Analyze a Blue Screen of Death in Windows 7

0

Bought a new computer 6 month ago. From day one it's been acting funny.

It hangs (without a BSOD) and the only way to un-hang it is by restarting it. On these occasions I have no idea what went wrong since there is not core dump. I went over all the event logs and found nothing out of the ordinary.

Sometimes it does me the favor of giving a BSOD. I have a full core dump file but cannot figure out who is the culprit.

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved

.


Loading Dump File [G:\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: F:\Program Files\Debug Symbols;SRV*F:\Program Files\Debug Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c00000 PsLoadedModuleList = 0xfffff800`02e45670
Debug session time: Thu Feb 16 18:33:27.793 2012 (UTC + 2:00)
System Uptime: 1 days 0:06:38.979
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
................................................................
................................................................
....................................
Loading unloaded module list
.............................................................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 101, {31, 0, fffff880009eb180, 1}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000031, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: fffff880009eb180, The PRCB address of the hung processor.
Arg4: 0000000000000001, 0.

Debugging Details:
------------------


BUGCHECK_STR:  CLOCK_WATCHDOG_TIMEOUT_4_PROC

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  d

STACK_TEXT:  
fffff880`0a086328 fffff800`02cd48c9 : 00000000`00000101 00000000`00000031 00000000`00000000 fffff880`009eb180 : nt!KeBugCheckEx
fffff880`0a086330 fffff800`02c87497 : 00000000`00000000 fffff800`00000001 00000000`000186a0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4e2e
fffff880`0a0863c0 fffff800`031f3895 : fffff800`03219460 fffff880`0a086570 fffff800`03219460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`0a0864c0 fffff800`02c79173 : fffff800`02df2e80 00000000`00000001 00000000`00000001 fffff800`02c00000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`0a0864f0 fffff800`02c52667 : fffff800`02df2e80 fffff800`02e00cc0 00000000`00000046 fffff800`02c786dc : nt!KiInterruptDispatchNoLock+0x163
fffff880`0a086680 fffff800`02f86def : 00000000`00000000 fffff880`0a086b60 00000000`00000000 00000000`00000001 : nt!KeFlushProcessWriteBuffers+0x6b
fffff880`0a0866f0 fffff800`02f87449 : 00000000`03b55e30 fffff800`02f734de 00000000`00000000 fffff800`02c7bda1 : nt!ExpQuerySystemInformation+0x13af
fffff880`0a086aa0 fffff800`02c7bed3 : 00000000`00000000 000007fe`f80cc001 ffffffff`fffe7960 000007fe`f80d0b00 : nt!NtQuerySystemInformation+0x4d
fffff880`0a086ae0 00000000`77a9167a : 000007fe`f80c107b 00000000`01a3f901 ffffffff`fffe7960 00000000`00c4a9f0 : nt!KiSystemServiceCopyEnd+0x13
00000000`01a3f268 000007fe`f80c107b : 00000000`01a3f901 ffffffff`fffe7960 00000000`00c4a9f0 00000000`00c4a9f0 : ntdll!NtQuerySystemInformation+0xa
00000000`01a3f270 000007fe`f80c12cf : 00000000`00000052 00004e20`00013880 000007fe`f80cc048 00000000`00000000 : mmcss!CiSchedulerWait+0x61
00000000`01a3f2e0 00000000`77a9112b : 00000000`000000c0 00000000`1736e5d0 00000000`002a90b0 000007fe`f80c1101 : mmcss!CiSchedulerWorkerApc+0x3e1
00000000`01a3f3b0 00000000`77a9165a : 000007fe`f80c1aaf 00000000`002a90b0 000007fe`f80c303e 00000000`0fd1bf50 : ntdll!KiUserApcDispatch+0x2b
00000000`01a3f8a8 000007fe`f80c1aaf : 00000000`002a90b0 000007fe`f80c303e 00000000`0fd1bf50 00000000`00000000 : ntdll!NtDelayExecution+0xa
00000000`01a3f8b0 000007fe`f80c3c3d : 00000000`0000001b 0004c2c2`00130b08 00000000`0000002e 00000000`00000002 : mmcss!CiSchedulerInitiailize+0x143
00000000`01a3f910 00000000`ffdb1344 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mmcss!CsServiceMain+0x1ea
00000000`01a3f9c0 000007fe`ffd3a82d : 00000000`00000001 00000000`1736e5c8 00000000`00000000 00000000`00000000 : svchost!ServiceStarter+0x1e8
00000000`01a3fa50 00000000`7783652d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : sechost!ScSvcctrlThreadW+0x25
00000000`01a3fa80 00000000`77a6c521 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`01a3fab0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

FAILURE_BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE

BUCKET_ID:  X64_CLOCK_WATCHDOG_TIMEOUT_4_PROC_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

0: kd> lmvm Unknown_Module
start             end                 module name
0: kd> !thread @@c++((nt!_kprcb *)0xfffff880009eb180)->CurrentThread)
THREAD fffffa8008dd3060  Cid 0308.1374  Teb: 000007fffffd4000 Win32Thread: 0000000000000000 RUNNING on processor 0
Impersonation token:  fffff8a015aa7530 (Level Delegation)
Owning Process            fffffa80087fc390       Image:         svchost.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      5563600        Ticks: 401 (0:00:00:06.255)
Context Switch Count      134512             
UserTime                  00:00:00.000
KernelTime                00:00:06.240
Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feffd3a808)
Stack Init fffff8800a086c70 Current fffff8800a086830
Base fffff8800a087000 Limit fffff8800a081000 Call 0
Priority 27 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0a086328 fffff800`02cd48c9 : 00000000`00000101 00000000`00000031 00000000`00000000 fffff880`009eb180 : nt!KeBugCheckEx
fffff880`0a086330 fffff800`02c87497 : 00000000`00000000 fffff800`00000001 00000000`000186a0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4e2e
fffff880`0a0863c0 fffff800`031f3895 : fffff800`03219460 fffff880`0a086570 fffff800`03219460 00000000`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`0a0864c0 fffff800`02c79173 : fffff800`02df2e80 00000000`00000001 00000000`00000001 fffff800`02c00000 : hal!HalpHpetClockInterrupt+0x8d
fffff880`0a0864f0 fffff800`02c52667 : fffff800`02df2e80 fffff800`02e00cc0 00000000`00000046 fffff800`02c786dc : nt!KiInterruptDispatchNoLock+0x163 (TrapFrame @ fffff880`0a0864f0)
fffff880`0a086680 fffff800`02f86def : 00000000`00000000 fffff880`0a086b60 00000000`00000000 00000000`00000001 : nt!KeFlushProcessWriteBuffers+0x6b
fffff880`0a0866f0 fffff800`02f87449 : 00000000`03b55e30 fffff800`02f734de 00000000`00000000 fffff800`02c7bda1 : nt!ExpQuerySystemInformation+0x13af
fffff880`0a086aa0 fffff800`02c7bed3 : 00000000`00000000 000007fe`f80cc001 ffffffff`fffe7960 000007fe`f80d0b00 : nt!NtQuerySystemInformation+0x4d
fffff880`0a086ae0 00000000`77a9167a : 000007fe`f80c107b 00000000`01a3f901 ffffffff`fffe7960 00000000`00c4a9f0 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0a086ae0)
00000000`01a3f268 000007fe`f80c107b : 00000000`01a3f901 ffffffff`fffe7960 00000000`00c4a9f0 00000000`00c4a9f0 : ntdll!NtQuerySystemInformation+0xa
00000000`01a3f270 000007fe`f80c12cf : 00000000`00000052 00004e20`00013880 000007fe`f80cc048 00000000`00000000 : mmcss!CiSchedulerWait+0x61
00000000`01a3f2e0 00000000`77a9112b : 00000000`000000c0 00000000`1736e5d0 00000000`002a90b0 000007fe`f80c1101 : mmcss!CiSchedulerWorkerApc+0x3e1
00000000`01a3f3b0 00000000`77a9165a : 000007fe`f80c1aaf 00000000`002a90b0 000007fe`f80c303e 00000000`0fd1bf50 : ntdll!KiUserApcDispatch+0x2b (TrapFrame @ 00000000`01a3f718)
00000000`01a3f8a8 000007fe`f80c1aaf : 00000000`002a90b0 000007fe`f80c303e 00000000`0fd1bf50 00000000`00000000 : ntdll!NtDelayExecution+0xa
00000000`01a3f8b0 000007fe`f80c3c3d : 00000000`0000001b 0004c2c2`00130b08 00000000`0000002e 00000000`00000002 : mmcss!CiSchedulerInitiailize+0x143
00000000`01a3f910 00000000`ffdb1344 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : mmcss!CsServiceMain+0x1ea
00000000`01a3f9c0 000007fe`ffd3a82d : 00000000`00000001 00000000`1736e5c8 00000000`00000000 00000000`00000000 : svchost!ServiceStarter+0x1e8
00000000`01a3fa50 00000000`7783652d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : sechost!ScSvcctrlThreadW+0x25
00000000`01a3fa80 00000000`77a6c521 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`01a3fab0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d

Elish

Posted 2012-02-16T17:13:42.370

Reputation: 11

Can you provide a copy of the minidumps? – jidar – 2012-02-16T19:07:59.710

Answers

1

I found the cause for the crashes/hangs, or at least I managed to stop it from crashing.

I had all the latest drivers for everything, and still the computer hung every other day. I had reinstalled the OS (and all the latest drivers) and still the computer kept crashing/hanging.

I decided to start "removing" hardware. Since this computer is basically a motherboard (with everything on it) there was very little hardware to remove. I started by replacing my Microsoft Wireless mouse 1000 and put instead a regular USB mouse. The computer has not hang since. I did have the latest drivers for the mouse so I assume the latest drivers are not good enough.

Last note, the wireless mouse came with a wireless keyboard that I am still using. So the problem is only with the mouse.

Elish

Posted 2012-02-16T17:13:42.370

Reputation: 11

0

I would use Resource Monitor to see if there are high system interrupt requests just before it hangs.

To open RM, use the Win key + R key, then type in resmon and hit enter, go to the cpu tab, click the top of cpu column to float the highest cpu percentage to the top and start watching for the Image name "System Interrupts" to start using a high percentage of cpu cycles.

If it does show high cpu cycles for System Interrupts see this tutorial on how to track it down. It usually turns out to be a buggy driver, so sometimes updating all the drivers you have can cure it without having to do intensive analysis and debugging. When all else fails perform a clean re-install of the OS and then update to the latest drivers.

Moab

Posted 2012-02-16T17:13:42.370

Reputation: 54 203

0

The most common cause of CLOCK_WATCHDOG_TIMEOUT is overclocking the motherboard:

  • If you are overclocking the motherboard, undo that change now.
  • If this does not apply, run Windows Update to the maximum extent and then visit your motherboard's manufacturer to see if any newer drivers are available for your motherboard.
  • If this does not work and the laptop is new, return it to the shop where you bought it for a refund.
  • Otherwise take a backup of your system and prepare for the fact that you might need a new motherboard in the near future.

SecurityMatt

Posted 2012-02-16T17:13:42.370

Reputation: 2 857

Asked: 2012-02-16T17:13:42.370

Viewed: 1 255 times

Active: 2012-03-13T21:58:50.773