BSOD - Running out of ideas

Sirik · 08 Aug 2010

Hi,

I just joined this forum because i am having bluescreens frequently and cannot find the source. I was wondering if anyone had any suggestions.

I get seemingly random bluescreen message codes that dont seem related to me in any way.

I have 2 ATi graphics cards running the latest drivers, I have also tried older drivers as well. I have tried to run with only 1 card and that seems to stop the bluescreens, but if i put the second card back in, it starts to bluescreen. This would indicate a fault graphics card, however it doesnt matter which card is in, as long as its on its own.

I am currently running with only 1 stick of ram at a time to see if any of the ram is faulty, but i did get another bluescreen shortly after starting back up from removing all other ram sticks.

i dont have dump files for all of the bluescreens ive had, but the last 5 are said to be caused by the following:

- tcpip.sys
- fltmgr.sys
- ntfs.sys
- atikmdag.sys
- tunnel.sys

I also remember having quite a few from ntokrnl.exe as well.
not long after the bluescreens started, i completely re-installed my OS and software (usually i would just restore from an image). so i dont think its software related.

any suggestions?

CarlTR6 · 08 Aug 2010

Welcome to the forum.

Please read these threads and post back. We will be glad to help you.

[1 - Novice] How to ask for help with a BSOD problem

https://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Sirik · 08 Aug 2010

Thanks for that.
I have run the tool and zipped the output as requested.
I hope someone can help me identify my problem.
I myself am thinking the motherboard is becomming faulty.

CarlTR6 · 08 Aug 2010

Why are you suspecting the motherboard? I'm not doubting you, just asking. I will look at the files and be right back.

Sirik · 08 Aug 2010

I suspect my motherboard because it is the oldest part in my machine. bought back in 2008.

I have just had another 2 bluescreens. the first whilst half way through a film, and the second whilst trying to post about the first bluescreen. thats 4 bluescreens since 7PM (UK Time).

these were caused by msahci.sys and ntfs.sys.. this is so annoying

CarlTR6 · 08 Aug 2010

The error codes point to hardware or hardware related issues.

STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control

STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

Usual causes: System service, Device driver, graphics driver, ?memory

STOP 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL

Usual causes: Device driver

STOP 0x00000034: CACHE_MANAGER

Usual causes: Insufficient physical memory, Indexing, Device driver

Notice the things in common in the usual causes of each error code: device driver in all of them followed by memory in two.

The dumps don't point to a specific cause; most of them blame a Windows system driver, which is highly unlikely.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Reports.zip\Windows7_BSOD_jcgriff2\080810-29000-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`03092e50
Debug session time: Sun Aug  8 13:58:38.467 2010 (GMT-4)
System Uptime: 0 days 19:32:27.314
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88001075100, fffff88009ea4d70, 0}

Probably caused by : fltmgr.sys ( fltmgr!FltpPerformPreCallbacks+3d0 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88001075100, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009ea4d70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
fltmgr!FltpPerformPreCallbacks+3d0
fffff880`01075100 b911000000      mov     ecx,11h

CONTEXT:  fffff88009ea4d70 -- (.cxr 0xfffff88009ea4d70)
rax=0000000000000000 rbx=fffffa80062a4100 rcx=0000000000000002
rdx=000000000000014c rsi=fffffa800c4c8e30 rdi=fffffa8006f63010
rip=fffff88001075100 rsp=fffff88009ea5740 rbp=fffffa8006f60e60
 r8=fffffa8006f83940  r9=fffffa8006f6daf0 r10=000000000000014e
r11=0000000000000001 r12=0000000000000054 r13=fffffa80062a1630
r14=fffffa8006f60bb0 r15=fffff88009ea58e0
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
fltmgr!FltpPerformPreCallbacks+0x3d0:
fffff880`01075100 b911000000      mov     ecx,11h
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  mpc-hc.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff88001075100

STACK_TEXT:  
fffff880`09ea5740 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpPerformPreCallbacks+0x3d0


FOLLOWUP_IP: 
fltmgr!FltpPerformPreCallbacks+3d0
fffff880`01075100 b911000000      mov     ecx,11h

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  fltmgr!FltpPerformPreCallbacks+3d0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fltmgr

IMAGE_NAME:  fltmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc11f

STACK_COMMAND:  .cxr 0xfffff88009ea4d70 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_fltmgr!FltpPerformPreCallbacks+3d0

BUCKET_ID:  X64_0x3B_fltmgr!FltpPerformPreCallbacks+3d0

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Reports.zip\Windows7_BSOD_jcgriff2\080810-26800-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e51000 PsLoadedModuleList = 0xfffff800`0308ee50
Debug session time: Sun Aug  8 14:21:50.478 2010 (GMT-4)
System Uptime: 0 days 0:03:25.226
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {2, 2, 1, fffff8800167a6c0}

Probably caused by : tcpip.sys ( tcpip!KfdIsV4InTransportFastEmpty+0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000002, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800167a6c0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f90e0
 0000000000000002 

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!KfdIsV4InTransportFastEmpty+0
fffff880`0167a6c0 ff259a650c00    jmp     qword ptr [tcpip!_imp_KfdIsV4InTransportFastEmpty (fffff880`01740c60)]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003bb0910 -- (.trap 0xfffff88003bb0910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa8001d1ff00
rdx=fffffa8001444980 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800167a6c0 rsp=fffff88003bb0aa8 rbp=fffff88003bb0db8
 r8=fffff88003bb0db8  r9=0000000000000000 r10=fffff88003bb0d10
r11=fffff88003bb0c58 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
tcpip!KfdIsV4InTransportFastEmpty:
fffff880`0167a6c0 ff259a650c00    jmp     qword ptr [tcpip!_imp_KfdIsV4InTransportFastEmpty (fffff880`01740c60)] ds:2120:fffff880`01740c60=00000000001da7ea
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec0b69 to fffff80002ec1600

STACK_TEXT:  
fffff880`03bb07c8 fffff800`02ec0b69 : 00000000`0000000a 00000000`00000002 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`03bb07d0 fffff800`02ebf7e0 : 00000000`00000000 00000000`00000020 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03bb0910 fffff880`0167a6c0 : fffff880`01675791 00000000`00000000 00000000`00000010 fffffa80`014337b0 : nt!KiPageFault+0x260
fffff880`03bb0aa8 fffff880`01675791 : 00000000`00000000 00000000`00000010 fffffa80`014337b0 fffffa80`04f3a5c0 : tcpip!KfdIsV4InTransportFastEmpty
fffff880`03bb0ab0 fffff880`0167a0ca : fffffa80`01d1ff00 00000000`00000000 fffffa80`01bc4da8 00000000`00000000 : tcpip!TcpTcbReceive+0x291
fffff880`03bb0c60 fffff880`01679c17 : fffffa80`0289cf22 fffffa80`01d1b270 00000000`00000000 fffff880`0165d400 : tcpip!TcpMatchReceive+0x1fa
fffff880`03bb0db0 fffff880`0165c3c7 : fffffa80`01d15000 fffffa80`01bf8ec0 fffffa80`01d15000 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x177
fffff880`03bb0e60 fffff880`0165c499 : fffff880`03bb0fe0 fffff880`0176c9a0 fffff880`03bb0ff0 fffffa80`01b98df0 : tcpip!IppDeliverListToProtocol+0x97
fffff880`03bb0f20 fffff880`0165c990 : fffffa80`02651030 fffffa80`02650a00 00000000`00000011 fffff880`03bb0fe0 : tcpip!IppProcessDeliverList+0x59
fffff880`03bb0f90 fffff880`0165b821 : 00000000`1900a8c0 fffffa80`01d1b270 fffff880`0176c9a0 00000000`025d9001 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`03bb1070 fffff880`0165a272 : fffffa80`02668220 00000000`00000000 fffffa80`025d9001 00000000`00000003 : tcpip!IpFlcReceivePackets+0x651
fffff880`03bb1270 fffff880`016736ba : fffffa80`025d9010 fffff880`03bb13a0 fffffa80`025d9010 fffff880`03bb0000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`03bb1350 fffff800`02ed0d4a : fffffa80`02650030 fffff880`03bac000 00000000`00004800 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`03bb13a0 fffff880`016730e2 : fffff880`016735e0 fffff880`03bb14b0 fffffa80`025db302 fffff880`014964bc : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`03bb1480 fffff880`014cc0eb : fffffa80`025db380 00000000`00000000 fffffa80`024f91a0 00000000`00000000 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`03bb14f0 fffff880`01495fc6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`03bb1560 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6


STACK_COMMAND:  kb

FOLLOWUP_IP: 
tcpip!KfdIsV4InTransportFastEmpty+0
fffff880`0167a6c0 ff259a650c00    jmp     qword ptr [tcpip!_imp_KfdIsV4InTransportFastEmpty (fffff880`01740c60)]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  tcpip!KfdIsV4InTransportFastEmpty+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc26e

FAILURE_BUCKET_ID:  X64_0xD1_tcpip!KfdIsV4InTransportFastEmpty+0

BUCKET_ID:  X64_0xD1_tcpip!KfdIsV4InTransportFastEmpty+0

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Reports.zip\Windows7_BSOD_jcgriff2\080710-36098-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e18000 PsLoadedModuleList = 0xfffff800`03055e50
Debug session time: Fri Aug  6 20:11:14.063 2010 (GMT-4)
System Uptime: 0 days 0:08:34.640
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff8800a1fff71, fffff88007bd04e8, fffff88007bcfd50}

Probably caused by : atikmdag.sys ( atikmdag+360f71 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800a1fff71, The address that the exception occurred at
Arg3: fffff88007bd04e8, Exception Record Address
Arg4: fffff88007bcfd50, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+360f71
fffff880`0a1fff71 488b01          mov     rax,qword ptr [rcx]

EXCEPTION_RECORD:  fffff88007bd04e8 -- (.exr 0xfffff88007bd04e8)
ExceptionAddress: fffff8800a1fff71 (atikmdag+0x0000000000360f71)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT:  fffff88007bcfd50 -- (.cxr 0xfffff88007bcfd50)
rax=fffffa8008c7f200 rbx=fffffa8008c7f200 rcx=0000000000000000
rdx=fffffa8005a18400 rsi=fffffa8005a18020 rdi=fffffa8005a18420
rip=fffff8800a1fff71 rsp=fffff88007bd0720 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8008c7f200
r11=fffff88007bd0600 r12=0000000000000000 r13=fffffa8005ea28a0
r14=fffffa8009333640 r15=fffffa8005f0f000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210282
atikmdag+0x360f71:
fffff880`0a1fff71 488b01          mov     rax,qword ptr [rcx] ds:002b:00000000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c00e0
 0000000000000000 

FOLLOWUP_IP: 
atikmdag+360f71
fffff880`0a1fff71 488b01          mov     rax,qword ptr [rcx]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800a1fff71

STACK_TEXT:  
fffff880`07bd0720 00000000`00000000 : 00000000`00000004 00000000`00000001 00000000`000007ff fffffa80`05a18420 : atikmdag+0x360f71


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+360f71

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c33da58

STACK_COMMAND:  .cxr 0xfffff88007bcfd50 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+360f71

BUCKET_ID:  X64_0x7E_atikmdag+360f71

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Reports.zip\Windows7_BSOD_jcgriff2\080710-24242-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`03095e50
Debug session time: Sat Aug  7 13:25:20.018 2010 (GMT-4)
System Uptime: 0 days 4:11:48.000
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50830, fffff880033937c8, fffff88003393030, fffff80002ef2580}

Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+10 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880033937c8
Arg3: fffff88003393030
Arg4: fffff80002ef2580

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880033937c8 -- (.exr 0xfffff880033937c8)
ExceptionAddress: fffff80002ef2580 (nt!MmUnmapViewInSystemCache+0x0000000000000010)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  fffff88003393030 -- (.cxr 0xfffff88003393030)
rax=0000000000000000 rbx=fffffa800620a730 rcx=fffff98007900000
rdx=fffff8a00cfc8960 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ef2580 rsp=fffff88003393a00 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=000000000000007f
r11=0000000000000003 r12=fffffa80057dc380 r13=fffffa800620a730
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
nt!MmUnmapViewInSystemCache+0x10:
fffff800`02ef2580 56              push    rsi
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800031000e0
 0000000000000000 

FOLLOWUP_IP: 
nt!MmUnmapViewInSystemCache+10
fffff800`02ef2580 56              push    rsi

FAULTING_IP: 
nt!MmUnmapViewInSystemCache+10
fffff800`02ef2580 56              push    rsi

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff800031e0155 to fffff80002ef2580

STACK_TEXT:  
fffff880`03393a00 fffff800`031e0155 : fffff980`07900000 fffff8a0`0cfc8960 00000000`00000000 00000000`00200246 : nt!MmUnmapViewInSystemCache+0x10
fffff880`03393a10 fffff800`02ee1447 : 00000000`00000000 fffffa80`057dc380 00000000`00000000 00000000`00040000 : nt!CcUnmapVacb+0x5d
fffff880`03393a50 fffff800`02eb8174 : 00000000`00000001 fffffa80`05fe6480 fffffa80`0620a700 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`03393ae0 fffff800`02ebbc1c : fffffa80`0620a730 00000000`00000011 fffffa80`0620a730 fffff800`00000000 : nt!CcDeleteSharedCacheMap+0x140
fffff880`03393b50 fffff800`02ebc41c : fffff800`030cf100 fffff880`03393c58 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x5bc
fffff880`03393c00 fffff800`02ed5861 : fffffa80`05808ab0 fffff800`02ebc254 fffff800`030cf140 fffffa80`00000000 : nt!CcWorkerThread+0x1c8
fffff880`03393cb0 fffff800`0316da86 : 33333333`33333333 fffffa80`05804040 00000000`00000080 fffffa80`057ee040 : nt!ExpWorkerThread+0x111
fffff880`03393d40 fffff800`02ea6b06 : fffff880`03164180 fffffa80`05804040 fffff880`0316efc0 33333333`13333333 : nt!PspSystemThreadStartup+0x5a
fffff880`03393d80 00000000`00000000 : fffff880`03394000 fffff880`0338e000 fffff880`033939f0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmUnmapViewInSystemCache+10

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88003393030 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+10

BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+10

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Reports.zip\Windows7_BSOD_jcgriff2\080610-24554-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e17000 PsLoadedModuleList = 0xfffff800`03054e50
Debug session time: Fri Aug  6 13:02:36.923 2010 (GMT-4)
System Uptime: 0 days 0:48:28.500
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc000001d, fffffa8009abab3e, fffff8800339aa08, fffff8800339a270}

Probably caused by : tunnel.sys ( tunnel!TunnelWorkQueueRoutine+1c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffffa8009abab3e, The address that the exception occurred at
Arg3: fffff8800339aa08, Exception Record Address
Arg4: fffff8800339a270, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
+16
fffffa80`09abab3e ff              ???

EXCEPTION_RECORD:  fffff8800339aa08 -- (.exr 0xfffff8800339aa08)
ExceptionAddress: fffffa8009abab3e
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  fffff8800339a270 -- (.cxr 0xfffff8800339a270)
rax=fffffa8006ea67d0 rbx=fffffa8006ee1060 rcx=fffff880042c3d58
rdx=fffffa8006ea67d0 rsi=fffffa8005804b60 rdi=fffffa8006ed3390
rip=fffffa8009abab3e rsp=fffff8800339ac48 rbp=fffff8000302c5a0
 r8=0000000000000000  r9=00000000002a4c66 r10=0000000000008493
r11=fffffa8006ed3390 r12=fffffa8006ed3390 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei ng nz ac po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010297
fffffa80`09abab3e ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from fffff880042b65a8 to fffffa8009abab3e

FAILED_INSTRUCTION_ADDRESS: 
+16
fffffa80`09abab3e ff              ???

STACK_TEXT:  
fffff880`0339ac48 fffff880`042b65a8 : fffff800`0302c5a0 fffff880`045745d8 00000000`00000000 00000000`00000000 : 0xfffffa80`09abab3e
fffff880`0339ac50 fffff800`03184827 : fffffa80`06ee1060 fffff800`0302c5a0 fffffa80`09045010 fffffa80`05804b60 : tunnel!TunnelWorkQueueRoutine+0x1c
fffff880`0339ac80 fffff800`02e94861 : fffff880`04574500 fffff880`04574510 fffffa80`05804b60 fffff800`00000000 : nt!IopProcessWorkItem+0x23
fffff880`0339acb0 fffff800`0312ca86 : fffd3ab8`e8ce8b4c fffffa80`05804b60 00000000`00000080 fffffa80`057ee040 : nt!ExpWorkerThread+0x111
fffff880`0339ad40 fffff800`02e65b06 : fffff880`03164180 fffffa80`05804b60 fffff880`0316efc0 0148c22b`480b7ec9 : nt!PspSystemThreadStartup+0x5a
fffff880`0339ad80 00000000`00000000 : fffff880`0339b000 fffff880`03395000 fffff880`0339a9f0 00000000`00000000 : nt!KxStartSystemThread+0x16


FOLLOWUP_IP: 
tunnel!TunnelWorkQueueRoutine+1c
fffff880`042b65a8 488b3d99d70000  mov     rdi,qword ptr [tunnel!TunnelGlobal+0x368 (fffff880`042c3d48)]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  tunnel!TunnelWorkQueueRoutine+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tunnel

IMAGE_NAME:  tunnel.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bccc1

STACK_COMMAND:  .cxr 0xfffff8800339a270 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_BAD_IP_tunnel!TunnelWorkQueueRoutine+1c

BUCKET_ID:  X64_0x7E_BAD_IP_tunnel!TunnelWorkQueueRoutine+1c

Followup: MachineOwner
---------

To begin troubleshooting, I suggest you enable Driver Verifier. Keep in mind that Driver Verifier will cause a crash when it encounters a faulty driver. Let driver verifier run for 36 hours and use your computer normally.

Driver Verifier - Enable and Disable

Upload any new BSOD's as soon as you can. You don't need to upload the whole package again.

https://www.sevenforums.com/tutorials...en-forums.html

Sirik · 08 Aug 2010

Hi.. Thanks for a quick reply..

I have tried the driver verifier before and it just crashes constantly.

I have just had another bluescreen this one is caused by dxgmm1.sys. i have included the minidumps from these last few BSOD's.

I have now put all my RAM back into my pc as it doesnt seem to make any difference with the crashes. (now back up to 6GB)

CarlTR6 · 08 Aug 2010

I bought installed my motherboard in 2005. It is obsolete; but still working fine.

Driver Verifier is supposed to cause crashes it it finds faulty drivers. The dump files will (hopefully) point to the offending driver.

I will look that that latest dump. dxgmm1.sys is a Direct X driver. That could mean your video card is acting up. What antivirus and firewall are you using.

The latest dump is another error code D1. It does blame dxgmm1.sys and also points to atikmdag.sys, ATI grapchic card driver.

Sirik · 08 Aug 2010

I have tried testing my video cards by removing them. I have 2 ATi 4870's one of them is an X2. If i remove either one of them my pc seems to be ok, but both in together seems to cause crashes. which is one of the other reasons why i suspect my motherboard. if it was my graphics card alone that was causing faults.. it would still appear if i had the bad card alone in my pc. but that doesnt appear to be the case.

i have Microsoft Security Essentials and i just use the windows default firewall.

CarlTR6 · 08 Aug 2010

Very good on the antivirus and Windows Firewall.

I suspect it is your graphics card arrangement causing some of this. All of your drivers are up to date, something I rarely see with BSOD's. I am going to ask for help from the graphics card gurus. I am not an expert in that area by any means. By the way, one of the other dumps I looked at implicated atikmdag.sys, also.