SOLVED Odd BSOD at shutdown

[OrangeJoe]

Hi, I've been getting odd BSOD's during shutdown for the past couple weeks. I was having trouble before with the Etron USB 3.0 drivers but I don't think I can do anything about that except buy an alternative motherboard which I can't afford.

Here's my dump file and CPU-Z screenshots. Thanks very much for the help.

 

[TrainableMan]

I'm not the BSOD expert here but a quick look and I notice you have some very old drivers.
One in particular, Gigabyte Easy Tune 6 is known to cause issues with W7 (Driver: GVTDrv64.sys 9/05/2006).

I suggest you run Windows Update and check for any optional driver updates. You could also try the manufacturers website of your computer (or the motherboard if it is a custom build) for driver updates. Also check AMD for updates to your video. And consider uninstalling Easy Tune 6.

 

[Shintaro]

Ok, so I would suggest that you do the standard checks below as well as what Trainableman has suggested.

1. Download and run TDSSKiller.
   1. Accept the "End User License Agreement"
   2. Accept the "KSN Statement"
   3. Select "Change Parameters" and Select:
      • Verify file digital signatures
      • Detect TDLFS file system
      • Use KSN to scan objects
   4. When the scan is complete the log file is in C:\ It will have a name like "TDSSKiller.3.0.0.34_04.05.2014_08.05.16_log.txt"
2. Install Malwarebytes (Free Version)
   1. Select "Threat Scan"
   2. When it is completed, please upload the log file from: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\Logs
3. Please download and run Windows Defender Offline.
   1. Click "Next"
   2. Click "I Accept"
   3. Select Either: (Typically it is either CD/DVD or USB)
      • CD or DVD
      • USB
      • ISO file
   4. Cllick "Next"
   5. It will create a CD / DVD / USB and will boot and scan your hard drive offline.
4. Download hwInfo and run it.
   • Click on "Save Report"
   • Make sure the Export Format is HTML
   • Click "Browse" and select your "Desktop"
   • Give the file a name like MyComputer or your Forum username.
   • Click on Save
   • Click on "Next".
   • Click on "Finish"
   • Put the newly created MyComputer.html (Or what ever you decided to call it) in to a zip file and upload it to the forum.

Thanks for the CPU-Z info but hwInfo is more convenient and easier for all to read. Not to mention some other logging feature.

Microsoft Check Disk (chkdsk)

1. Click on the Start button and type in cmd.
2. In the list you will see cmd.exe.
3. Right click on Cmd.exe and select "Run as Administrator"
4. Type in the following chkdsk /r /f
5. Reboot your computer. On the restart chkdsk will check the hard disk for errors.
6. There will be an event logged. Which can be viewed via the Event viewer. (eventvwr.exe)
7. Please copy the contents of that event to the forum.

Why I say do those checks is because the crash dump file is inconclusive. There is something that is NOT Microsoft on the stack causing the crash.

# Child-SP  RetAddr  Call Site
00 fffff880`0334ee38 fffff800`0621a892 nt!KeBugCheckEx
01 fffff880`0334ee40 fffff800`061c6e8b nt!PspCatchCriticalBreak+0x92
02 fffff880`0334ee80 fffff800`06145f74 nt! ?? ::NNGAKEGL::`string'+0x176d6
03 fffff880`0334eed0 fffff800`05e92453 nt!NtTerminateProcess+0xf4
04 fffff880`0334ef50 fffff800`05e8ea10 nt!KiSystemServiceCopyEnd+0x13
05 fffff880`0334f0e8 fffff800`05edde7f nt!KiServiceLinkage
06 fffff880`0334f0f0 fffff800`05e92842 nt! ?? ::FNODOBFM::`string'+0x48e34
07 fffff880`0334f900 fffff800`05e913ba nt!KiExceptionDispatch+0xc2
08 fffff880`0334fae0 00000000`77021273 nt!KiPageFault+0x23a
09 00000000`001d1000 00000000`00000000 0x77021273

A couple of further questions:

1. What is plugged in to the USB ports when it crashes?
2. What AV /Malware software do you have installed?

Any questions please don't hesitate to ask.

 

[OrangeJoe]

Hi, thanks for the help.

1. Either of my USB 3.0 devices are plugged in when my computer crashes:
Transcend RDF8W multi card reader
Seagate Backup Plus Slim

2. I have Malawarebytes free and SuperAntiSpyware Free.

Here's the zipped files you requested.

 

[Shintaro]

Mate,

What was the AV you are running?
What was the outcome from Windows Offline scanner?

What happens when you shutdown with only the Logitech mouse and Dell keyboard plugged in? Crash / No crash?

Don't run 2 Malware programs. Best to just use Malwarebytes for now.

 

[OrangeJoe]

I don't think I'm running any AV. Only Malawarebytes and SuperAntiSpyware.

What AV do you suggest?

The windows offline scanner found no problems.

I usually don't have a crash when only the mouse and keyboard are plugged in. I know the Etron hardware/drivers are an issue so I try to tread lightly and unplug them first before shutting down but I think sometimes even with them unplugged I still get a crash.

 

[OrangeJoe]

Hi, I had another BSOD with only mouse and keyboard connected. Here is the dump file and the chkdsk text file. Thanks.

 

[Shintaro]

I'm just having a look at the crash dump now.

But I would suggest that you use Windows Defender / Microsoft Security Essential(same thing just different names), found HERE.
It causes a lot less problems.

 

[Shintaro]

Same inconclusive information.

Ok, lets try and get some more information about this crash.

1. Click the Start Button.
2. Type in cmd
3. You should see cmd.exe in the list.
4. Right click on cmd.exe and select "Run as Administrator"
5. In the command prompt window type in:

wmic recoveros set DebugInfoType = 2
​

It should say that the command was successful.


Driver verifier

The Driver Verifier tool that is included in every version of Windows since Windows 2000 it is used to detect and troubleshoot many driver issues that are known to cause system corruption, failures, or other unpredictable behavior.

***FIRST: Please backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise.
Then make a System Restore point (so you can restore the system using the Windows 7 Startup Repair feature.)

1. Go to Start and type in "verifier" (without the quotes) and press Enter
2. Select "Create custom settings (for code developers)" and click "Next"
3. Select "Select individual settings from a full list" and click "Next"
4. Select:
   ---- Special Pool
   ---- Pool Tracking
   ---- Force IRQL Checking
   ----Deadlock Detection
   ---- Security Checks (Windows 7 & 8)
   ---- DDI compliance checking (Windows 8)
   ---- Miscellaneous Checks
   
5. Click "Next"
6. Select "Select driver names from a list" and click "Next"
7. Then select all drivers NOT provided by Microsoft and click "Next"
8. Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Will I see anything when I enable Driver Verifier?

No, Driver Verifier configures Windows so that people looking at the crash dump files get (in most cases) more detailed information about what actually crashed the computer.
​

How Long should I wait for a crash?

- If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.
​

How do I turn Driver Verifier off?!

- Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page.

- Or press the Windows Key + R, and type in "verifier /reset" (Without the quotes)

- Then locate and zip up the memory dump file and upload it with your next post. then locate and zip up the memory dump file and upload it with your next post.
​

I can't get in to Windows, what do I do?

- If Windows will not start and get to a login screen or desktop, because it crashes too soon, try it in Safe Mode.


- If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
​

How do I put the crash dump files in a Zip file?

Instructions on putting files in a Zip file and extracting (Taking them out) again are explained HERE.
​

If you have any questions please don't hesitate to ask.

 

[Shintaro]

Also please make sure that Paging is turned on.

1. Open System by clicking the Start button
   
   , right-clicking Computer, and then clicking Properties.
2. In the left pane, click Advanced system settings.
   
   If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
3. On the Advanced tab, under Performance, click Settings.
4. Click the Advanced tab, and then, under Virtual memory, click Change.
5. Make sure that there is a tick in the box for "Automatically manage paging file size for all drives".

 

[OrangeJoe]

HI, I tried your instructions and my machine crashes even before the win7 logo screen. I can boot into safe mode. I looked and there isn't a dump file with today's date. What to do next? Thanks.

 

[Shintaro]

Did you see what the text of the crash was or was it too quick on the reboot?

 

[OrangeJoe]

Hi, no text at all. It crashes right away and then reboots. Thanks for the quick reply.

 

[Shintaro]

Mate,

Could you please have a look in all three places:

c:\Windows
c:\Windows\Minidump
c:\Windows\Live KernelReports\WATCHDOG

 

[OrangeJoe]

Hi, the only new file is in c:\Windows. There is a WindowsUpdate.log.

Minidump is from yesterday.
The Watchdog folder goes way back to January.

Thanks.

 

[Shintaro]

Mate,

Please reset driver verifier and reboot to your desktop.

Then from a command prompt with administrator privileges type in the following:

verifier /volatile /flags 0xdd9

Please give that a go. You won't need to reboot.

Then please do what ever it is that makes the computer crash. Hopefully it will provide more information about who is crashing the computer.

Let us know how you get on.

 

[Shintaro]

How did you go?
Did you run the command in my last post? If you did could you please post the new crash dump file.

 

[OrangeJoe]

Sorry, I had a rough couple of days at work.

I did run the command. It crashed upon shutdown like before. I think the problem is with MDFSYSNT.SYS which is part of MediaFour's MacDrive program that I don't use anymore. After the crash I uninstalled the program but didn't have much time to see if it made a difference. I'm not near my desktop now but I'll upload the dump file when I get back. Thanks very much for your help.

 

[OrangeJoe]

Hi, here's the dump file.

 

[Shintaro]

Mate,

Don't stress it, sometimes life just gets in the way.

Yep it is MDFSYSNT.sys, the reason you can see it is because driver verifier was running and watching for misbehaving drivers.

Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:51:44.216
*** WARNING: Unable to verify timestamp for MDFSYSNT.sys
*** ERROR: Module load completed but symbols could not be loaded for MDFSYSNT.sys
Probably caused by : MDFSYSNT.sys ( MDFSYSNT+220c4 )
BugCheck D6, {fffff98021fbd000, 0, fffff88001c410c4, 0}
BugCheck Info: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
Bugcheck code 000000d6
Arguments:
Arg1: fffff98021fbd000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff88001c410c4, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)
BUGCHECK_STR: 0xD6
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: wininit.exe
FAILURE_BUCKET_ID: X64_0xD6_VRF_MDFSYSNT+220c4

How are things going since you uninstalled the app?

If all is good, don't forget to turn off verifier, by restarting your computer (the volatile version) and run verifier /reset just in case.