Windows 7 BSOD: system_service_exception and a few more

[Marjan Bazalac]

So, I'm having a BSOD every couple of days. I thought maybe the graphics card drivers could be the problem, but I have the latest one and still have those BSODs. I've attached several minidumps so if you can check them out. Thanks.

 

[Vayra86]

I can't open the file from work, but BSOD error codes can point us in the right direction.

Any chance you can paste that line from your dumps? (it has the error code in it, some string of numbers with generally a lot of 00000 in it)

 

[Marjan Bazalac]

I don't know how to do that.

 

[EarthDog]

How about you list your system specs... what you were doing at the time it BSOD.... etc.

We need SOME information other than what you have posted.

 

[Vayra86]

I don't know how to do that.

Open the minidump file and copy/paste the text here, if you don't know which lines to look for, just paste the whole thing.

Also like EarthDog said, some additional info is nice, including your system specs.

 

[Marjan Bazalac]

ok. screenshot of my specs attached. I get BSOD randomly. Yesterday I've had it while I was surfing the web.

@Vayra86 But open it with what?

 

[truth teller]

your minidumps dont point to a single software failure from what i can see, one of the bsods even "occurred" on fileinfo.sys which is beyond odd. if you have your cpu overclocked revert back to stock clock

although, im more inclined to say you have a bad memory stick, try to run memtest of a flashdrive to test all the ram pool or see if you can use the computer normally with one stick at a time and check with which one it doesnt bsod

gl

 

[Vayra86]

ok. screenshot of my specs attached. I get BSOD randomly. Yesterday I've had it while I was surfing the web.

@Vayra86 But open it with what?

http://www.winrar.nl/

 

[Marjan Bazalac]

I don't get it....dmp file to open with WinRAR? I've tried it, but it can't. Can anyone of you guys open it, since I've uploaded it?

 

[Vayra86]

I don't get it....dmp file to open with WinRAR? I've tried it, but it can't. Can anyone of you guys open it, since I've uploaded it?

AHERM. Sorry, miscommunication error. You posted a .rar file

Notepad will show the most important info, open with that.

I've gone ahead and installed a zip utility so I can look into the files now. Seems pretty random applications like truth teller also found.

Next time you get a BSOD, check the code or take a picture of it and post it here, it can be really helpful. Random application crashes are generally storage access denial, or RAM issues, if they are not directly software related.

For a quick/temporary fix attempt and at least some narrowing down of the actual issue, you can try using Windows Recovery, go to a recovery point from before you have been getting BSOD's. If that solves the problem, you will know it is software changes that cause the BSOD (this is unlikely however, but nice to rule out because then you can focus on hardware issues).

 

[truth teller]

I don't get it....dmp file to open with WinRAR? I've tried it, but it can't. Can anyone of you guys open it, since I've uploaded it?

i have, see post #7.

you can do it too: 7zip (or something else to extract the rar) and bluescreenview (drag&drop minidumps to analyze)

its most certainly an hardware failure (hopefully ram related)

 

[Marjan Bazalac]

OK, I will try to test the ram, but the problem is I need my computer for work every day, and memtest takes like 2 days straight work to finish. And no, my CPU is not overclocked.

 

[truth teller]

then your best course of action is using the computer without a ram stick at a time, 8gb (assuming you got 3 4gb sticks) is still plenty unless you are running vms/containers or other ram intensive workloads (video editing, daw, etc.)

go ahead and take one of the sticks out, keep using your computer for a couple days normally, if no bsod happens then you got your answer. if a bsod is triggered then swap the sticks and repeat

gl

 

[Ahhzz]

I also recommend running a full disk check this evening.afternoon when you call it for the day. With a fileinfo.sys error mixed in with the others, it really does point to a problem with something either actively in memory, or in the process of moving it to or from memory. Do you know how to perform a full disk check with bad sectors?

 

[red_stapler]

2-11-2016 - 0x3B - PROCESS_NAME: chrome.exe
2-10-2016 - 0x0A - PROCESS_NAME: vmware-vmx.exe
2-3-2016 - 0x1E - PROCESS_NAME: System
1-28-2016 - 0x1E - PROCESS_NAME: System
1-27-2016 - 0x0A - PROCESS_NAME: chrome.exe
1-21-2016 - 0x3B - PROCESS_NAME: cubby.exe
1-06-2016 - 0x4E - PROCESS_NAME: vmware-vmx.exe
12-29-2015 - 0x3B - PROCESS_NAME: audiodg.exe
12-25-2015 - 0x4E - PROCESS_NAME: vmware-vmx.exe
12-23-2015 - 0x50 - PROCESS_NAME: chrome.exe

Here's the full output from the debugger of the most recent dump.

Spoiler

Loading Dump File [C:\Users\carpem\Downloads\Minidump\Minidump\021116-10654-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.19110.amd64fre.win7sp1_gdr.151230-0600
Machine Name:
Kernel base = 0xfffff800`03405000 PsLoadedModuleList = 0xfffff800`0364c730
Debug session time: Wed Feb 10 21:02:41.330 2016 (UTC - 6:00)
System Uptime: 0 days 13:02:06.563
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800034a1dd2, fffff8800ac57c40, 0}

Probably caused by : ntkrnlmp.exe ( nt!CcCopyWrite+2 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800034a1dd2, Address of the instruction which caused the bugcheck
Arg3: fffff8800ac57c40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!CcCopyWrite+2
fffff800`034a1dd2 57 push rdi

CONTEXT: fffff8800ac57c40 -- (.cxr 0xfffff8800ac57c40;r)
rax=00000000053eed08 rbx=000000000000000a rcx=fffffa800cb9b8c0
rdx=fffff8800ac58670 rsi=fffffa800cb9b8c0 rdi=fffff8a003f0f8c0
rip=fffff800034a1dd2 rsp=fffff8800ac58620 rbp=fffffa800cb9b800
r8=0000000000000002 r9=0000000000000001 r10=fffffa800cb9b8c0
r11=0000000000000000 r12=fffff8800ac58690 r13=0000000000000002
r14=fffffa800a535a01 r15=fffffa800c22ede0
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!CcCopyWrite+0x2:
fffff800`034a1dd2 57 push rdi
Last set context:
rax=00000000053eed08 rbx=000000000000000a rcx=fffffa800cb9b8c0
rdx=fffff8800ac58670 rsi=fffffa800cb9b8c0 rdi=fffff8a003f0f8c0
rip=fffff800034a1dd2 rsp=fffff8800ac58620 rbp=fffffa800cb9b800
r8=0000000000000002 r9=0000000000000001 r10=fffffa800cb9b8c0
r11=0000000000000000 r12=fffff8800ac58690 r13=0000000000000002
r14=fffffa800a535a01 r15=fffffa800c22ede0
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
nt!CcCopyWrite+0x2:
fffff800`034a1dd2 57 push rdi
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800034a1dd2

STACK_TEXT:
fffff880`0ac58620 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcCopyWrite+0x2


FOLLOWUP_IP:
nt!CcCopyWrite+2
fffff800`034a1dd2 57 push rdi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CcCopyWrite+2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 5684191c

IMAGE_VERSION: 6.1.7601.19110

STACK_COMMAND: .cxr 0xfffff8800ac57c40 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!CcCopyWrite+2

BUCKET_ID: X64_0x3B_nt!CcCopyWrite+2

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x3b_nt!cccopywrite+2

FAILURE_ID_HASH: {ebc7a8e1-051a-53bb-3649-f7a2b200f5fc}

Followup: MachineOwner
---------

 

[Ahhzz]

might also check and make sure you don't have some random addons/extensions that grabbed onto Chrome as spyware. Actually, running something like a full scan with Malwarebytes, as well as ADWCleaner from bleepingcomputer.com is an excellent idea.....

 

[Marjan Bazalac]

I did run Malwarebytes a few days ago and nothing found. I will run ADWCleaner now. I don't have any fishy extension in Chrome, all old extension I use all the time.

Do you know how to perform a full disk check with bad sectors?

With chkdsk or some 3rd party software?

 

[Ahhzz]

With the standard check disk with Windows. either chkdsk /F from the command prompt, or right clicking the drive, tool, check disk, select both options, agree to do the check on next reboot.

 

[Marjan Bazalac]

So, I've had one more of those. But now a different one, like never before. Check it out on the picture. Also, I've tested my hard drives with HD Tune and they are all OK. Also, tested one of my RAM sticks, and it's OK too 23 passes. That's the 4 GB one. I will test the other one too when I get the chance.