none
BSOD System Service Exception error 3B

Answers

  • MEMORY_MANAGEMENT (1a) as we've seen above.

    This indicates that a severe memory management error occurred.

    BugCheck 1A, {31, fffffa8010c630d0, fffff88007ea9000, fffff8a004f6ccf4}
    

    The 1st parameter is 31 which indicates the image relocation fix-up table or code stream has been corrupted. This is always usually a hardware error.

    DV is also failing to detect a 3rd-party driver again, so we are definitely dealing with hardware.

    At this point, even though Memtest is passing, your RAM is either faulty or we have a motherboard problem (possible faulty DIMM slots). I would try a BIOS update as well if available/CMOS clear.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 8:55 PM

All replies

  • Hi,

    We have various bug checks:

    SYSTEM_SERVICE_EXCEPTION (3b)

    This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

    This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

    BugCheck 3B, {c0000005, fffff80003eb3f7e, fffff8800e018c90, 0}

    6: kd> ln fffff80003eb3f7e
    (fffff800`03eb3a80)   nt!MiDeletePteRun+0x504   |  (fffff800`03eb2da0)   nt!MiDeleteVirtualAddresses

    ^^ The exception occurred in nt!MiDeletePteRun.

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

    This indicates that a system thread generated an exception which the error handler did not catch.

    BugCheck 1000007E, {ffffffffc0000005, fffff80003e9db04, fffff8800395b568, fffff8800395adc0}

    ^^ The 1st parameter of the bug check is 0xc0000005 which indicates an access violation occurred.

    0: kd> .exr 0xfffff8800395b568
    ExceptionAddress: fffff80003e9db04 (nt!KiFlushRangeWorker+0x0000000000000014)
       ExceptionCode: c0000005 (Access violation)

    ^^ The violation occurred in nt!KiFlushRangeWorker.

    MEMORY_MANAGEMENT (1a)

    This indicates that a severe memory management error occurred.

    BugCheck 1A, {41284, 63e90001, 4f98e, fffff70001080000}

    ^^ The 1st parameter of the bug check is 41284 which indicates a PTE or the working set list is corrupted.

    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

    A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high. This bug check is usually caused by drivers that have used improper addresses.

    PROCESS_NAME:  uTorrent.exe

    -------------------

    Given the above information, we can assume that we're likely dealing with a driver causing corruption that's working with the network (uTorrent.exe process crash at the time of the bug check), and the file system as well.

    5: kd> lmvm mdmxsdk
    start             end                 module name
    fffff880`07ff3000 fffff880`07ff7280   mdmxsdk    (deferred)             
        Image path: \SystemRoot\system32\DRIVERS\mdmxsdk.sys
        Image name: mdmxsdk.sys
        Timestamp:        Mon Jun 19 17:27:26 2006

    ^^Conexant Modem Diagnostic Interface x86 driver, it's dated from 2006. This is far too old of a device driver to function with the OS, and is always the big problem with a lot of these modems.

    Check for an update here - http://www.conexant.com/support/, but if not available, your only option unfortunately is to purchase a more up-to-date modem/method of connection.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Saturday, April 19, 2014 5:40 PM
  • If I update the modem it should remove all the problems? I use Lan port for cable internet,. I dont use this modem and I couldnt find it in device manager. Could I disable it some other way? Thanks
    Thursday, April 24, 2014 12:40 AM
  • I can't say that it will solve your problems for sure, no. It seems to be the problem though, from what I can see.

    You could try navigating to C:\Windows\System32\Drivers and renaming mdmxsdk.sys to mdmxsdk.old, and then restarting.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, April 24, 2014 12:42 AM
  • I will try that thanks a bunch! One last question is what tool do you use to analyze these dump files like you do? I have only heard of bluescreen view.
    Thursday, April 24, 2014 12:46 AM
  • Great, keep me updated.

    Regarding what I use for debugging, I use WinDbg - http://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, April 24, 2014 1:13 AM
  • Ok I will thanks very much, I renamed the driver now and checked after restarted and its still there named old at the end.
    Thursday, April 24, 2014 1:25 AM
  • Great, please keep me updated.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, April 24, 2014 1:34 AM
  • Ok I got a memory management error 1a yesterday now but i did 20 passes with memtest and no errors were found

    https://drive.google.com/file/d/0B39S6eNyRvOHdHI0ell4SVhfTUU/edit?usp=sharing

    https://drive.google.com/file/d/0B39S6eNyRvOHSE1XcE42WDdXZmM/edit?usp=sharing

    • Edited by getgcs Monday, April 28, 2014 2:21 PM
    Monday, April 28, 2014 2:17 PM
  • MEMORY_MANAGEMENT (1a)

    This indicates that a severe memory management error occurred.

    BugCheck 1A, {31, fffffa80126efee0, fffff8800f450000, fffff8a00a1257ff}
    

    - The 1st parameter of the bug check is 31 which indicates the image relocation fix-up table and/or code stream has been corrupted. This is generally a hardware error, and even if you passed Memtest, faulty RAM is likely.

    Please enable Driver Verifier to be sure we're not dealing with a low-level driver causing corruption:

    Driver Verifier:

    What is Driver Verifier?

    Driver Verifier is included in Windows 8/8.1, 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows 2000, Windows XP, and Windows Server 2003 to promote stability and reliability; you can use this tool to troubleshoot driver issues. Windows kernel-mode components can cause system corruption or system failures as a result of an improperly written driver, such as an earlier version of a Windows Driver Model (WDM) driver.

    Essentially, if there's a 3rd party driver believed to be at issue, enabling Driver Verifier will help flush out the rogue driver if it detects a violation.

    Before enabling Driver Verifier, it is recommended to create a System Restore Point:

    Vista - START | type rstrui - create a restore point
    Windows 7 - START | type create | select "Create a Restore Point"
    Windows 8/8.1 - http://www.eightforums.com/tutorials/4690-restore-point-create-windows-8-a.html

    How to enable Driver Verifier:

    Start > type "verifier" without the quotes > Select the following options -

    1. Select - "Create custom settings (for code developers)"
    2. Select - "Select individual settings from a full list"
    3. Check the following boxes -
    - Special Pool
    - Pool Tracking
    - Force IRQL Checking
    - Deadlock Detection
    - Security Checks (Windows 7 & 8)
    - DDI compliance checking (Windows 8)
    - Miscellaneous Checks
    4. Select  - "Select driver names from a list"
    5. Click on the "Provider" tab. This will sort all of the drivers by the provider.
    6. Check EVERY box that is NOT provided by Microsoft / Microsoft Corporation.
    7. Click on Finish.
    8. Restart.

    Important information regarding Driver Verifier:

    - If Driver Verifier finds a violation, the system will BSOD. To expand on this a bit more for the interested, specifically what Driver Verifier actually does is it looks for any driver making illegal function calls, causing memory leaks, etc. When and/if this happens, system corruption occurs if allowed to continue. When Driver Verifier is enabled, it is monitoring all 3rd party drivers (as we have it set that way) and when it catches a driver attempting to do this, it will quickly flag that driver as being a troublemaker, and bring down the system safely before any corruption can occur.

    - After enabling Driver Verifier and restarting the system, depending on the culprit, if for example the driver is on start-up, you may not be able to get back into normal Windows because Driver Verifier will detect it in violation almost straight away, and as stated above, that will cause / force a BSOD.

    If this happens, do not panic, do the following:

    - Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

    - Once in Safe Mode - Start > Search > type "cmd" without the quotes.

    - To turn off Driver Verifier, type in cmd "verifier /reset" without the quotes.
    ・    Restart and boot into normal Windows.

    If your OS became corrupt or you cannot boot into Windows after disabling verifier via Safe Mode:

    - Boot into Safe Mode by repeatedly tapping the F8 key during boot-up.

    - Once in Safe Mode - Start > type "system restore" without the quotes.

    - Choose the restore point you created earlier.

    -- Note that Safe Mode for Windows 8/8.1 is a bit different, and you may need to try different methods: 5 Ways to Boot into Safe Mode in Windows 8 & Windows 8.1

    How long should I keep Driver Verifier enabled for?

    I recommend keeping it enabled for at least 24 hours. If you don't BSOD by then, disable Driver Verifier. I will usually say whether or not I'd like for you to keep it enabled any longer.

    My system BSOD'd with Driver Verifier enabled, where can I find the crash dumps?

    They will be located in %systemroot%\Minidump

    Any other questions can most likely be answered by this article:
    http://support.microsoft.com/kb/244617

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Monday, April 28, 2014 5:20 PM
  • will do thanks! and i will post the results soon 
    Tuesday, April 29, 2014 1:47 AM
  • Great, I look forward to your update.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 2:00 AM
  • Ok I enabled those drivers in verifier.exe then i restarted and it did successfully boot into windows normally. So now I assume I wait 24 hours for a bsod and then give you the dump file?

    The frequency usually for me to get a bsod is every 2-5 hours of using the computer (in chrome browser mostly) It can also happen 10 mins after boot time or 10 hours during idle.

    Now that verifier is enabled I assume I will get a different BSOD if it is a low level driver problem. 

    How do I know the verifier is running though or enabled? It didn't say anything when windows started up.

    I wait for a bsod and your response,

    Thanks.


    • Edited by getgcs Tuesday, April 29, 2014 5:59 PM
    Tuesday, April 29, 2014 5:40 PM
  • As long as you followed my DV directions, everything should be fine. To check though, you can run an elevated CMD and type verifier /query.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama


    Tuesday, April 29, 2014 6:20 PM
  • Ok I receieved a BSOD with no error name possibly the 0kb dump file (the error number was zero 24 at end (possibly low level driver problem?) I was using chrome again trying to load a video.

    then it restarted and imediatley once windows started to load again it got a 7e bsod. then it restarted again and successfully booted normally into windows which is now.

    I checked the query and a bunch of stuff came up so i assume its enabled.

    here are the dump files that just happened and again the one that could be a low level driver problem is the one that happened first and had the error 0x00000024

    https://drive.google.com/file/d/0B39S6eNyRvOHQmdxeF91b0hmWU0/edit?usp=sharing

    https://drive.google.com/file/d/0B39S6eNyRvOHLTJHdVJ3Ulk1MlU/edit?usp=sharing




    • Edited by getgcs Tuesday, April 29, 2014 7:22 PM
    Tuesday, April 29, 2014 7:20 PM
  • The first crash dump is corrupt.

    The second is verifier enabled, however, we're failing to find a 3rd-party driver/low-level driver in violation.

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

    This indicates that a system thread generated an exception which the error handler did not catch.

    BugCheck 1000007E, {ffffffffc0000005, fffff800041b4817, fffff88003b708d8, fffff88003b70130}


    The 1st parameter of the bug check is 0xc0000005 which indicates an access violation occurred.

    7: kd> .exr 0xfffff88003b708d8
    ExceptionAddress: fffff800041b4817 (nt!CmpDelayDerefKCBWorker+0x00000000000000e7)
       ExceptionCode: c0000005 (Access violation)
    

    The violation occurred in nt!CmpDelayDerefKCBWorker.

    Looks like pool corruption. Did you set up verifier 100% how I instructed it? Checked all options I instructed, checked all 3rd-party drivers as I instructed, etc?

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 7:30 PM
  • Yes I did I can wait for another bsod if this will help or I can snapshot photos of the steps I did with the verifier after I reset it.
    Tuesday, April 29, 2014 7:31 PM
  • That would be great (photos showing what you've done). The only reason I say this is because if you are following it properly and we get a similar corrupt dump/output next time, this is hardware.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 7:39 PM
  • Ok should I reset it and then re-enable it with photos on how I do it or a video or should I just leave it enabled the way I have done it the first time?

    Ok well I reset it and here are the steps,

    https://drive.google.com/file/d/0B39S6eNyRvOHeFYtRHExeXpaZWc/edit?usp=sharing

    now I will restart windows.. thanks for your continued support in the matter and I enjoy this learning experience from one tech to another.

    • Edited by getgcs Tuesday, April 29, 2014 8:19 PM
    Tuesday, April 29, 2014 8:00 PM
  • I would reset and follow the instructions again. The photos aren't necessary, but if you'd like to I wouldn't object.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 8:12 PM
  • Ok yes I did reset it and the steps I followed are in my previous post via the link provided.
    Tuesday, April 29, 2014 8:21 PM
  • Looks good, I presume you also checked:

    - Special Pool
    - Pool Tracking
    - Force IRQL Checking
    - Deadlock Detection
    - Security Checks (Windows 7 & 8)
    - DDI compliance checking (Windows 8)
    - Miscellaneous Checks

    If so, keep me updated once the next crash occurs.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 8:29 PM
  • Yes and it booted into windows fine after restart. The video for step 6 will show you what I checked.
    Tuesday, April 29, 2014 8:30 PM
  • Ok now I got another BSOD 1a but before it I got an error in windows of audio stopped working or something. Please see the dump file but also the other files I attached for the app crash that could point to a driver issue.

    https://drive.google.com/file/d/0B39S6eNyRvOHRHJIMGN3NVUwYW8/edit?usp=sharing

    Tuesday, April 29, 2014 8:52 PM
  • MEMORY_MANAGEMENT (1a) as we've seen above.

    This indicates that a severe memory management error occurred.

    BugCheck 1A, {31, fffffa8010c630d0, fffff88007ea9000, fffff8a004f6ccf4}
    

    The 1st parameter is 31 which indicates the image relocation fix-up table or code stream has been corrupted. This is always usually a hardware error.

    DV is also failing to detect a 3rd-party driver again, so we are definitely dealing with hardware.

    At this point, even though Memtest is passing, your RAM is either faulty or we have a motherboard problem (possible faulty DIMM slots). I would try a BIOS update as well if available/CMOS clear.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 8:55 PM
  • Ok I see thanks very much I will try to update the BIOS again.. I believe these problems started happening more after I did the BIOS update but Im not sure.
    Tuesday, April 29, 2014 8:59 PM
  • BIOS update gone bad possibly, it happens quite a bit. Usually a re-flash/re-updating the BIOS helps, sometimes not.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 9:13 PM
  • Ok well before I try a new BIOS update I have removed all my memory except the first 4GB chip in the first DIMM slot and driver verifier is still enabled. ( I had a total of 4 4gb chips all dimm slots used before)
    Tuesday, April 29, 2014 9:29 PM
  • Disable DV, it's not necessary at this point any longer. Be sure you clear the CMOS before and after the BIOS update.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 9:40 PM
  • Ok will do thanks.. so far since the only change (memory modules removed) no BSOD! :-)
    Tuesday, April 29, 2014 9:59 PM
  • no bsod yet since memory removed :-) ill keep u updated and i reset verifier
    Tuesday, April 29, 2014 10:00 PM
  • Great! I look forward to your update.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Tuesday, April 29, 2014 10:06 PM
  • Still no BSOD i will be putting in 1 memory chip in the second slot tonight. Do you think I should do that or do two? Im thinking 1.
    Thursday, May 01, 2014 3:15 PM
  • One at a time is a good idea.

    Regards,

    Patrick

    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, May 01, 2014 7:25 PM
  • Ok yes I will put in 1 chip now. When will this thread close? How long do I have to let you know?
    Thursday, May 01, 2014 10:24 PM
  • The only way this thread officially is answered is if you say it is, by selecting 'Mark as answer' for the post(s) that lead to answering your question.

    With that said, if you don't crash for a few days and are comfortable considering it solved, then that's what you'd do. Keep me updated, in any case.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, May 01, 2014 10:33 PM
  • The only way this thread officially is answered is if you say it is, by selecting 'Mark as answer' for the post(s) that lead to answering your question.

    With that said, if you don't crash for a few days and are comfortable considering it solved, then that's what you'd do. Keep me updated, in any case.

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    PJB

    Not completely accurate.  We prefer the thread starter mark the thread but if it appears there is an answer (say the memory chip) Moderators can/should/will mark it if there has not been any activity for >7 days so that users can search for "answered" threads similar to their own problem.

    I have been watching this thread for a while to mark it. 

    @getgcs if you havent crashed in a couple of days please come back  and let Patrick know (and mark him if he has answered it FOR YOU)


    Wanikiya and Dyami--Team Zigzag

    Thursday, May 01, 2014 10:53 PM
    Moderator
  • Ah, well there's your answer regarding your question, getgcs : )

    Thanks for the clarification, Ken!

    Regards,

    Patrick


    “Be kind whenever possible. It is always possible.” - Dalai Lama

    Thursday, May 01, 2014 11:19 PM
  • Patrick

    I would have marked your memory management analysis but am waiting for get to mark it.  In the meantime I proposed it

    BTW congrats on "code answerer II" "first helpful vote"and 550 points!


    Wanikiya and Dyami--Team Zigzag




    Thursday, May 01, 2014 11:34 PM
    Moderator
  • I would like to re-open this thread as I just got a new bsod today while playing a game and it has been bsod free for about a month since I removed the memory, I removed all the ram and slowly added the ram back. I was bsod free with these three sticks for a month. (12GB) 

    here is the link to download the bsod from today (4/29 IRQ_NOT_LESS_OR_EQUAL) link

    Friday, June 06, 2014 5:41 PM
  • I would like to re-open this thread as I just got a new bsod today while playing a game and it has been bsod free for about a month since I removed the memory, I removed all the ram and slowly added the ram back. I was bsod free with these three sticks for a month. (12GB) 

    here is the link to download the bsod from today (4/29 IRQ_NOT_LESS_OR_EQUAL) link

    Getcs

    All of those DMPS are dated April 29 so not relevant to the problem you are currently having.  You may not have creating DMPS enabled in your system control panel.


    To ensure minidumps are enabled:
    Go to Start, in the Search Box type: sysdm.cpl, press Enter.
    (In win 8 you can use the windows key "win" + "s")

    Under the Advanced tab, click on the Startup and Recovery Settings button.

    Ensure that Automatically restart is unchecked.

    Under the Write Debugging Information header select Small memory dump (256 kB) in the drop down box (the 256kb varies).

    Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.

    OK your way out.

    Reboot if changes have been made.


    Wanikiya and Dyami--Team Zigzag

    Friday, June 06, 2014 6:40 PM
    Moderator
  • Ok I just re-enabled the settings.. how the heck could those settings been changed if I didnt change them since the last bsod before todays which yes my bad is not 4-29 haha its 6-6.. it was IRQ_NOT_LESS_OR_EQUAL though and it references ntsokrnl file
    Saturday, June 07, 2014 3:13 AM
  • I just got another bsod and it didnt save it.. my settings are set to the ones above (2 posts up)
    Friday, June 13, 2014 10:03 PM
  • any ideas?
    Saturday, June 14, 2014 1:33 PM
  • here is the memory dmp file..file here  maybe the location of the dmp files is c:windows not c:windows/minidump ?
    Wednesday, June 18, 2014 6:45 PM