Sporadic Crashes

Gia · Jan 9, 2013

Hello, I recently purchased a computer from iBUYPOWER (through newegg) and after a week of ownership have been receiving almost daily crashes (some days with more than one crash), with error messages like 'MEMORY_MANAGEMENT, IRQL_LESS_OR_NOT_EQUAL, and PAGE_FAULT_IN_NONPAGED_AREA'. The crashes seemed to taper off a week or so ago but then came back when I started playing the game Planetside 2. Most of the crashes had a new error message during the blue-screen, saying: 'DRIVER_VERIFIER_DETECTED_VIOLATION'. I did have Driver Verifier on at first, but received the same crash and message even after turning it off.

I contacted iBUYPOWER and was informed that if I called customer service, they would replace the computer while looking at it, but I decided to come here first because I wanted to see if there could be a way to fix these issues without resorting to repackaging the tower and sending it back.

usasma · Jan 10, 2013

Start with these free diagnostics: Initial Hardware Diagnostics
Then try these: Additional Hardware Diagnostics
If any of the tests fail, it's most likely hardware - so let them fix it

Only 20 updates, most systems have 30 or more. Please visit Windows Update and get ALL available updates

Memory dumps seem to be hardware related, the only older driver is the Intel Management Engine.
Update Intel Management Engine drivers ( Intel Download Center )

Verifier doesn't seem to point at anything in particular, another sign suggesting that it may be hardware (depending on the settings that you used).

Turn off Verifier by opening verifier.exe as an Administrator (right click on verifier.exe and select "Run as adminstrator")
Select "Delete existing settings", then click on the "Finish" button.
Reboot for the changes to take affect (?effect?)

If it still doesn't stop running, we'll see about manually removing it from the registry.

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Wed Jan  9 16:16:35.822 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010913-13125-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]0 days 6:12:00.504[/B]
Probably caused by :[B]rdyboost.sys ( rdyboost!SmdProcessReadWrite+792 )[/B]
BugCheck [B]C4, {1011, fffffa8008ba9b20, fffff9802331ac10, fffff880082e0000}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C4]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/url]
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 0000000000001011, Invariant MDL buffer contents for Read Irp were modified during dispatch or buffer backed by dummy pages.
Arg2: fffffa8008ba9b20, Device object to which the Read IRP was issued.
Arg3: fffff9802331ac10, The address of the IRP.
Arg4: fffff880082e0000, System-Space Virtual Address for the buffer that the MDL describes.
BUGCHECK_STR:  0xc4_1011
PROCESS_NAME: [B]PlanetSide2.ex[/B]
FAILURE_BUCKET_ID: [B]0xc4_1011_rdyboost!SmdProcessReadWrite[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Tue Jan  8 13:55:16.472 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010813-18421-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]0 days 21:38:45.752[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!IoCancelIrp+28 )[/B]
BugCheck [B]A, {fffff8800b3ff8b4, 2, 1, fffff803d543d428}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000000A]IRQL_NOT_LESS_OR_EQUAL (a)[/url]
Arguments: 
Arg1: fffff8800b3ff8b4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803d543d428, address which referenced memory
BUGCHECK_STR:  AV
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]chrome.exe[/B]
FAILURE_BUCKET_ID: [B]AV_nt!IoCancelIrp[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Jan  7 16:10:42.987 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010713-13312-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]0 days 0:16:06.675[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )[/B]
BugCheck [B]139, {3, fffff8800a9027a0, fffff8800a9026f8, 0}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000139]KERNEL_SECURITY_CHECK_FAILURE (139)[/url]
Arguments: 
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff8800a9027a0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff8800a9026f8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
BUGCHECK_STR:  0x139
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME: [B]SearchIndexer.[/B]
FAILURE_BUCKET_ID: [B]0x139_3_nt!KiFastFailDispatch[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Mon Jan  7 15:54:09.518 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010713-13937-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]0 days 1:14:54.205[/B]
Probably caused by :[B]fvevol.sys ( fvevol!FveReadWrite+3e )[/B]
BugCheck [B]C4, {1011, fffffa8008c63040, fffff98086426c10, fffff8800c400000}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C4]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/url]
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 0000000000001011, Invariant MDL buffer contents for Read Irp were modified during dispatch or buffer backed by dummy pages.
Arg2: fffffa8008c63040, Device object to which the Read IRP was issued.
Arg3: fffff98086426c10, The address of the IRP.
Arg4: fffff8800c400000, System-Space Virtual Address for the buffer that the MDL describes.
BUGCHECK_STR:  0xc4_1011
PROCESS_NAME: [B]PlanetSide2.ex[/B]
FAILURE_BUCKET_ID: [B]0xc4_1011_fvevol!FveReadWrite[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Sat Jan  5 20:30:00.958 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010513-22390-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]3 days 1:03:27.693[/B]
Probably caused by :[B]rdyboost.sys ( rdyboost!SmdProcessReadWrite+792 )[/B]
BugCheck [B]C4, {1011, fffffa8008ba9c40, fffff980d8b3cc10, fffff8800e400000}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000C4]DRIVER_VERIFIER_DETECTED_VIOLATION (c4)[/url]
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
Arguments: 
Arg1: 0000000000001011, Invariant MDL buffer contents for Read Irp were modified during dispatch or buffer backed by dummy pages.
Arg2: fffffa8008ba9c40, Device object to which the Read IRP was issued.
Arg3: fffff980d8b3cc10, The address of the IRP.
Arg4: fffff8800e400000, System-Space Virtual Address for the buffer that the MDL describes.
BUGCHECK_STR:  0xc4_1011
PROCESS_NAME: [B]PlanetSide2.ex[/B]
FAILURE_BUCKET_ID: [B]0xc4_1011_rdyboost!SmdProcessReadWrite[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Wed Jan  2 19:21:58.331 2013 (UTC - 5:00)**************************
Loading Dump File [C:\Users\John\_jcgriff2_\dbug\__Kernel__\010213-29578-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16442.amd64fre.win8_gdr.121023-1503
System Uptime:[B]2 days 2:49:48.029[/B]
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
Probably caused by :[B]aswMonFlt.sys ( aswMonFlt+3081 )[/B]
BugCheck [B]24, {b50019060b, fffff88009c6e278, fffff88009c6dab0, fffff8025294c196}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x00000024]NTFS_FILE_SYSTEM (24)[/url]
Arguments: 
Arg1: 000000b50019060b
Arg2: fffff88009c6e278
Arg3: fffff88009c6dab0
Arg4: fffff8025294c196
PROCESS_NAME: [B]AstralCata.exe[/B]
BUGCHECK_STR:  0x24
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
FAILURE_BUCKET_ID: [B]0x24_aswMonFlt+3081[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Wed Jan  9 16:16:35.822 2013 (UTC - 5:00)**************************
[COLOR=RED][B]hamachi.sys            Thu Feb 19 05:36:41 2009 (499D3639)[/B][/COLOR]
[COLOR=RED][B]HECIx64.sys            Tue Oct 19 19:33:43 2010 (4CBE2AD7)[/B][/COLOR]
[COLOR=RED][B]Rt630x64.sys           Wed Oct 19 08:12:55 2011 (4E9EBEC7)[/B][/COLOR]
viahduaa.sys           Fri May  4 06:35:46 2012 (4FA3B102)
nvhda64v.sys           Tue Jul  3 11:25:04 2012 (4FF30ED0)
intelppm.sys           Wed Jul 25 22:26:48 2012 (5010AAE8)
dump_storahci.sys      Wed Jul 25 22:30:35 2012 (5010ABCB)
aswrdr2.sys            Mon Oct  8 04:23:43 2012 (50728D8F)
aswFsBlk.SYS           Tue Oct 30 18:43:04 2012 (509057F8)
aswMonFlt.sys          Tue Oct 30 18:43:09 2012 (509057FD)
aswSP.SYS              Tue Oct 30 18:44:06 2012 (50905836)
aswSnx.SYS             Tue Oct 30 18:44:08 2012 (50905838)
aswnet.sys             Sun Nov  4 05:12:57 2012 (50963FA9)
nvlddmkm.sys           Fri Nov 30 22:24:02 2012 (50B97852)
[/font]

Gia · Jan 15, 2013

Thank you for the reply, usasma, and sorry for not responding for a few days. I let the computer download updates (having prevented it from doing so previously because the last time I tried to update I just crash even more) and seemed to have about a whole week or no crashes, but they started again this morning. I hadn't the time to go through each of the diagnostics, but I managed to put through a few passes of the memtest86+ and it showed no errors.

With all of the crashes today (two in the last hour), most being PAGE_FAULT_IN_NONPAGED_AREA and one showing ntkrnlmp.exe, I've decided that I'm going to call the maker and send the machine back.

usasma · Jan 15, 2013

It's probably for the best!
Good luck!

Sporadic Crashes

Gia

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

Gia

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One