BSOD Double Fault error

[firewound]

Hey Folks,

I've been browsing around the board and it looks like there are some very bright people around so I thought I'd see if anyone could help me. I've been having computer issues for a week now and I'm utterly stumped. Here is what's happening.

Symptoms

-Running windows update freezes my computer every time. I am able to click on Express/Custom and as its checking for updates, the computer hangs and I have to restart.

-On startup, the computer gets to the Loading Windows screen (with the little blue scroller). Then, one of two things happens, I either get a blue screen (more info below) or there is no screen output at all and the monitor subsequently goes dark.

-Downloading torrents freezes the computer after about five minutes (in safe mode too)

-Safe mode never fails to load, but I will sometimes have the computer freeze a few seconds after loading safe mode succesfully.

Configuration:

Core 2 Duo E6300

Asrock 775Dual-VSTA mobo

ATI Radeon 9700 Pro

2x512 Mb DDR 400

2xSeagate 7200.10 320Gb hard drives

Here's what I've tried so far:

-Updated mobo BIOS

-Tried putting in a different video card (Nvidia)

-Tried putting in differnet RAM, declocking it, lowering its voltage

-Updating mobo drivers manually

-Removing all unnecessary PCI cards

-Formating the hard drive and doing a clean install

-Reinstalling the CPU to check for bad contacts (reapplied thermal grease)

The blue screen errors only started recently whereas the freezing issues have been there since day 1.

I've included the memory dump information below. I only ran the !analyze -v command because I wasn't sure which other commands might be useful. If someone is willing to look at my actual dump file, I would be more than happy to upload zipped copy of it somewhere. Since the problem seemed to be related to SPTD.sys file, I removed it from c:\windows\system32\drivers but was unable to delete its registry key. That didn't make a difference.

This computer issue has been a constant thorn in my side because I depend on my computer for a ton of stuff. Any help would be greatly appreciated. Keep up the good work guys!

Nick

----------------------------------------------------------------------------------------------------------------

Microsoft ® Windows Debugger Version 6.6.0007.5

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [D:\Debugging Tools for Windows\MEMORY.DMP]

Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*downstream_store*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp.060411-1541

Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0

Debug session time: Fri Jan 19 18:00:34.468 2007 (GMT-5)

System Uptime: 0 days 0:00:13.156

WARNING: Process directory table base 19496000 doesn't match CR3 00039000

WARNING: Process directory table base 19496000 doesn't match CR3 00039000

Loading Kernel Symbols

....................................................................................................

..........

Loading User Symbols

........

Loading unloaded module list

...

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, f7ac7d70, 0, 0}

*** ERROR: Module load completed but symbols could not be loaded for sptd.sys

Probably caused by : sptd.sys ( sptd+260a )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)

This means a trap occurred in kernel mode, and it's a trap of a kind

that the kernel isn't allowed to have/catch (bound trap) or that

is always instant death (double fault). The first number in the

bugcheck params is the number of the trap (8 = double fault, etc)

Consult an Intel x86 family manual to learn more about what these

traps are. Here is a *portion* of those codes:

If kv shows a taskGate

use .tss on the part before the colon, then kv.

Else if kv shows a trapframe

use .trap on that value

Else

.trap on the appropriate frame will show where the trap was taken

(on x86, this will be the ebp that goes with the procedure KiTrap)

Endif

kb will then show the corrected stack.

Arguments:

Arg1: 00000008, EXCEPTION_DOUBLE_FAULT

Arg2: f7ac7d70

Arg3: 00000000

Arg4: 00000000

Debugging Details:

------------------

BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)

eax=000000a0 ebx=85cf839c ecx=00230e01 edx=00000001 esi=86549370 edi=f7739604

eip=f773960a esp=f6b63ff0 ebp=f6b64004 iopl=0 nv up ei ng nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286

sptd+0x260a:

f773960a 0000 add byte ptr [eax],al ds:0023:000000a0=f3

Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 00000000 to f773960a

STACK_TEXT:

f6b64004 00000000 00000000 00000000 00000000 sptd+0x260a

STACK_COMMAND: .tss 0x28 ; kb

FOLLOWUP_IP:

sptd+260a

f773960a 0000 add byte ptr [eax],al

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: sptd

IMAGE_NAME: sptd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45608c07

SYMBOL_NAME: sptd+260a

FAILURE_BUCKET_ID: 0x7f_8_sptd+260a

BUCKET_ID: 0x7f_8_sptd+260a

Followup: MachineOwner

[cluberti]

You wouldn't happen to have Daemon Tools installed, would you? That driver (sptd.sys) belongs to Daemon Tools, and is a Scsi PassThrough Driver (hence sptd) for the suite. That driver is notorious in it's own right for causing bugchecks and random system freezes, but if you have starforce drivers on your system (usually installed by a select set of Windows games for copy protection), you will get the very symptoms you are describing. Since the sptd.sys loads even in safe mode, it becomes an invalid test until you completely remove Daemon Tools and the sptd.sys driver.

Good luck, you're gonna need it .

[firewound]

Come to think of it the blue screen problem probably appeared right around the time I installed Alcohol 120% which also uses the sptd driver.

I was able to remove the sptd.sys file from system32/drivers but I was unable to delete the registry key in services/sptd for some reason. In any case, I figured I was attacking a secondary problem so I went ahead and reinstalled a clean copy of windows onto another hard drive. So I now have all my original problems except no BSOD and therefore no dump file.

I did notice one thing though; when I was reinstalling windows, during the "Installing Devices" phase, my monitor went dark very much like it does every 3rd or 4th time I start the computer. At that point I restarted the computer and the windows setup completed normally.

[firewound]

Another thing I noticed. After a fresh windows install, two devices in Device Manager have the yellow question mark next to them. "RAID controller" and "System Interrupt Controller". Last time this happened as well, but I was able to find the drivers for both of these devices off the CD that came with the motherboard. I guess they wouldn't be causing the problem, but who knows.

I don't have RAID, so it's strange that these devices would be installed.

[cluberti]

That is a bit odd - so you still have symptoms of system freezes?

[firewound]

Yes. Clearly the BSOD errors were caused by something I installed later on. So everything in my original post applies except there are no more BSODs.

Right now, each time I start up my computer it gets to the windows loading screen, then the monitor shuts off and I have to restart. If I try to boot normally after the restart, the same things happens. But, if I boot into safe mode, and then restart, I can boot into normal windows just fine. I'm not sure if the boot failure is connected to the semi-random freezes, but I would think that it is.

[cluberti]

Hm - OK, well, I think at this point only a dump of the machine in state (or at least an attempt to get a dump) will suffice to resolve this. If you have a PS/2 keyboard attached (or can attach one for testing), configure your machine for a complete memory dump as per these instructions.

The next time you either have the video go dead on boot, or have a complete system freeze, hold down the RIGHT hand CTRL key, and press the SCROLL LOCK key twice (all while holding down that CTRL key). If you don't have a hardware problem, your box should bugcheck with a STOP 0xE2 and create a memory dump and reboot. If you have a PS/2 keyboard attached and the box does NOT bugcheck when you do this key combination, you most likely have a hardware problem and should start troubleshooting from there.

In fact, after you've configured for a complete dump, you might want to try it while the system is working just to make sure you've got it down and it works. If you've got any questions, let me know.

[firewound]

Hey Cluberti,

So I followed the instructions for making a memory dump. When the system is running stable, I can initiate a dump succesfully. However, when the system hangs, doing the CTRL+Scroll has no effect. Right now I'm using a wireless usb keyboard but it's plugged into the PS2 port with a converter.

Update: I explored the issue of the torrent program crashing a bit more. The program itself doesn't crash the computer until a torrent is being downloaded. I thought it might be a hard drive issue so I plugged in a USB HDD enclosure and set the torrent program to download to the external hard drive. This worked for about 4-5 minutes before crashing.

Edited January 22, 2007 by firewound

[cluberti]

We'd only be able to test 100% with a null modem cable and a remote kernel debugger, but when a system hangs hard and it can't be dumped via a PS/2 keyboard (which is operating at the hardware interrupt level), it's almost always a hardware error. It could be that the windows kernel is so hung that it isn't accepting interrupts at the driver level anymore (rare with the NT kernel, but still possible), but I'd say it's quite likely you've got yourself a hardware problem.

Can you install a second copy of Windows on a separate partition and see if you get the same hanging behavior? Also, checking your memory for errors, making sure you aren't overclocking anything, etc. would be a good road to travel down as well.

[firewound]

Hey Cluberti,

I've installed a fresh copy of windows xp on an older hard drive and it exhibits the exact same problem. I have not applied any overclock settings.

I ran memtest for a good 20-30 minutes and found 0 errors.

Event Logger has the following notable entry: WMI ADAP was unable to process the performance libraries: 0x80041001

I doubt something like this could cause such a low level error, but I thought I'd mention it.

Edited January 22, 2007 by firewound

[cluberti]

Actually, it likely indicates one. That error maps to "REC_E_NOCALLBACK" and "WBEM_E_FAILED", leading to believe it's having trouble talking to a device on your system, or a .dll file. Since you're having hangs and lockups, I'd say it's more likely a hardware device than a .dll file. You won't be able to tell which without exhaustive wbemtest'ing, but if your memory tests OK, I'd say you should consider removing all unnecessary devices needed to boot (leave only memory, CPU, and video card) and reboot into the test Windows and see if the problem persists.

[firewound]

I tried taking out everything except RAM, video, CPU and HDD. I tried alternating RAM sticks and alternating DIMMs. Same problem.

edit: If I try to boot into normal mode, it doesn't work (even after several attempts). But, if I enter safe mode (which never fails to boot) and then restart, normal windows comes up without a problem.

Edited January 22, 2007 by firewound

[cluberti]

And you've installed no 3rd party software or drivers on this install?

[firewound]

To guard against that, I tried doing a fresh install of windows onto a newly formatted hard drive. Then, literally on the first boot, I try to run windows update and it froze as always.

[cluberti]

And safe mode always works?