Multiple BSOD - when using firefox

Jonathan_King · 05 Sep 2010

Two BSODs occurred while the Microsoft Malware Engine was running, i.e. MSE or Defender.

Both of those programs are known to be stable, so we must look at other causes. Network adapter drivers?

Go ahead and enable driver verifier: Driver Verifier - Enable and Disable

...Summary of the Dumps:

Code:


Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Sep  5 07:06:16.912 2010 (UTC - 4:00)
System Uptime: 0 days 0:01:17.911
BugCheck 1A, {41790, fffffa8004b51bd0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Sep  5 07:02:32.676 2010 (UTC - 4:00)
System Uptime: 0 days 0:03:36.675
BugCheck 1A, {41790, fffffa8003f800a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sat Sep  4 21:52:09.135 2010 (UTC - 4:00)
System Uptime: 1 days 7:44:05.135
BugCheck 1A, {41790, fffffa8004c6fda0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

00sully · 05 Sep 2010

Hi Jonathan,

I installed the latest realtek network drivers as advised earlier so they should be ok right? I have enabled driver verifier - what should I now watch for with this installed?

Thanks

00sully · 06 Sep 2010

And I'm back! I can no longer run the steps required in https://www.sevenforums.com/crashes-d...tructions.html as this results in a BSOD every time with the error message

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION

This even crashes when I execute it in safe mode. I also am unable to decode the information contained in verifier.exe - as in I cannot see any errors in global counters. I have read that this specific error is indeed a driver writing to the pool - any more suggestions before I go insane??

Thanks.

Jonathan_King · 06 Sep 2010

Go ahead and upload the dump files then: https://www.sevenforums.com/tutorials...en-forums.html

00sully · 07 Sep 2010

ok I managed to get the report to run, I ran memtest again and started to receive errors again so I removed 2 sticks am now running 2 x 2gb sticks in slot 0 and 1 and ran memtest for 8 hours 29 tests no errors. Could something be corrupting my ram as the last time I ran memtest on all stick I had no errors!?

Anywho, here is the latest dump attached.

Thanks again :)

JMH · 07 Sep 2010

00sully said:

ok I managed to get the report to run, I ran memtest again and started to receive errors again so I removed 2 sticks am now running 2 x 2gb sticks in slot 0 and 1 and ran memtest for 8 hours 29 tests no errors. Could something be corrupting my ram as the last time I ran memtest on all stick I had no errors!?

Anywho, here is the latest dump attached.

Thanks again :)

Hi 00sully and welcome

These 20 dmps all point to memory management. Something is probably corrupting the memory stack. I have noticed several drivers that are known to do that. Specifically I noticed you had updated your ASACPI.sys file to the 2009 version. You might want to see if a re-install might not help.

It may be the memory, or it may be the driver - the only way to be sure is to check both.

Here is what I would suggest

1-run memtest again. One memory stick at a time. When you find a good one use it to test the motherboard slots, one at a time.

Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

You can narrow it further if you test one ram stick at a time. When you find one that is good try each mobo slot. That way you can find if it is ram or mobo.

2-run a system file check to verify and repair your system files.

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

read here for more information SFC /SCANNOW Command - System File Checker

Let us know the results from the report at the end.

Jan

Code:

090610-30076-01.dmp 9/6/2010 23:07:50 KMODE_EXCEPTION_NOT_HANDLED 0x0000001e ffffffff`c0000005 fffff800`02cb5524 00000000`00000000 ffffffff`ffffffff ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-30076-01.dmp 8 15 7600 082210-33415-01.dmp 8/22/2010 15:30:58 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`052586d0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082210-33415-01.dmp 8 15 7600 082210-43399-01.dmp 8/22/2010 21:45:14 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`05198fa0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082210-43399-01.dmp 8 15 7600 082310-20701-01.dmp 8/23/2010 20:17:16 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`046595d0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082310-20701-01.dmp 8 15 7600 082310-19718-01.dmp 8/23/2010 22:49:46 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`046592a0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082310-19718-01.dmp 8 15 7600 082310-21075-01.dmp 8/23/2010 22:53:40 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`046592a0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082310-21075-01.dmp 8 15 7600 083110-54849-01.dmp 8/31/2010 20:39:46 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`0522b9a0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\083110-54849-01.dmp 8 15 7600 090310-50591-01.dmp 9/3/2010 00:18:48 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`04c6fda0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090310-50591-01.dmp 8 15 7600 090510-33431-01.dmp 9/5/2010 02:54:16 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`04c6fda0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090510-33431-01.dmp 8 15 7600 090510-23306-01.dmp 9/5/2010 12:05:26 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`03f800a0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090510-23306-01.dmp 8 15 7600 090510-34554-01.dmp 9/5/2010 12:08:32 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`04b51bd0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090510-34554-01.dmp 8 15 7600 090610-35037-01.dmp 9/6/2010 21:21:36 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`0403e2d0 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-35037-01.dmp 8 15 7600 082210-26785-01.dmp 8/22/2010 21:08:40 NTFS_FILE_SYSTEM 0x00000024 00000000`001904fb fffff880`03b3b168 fffff880`03b3a9d0 fffff800`01e577b8 Ntfs.sys Ntfs.sys+213d8 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082210-26785-01.dmp 8 15 7600 090610-25646-01.dmp 9/6/2010 21:48:32 NTFS_FILE_SYSTEM 0x00000024 00000000`001904fb fffff880`058cae98 fffff880`058ca700 fffff800`01e81e2e Ntfs.sys Ntfs.sys+213d8 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-25646-01.dmp 8 15 7600 090610-31746-01.dmp 9/6/2010 22:23:04 NTFS_FILE_SYSTEM 0x00000024 00000000`000c08a2 00000000`00000000 00000000`00000000 00000000`00000000 Ntfs.sys Ntfs.sys+1e95 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-31746-01.dmp 8 15 7600 090610-23088-01.dmp 9/6/2010 21:33:54 SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0x000000c1 fffff980`251acfc0 fffff980`251acc7f 00000000`004d0034 00000000`00000032 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-23088-01.dmp 8 15 7600 090610-34538-01.dmp 9/6/2010 21:44:14 SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0x000000c1 fffff980`2a858f10 fffff980`2a858c7f 00000000`002f00f0 00000000`00000032 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-34538-01.dmp 8 15 7600 090610-29390-01.dmp 9/6/2010 22:35:46 SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0x000000c1 fffff980`251beee0 fffff980`251bebff 00000000`00f10118 00000000`00000032 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-29390-01.dmp 8 15 7600 090610-34335-01.dmp 9/6/2010 22:38:58 SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0x000000c1 fffff980`143aec10 fffff980`143ae2ff 00000000`007f03e8 00000000`00000032 ntoskrnl.exe ntoskrnl.exe+70740 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-34335-01.dmp 8 15 7600 090610-30248-01.dmp 9/6/2010 22:43:26 SYSTEM_SERVICE_EXCEPTION 0x0000003b 00000000`c0000005 fffff960`001c6365 fffff880`04dbcd90 00000000`00000000 win32k.sys win32k.sys+156365 x64 C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\090610-30248-01.dmp 8 15 7600

Analysis

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\082210-26785-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols *http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`01e1d000 PsLoadedModuleList = 0xfffff800`0205ae50 Debug session time: Sun Aug 22 15:59:09.383 2010 (GMT-4) System Uptime: 0 days 0:03:20.883 Loading Kernel Symbols ............................................................... ................................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff88003b3b168, fffff88003b3a9d0, fffff80001e577b8} Probably caused by : Ntfs.sys ( Ntfs!NtfsSetRenameInfo+7d8 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88003b3b168 Arg3: fffff88003b3a9d0 Arg4: fffff80001e577b8 Debugging Details: ------------------ EXCEPTION_RECORD: fffff88003b3b168 -- (.exr 0xfffff88003b3b168) ExceptionAddress: fffff80001e577b8 (nt!FsRtlCompareNodeAndKey+0x0000000000000004) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88003b3a9d0 -- (.cxr 0xfffff88003b3a9d0) rax=000000000000000f rbx=fffffa8008277238 rcx=fbfff8a001d88780 rdx=0004000000030e5d rsi=fbfff8a001d88780 rdi=0000000000000001 rip=fffff80001e577b8 rsp=fffff88003b3b3a0 rbp=fffff88003b3b9e0 r8=fffff88003b3b548 r9=0000000000213d74 r10=fffff8a007fb1a78 r11=fffff8a007fb1a8a r12=fbfff8a001d88780 r13=fffff88003b3b548 r14=0004000000030e5d r15=fffff88003b3b6b0 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!FsRtlCompareNodeAndKey+0x4: fffff800`01e577b8 48395130 cmp qword ptr [rcx+30h],rdx ds:002b:fbfff8a0`01d887b0=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: wininit.exe CURRENT_IRQL: 1 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800020c50e0 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsSetRenameInfo+7d8 fffff880`012bfa70 403ac7 cmp al,dil FAULTING_IP: nt!FsRtlCompareNodeAndKey+4 fffff800`01e577b8 48395130 cmp qword ptr [rcx+30h],rdx BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff800021a1e8b to fffff80001e577b8 STACK_TEXT: fffff880`03b3b3a0 fffff800`021a1e8b : fffff880`00000301 fffffa80`08277238 fffff880`03b3b9e0 00000000`000007ff : nt!FsRtlCompareNodeAndKey+0x4 fffff880`03b3b3e0 fffff880`012bfa70 : fffffa80`08277238 fffff8a0`07d9ab40 00000000`00000000 00000000`000007ff : nt!FsRtlFindInTunnelCache+0x9f fffff880`03b3b450 fffff880`012d3695 : fffff8a0`081e96d0 fffff8a0`00000000 00000000`0000000a 00000000`00000701 : Ntfs!NtfsSetRenameInfo+0x7d8 fffff880`03b3b840 fffff880`01242e0c : fffffa80`07099840 fffffa80`0721c550 fffff880`03b3b901 fffff880`03b3b900 : Ntfs!NtfsCommonSetInformation+0x795 fffff880`03b3b920 fffff880`010f823f : fffffa80`0721c8f0 fffffa80`0721c550 fffffa80`07099840 fffff880`03b3b948 : Ntfs!NtfsFsdSetInformation+0x11c fffff880`03b3b9a0 fffff880`010f66df : fffffa80`07d608e0 fffffa80`0721c550 fffffa80`07d60800 fffffa80`0721c550 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`03b3ba30 fffff800`0217062d : 00000000`000000c6 fffff880`03b3bca0 00000000`00000000 fffffa80`07232260 : fltmgr!FltpDispatch+0xcf fffff880`03b3ba90 fffff800`01e8c993 : 00000000`0000018c fffffa80`087b0b60 00000000`000ee738 fffff800`000000c6 : nt!NtSetInformationFile+0x909 fffff880`03b3bbb0 00000000`7743ffca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`000ee718 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7743ffca SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: Ntfs!NtfsSetRenameInfo+7d8 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f STACK_COMMAND: .cxr 0xfffff88003b3a9d0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsSetRenameInfo+7d8 BUCKET_ID: X64_0x24_Ntfs!NtfsSetRenameInfo+7d8 Followup: MachineOwner ---------

Jonathan_King · 07 Sep 2010

In addition to Jan's advice, go ahead and install these ATI drivers: https://a248.e.akamai.net/f/674/9206...win7_64_dd.exe

Be sure to completely remove all ATI drivers first, including the Catalyst Control Center.

Do complete the RAM test, as Verifier didn't flag a 3rd-party driver. Here is a tutorial: RAM - Test with Memtest86+

Complete a disk check as well. Open an elevated command prompt and enter chkdsk /r.

...Summary of the Dumps:

Code:


Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:36:45.823 2010 (UTC - 4:00)
System Uptime: 0 days 0:01:41.822
BugCheck C1, {fffff980143aec10, fffff980143ae2ff, 7f03e8, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:20:37.539 2010 (UTC - 4:00)
System Uptime: 0 days 0:32:34.554
BugCheck 24, {c08a2, 0, 0, 0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0x24
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:42:11.898 2010 (UTC - 4:00)
System Uptime: 0 days 0:08:43.913
BugCheck C1, {fffff9802a858f10, fffff9802a858c7f, 2f00f0, 32}
Probably caused by : win32k.sys ( win32k!xxxMsgWaitForMultipleObjects+108 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:19:30.955 2010 (UTC - 4:00)
System Uptime: 0 days 2:05:43.859
BugCheck 1A, {41790, fffffa800403e2d0, ffff, 0}
Probably caused by : win32k.sys ( win32k!EngUnmapFontFileFD+8a )
BUGCHECK_STR:  0x1a_41790
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

zigzag3143 · 07 Sep 2010

Just a drive by but....

In looking at these DMP's I didt find any evidece of video problems. I did see that the most freequent Bug check was 1A and that the cause in those was probably (as listed) MsMpEng.exe. Either Defender or MSE.

I also noticed that in those the system uptime was short (2-5 mins), and in the others much longer.

I dont know if anyone asked him if he is running either Defender (most likely) or MSE? Could remove to test?

Just a thought

Ken

Bugchecks

Code:

Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:41:22.004 2010 (GMT-4)
System Uptime: 0 days 0:03:05.504
BugCheck 3B, {c0000005, fffff960001c6365, fffff88004dbcd90, 0}
Probably caused by : win32k.sys ( win32k!SetOrClrWF+69 )
BUGCHECK_STR:  0x3B
PROCESS_NAME:  explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:36:45.823 2010 (GMT-4)
System Uptime: 0 days 0:01:41.822
BugCheck C1, {fffff980143aec10, fffff980143ae2ff, 7f03e8, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:32:35.753 2010 (GMT-4)
System Uptime: 0 days 0:10:14.768
BugCheck C1, {fffff980251beee0, fffff980251bebff, f10118, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 17:20:37.539 2010 (GMT-4)
System Uptime: 0 days 0:32:34.554
BugCheck 24, {c08a2, 0, 0, 0}
Probably caused by : Ntfs.sys ( Ntfs!NtfsPagingFileIo+155 )
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR:  0x24
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:46:35.912 2010 (GMT-4)
System Uptime: 0 days 0:03:02.412
BugCheck 24, {1904fb, fffff880058cae98, fffff880058ca700, fffff80001e81e2e}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCleanup+1fd )
PROCESS_NAME:  iexplore.exe
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:42:11.898 2010 (GMT-4)
System Uptime: 0 days 0:08:43.913
BugCheck C1, {fffff9802a858f10, fffff9802a858c7f, 2f00f0, 32}
Probably caused by : win32k.sys ( win32k!xxxMsgWaitForMultipleObjects+108 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:31:59.404 2010 (GMT-4)
System Uptime: 0 days 0:08:32.419
BugCheck C1, {fffff980251acfc0, fffff980251acc7f, 4d0034, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  firefox.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Sep  6 16:19:30.955 2010 (GMT-4)
System Uptime: 0 days 2:05:43.859
BugCheck 1A, {41790, fffffa800403e2d0, ffff, 0}
Probably caused by : win32k.sys ( win32k!EngUnmapFontFileFD+8a )
BUGCHECK_STR:  0x1a_41790
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  csrss.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Sep  5 07:06:16.912 2010 (GMT-4)
System Uptime: 0 days 0:01:17.911
BugCheck 1A, {41790, fffffa8004b51bd0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Sep  5 07:02:32.676 2010 (GMT-4)
System Uptime: 0 days 0:03:36.675
BugCheck 1A, {41790, fffffa8003f800a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sat Sep  4 21:52:09.135 2010 (GMT-4)
System Uptime: 1 days 7:44:05.135
BugCheck 1A, {41790, fffffa8004c6fda0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  svchost.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Thu Sep  2 19:15:23.036 2010 (GMT-4)
System Uptime: 0 days 4:35:00.035
BugCheck 1A, {41790, fffffa8004c6fda0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  wuauclt.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Tue Aug 31 15:37:04.558 2010 (GMT-4)
System Uptime: 0 days 0:49:58.588
BugCheck 1A, {41790, fffffa800522b9a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Aug 23 17:51:40.365 2010 (GMT-4)
System Uptime: 0 days 0:02:24.395
BugCheck 1A, {41790, fffffa80046592a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Aug 23 17:47:30.571 2010 (GMT-4)
System Uptime: 0 days 0:05:37.601
BugCheck 1A, {41790, fffffa80046592a0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339c8 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  plugin-contain
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Mon Aug 23 15:14:20.265 2010 (GMT-4)
System Uptime: 0 days 0:44:53.295
BugCheck 1A, {41790, fffffa80046595d0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Aug 22 16:43:06.102 2010 (GMT-4)
System Uptime: 0 days 0:35:00.132
BugCheck 1A, {41790, fffffa8005198fa0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  firefox.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Aug 22 15:59:09.383 2010 (GMT-4)
System Uptime: 0 days 0:03:20.883
BugCheck 24, {1904fb, fffff88003b3b168, fffff88003b3a9d0, fffff80001e577b8}
Probably caused by : Ntfs.sys ( Ntfs!NtfsSetRenameInfo+7d8 )
PROCESS_NAME:  wininit.exe
BUGCHECK_STR:  0x24
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Sun Aug 22 10:29:10.319 2010 (GMT-4)
System Uptime: 0 days 0:00:59.238
BugCheck 1A, {41790, fffffa80052586d0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
BUGCHECK_STR:  0x1a_41790
PROCESS_NAME:  MsMpEng.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨

Bugcheck list

Code:

Bugcheck code 0000001E
Bugcheck code 0000003B
Bugcheck code 000000C1
Bugcheck code 000000C1
Bugcheck code 00000024
Bugcheck code 00000024
Bugcheck code 000000C1
Bugcheck code 000000C1
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 0000001A
Bugcheck code 00000024
Bugcheck code 0000001A

System Uptime

Code:

System Uptime: 0 days 0:01:17.469
System Uptime: 0 days 0:03:05.504
System Uptime: 0 days 0:01:41.822
System Uptime: 0 days 0:10:14.768
System Uptime: 0 days 0:32:34.554
System Uptime: 0 days 0:03:02.412
System Uptime: 0 days 0:08:43.913
System Uptime: 0 days 0:08:32.419
System Uptime: 0 days 2:05:43.859
System Uptime: 0 days 0:01:17.911
System Uptime: 0 days 0:03:36.675
System Uptime: 1 days 7:44:05.135
System Uptime: 0 days 4:35:00.035
System Uptime: 0 days 0:49:58.588
System Uptime: 0 days 0:02:24.395
System Uptime: 0 days 0:05:37.601
System Uptime: 0 days 0:44:53.295
System Uptime: 0 days 0:35:00.132
System Uptime: 0 days 0:03:20.883
System Uptime: 0 days 0:00:59.238

00sully · 08 Sep 2010

Hi again guys and thanks again!!

ok I was running MSE - now uninstalled. still getting bsods without it though I am now up for 20+ minutes where as an hour ago I was crashing every 5 minutes.

chkdsk couldn't even complete without crash. Eventually ran it and it completed ok.

ram test completed on all sticks no errors. HOWEVER, after taking out the ram I notice on it it is marked "1600mhz 1.65v"

now, in the bios, it was auto detecting this at 1333mhz and voltage was 1.55. I have manually set this to what it actually is printed on the sticks and haven't had a bsod yet (whooo hooo 20 minutes!!!) Could this be contributing to the bsods??

I have the latest drivers for vid card.

Media center tends to crash a lot - I have this error from it

An unhandled win32 exception occurred in mcupdate.exe [3736]. Just-In-Time debugging this exception failed with the following error: No installed debugger has Just-In-Time debugging enabled. In Visual Studio, Just-In-Time debugging can be enabled from Tools/Options/Debugging/Just-In-Time.

I don't know if thats relevant or not.

SFC /SCANNOW returns all ok

Attaching latest dumps if you want to see what happened over the last few hours - really dishearting at this stage.

Thanks as always, my fingers are crossed it was the RAM frequency and voltage!!

Jonathan_King · 08 Sep 2010

Keep in mind 1600 MHz is the maximum speed the RAM can operate at. Provided all sticks are running the same speed, it should run at 1333 MHz no problem, albeit a little slower.

More likely, it was the voltage that may have done something.

One of the dumps blamed your ATI drivers; be sure to install these ones: https://a248.e.akamai.net/f/674/9206...win7_64_dd.exe

...Summary of the Dumps:

Code:


Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Sep  8 15:42:29.489 2010 (UTC - 4:00)
System Uptime: 0 days 0:14:36.520
BugCheck C9, {226, fffff88003da2b0c, fffff9800913ae10, 0}
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+3b0c )
BUGCHECK_STR:  0xc9_226
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Sep  8 14:55:49.891 2010 (UTC - 4:00)
System Uptime: 0 days 0:39:25.921
BugCheck 19, {3, fffff8a009c0b360, fbfff8a009c0b360, fffff8a009c0b360}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+15e5 )
BUGCHECK_STR:  0x19_3
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Debug session time: Wed Sep  8 14:06:54.930 2010 (UTC - 4:00)
System Uptime: 0 days 0:27:13.961
BugCheck C1, {fffff980214dcc10, fffff980214dc1bf, 2303e8, 32}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )
BUGCHECK_STR:  0xC1_32
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨