Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: pretty new machine BSOD


12 Aug 2010   #1

Windows 7 64-bit Professional
 
 
pretty new machine BSOD

Hey all,

First post here -- getting a BSOD on a newly imaged Win 7 64-bit box. .dmp file is HUGE (>500MB)...I tried to analyze it, but still a newbie and confused.

kd log posted below:

===
C:\dbg>kd -y SRV*c:\symbols*http://msdl.microsoft
com/downloads/symbols -z C:\windows\MEMORY.DMP

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbo
s
Executable search path is:
Page bc40000 too large to be in the dump file.
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Thu Aug 12 10:56:59.809 2010 (UTC - 5:00)
System Uptime: 0 days 19:57:52.038
Page bc40000 too large to be in the dump file.
Loading Kernel Symbols
Page bc40000 too large to be in the dump file.
Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc4029d too large to be in the dump file.
.Missing image name, possible paged-out or corrupt data.
.Unable to read KLDR_DATA_TABLE_ENTRY at 2ea9d85a`bb65a3d4 - NTSTATUS 0xC000014


Image path too long, possible corrupt data.
Loading unloaded module list
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c8a8b6}

Probably caused by : Unknown_Image ( nt!KeSetEvent+226 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

===

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: fffff80002c8a8b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 0000000000000000

CURRENT_IRQL: 0

FAULTING_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 0000000000000000 to 000007fefcdd10f4

STACK_TEXT:
00000000`017cebe0 00000000`00000000 : 00000000`00000000 00000000`00000000 000000
00`00000000 00000000`00000000 : 0x7fe`fcdd10f4


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]

SYMBOL_NAME: nt!KeSetEvent+226

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: INVALID_KERNEL_CONTEXT

MODULE_NAME: Unknown_Module

Followup: MachineOwner

===

Memory/CPU maybe? Or maybe my dump is bad?

Thanks for any ideas!

My System SpecsSystem Spec
.

12 Aug 2010   #2

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by reggiet View Post
Hey all,

First post here -- getting a BSOD on a newly imaged Win 7 64-bit box. .dmp file is HUGE (>500MB)...I tried to analyze it, but still a newbie and confused.

kd log posted below:


Code:
===
C:\dbg>kd -y SRV*c:\symbols*http://msdl.microsoft
com/downloads/symbols -z C:\windows\MEMORY.DMP

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbo
s
Executable search path is:
Page bc40000 too large to be in the dump file.
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Thu Aug 12 10:56:59.809 2010 (UTC - 5:00)
System Uptime: 0 days 19:57:52.038
Page bc40000 too large to be in the dump file.
Loading Kernel Symbols
Page bc40000 too large to be in the dump file.
Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc4029d too large to be in the dump file.
.Missing image name, possible paged-out or corrupt data.
.Unable to read KLDR_DATA_TABLE_ENTRY at 2ea9d85a`bb65a3d4 - NTSTATUS 0xC000014


Image path too long, possible corrupt data.
Loading unloaded module list
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c8a8b6}

Probably caused by : Unknown_Image ( nt!KeSetEvent+226 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

===

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: fffff80002c8a8b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000000000000

CURRENT_IRQL:  0

FAULTING_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09          mov     rcx,qword ptr [rcx]

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 000007fefcdd10f4

STACK_TEXT:
00000000`017cebe0 00000000`00000000 : 00000000`00000000 00000000`00000000 000000
00`00000000 00000000`00000000 : 0x7fe`fcdd10f4


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09          mov     rcx,qword ptr [rcx]

SYMBOL_NAME:  nt!KeSetEvent+226

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  INVALID_KERNEL_CONTEXT

MODULE_NAME: Unknown_Module

Followup: MachineOwner

===
Memory/CPU maybe? Or maybe my dump is bad?

Thanks for any ideas!
First you should look for the "minidump" in c:\windows\minidump.

You can also search for *.DMP

You shoul also check the system control panel to insure it is configured for "kernel dump" (see attache screenshot)

Let us know if you need more help

Ken
My System SpecsSystem Spec
12 Aug 2010   #3

Windows 7 Ultimate 32 bit
 
 

Stop error C2 - Usual causes: Device driver, ?Memory

Your latest dump shows Symantec/Norton still installed and the drivers are obsolete. If you have not unistalled it completely, do so using this tool>Info > Tool

The dump file does not point to a specific cause. Try updating these drivers:
Quote:
AtiPcie.sys Tue May 05 11:00:22 2009
ccHPx64.sys Fri Jun 19 19:28:39 2009
gdrv.sys Thu Mar 12 23:22:29 2009
mcdbus.sys Tue Feb 24 05:34:07 2009
PxHlpa64.sys Tue Jun 23 19:16:35 2009
SRTSPX64.SYS Mon Jun 22 22:47:54 2009
SYMEFA64.SYS Tue Jun 23 17:52:39 2009
SYMEVENT64x86.SYS Wed Jun 24 16:19:12 2009
SYMFW.SYS Mon Jul 06 20:29:22 2009
SymIMv.sys Mon Jun 22 19:11:56 2009
SYMNDISV.SYS Mon Jul 06 20:33:26 2009
SYMTDI.SYS Mon Jul 06 20:28:48 2009
Outdated drivers can and do cause crashes. If you need help updating these drivers, please post.
Quote:
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Once you have updated these drivers, run your system and let's see what happens. If you get another BSOD, please upload it.
My System SpecsSystem Spec
.


Reply

 pretty new machine BSOD




Thread Tools



Similar help and support threads for2: pretty new machine BSOD
Thread Forum
This was a pretty cool car Chillout Room
Various BSOD while doing pretty much anything, mainly memory related BSOD Help and Support
BSOD while doing pretty much anything moderately intensive BSOD Help and Support
Solved BSOD while playing pretty much any game, 0x000000c4 BSOD Help and Support
BSOD at pretty much all times. BSOD Help and Support
BSOD'ing pretty randomly BSOD Help and Support
My Temp folder is pretty big General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:24 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33