New
#1
pretty new machine BSOD
Hey all,
First post here -- getting a BSOD on a newly imaged Win 7 64-bit box. .dmp file is HUGE (>500MB)...I tried to analyze it, but still a newbie and confused.
kd log posted below:
===
C:\dbg>kd -y SRV*c:\symbols*http://msdl.microsoft
com/downloads/symbols -z C:\windows\MEMORY.DMP
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbo
s
Executable search path is:
Page bc40000 too large to be in the dump file.
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Thu Aug 12 10:56:59.809 2010 (UTC - 5:00)
System Uptime: 0 days 19:57:52.038
Page bc40000 too large to be in the dump file.
Loading Kernel Symbols
Page bc40000 too large to be in the dump file.
Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc4029d too large to be in the dump file.
.Missing image name, possible paged-out or corrupt data.
.Unable to read KLDR_DATA_TABLE_ENTRY at 2ea9d85a`bb65a3d4 - NTSTATUS 0xC000014
Image path too long, possible corrupt data.
Loading unloaded module list
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, fffff80002c8a8b6}
Probably caused by : Unknown_Image ( nt!KeSetEvent+226 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
===
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: fffff80002c8a8b6, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 0000000000000000
CURRENT_IRQL: 0
FAULTING_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 0000000000000000 to 000007fefcdd10f4
STACK_TEXT:
00000000`017cebe0 00000000`00000000 : 00000000`00000000 00000000`00000000 000000
00`00000000 00000000`00000000 : 0x7fe`fcdd10f4
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]
SYMBOL_NAME: nt!KeSetEvent+226
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: INVALID_KERNEL_CONTEXT
MODULE_NAME: Unknown_Module
Followup: MachineOwner
===
Memory/CPU maybe? Or maybe my dump is bad?
Thanks for any ideas!