Blue Screen System Thread Exception msrcp.sys

Hi, I recently started getting a lot of different bluescreens on my PC. After some frustration I backed up my important files, formatted my system drive and primary data drive and reinstalled Windows 7 Professional 64 bit. This didn't fix my bluescreen errors at all. I'm running my OS off of a solid state drive, and installed two 2TB drives in Raid0 before reinstalling my OS. I have the drivers for RAID for my motherboard, they seem to be working properly, and I'm not writing to them or reading them so I doubt this is the source of my problem. The analysis of my crashes by WhoCrashed is below.

 

On Thu 12/27/2012 7:05:17 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-12386-01.dmp
This was probably caused by the following module: msrpc.sys (msrpc+0x1F1F1)
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF880017AF1F1, 0xFFFFF88003292A68, 0xFFFFF880032922D0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\Windows\system32\drivers\msrpc.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Kernel Remote Procedure Call Provider
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 12/27/2012 7:05:17 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: msrpc.sys (msrpc!I_RpcGetBufferWithObject+0x741)
Bugcheck code: 0x7E (0xFFFFFFFFC0000005, 0xFFFFF880017AF1F1, 0xFFFFF88003292A68, 0xFFFFF880032922D0)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
file path: C:\Windows\system32\drivers\msrpc.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Kernel Remote Procedure Call Provider
Bug check description: This bug check indicates that a system thread generated an exception that the error handler did not catch.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 12/27/2012 6:51:50 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-16395-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x70700)
Bugcheck code: 0x1A (0x41790, 0xFFFFFA800C0D10D0, 0xFFFF, 0x0)
Error: MEMORY_MANAGEMENT
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a severe memory management error occurred.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Thu 12/27/2012 6:41:05 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-12979-01.dmp
This was probably caused by the following module: dxgmms1.sys (dxgmms1+0x5EEA)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8800472EEEA, 0xFFFFF8800D01C600, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\drivers\dxgmms1.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics MMS
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Thu 12/27/2012 6:06:16 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-15241-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0x77ADC)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF96000157ADC, 0xFFFFF8800C382AA0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.



On Thu 12/27/2012 5:24:29 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-13852-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x70740)
Bugcheck code: 0x50 (0xFFFFFFFFFFFFFF8B, 0x1, 0xFFFFF800035692B9, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Thu 12/27/2012 4:56:45 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-15537-01.dmp
This was probably caused by the following module: clfs.sys (0xFFFFF88000D5DB80)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF88000D5DB80, 0xFFFFF8800C108AB0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: C:\Windows\system32\clfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Common Log File System Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.




Conclusion



7 crash dumps have been found and analyzed. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

dxgmms1.sys (DirectX Graphics MMS, Microsoft Corporation)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination the errors that have been reported for these drivers and include the brand and model name of your computer as well in the query. This often yields interesting results from discussions from users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

New Crash:

 

On Thu 12/27/2012 7:40:55 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0xA (0x48, 0x2, 0x1, 0xFFFFF800032672B9)
Error: IRQL_NOT_LESS_OR_EQUAL
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

On Thu 12/27/2012 7:46:05 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\122712-19312-01.dmp
This was probably caused by the following module: ntfs.sys (Ntfs+0x5F68)
Bugcheck code: 0x24 (0x1904FB, 0xFFFFF88006A6DDC8, 0xFFFFF88006A6D630, 0xFFFFF800032DED4F)
Error: NTFS_FILE_SYSTEM
file path: C:\Windows\system32\drivers\ntfs.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT File System Driver
Bug check description: This indicates a problem occurred in the NTFS file system.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.

 

This crash came moments after adding the new crash... I'm not sure how I can troubleshoot a BSOD thats different every time.

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Similar experience, three Win7 BSOD crashes since 27 January 2013 after installing a series of updates through Windows Updates. Each time, the machine was sitting alone largely idle when it crashed and restarted.

Various bugcheck STOP codes, analysed the crash dumps, wide variety, all within Microsoft drivers, netio.sys, msrpc.sys, etc.

Interestingly enough, the debugger is unable to fetch symbols online for some of these MS modules...

My system is *very* simple, 100% clean, no fancy hardware or hardware changes since the machine was built, no new applications installed around that time, so I tend to think it is a newly-created OS stability problem.


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: N:\Symbols;SRV*N:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.x86fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0x82a54000 PsLoadedModuleList = 0x82b9e4d0
Debug session time: Sun Feb 10 02:25:55.240 2013 (UTC + 13:00)
System Uptime: 4 days 0:57:33.444
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols

Loading unloaded module list
........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for msrpc.sys
*** ERROR: Module load completed but symbols could not be loaded for msrpc.sys
Probably caused by : msrpc.sys ( msrpc+a50d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 82c56cf2 to 82a9541b

STACK_TEXT:
8adbcbac 82c56cf2 badb0d00 0000000a 00000000 nt!KiSystemFatalException+0xf
8adbcc80 82a918fa 800002cc 8adbcd34 00000000 nt!NtRemoveIoCompletionEx+0x148
8adbcc80 82a904e5 800002cc 8adbcd34 00000000 nt!KiFastCallEntry+0x12a
8adbcd10 88c1850d 800002cc 8adbcd34 00000001 nt!ZwRemoveIoCompletionEx+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
8adbcd50 82c5e07a 00000000 aaf8c4d9 00000000 msrpc+0xa50d
8adbcd90 82b04819 88c184e9 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND: kb

FOLLOWUP_IP:
msrpc+a50d
88c1850d 85c0 test eax,eax

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: msrpc+a50d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: msrpc

IMAGE_NAME: msrpc.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0x7f_d_msrpc+a50d

BUCKET_ID: 0x7f_d_msrpc+a50d

Followup: MachineOwner
---------

Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

 
 

Question Info


Last updated December 29, 2020 Views 5,871 Applies to: