Stop 0x3b bugcheck
My W7 install just recovered from its first crash. Some detail from event viewer:The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000046, 0xfffff80002c7ec4c, 0xfffff880096990a0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 052109-40107-01.Here's what I remember and/or know:1. I had a lot of tabs open in IE and one of them (a forum thread at cdrlabs.com) "grayed out" as not responding. I may have been offered to close the tab and chose to do that.2. Then I believe I was offered to close IE (entirely) and I chose that.3. Very quickly after that the BSOD occurred.4. During reboot, the system decided it needed to chkdsk C:. I let that complete.5. After the re-reboot, I allowed the system to "check for a solution" regarding the crash. No solution was returned.6. When IE restarted, I allowed it to recover the previous session.7. During this recovery, one of the tabs, a result page fromsearch.live.com, claimed to have some problem and wanted to close the tab. I let it close. Tried opening it from history later, it worked. Probably unrelated.8.I have McAfee SiteAdvisor (SA) installed.The same tab that had been suspect from step 1 started to appear and then SA took over that tab, claiming that a completely unknownsite had attempted to subvert browser security. Had a site caused a bad enough IE problem to take down the whole OS? Was it malware? Looking in the browser history I don't see the original (step 1) website nor the one that SA complained about. But here is the SA warning with a reference to the original website:http://www.siteadvisor.com/exploit.html?domain=http://mm.chitika.net/minimall?w=728&h=90&client=cdrlabs&noctxt=1&url=http%3A//www.cdrlabs.com/iframe-leader.html&defaultcat=200001&nosearch=1&alturl=http%3A//phpads.cdrlabs.com/google_leader.html&ref=http%3A//www.cdrlabs.com/forums/problems-enabling-dma-windows-t6645.html&cb=510&originalURL=1242957497&premium=false&client_ver=2.9.258&client_type=IEPlugin&suite=true&aff_id=0&locale=en-us&os_ver=6.1.0.0&pip=trueFurther info, possibly related or not... the (step 4 above) chkdsk results in the application log state that "Windows has checked the file system and found no problems." Following that,in the post-chkdsk restart,there was a lot of heavy disk activity and continuing consumption of RAM, and at some time during that activityan event 55 from NTFS was logged - "the file system structure on the disk is corrupt and unusable. please run the chkdsk utility on the volume \device\harddisk\volume3". If I use diskpart ahd "list volume", it tells me "volume 3" is the manufacturer's recovery partition on this Sony Vaio. So maybe this isn't important. FYI there aretwo hard drives: Disk 0 contains the Sony recovery partition and Vista-32. Disk 1 has W7 x64.I can provide the memory.dmp if further analysis is desired. 428MB worth of it - or I can install a debugger, run a few commands and return specific results.Beyondthis, I've had nothing elsenearly as severe to complain about. I am running a SMART disk status monitor and it reports that status is good on both drives. I've previously verified that myW7 .iso download was complete and intact, and that the burned DVD from that .iso was also error-free and has the same checksum as the original downloaded .iso.
May 22nd, 2009 5:59am

Since the dump is so large, I'd suggest that you run the dump in the debugger and post the results here.More info on how to setup the debugger is here: http://usasma.vox.com/library/post/diagnosing-bsods-originally-posted-02oct08.html- John
Free Windows Admin Tool Kit Click here and download it now
May 24th, 2009 12:30am

Your webpage points to http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx# as a source of debugging tools, but according to that page:The following are system requirements for the 64-bit version of Debugging Tools for Windows: 64-bit Microsoft Windows Server 2003, 64-bit Windows XP, 64-bit Windows Vista, or 64-bit Windows Server 2008. Did somebody forget toadd Windows 7 in the list?
May 24th, 2009 5:59pm

Nope, it seems that the Debugging Tools haven't been updated for Windows 7 yet. They're still usable, but there are some issues obtaining symbols for Win7 through the symbol server. You can install the symbols separately, but I haven't had good luck with them.FWIW - I do all of my debugging analysis on a 64 bit Windows 7 system, and have been doing this since the beta came out.I believe that I installed them directly from the executable - but you could (if you want to) install them in compatibility mode for Windows Vista. All the debugger is (for our purposes)is a means to extract information from the dump files in a readable manner.- John
Free Windows Admin Tool Kit Click here and download it now
May 24th, 2009 8:19pm

OK, I downloaded and installed the x64 debugger, downloaded andinstalled the W7 RC symbols (from .msi file), pointed the debugger to the symbol path, and opened the crash dump. Result:1: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ******************************************************************************** SYSTEM_SERVICE_EXCEPTION (3b)An exception happened while executing a system service routine.Arguments:Arg1: 00000000c0000046, Exception code that caused the bugcheckArg2: fffff80002c7ec4c, Address of the exception record for the exception that caused the bugcheckArg3: fffff880096990a0, Address of the context record for the exception that caused the bugcheckArg4: 0000000000000000, zero. Debugging Details:------------------ The call to LoadLibrary(exts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(kdexts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(exts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(kdexts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(exts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(kdexts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(exts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.The call to LoadLibrary(kdexts) failed, Win32 error 0n2 "The system cannot find the file specified."Please check your debugger configuration and/or network access.Page 1347ea not present in the dump file. Type ".hh dbgerr004" for detailsPEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for detailsPage 1347ea not present in the dump file. Type ".hh dbgerr004" for detailsPEB is paged out (Peb.Ldr = 00000000`7efdf018). Type ".hh dbgerr001" for details EXCEPTION_CODE: (NTSTATUS) 0xc0000046 - An attempt to release a mutant object was made by a thread that was not the owner of the mutant object. FAULTING_IP: nt!RtlRaiseStatus+18fffff800`02c7ec4c 488b8424b8010000 mov rax,qword ptr [rsp+1B8h] CONTEXT: fffff880096990a0 -- (.cxr 0xfffff880096990a0)rax=0000000000000000 rbx=00000000c0000046 rcx=fffff880096990a0rdx=0000000000000000 rsi=fffffa8006ebb7d0 rdi=0000000000000001rip=fffff80002c7ec4c rsp=fffff88009698fe0 rbp=0000000000000000r8=0000000000000000 r9=0000000000000200 r10=fffff80002c11000r11=fffff880096995b0 r12=fffff880009e7180 r13=0000000000000000r14=0000000000000000 r15=fffff88009595000iopl=0 nv up ei ng nz na pe nccs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000282nt!RtlRaiseStatus+0x18:fffff800`02c7ec4c 488b8424b8010000 mov rax,qword ptr [rsp+1B8h] ss:0018:fffff880`09699198=fffff80002c7ec4cResetting default scope DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: iexplore.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002c84b23 to fffff80002c7ec4c STACK_TEXT: fffff880`09698fe0 fffff800`02c84b23 : 00000000`00000000 fffffa80`050543b0 00000001`05060001 fffff880`09699598 : nt!RtlRaiseStatus+0x18fffff880`09699580 fffff880`09598ba0 : fffffa80`04e61190 00000000`00000001 fffffa80`06d61100 00000000`00000000 : nt!KeReleaseMutant+0x243fffff880`09699630 fffff880`095954a2 : fffffa80`04fe8f68 fffffa80`04fe8fb0 fffffa80`06d6bec0 fffffa80`04fe8c10 : R5U870FUamd64+0x3ba0fffff880`09699690 fffff880`056a1825 : 00000000`00000001 fffffa80`06d6bec0 fffffa80`06d611b0 fffffa80`06453560 : R5U870FUamd64+0x4a2fffff880`096996c0 fffff800`02f656ae : fffffa80`06453590 00000000`00000001 fffffa80`00000000 fffffa80`04fe8c10 : ksthunk!CKernelFilterDevice::DispatchIrp+0x11dfffff880`09699720 fffff800`02c855b4 : fffffa80`07394190 fffff8a0`017afe30 fffffa80`03cfc360 fffffa80`000006c3 : nt!IopDeleteFile+0x11efffff880`096997b0 fffff800`02f654a7 : fffff8a0`017afe30 00000000`00000000 fffffa80`06ebb7d0 00000000`00000000 : nt!ObfDereferenceObject+0xd4fffff880`09699810 fffff800`02f52a20 : 00000000`00000730 fffff8a0`017afe30 fffff8a0`02604cc0 00000000`00000730 : nt!ObpCloseHandleTableEntry+0xb7fffff880`096998a0 fffff800`02f52998 : 00000000`00000404 00000000`00000001 fffffa80`06d611b0 fffff800`02f473d1 : nt!ObpCloseHandleProcedure+0x30fffff880`096998e0 fffff800`02f51bfa : fffff8a0`0aa1b001 fffff880`09699c20 fffffa80`06d611b0 fffffa80`06d61301 : nt!ExSweepHandleTable+0x74fffff880`09699920 fffff800`02f50458 : fffff8a0`0aa1b060 00000000`00000000 00000000`00000000 fffffa80`06859570 : nt!ObKillProcess+0x62fffff880`09699960 fffff800`02f54f75 : fffffa80`cfffffff fffff880`09699b01 00000000`7efa1000 fffffa80`05140060 : nt!PspExitThread+0x4e4fffff880`09699a30 fffff800`02c5e69a : 00000000`00000001 fffff880`09699ba8 00000000`0793e1f0 fffff880`09699be0 : nt!PsExitSpecialApc+0x1dfffff880`09699a60 fffff800`02c5ede0 : 00000000`7efa1000 fffff880`09699ae0 fffff800`02f54e70 00000000`00000001 : nt!KiDeliverApc+0x30afffff880`09699ae0 fffff800`02c8f277 : fffffa80`06ebb7d0 00000000`7efa1000 fffff880`000000c0 fffffa80`05128d50 : nt!KiInitiateUserApc+0x70fffff880`09699c20 00000000`76e0fdda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c00000000`0793e1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e0fdda FOLLOWUP_IP: R5U870FUamd64+3ba0fffff880`09598ba0 8bc7 mov eax,edi SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: R5U870FUamd64+3ba0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: R5U870FUamd64 IMAGE_NAME: R5U870FUamd64.sys DEBUG_FLR_IMAGE_TIMESTAMP: 46e2259a STACK_COMMAND: .cxr 0xfffff880096990a0 ; kb FAILURE_BUCKET_ID: X64_0x3B_R5U870FUamd64+3ba0 BUCKET_ID: X64_0x3B_R5U870FUamd64+3ba0 Followup: MachineOwner---------
May 27th, 2009 5:25am

Also, some addendum to this whole scenario - following the crash, I started having automatic chkdsk's on the boot volume after almost every reboot. It appeared the chkdsk's were only happening if I used the browser during that session and restored the entire collection of tabs similar to whatwas open when the crash happened.I uninstalled McAfee SiteAdvisor and the SMART hard disk monitor, in case either of those were contributing, but still had the issue after that. Deleted all Internet temporary files including cookies, and that seems to have ended the chkdsk-at-boot issue.Also FWIW I ran afull scan with Avira Antivir which has up-to-date signatures, found nothing.
Free Windows Admin Tool Kit Click here and download it now
May 27th, 2009 5:32am

Hmm, R5U870FUamd64.sys is a driver for the built-in webcam on this laptop.So maybe a website tried to access the webcam? And therefore this crash is a 3rd party driver issue. Doesn't quite explain the chkdsk's at bootup though...
May 27th, 2009 5:41am

The webcam driver can be corrupted - which can cause the errors that you're getting. As it's high on the stack trace and is blamed by the debugger it's probably the issue (although other things could cause it). I'd suggest uninstalling the webcam drivers and reinstalling the latest available one's. If you can't find one's for Windows 7, use the Vista drivers and run the installer in compatibility mode for Vista and Run as administrator for ALL users. Beyond that, there's an entry for kthunk.sys immediately prior to the webcam drivers in the stack. This is a windows driver that's the Kernel Streaming WOW64 Thunk Service. As it's related to streaming, and I think that a "thunk" is a coding term for something that provides an address, and because this BSOD occurred in iexplore.exe - I wonder if there's an issue here with the way that Win7 handles the streaming from the webcam through IE. So, in other words, this could be an issue with either the driver's compatibility, or an issue within Win7. Uninstalling/reinstalling the webcam drivers in the manner described above will let you know if that fixes the issue. If it does, then nothing more is needed. But if it doesn't fix it, then I'd have to suggest filing a bug report to see if that will generate any results. You may also want to check with the manufacturer of the webcam to see if they've had any issues with Win7 drivers during their testing.- John
Free Windows Admin Tool Kit Click here and download it now
May 28th, 2009 2:27am

Sorry John, but I have a problem with the knee-jerk suggestion of "corruption" to explain an otherwise unexplained problem. I'm not havinghardware issues norrandom unexplainedissues on this platform. So unless W7is the cause of corruption(hopefully not), the driver's notcorrupt.Either that, or the original download that installed successfully is corrupt at the source, andre-installing it will re-installthe corrupt file, proving nothing. Thus I have neither thetime fornor interestin investigatingthe "corruption"red herring theory.FYI as of this time the problem has not recurred, nor have I put any effort into seeing if can be reproduced.This particular webcam driveris both providedandunsupported by Sony for Vista x64 (they only support Vista x86 since the laptop shipped with it). Never used Vista x64 on it so can't comment on whether this driver is stable under Vista. Ican report that under W7 a movie-recording/snapshot program (also provided by Sony) works OK in limited (30 seconds) testing.This is my last followup to this topic, having done my duty to report a potential problem. If someone from Microsoft wants further details,they should feel free to contact me privately, and I will gladly help investigate further.
May 28th, 2009 6:06am

I am not a Microsoft employee, nor do I represent Microsoft. I was recognized for my volunteer contributions to the online communities with the MVP award. More info on it here: http://mvp.support.microsoft.com/gp/mvpawardintro I apologize for the knee-jerk reaction. Since you obviously know so much more about this issue than I do (all of my information was from you), then you must be more than qualified to fix it yourself. Please rest assured that I will never knowingly provide a response to you again.- John
Free Windows Admin Tool Kit Click here and download it now
May 29th, 2009 12:21am

That's fine, I'm not here toget problems solved, I'm here to provide feedback on my experience with the RC so that bugs can be fixedbefore the RTM.Carl
May 29th, 2009 4:23am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics