Frequent, but inconclusive, BSODs

[MagicAndre1981]

Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED

This means that an error has occurred in a crucial user-mode subsystem.

http://msdn.microsoft.com/en-us/library/ff560177%28v=VS.85%29.aspx

Cause

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.

Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use.

can you boot into safemode?

[wlw]

It happened when I powered the PC on and walked away as I usually do when it boots up.

When I returned I was welcomed by that screen.

However I gave it a hard reset and it's working normally (well, within it's own "norm", that is...) and it has been working ok for a whole day today, even without the crazy tower fan.

So it's like it used to be, couple of days of crashes and then a week of peace.

[wlw]

Okay, I have found some info that the motherboard has issues when HPET is enabled, I will test the system with HPET disabled in BIOS.

Edited May 7, 2011 by wlw

[MagicAndre1981]

which board do you have? Do you use the latest BIOS?

[wlw]

ASRock 870 Extreme3, it came with BIOS 1.60 and there was no update since.

If this check out, I will notify ASRock tech support, as I have submitted two tickets to them but they couldn't help.

[wlw]

Interesting news!

Because, as I have mentioned earlier, the system was a bit more eager to hang or crash when certain apps were operating, I gave it some more thought.

SpeedFan and Trixx, when set to auto fan control, they both operate on short timers performing I/O operations on NB, SB and GPU (PCI-E through NB, of course).

When set to fixed speeds however, there was no such symptom (crashes more common). The system would still crash or freeze from time to time, but as crash dump collection attempts were futile, this points to some serious hardware issue.

Well then, what do we know about NB. Firstly, HPET counter/comparators are integrated in it. Secondly, it gets quite hot, and as any silicone semiconductor chip, it gets moody when it's hot and becomes less stable, which in turn begs for higher voltage to make it more stable. HPET is also used for streamed content synchronization, which is a clear connection to flash videos crashing the machine.

Now let's focus on the CPU. The system would run OCCT for hours with ease, but then crash when an Internet browser was opened and such. It handles constant load okay, crashes when load changes - CPU Load Line Calibration anyone?

Lastly, Spread Spectrum shifts frequency to minimize EMI, but this could potentially decrease overall system stability.

So based on above thoughts, I made the following changes:

- set Spread Spectrum from Auto to Disabled

- set CPU Load Line Calibration from Auto to Disabled

- disabled HPET

- increased NB voltage from default 1.1V up three notches to 1.1375V

- re-unlocked CPU to 3 cores (leaving 4th core with it's faulty L1 cache off)

- restored CPU overclock to 3.7/3.7/3.5 and 1.42V

I have been doing everything that used to crash or freeze the PC. Hosting L4D2 server for 4 people was a guarantee of a failure. Some flash videos, most commonly in Steam's store, like I said before, also automatic fan control... No problems. I'm still cautious, but I have yet to see another BSOD, crash or freeze.

Will keep you updated.

Edited May 9, 2011 by wlw

[wlw]

Hello,

The problems went away for a little while but returned quickly, so I have returned the mainboard and received a new one.

And what do you know, same problems on the brand new motherboard.

It's BSODing on every occasion it can, mostly when idling or when loaded slightly, for example when my kid was watching cartoons on youtube. Also it sometimes freezes for a minute after the desktop appears (as it used to) and crashes with that same strange pattern on the monitor that I gave a photo of before.

Also, it refuses to shut down. It goes up to the "Shutting down" screen and hangs there (the circle doesn't rotate).

I attached external probe to the NB heatsink because it's hot on this MoBo (and it was on the RMA'd one), but it's sitting at max 65*C when there's no fan blowing at it, which I'd say is about 10 degrees below a warning level.

I'm attaching two fresh minidumps, one of them points to the CPU, so I'm running OCCT right now and as usual, no problems when the machine is loaded, only when it's not...

Oh and this time the CPU is untouched, 2 cores on stock speed and stock voltage.

Minidump.zip

[MagicAndre1981]

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)

0x00000008, or Double Fault, indicates that an exception occurs during a call to the handler for a prior exception. Typically, the two exceptions are handled serially. However, there are several exceptions that cannot be handled serially, and in this situation the processor signals a double fault. There are two common causes of a double fault:

    A kernel stack overflow. This overflow occurs when a guard page is hit, and the kernel tries to push a trap frame. Because there is no stack left, a stack overflow results, causing the double fault. If you think this overview has occurred, use !thread to determine the stack limits, and then use kb (Display Stack Backtrace) with a large parameter (for example, kb 100) to display the full stack.
    A hardware problem.


nt!KeBugCheckEx
nt!KiBugCheckDispatch+0x69
nt!KiDoubleFaultAbort+0xb2
[b]amdppm!C1Halt[/b]+0x2

so you get a crash while sending the CPU to C1 ACPI Processor state. have you tested a new CPU and not your AMD Phenom II X2 550 Processor?

[wlw]

Unfortunately no, I have no other AM3 compatible CPU to test.

I was going to buy a full PII x4 955 but during the two weeks of RMA I spent all my money on renovation so no CPU for now.

I find it strange that the CPU was working fine for two years in AM2+/DDR2 motherboard but ever since I switched to AM3/DDR3 there have been nothing but problems.

It all checks out, it's most likely to crash/freeze/BSOD when doing little or nothing - switching power states (hence my previous ideas with CPU LLC, Spread Spectrum etc.).

I doubt if C1E enabled in BIOS is the reason for that as I altered that setting on the old mobo, but I'll check it.

I'll try to find another CPU for testing but it's turning out to be much harder than another GPU, obviously...

ED: just had another BSOD, this time it was cdd.sys (no dump was saved) which doesn't fit the pattern at all...

Edited June 5, 2011 by wlw

[cluberti]

No, given the fact there really isn't a viable pattern that leaves two things - malware, or hardware malfunctions. It seems like you're investigating hardware, but I'd run an offline scan of the HDD again to be sure it's clean of viruses and malware too just to be on the safe side and rule that potential problem area out.

[wlw]

I have Avira as a resident scanner and MBAM, CureIt and OTL nearby for extra scanning when there's something suspicious. Just scanned the system with MBAM and it didn't find anything.

I have once again disabled HPET and C1E in BIOS and bumped the NB voltage a little (from 1.1 to 1.15V), prior to that I've run 2h OCCT Linpack and 3 passes of bootable MemTest86+, it's been running nicely for couple of hours, it even went sleeping for some time and it's still working fine. The NB is sitting there at 65*C, everything else is cold, besides crashing when idle basically rules out overheating as the cause.

I'm leaning towards CPU failure but I haven't found another one to test yet.

And what about that checkered-distorted screen pattern?

First shot is GPU, sure, but what else could cause that? CPU, NB? Interesting thing is that the mouse pointer stays intact, which suggest that the corruption doesn't occur on the whole frame buffer at the GPU level, but rather that that's what the GPU already receives and promptly displays it. Also, when it happens, the sound loops, which again suggests general hardware failure, so, CPU, NB...?

[cluberti]

If it's Windows 7 as the client and you're running Aero, the CPU is pretty much out of the question. From there, it would depend on the chipset design as to where the GPU traffic routes back to the CPU, but most likely it would point to the GPU or the slot it's in on the motherboard.

[dencorso]

A longshot worth trying with AMDs is the following:

Go to HKLM\System\Current\ControlSet\Control\Session Manager and set

EnableMCA=0 and EnableMCE=0

and see whether the BSODs stop.

If they don't, return those two settings to their previous state.

[wlw]

cluberti yes, it's Windows 7 with Aero, there is only one x16 slot on this MoBo so I don't have much choice; the board have been swapped for a new one so this pretty much rules out slot corruption.

Could you elaborate a little why Aero rules out CPU?

Anyway I am getting another GPU and CPU for testing, finding an AM3 CPU proves to be much harder, I should have another GPU soon.

dencorso I don't have those keys at all, will setting them to 0s and then deleting (if it doesn't help) return them to their default values?

[Tripredacus]

Have you tried running with Aero disabled? I initially had problems with my computer at work (graphic distortions) with Aero enabled but haven't had a problem with it disabled.