locked
Windows 7 Blue Screen RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I have been experiencing blue screen on the windows 7 Home premium on my laptop for a few months now. I have updated the various drivers to the latest version but it still persists.

    I have uploaded the mindump here along with the xml file. the bugcheck info is here

    The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000001e (0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\windows\MEMORY.DMP. Report Id: 010514-102882-01.

    Thanks for your response!


    • Edited by DD10036 Sunday, January 5, 2014 10:44 PM
    Sunday, January 5, 2014 10:41 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    DD10036

    The 2 verified DMPS point to two files 

    igdkmd64.sys
    dxgmms1.sys

    Both video related.  I would turn off driver verifier (type verifier /reset), download the current video driver package and the un-instal the current video driver package, then re-install the downloaded one.

    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ken\Desktop\011614-49327-01(2).dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324b6d0
Debug session time: Thu Jan 16 10:06:37.120 2014 (UTC - 5:00)
System Uptime: 0 days 1:46:39.369
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 2, fffff80003206cc0, 0}

*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
	the operating system. The only supported way to extend a kernel
	mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80003206cc0
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

EXCEPTION_RECORD:  fffff80000b9c9c8 -- (.exr 0xfffff80000b9c9c8)
ExceptionAddress: fffff80003080e94 (nt!SwapContext_PatchXRstor)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff80000b9ca70 -- (.trap 0xfffff80000b9ca70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=fffff80000b9ccc0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003080e94 rsp=fffff80000b9cc00 rbp=fffff80000b9cc70
 r8=fffffa80065fbc50  r9=0000000000000000 r10=0000000000000000
r11=fffff800031f8e80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!SwapContext_PatchXRstor:
fffff800`03080e94 0fae09          fxrstor [rcx]         ds:fffff800`00b9ccc0=00
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d44fa to fffff8000307dbc0

STACK_TEXT:  
fffff800`00b9bac8 fffff800`030d44fa : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`03206cc0 : nt!KeBugCheckEx
fffff800`00b9bad0 fffff800`030a7153 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4884
fffff800`00b9bb10 fffff800`030b84c1 : fffff800`00b9c9c8 fffff800`00b9c720 fffff800`00b9ca70 fffffa80`091b1060 : nt!RtlDispatchException+0x33
fffff800`00b9c1f0 fffff800`0307d242 : fffff800`00b9c9c8 fffff800`031f8e80 fffff800`00b9ca70 fffff800`03206cc0 : nt!KiDispatchException+0x135
fffff800`00b9c890 fffff800`0307bb4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`00b9ca70 fffff800`03080e94 : fffff800`00b96080 fffffa80`06719890 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9cc00 fffff800`0307597d : fffff800`031f8e80 fffff800`00000000 00000000`00000000 fffff880`016fb800 : nt!SwapContext_PatchXRstor
fffff800`00b9cc40 fffff880`0435c69d : 00000000`0022320b fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x10d
fffff800`00b9cc70 fffff880`043563fd : 00000000`00000001 00000000`0022320b fffffa80`093c2010 00000000`00000000 : dxgmms1!VidSchiUpdateCurrentIsrFrameTime+0x95
fffff800`00b9cca0 fffff880`04356083 : 00000000`00064265 00000000`00000000 00000000`08d80000 fffff880`04a66066 : dxgmms1!VidSchiProcessIsrVSync+0xc9
fffff800`00b9cd30 fffff880`04a6651f : 00000000`00000000 01cf12cc`8d5a2244 fffffa80`157da000 fffffa80`157d5000 : dxgmms1!VidSchDdiNotifyInterruptWorker+0xef
fffff800`00b9cd80 00000000`00000000 : 01cf12cc`8d5a2244 fffffa80`157da000 fffffa80`157d5000 fffffa80`157d5000 : igdkmd64+0x5351f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95
fffff880`0435c69d 48837f4000      cmp     qword ptr [rdi+40h],0

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5164dc13

IMAGE_VERSION:  6.1.7601.18126

FAILURE_BUCKET_ID:  X64_0xc4_91_dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

BUCKET_ID:  X64_0xc4_91_dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_91_dxgmms1!vidschiupdatecurrentisrframetime+95

FAILURE_ID_HASH:  {087f5976-b49d-1aba-ab08-6f723c9d4175}

Followup: MachineOwner
---------


    Wanikiya and Dyami--Team Zigzag

    • Marked as answer by Yolanda Zhu Thursday, January 23, 2014 12:37 PM
    Friday, January 17, 2014 6:26 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  
    WE NEED AT LEAST TWO DMP FILES TO SPOT TRENDS AND CONFIRM THE DIAGNOSIS.

    Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
    If you have any questions about the procedure please ask

    Wanikiya and Dyami--Team Zigzag

    Monday, January 6, 2014 2:26 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    When I try to include the skydrive url where I have uploaded the dump files I get this message:Body  text cannot contain images or links until we are able to verify your account. I have already verified the account earlier.

    Pls provide an email address where I can send you the url..or advise how else I can send you the skydrive url.

    thx.

    Tuesday, January 7, 2014 3:04 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    If you are being told you cant post a link, or embed a picture (or any other restriction) you just need to post to this thread saying your account has not been validated
    http://social.microsoft.com/Forums/en-US/ceb31cd8-39fc-4af9-ac77-1dff965dfcf0/verify-your-account-10?forum=reportabug

    Wanikiya and Dyami--Team Zigzag

    Tuesday, January 7, 2014 3:10 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    It seems like my account has not been validated as I am not able to post a link or embed a picture. Please help !
    Tuesday, January 7, 2014 3:10 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    DD10036

    You obviously did not post in the thread I suggested. 

    Wanikiya and Dyami--Team Zigzag

    Tuesday, January 7, 2014 9:53 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    sorry have posted it to the forum u suggested now.
    Wednesday, January 8, 2014 1:30 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Here is the link to the dump files

    Dump files

    DD

    Wednesday, January 8, 2014 11:57 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    DD

    These were both inconclusive but point to a memory issue.  It is probably a driver.  Please run verifier to find out which driver it is


    If you are overclocking (pushing the components beyond their design) you should revert to default at least until the crashing is solved. If you don't know what it is you probably are not overclocking.

    *

    Driver verifier (for complete directions see our wiki here)
    Co-Authored by  JMH3143
    .

    Wanikiya and Dyami--Team Zigzag

    Wednesday, January 8, 2014 4:51 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks will take a look at this over the weekend..

    Thx.

    DD

    Friday, January 10, 2014 1:36 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    After enabling driver verifier I got the blue screen . I have uploaded the dumpfile along with system specs and msinfo

    Here is the the url for the files

    https://skydrive.live.com/?cid=3e43ec912409f756#cid=3E43EC912409F756&id=3E43EC912409F756%21243

    TIA

    DD

    Monday, January 13, 2014 2:31 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    DD

    Verifier didnt catch the driver (probably because it wasn't in the set being verified)  I would change the driver set to all.

    That may slow the computer down a bit but will help find the offending driver faster.

    Wanikiya and Dyami--Team Zigzag

    Monday, January 13, 2014 5:24 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Changing the driver set to all results in a blue screen as soon as it was enabled. I cannot even login .
    I have uploaded two more dumps 1/13/14and 1/16/14 here

    https://skydrive.live.com/?cid=3e43ec912409f756#cid=3E43EC912409F756&id=3E43EC912409F756%21243

    The latest bluscreen shows a stoperror with  igdkmd64.sys .I have included the jpg of the bluescreen error

    I see this in the event log. 

    The driver detected a controller error on \Device\Harddisk1\DR1.  and previously
    The driver detected a controller error on \Device\Harddisk2\DR2.

    Not sue if this is related to the seagate usb drive that I have connected to the machine.

    Pls take a look if that has any info.Seems like the bluescreen frequency has gone up after verifier has been enabled.

    Thanks.

    DD




    • Edited by DD10036 Thursday, January 16, 2014 10:01 PM
    Thursday, January 16, 2014 2:04 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    DD10036

    The 2 verified DMPS point to two files 

    igdkmd64.sys
    dxgmms1.sys

    Both video related.  I would turn off driver verifier (type verifier /reset), download the current video driver package and the un-instal the current video driver package, then re-install the downloaded one.

    Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ken\Desktop\011614-49327-01(2).dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*H:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324b6d0
Debug session time: Thu Jan 16 10:06:37.120 2014 (UTC - 5:00)
System Uptime: 0 days 1:46:39.369
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 2, fffff80003206cc0, 0}

*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
Probably caused by : dxgmms1.sys ( dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
	the operating system. The only supported way to extend a kernel
	mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000002
Arg3: fffff80003206cc0
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

EXCEPTION_RECORD:  fffff80000b9c9c8 -- (.exr 0xfffff80000b9c9c8)
ExceptionAddress: fffff80003080e94 (nt!SwapContext_PatchXRstor)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff80000b9ca70 -- (.trap 0xfffff80000b9ca70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000004 rbx=0000000000000000 rcx=fffff80000b9ccc0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003080e94 rsp=fffff80000b9cc00 rbp=fffff80000b9cc70
 r8=fffffa80065fbc50  r9=0000000000000000 r10=0000000000000000
r11=fffff800031f8e80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!SwapContext_PatchXRstor:
fffff800`03080e94 0fae09          fxrstor [rcx]         ds:fffff800`00b9ccc0=00
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030d44fa to fffff8000307dbc0

STACK_TEXT:  
fffff800`00b9bac8 fffff800`030d44fa : 00000000`000000c4 00000000`00000091 00000000`00000002 fffff800`03206cc0 : nt!KeBugCheckEx
fffff800`00b9bad0 fffff800`030a7153 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4884
fffff800`00b9bb10 fffff800`030b84c1 : fffff800`00b9c9c8 fffff800`00b9c720 fffff800`00b9ca70 fffffa80`091b1060 : nt!RtlDispatchException+0x33
fffff800`00b9c1f0 fffff800`0307d242 : fffff800`00b9c9c8 fffff800`031f8e80 fffff800`00b9ca70 fffff800`03206cc0 : nt!KiDispatchException+0x135
fffff800`00b9c890 fffff800`0307bb4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff800`00b9ca70 fffff800`03080e94 : fffff800`00b96080 fffffa80`06719890 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff800`00b9cc00 fffff800`0307597d : fffff800`031f8e80 fffff800`00000000 00000000`00000000 fffff880`016fb800 : nt!SwapContext_PatchXRstor
fffff800`00b9cc40 fffff880`0435c69d : 00000000`0022320b fffff800`00b97000 fffff800`00b9cc00 00000000`00000000 : nt!KiIdleLoop+0x10d
fffff800`00b9cc70 fffff880`043563fd : 00000000`00000001 00000000`0022320b fffffa80`093c2010 00000000`00000000 : dxgmms1!VidSchiUpdateCurrentIsrFrameTime+0x95
fffff800`00b9cca0 fffff880`04356083 : 00000000`00064265 00000000`00000000 00000000`08d80000 fffff880`04a66066 : dxgmms1!VidSchiProcessIsrVSync+0xc9
fffff800`00b9cd30 fffff880`04a6651f : 00000000`00000000 01cf12cc`8d5a2244 fffffa80`157da000 fffffa80`157d5000 : dxgmms1!VidSchDdiNotifyInterruptWorker+0xef
fffff800`00b9cd80 00000000`00000000 : 01cf12cc`8d5a2244 fffffa80`157da000 fffffa80`157d5000 fffffa80`157d5000 : igdkmd64+0x5351f


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95
fffff880`0435c69d 48837f4000      cmp     qword ptr [rdi+40h],0

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  5164dc13

IMAGE_VERSION:  6.1.7601.18126

FAILURE_BUCKET_ID:  X64_0xc4_91_dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

BUCKET_ID:  X64_0xc4_91_dxgmms1!VidSchiUpdateCurrentIsrFrameTime+95

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xc4_91_dxgmms1!vidschiupdatecurrentisrframetime+95

FAILURE_ID_HASH:  {087f5976-b49d-1aba-ab08-6f723c9d4175}

Followup: MachineOwner
---------


    Wanikiya and Dyami--Team Zigzag

    • Marked as answer by Yolanda Zhu Thursday, January 23, 2014 12:37 PM
    Friday, January 17, 2014 6:26 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I turned off driver verifier , downloaded the new vdo driver and reinstalled the downloaded one. I forgot to uninstall  the old vdo driver first.Since then I have had one blue screen in 4 days...which is much better than before..It was still complaining abt igdkm64.sys in the blue screen dump. Is there any way I can remove traces of the old driver at this point? Whats the best way to handle this?

    Thx.


    DD

    Thursday, January 23, 2014 5:53 PM