23, 2010 5:42 PM
  • System restore has never done a lot of good for me either.
     
    Anyway the best way that I have found for drivers is using the vendor's
    site for downloads for the BIOS/Firmware and the chipset/motherboard
    drivers.
     
    Then I usually use information under the "Components" node of the
    msinfo32.exe utility to identify vendors/hardware to look for updates for.
     
    I then visit all of the vendor's sites and get the latest drivers for
    all of the hardware that I am able to identify.
     
    I then finish up by manually checking for updates through Microsoft
    through the high priority and optional updates to see if there is
    anything that I might have missed.
     

    -- Mike Burr
    Friday, July 23, 2010 7:16 PM
  • Well, looks like I'll be checking for driver updates, then.  Chkdsk did a lot of checking *smile*, but didn't find any problems.

    I may reinstall this weekend anyways, since I have a new hard disk (SSD) that came today and I want to use it.

    That may change things, but I should most likely still check for driver updates after re-installing, since I would have the ones from the MS Windows install...

    Thanks very much for your help, I really appreciate it.  The exercise of getting the debugger working with symbols was kind of interesting.  I have a CD now with the WDK, so I can do it again if I need to...I wish that I had more information on what the various kernel routines do, since when I see routine names in a stacktrace, that doesn't give me much insight on what was going on when things went bad.

    -Roger

    Friday, July 23, 2010 8:48 PM
  • This is an awesome first book on the subject

    http://www.amazon.com/Windows%C2%AE-Internals-Including-Windows-PRO-Developer/dp/0735625301/ref=sr_1_1?ie=UTF8&s=books&qid=1279918629&sr=8-1

    besides that, the WDK has a lot of good information as well and there are a number of books about driver development and debugger use.


    -- Mike Burr
    Friday, July 23, 2010 8:58 PM
  • You can try Last Known Good Configuration and see if the issue can be fixed. If the issue persists, please test each RAM module independently and see if the issue is RAM related.

     

    Besides, please disable Screen Saver, Sleep Mode and change the power plan to High Performance to test the issue. If the issue still exists, run System File Checker to troubleshoot the issue.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Linda Yan Friday, July 30, 2010 1:38 AM
    Monday, July 26, 2010 7:49 AM