BSOD's on the daily...

[jerodpaul]

So... I get a BSOD every day it seems and it's not always the same. IDK what to do. Heres my crashdump, this is the info I got from Winbg, I have absolutely no idea how to analyze this info or anything... Could someone help me out and tell me whats going on.
I have 16GB 2133 RAM an i5-3570k an Asrock Z77 Pro4 and a MSI GTX 770.
(Also not of utmost importance but with my specs shouldn't I be able to stream with low settings or something? When I stream LOL through OBS and Twitch i'm getting roughly 200 pagefaults a second... I can't do anything. This computer shouldnt have issues... why is it?)
Thank you in advance XD
Jerod


Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
Machine Name:
Kernel base = 0xfffff800`03401000 PsLoadedModuleList = 0xfffff800`03648730
Debug session time: Wed May 27 13:00:11.210 2015 (GMT-7)
System Uptime: 0 days 2:00:17.380
Loading Kernel Symbols
...............................................................
................................................................
.........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff683ff768df8, 0, 0, fffff800034454b7}

PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+11b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff683ff768df8, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034454b7, address which referenced memory

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details

READ_ADDRESS: fffff683ff768df8

CURRENT_IRQL: 0

FAULTING_IP:
nt!MiDeleteAddressesInWorkingSet+11b
fffff800`034454b7 488b1e mov rbx,qword ptr [rsi]

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: powercfg.exe

TRAP_FRAME: fffff8800da11ed0 -- (.trap 0xfffff8800da11ed0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=0000000000000582
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800034454b7 rsp=fffff8800da12060 rbp=fffff70001081570
r8=fffffa801977f958 r9=0000000000000001 r10=0000000000000082
r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!MiDeleteAddressesInWorkingSet+0x11b:
fffff800`034454b7 488b1e mov rbx,qword ptr [rsi] ds:01e6:0000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003474e69 to fffff800034758c0

STACK_TEXT:
fffff880`0da11d88 fffff800`03474e69 : 00000000`0000000a fffff683`ff768df8 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0da11d90 fffff800`03473ae0 : 00000000`00000000 fffff683`ff768df8 00000000`00001000 0000000f`ffffffff : nt!KiBugCheckDispatch+0x69
fffff880`0da11ed0 fffff800`034454b7 : 00000003`00000000 a1c00001`258ab867 fffff700`01081568 fffff680`00001410 : nt!KiPageFault+0x260
fffff880`0da12060 fffff800`03446785 : fffffa80`1977f5c0 fffffa80`00000000 fffff8a0`00000082 00000000`00000000 : nt!MiDeleteAddressesInWorkingSet+0x11b
fffff880`0da12910 fffff800`03749166 : fffff8a0`18428c50 00000000`00000001 fffffa80`1cb1c600 fffffa80`1cb1c600 : nt!MmCleanProcessAddressSpace+0x95
fffff880`0da12960 fffff800`0372d2b0 : 00000000`00000000 00000000`00000001 000007ff`fffdd000 00000000`00000000 : nt!PspExitThread+0x56a
fffff880`0da12a60 fffff800`03474b53 : fffffa80`1977f5c0 000007fe`00000000 fffffa80`1cb1c600 000007fe`fe8926c8 : nt!NtTerminateProcess+0x138
fffff880`0da12ae0 00000000`76d9de7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0027fac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d9de7a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeleteAddressesInWorkingSet+11b
fffff800`034454b7 488b1e mov rbx,qword ptr [rsi]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+11b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 553e7b7b

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

BUCKET_ID: X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

Followup: MachineOwner

CURRENT_IRQL: 0

FAULTING_IP:
nt!RtlEnumerateGenericTableWithoutSplayingAvl+177
fffff800`034454b7 488b1e mov rbx,qword ptr [rsi]

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from fffff80003474e69 to fffff800034758c0

STACK_TEXT:
fffff880`0da11d88 fffff800`03474e69 : 00000000`0000000a fffff683`ff768df8 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0da11d90 fffff800`03473ae0 : 00000000`00000000 fffff683`ff768df8 00000000`00001000 0000000f`ffffffff : nt!KeSynchronizeExecution+0x3d39
fffff880`0da11ed0 fffff800`034454b7 : 00000003`00000000 a1c00001`258ab867 fffff700`01081568 fffff680`00001410 : nt!KeSynchronizeExecution+0x29b0
fffff880`0da12060 fffff800`03446785 : fffffa80`1977f5c0 fffffa80`00000000 fffff8a0`00000082 00000000`00000000 : nt!RtlEnumerateGenericTableWithoutSplayingAvl+0x177
fffff880`0da12910 fffff800`03749166 : fffff8a0`18428c50 00000000`00000001 fffffa80`1cb1c600 fffffa80`1cb1c600 : nt!RtlEnumerateGenericTableAvl+0xb1
fffff880`0da12960 fffff800`0372d2b0 : 00000000`00000000 00000000`00000001 000007ff`fffdd000 00000000`00000000 : nt!RtlCopySidAndAttributesArray+0x1846
fffff880`0da12a60 fffff800`03474b53 : fffffa80`1977f5c0 000007fe`00000000 fffffa80`1cb1c600 000007fe`fe8926c8 : nt!RtlNtStatusToDosError+0x1534
fffff880`0da12ae0 00000000`76d9de7a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x3a23
00000000`0027fac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d9de7a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlEnumerateGenericTableWithoutSplayingAvl+177
fffff800`034454b7 488b1e mov rbx,qword ptr [rsi]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!RtlEnumerateGenericTableWithoutSplayingAvl+177

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

*EDITED* (Fixed symbols)

 

[i7Baby]

TLR

 

[SBMfromLA]

Perhaps it's time to throw in the towel and do a fresh reinstall?

 

[neieus]

Um you don't have the correct symbol path saved for windows debugger so it can't read the data correctly.

 

[smorizio]

make sure the mb has the newest bios file. set you ram to 1600 speed see if one of the ram or the ram/cpu having issues running over clocked. if it still bsod. take 1/2 ram out run memtest on it overnight see if it still bsod. if the pc stable swap one ram stick see if it stable.if after two ram stick the pc is stable and there no errors. put the ram back in and with 4 dimms you may have to bump the ram voltage.

 

[jerodpaul]

@smorizio The Ram's not running overclocked thats its clock speed from manufacturer, I will do memtest though, that's a great idea I thought it might be linked to RAM.
@neisus How do I get the correct symbol path?

 

[neieus]

Open the windows debugger and under file select symbol file path and paste this

http://msdl.microsoft.com/download/symbols

Press Ok then go back to file and choose save work space to save the path. From here you can open your minidump or memory dump and it should automatically download the symbols from now on.

 

[jerodpaul]

I have edited the post to use the proper files and now i have the correct symbols and the updated info is at the top.

 

[neieus]

You mention that the bsod aren't always the same. In order to determine the cause you'll need to look at the other dumps to get a pattern. Looking at your current information it looks like powercfg.exe made an invalid IRQ request which caused memory corruption. Powercfg is Windows hibernation feature so it's possible some device doesn't like going in to sleep mode or hibernation. This is just based off your single dump you provided so I suggest you look at the others and see if there is any similarities between the dump data in correlation with what the computer was actually doing at the time.

 

[jerodpaul]

How do I go about finding other dump files, and that would make a lot of since, generally when I tell my computer to sleep it wakes itself up in less than 5 minutes

 

[neieus]

While you'll only have one dump file your comp will store all the minidumps. There is a difference in the data they hold but it's not important unless you're working with MS directly. The minidump holds the basis data about the crash. Go to your Windows directory and find the folder called minidump and you should see them there.