A problem with hal.dll+12a3b - Windows 7 x64

cluberti said:
Core Temp is indeed a good tool, as is RealTemp. If you're looking to replace the stock cooler, talk to Novatech about what they offer and consider it if you're going to be pushing the system with new games or high-end graphics work on a regular basis. If you're just going to run the machine under "normal" conditions most of the time, you should be OK with what shipped with the machine.
Click to expand...

Thanks for the reply, I've been doing some more investigation and according to Core Temp the highest temp in normal use is 80C. Thats whist running BOINC when the machine is idle.

I found the Intel Extreme Tuning Utility and the benchmark achieved, is right in the middle of other people benchmarks for the same MB and processor.

I am still getting BSOD's and unexpected stops, though this time they are appearing in the Action Centre. They didn't before. It is not possible to analyse the minidump as it got deleted by accident (CCleaner, I didn't realise it deleted mindumps).

I suspect that there was more than one cause, now the processor has been replaced the underlying problem is revealed.

I am no nearer a solution. Overheating is an issue, but, I think not the cause. As the previous processor failed, probably due to the overheating. It exacerbated the underlying problem.

This is not my area of expertise, I am picking things up from the Internet, but am still not clear or confident about the problem. I have ensured the drivers are all upto date, there have been multiple memory and disk tests.

What else can I do? WHo else can I ask?
 
Well, first of all, if you're folding using BOINC or any other client, that's not normal use + that's not idle. Your system is completely under load, since you're literally using your hardware to its fullest potential for researching purposes. Given you're running the stock cooler on an OEM machine, this is not entirely practical, and overheating is likely the cause of your bug checks.

For now, here's my advice: stop folding, using any sort of stress tests, etc, period. If you don't crash whatsoever after stopping these things, we know it's overheating, and the solution is to buy an aftermarket cooler that's capable of appropriately handling these tasks.
 
Agreed - a temperature of 80C is about 20C warmer than my 4790K runs at it's hottest under full load (prime95) with a Noctua cooler. Hitting 80C would indicate you have much room for cooling improvement.
 
Thanks for the advice. Would you consider Photoshop high end graphics work? I also run BOINC that pushes the temperatures up.

The one thing I cannot find on Intel's website is definative information about the acceptable temperatures. They talk about Tcase and Tj with inadequate definitions and no explanation of how these relate to the temperature reported by the processor.

Can you point me to expalnations on these points?
 
Thanks for the advice. Would you consider Photoshop high end graphics work?
Click to expand...

It depends on what you're doing. Are you simply doing an image edit with the res of 1680x1050, or are you doing a giant landscape digital painting at a huge HD resolution? Regardless, PS generally isn't too demanding under normal use. Your temperature issue is coming from folding, and anything else is just an additive.

They talk about Tcase and Tj with inadequate definitions and no explanation of how these relate to the temperature reported by the processor.
Click to expand...

The Tjmax (thermal junction) is quite literally the # that your CPU is built not to exceed. If it exceeds that, it generally throttles pretty hard until temps lower, and if they can't in a certain time frame, it shuts down/bug checks to prevent damage.
 
Thank you both, you been very patient with my questions and I appreciate it.

I am not inclined to go back to Novatech to ask about better CPU cooler's. I am not convinced they have what I would consider sufficent expertise nor that their answer would be non-biased.

Do you have any recommendations for good quality coolers? Cluberti, you mentioned Noctua coolers, do they come particularly recommended?
 
I have had more Unexpected stops the latest was at 12:57 yesterday. Core Temp was logging, but stopped at 12:52, I have no explanation I was not using the machine at the time. It showed temps of 28-30C and max temps achieved 58-60C, both CPU load and speed were also low.

Yesterday's stop produced a MEMORY DMP, which I have zipped and uploaded to Google Drive, here is the link. I ran WinDbg on it but all I got was a hardware error.

I would be grateful for any help, specifically what can I do to more closely identify the problem, and what can I do to remove it.
 
0x124, internal unclassified again. Different processor, different bank.

Code: 
===============================================================================
Section 2     : x86/x64 MCA
-------------------------------------------------------------------------------
Descriptor    @ fffffa8010890138
Section       @ fffffa80108902c0
Offset        : 664
Length        : 264
Flags         : 0x00000000
Severity      : Fatal

Error         : Internal unclassified (Proc 2 Bank 1)
  Status      : 0xbf80000000200401
  Address     : 0x00000000fee00040
  Misc.       : 0x0000000000000086

Do you know what revision your motherboard is? I.e. is it 1.0, 1.1, or 1.2?

Code: 
  BIOS Major Revision           4
  BIOS Minor Revision           6

I ask because at this point it's worth trying a BIOS update, and you're on the 2nd major release after its first release (F3).
 
Patrick said:
0x124, internal unclassified again. Different processor, different bank.
Click to expand...

Great!

Patrick said:
Do you know what revision your motherboard is? I.e. is it 1.0, 1.1, or 1.2?
Click to expand...

according to the Bios updater from Gigabyte Rev 1.0

Patrick said:
I ask because at this point it's worth trying a BIOS update, and you're on the 2nd major release after its first release (F3).
Click to expand...

It is showing Bios Ver F8, which is the latest acording to the Bios Updater. I updated it anyway in case there was any corruption.

An interesting thing happened, after the Bios updater is finished, a restart is required. It did not shutdown correctly, I got a BSOD, 0x03F if memory serves, and a new MEMORY.DMP. Do you want to have a look at it?
 
Patrick said:
Do you have any recommendations for good quality coolers
Click to expand...

For air, as cluberti said, Noctua is about as good as it gets. Their most famous air cooler afaik (may have changed, it's been a few years since I've bothered to check) is the NH-D14 - Noctua NH-D14 CPU Cooler - Newegg.com

For water, I'd go self-contained on a system like yours, and with that said, Corsair's Hxx(x) series is great. For example, H100 - Hydro Series? H100 Extreme Performance Liquid CPU Cooler
Click to expand...

Thanks for the advice, there is only one problem, my case is a midi. With respect to the H100, I only have space for one 120mm fan, so that is out. I guess it would have to be the H80, but I have seen videos where people have difficulty fitting a H80 in small cases. That is a suck and see situation. As for the Noctua cooler a similar situation applies I think I have to get in there and do some measuring, but I don't expect there to be enough room. I have to check with Novatech first to see if I void the warrenty by opening the case.

Can you recommend any smaller coolers? Also, how does one judge the performance of coolers, all the coolers I have investigated are described in superlatives, I would expect definative figures of cooling performance. But nobody seems to use that. It is baffling, is there no engineering behind these coolers or is cooler design an art form?
 
Code: 
[COLOR=#ff0000]BugCheck 3B[/COLOR], {[COLOR=#008000]c0000005[/COLOR], fffff9600012a1bc, fffff880211886a0, 0}

Page 3b3e9a not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : win32k.sys ( win32k!PDEVOBJ::vUnreferencePdev+3c )

It appears that an invalid memory address was referenced.

Code: 
0: kd> [COLOR=#008000]!error c0000005[/COLOR]
Error code: (NTSTATUS) 0xc0000005 (3221225477) - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

From the stack:

Code: 
0: kd> [COLOR=#008000]knL[/COLOR]
 # Child-SP          RetAddr           Call Site
00 fffff880`21187dd8 fffff800`0328ae69 nt!KeBugCheckEx
01 fffff880`21187de0 fffff800`0328a7bc nt!KiBugCheckDispatch+0x69
02 fffff880`21187f20 fffff800`032b713d nt!KiSystemServiceHandler+0x7c
03 fffff880`21187f60 fffff800`032b5f15 nt!RtlpExecuteHandlerForException+0xd
04 fffff880`21187f90 fffff800`032c6e81 nt!RtlDispatchException+0x415
05 fffff880`21188670 fffff800`0328af42 nt!KiDispatchException+0x135
06 fffff880`21188d10 fffff800`03289aba nt!KiExceptionDispatch+0xc2
07 fffff880`21188ef0 fffff960`0012a1bc nt!KiPageFault+0x23a
08 fffff880`21189080 fffff960`0026c6d3 [COLOR=#ff0000]win32k!PDEVOBJ::vUnreferencePdev+0x3c[/COLOR] <-- Bugchecking instruction
09 fffff880`211890c0 fffff960`0012a2be win32k!bDeleteDCInternalWorker+0x233
0a fffff880`21189120 fffff960`000e8ae8 win32k!bDeleteDCInternal+0x56
0b fffff880`21189170 fffff800`0328ab53 win32k!NtGdiDeleteObjectApp+0x120
0c fffff880`211891a0 000007fe`ffc9108a nt!KiSystemServiceCopyEnd+0x13
0d 00000000`0012ec28 fffff800`03282f10 0x000007fe`ffc9108a
0e fffff880`21189380 fffffa80`131ea060 nt!KiCallUserMode
0f fffff880`21189388 fffff800`0380ab7f 0xfffffa80`131ea060
10 fffff880`21189390 00000000`00000000 hal!HalSendSoftwareInterrupt+0x48

I've unwinded the thread and examined the entire call stack, there appears to be a few references to Rapport, have you checked for any updates?

Code: 
0: kd> [COLOR=#008000]lmvm RapportCerberus64_1412112[/COLOR]
Browse full module list
start             end                 module name
fffff880`04e00000 fffff880`04ede1a0   RapportCerberus64_1412112   (no symbols)           
    Loaded symbol image file: RapportCerberus64_1412112.sys
    Image path: \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1412112.sys
    Image name: RapportCerberus64_1412112.sys
    Timestamp:        [COLOR=#ff0000]Mon Jun 01 18:21:13 2015[/COLOR] (556C9489)
    CheckSum:         000E1AE6
    ImageSize:        000DE1A0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Code: 
0: kd> [COLOR=#008000]lmvm RapportPG64[/COLOR]
Browse full module list
start             end                 module name
fffff880`0512c000 fffff880`0519f7e0   RapportPG64   (no symbols)           
    Loaded symbol image file: RapportPG64.sys
    Image path: \??\C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys
    Image name: RapportPG64.sys
    Timestamp:        [COLOR=#ff0000]Tue Jun 02 16:38:25 2015[/COLOR] (556DCDF1)
    CheckSum:         00075846
    ImageSize:        000737E0
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Are you using two different security programs?
 
Code: 
//Handle for a previous semaphore object

0: kd> !handle fffff960`001f68a4

PROCESS fffffa801140c060
    SessionId: 1  Cid: 1430    Peb: 7fffffdc000  ParentCid: 12c8
    DirBase: 373f56000  ObjectTable: fffff8a01300e270  HandleCount: 149.
    Image: LWEMon.exe

Handle table at fffff8a01300e270 with 149 entries in use

//Module information on the Logitech kernel driver

Loaded Module Info: [wmbenum] 
         Module: WmBEnum
   Base Address: fffff88007611000
     Image Name: WmBEnum.sys
   Machine Type: 34404 (X64)
     Time Stamp: 4bd744ab Tue Apr 27 21:10:19 2010
           Size: 4d00
       CheckSum: e6b8
Characteristics: 22  
Debug Data Dirs: Type  Size     VA  Pointer
             CODEVIEW    5f,  2190,    2190 RSDS - GUID: {355EE583-4B7B-4632-AE57-A2D332845B14}
               Age: 1, Pdb: d:\wingman\src\drivers\src\wmbenum\objfre_wnet_amd64\amd64\wmbenum.pdb
     Image Type: MEMORY   - Image read successfully from loaded memory.
    Symbol Type: NONE     - PDB not found from image header.
    Load Report: no symbols loaded

//Snippet of the addresses accessed by the driver

	fffff8a00858d000+0x98b8  : DxgK (LargePool)  -- Vista display driver support
00000000004055C8 00000C40 FFFFF88007611000 FFFFF8A0085A0C40 FFFFF6FC50042D00 
	fffff8a00858d000+0x13c40 : DxgK (LargePool)  -- Vista display driver support

It could be Rapport, but it's difficult to say exactly what went wrong in this dump.

Just prior to the faulting instruction of the dereference, I can see semaphore work with the Logitech Wingman process, which contains the Kernel driver WmBEnum.sys
I have found quite a bit of driver management related to the Windows Subsystem Kernel driver win32k.sys.
It seems to be accessing a lot of display driver support.

Might be worth removing that for the time being as well.
 
Jared said:
It could be Rapport, but it's difficult to say exactly what went wrong in this dump.

Just prior to the faulting instruction of the dereference, I can see semaphore work with the Logitech Wingman process, which contains the Kernel driver WmBEnum.sys
I have found quite a bit of driver management related to the Windows Subsystem Kernel driver win32k.sys.
It seems to be accessing a lot of display driver support.

Might be worth removing that for the time being as well.
Click to expand...

Sorry, I'm going to need an explanation of that advice, what exactly should I remove? And how do I remove it without damaging Windows?
 
I don't have a Logitech Wingman! The only Logitech product I have is a Logitech Driving Force GT wheel. I am removing it, but I would like to be able to use it, as I need it for my favorite game, Euro Truck Simulator.

Do you have any advice on how I can reinstall it without setting up a conflict.
 
Either the driver was named incorrectly from a source I used, or it is the same driver for different software.
I suggest you remove Rapport first, then see how it goes. If it crashes again, remove the Logitech software.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top