System_Service_Exception occurs once in 2 days while starting

veeraraghvan · 31 Aug 2010

Hi,
Can you please help me resolving this System_Service_exception issue that i have been facing for atleast 3months now. This occurs more often when i start my Laptop.

Here is the dmp files available for any assistance. Thanks a lot in advance.

RapidShare: 1-CLICK Web hosting - Easy Filehosting

Veera

CarlTR6 · 31 Aug 2010

Hi Veera and welcome to the forum.

I am going to ask the moderators to start a new thread for your problem. It is really confusing to try to work with two problems in the same thread. They will begin a new thread for you.

Please read these threads in the links below and post back in the new thread. We will be glad to help you.

[1 - Novice] How to ask for help with a BSOD problem

https://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

CarlTR6 · 31 Aug 2010

I looked at your five most recent dumps. Four of these are error code #b and one shows error code 135.

Error code 3B, SYSTEM_SERVICE_EXCEPTION - usual caused by system service, Device driver, graphics driver, ?memory.

Error code 135, REGISTRY_FILTER_DRIVER_EXCEPTION.

All of the dumps point to memory corruption. I suspect there may be other issues as well.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidumps.zip\Minidumps\083110-22666-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e5a000 PsLoadedModuleList = 0xfffff800`03097e50
Debug session time: Mon Aug 30 22:43:07.252 2010 (GMT-4)
System Uptime: 0 days 0:01:48.250
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002e8c109, fffff88008a50f40, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiActivateWaiterQueue+69 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002e8c109, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88008a50f40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiActivateWaiterQueue+69
fffff800`02e8c109 488b0f          mov     rcx,qword ptr [rdi]

CONTEXT:  fffff88008a50f40 -- (.cxr 0xfffff88008a50f40)
rax=00000000000000ff rbx=fffffa80071ddeef rcx=fffffa80071ddeef
rdx=fffffa80071ddf20 rsi=fffffa80071ddf07 rdi=fffa80071ddf08ff
rip=fffff80002e8c109 rsp=fffff88008a51910 rbp=fffffa80071ddef7
 r8=0000000000000000  r9=0000000000000000 r10=fffffa80036d9c90
r11=00000000000f00ff r12=0000000000000000 r13=fffff880009e7180
r14=0000000000000001 r15=0000000000000001
iopl=0         nv up ei ng nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
nt!KiActivateWaiterQueue+0x69:
fffff800`02e8c109 488b0f          mov     rcx,qword ptr [rdi] ds:002b:fffa8007`1ddf08ff=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  quickset.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002e8c109

STACK_TEXT:  
fffff880`08a51910 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiActivateWaiterQueue+0x69


FOLLOWUP_IP: 
nt!KiActivateWaiterQueue+69
fffff800`02e8c109 488b0f          mov     rcx,qword ptr [rdi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiActivateWaiterQueue+69

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88008a50f40 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiActivateWaiterQueue+69

BUCKET_ID:  X64_0x3B_nt!KiActivateWaiterQueue+69

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidumps.zip\Minidumps\082310-18657-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`0305ce50
Debug session time: Mon Aug 23 03:42:07.211 2010 (GMT-4)
System Uptime: 0 days 0:01:03.208
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 135, {ffffffffc0000005, fffff8800846c030, fffff8800116b450, fffff8a00023f7d0}

Unable to load image \SystemRoot\system32\drivers\mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : mfehidk.sys ( mfehidk+16522 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (135)
Unknown bugcheck description
Arguments:
Arg1: ffffffffc0000005
Arg2: fffff8800846c030
Arg3: fffff8800116b450
Arg4: fffff8a00023f7d0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x135

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800846c7c8 -- (.exr 0xfffff8800846c7c8)
ExceptionAddress: fffff80002fc390d (nt!ExAllocatePoolWithTag+0x000000000000053d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800846c870 -- (.trap 0xfffff8800846c870)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffa8006b67e9000 rbx=0000000000000000 rcx=fffffa800773e2df
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fc390d rsp=fffff8800846ca00 rbp=fffff8000301e880
 r8=0000000000000000  r9=fffff8000301eb30 r10=fffff8000301e888
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x53d:
fffff800`02fc390d 48895808        mov     qword ptr [rax+8],rbx ds:0001:fffa8006`b67e9008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003204c24 to fffff80002e8f740

STACK_TEXT:  
fffff880`0846b808 fffff800`03204c24 : 00000000`00000135 ffffffff`c0000005 fffff880`0846c030 fffff880`0116b450 : nt!KeBugCheckEx
fffff880`0846b810 fffff800`03240dbd : fffffa80`0365a280 00000000`00001000 00000000`00000001 00000000`00000000 : nt!CmpFatalFilter+0x24
fffff880`0846b850 fffff800`02ebdd1c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpCallCallBacks+0x556
fffff880`0846b880 fffff800`02eb540d : fffff800`02ffa4ac fffff880`0846cb50 00000000`00000000 fffff800`02e1f000 : nt!_C_specific_handler+0x8c
fffff880`0846b8f0 fffff800`02ebca90 : fffff800`02ffa4ac fffff880`0846b968 fffff880`0846c7c8 fffff800`02e1f000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0846b920 fffff800`02ec99ef : fffff880`0846c7c8 fffff880`0846c030 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
fffff880`0846c000 fffff800`02e8ed82 : fffff880`0846c7c8 fffff800`0301eb30 fffff880`0846c870 00000000`00001000 : nt!KiDispatchException+0x16f
fffff880`0846c690 fffff800`02e8d68a : fffff8a0`03153720 00000000`00000000 00000000`8cc6947a 00000000`00000008 : nt!KiExceptionDispatch+0xc2
fffff880`0846c870 fffff800`02fc390d : 00000000`00000001 00000000`00000001 fffff880`011c0ee0 fffff880`01199700 : nt!KiGeneralProtectionFault+0x10a
fffff880`0846ca00 fffff880`01167522 : 00000000`00000000 fffff880`0846cd80 00000000`00000001 00000000`00000000 : nt!ExAllocatePoolWithTag+0x53d
fffff880`0846caf0 00000000`00000000 : fffff880`0846cd80 00000000`00000001 00000000`00000000 fffff880`0846cd80 : mfehidk+0x16522


STACK_COMMAND:  kb

FOLLOWUP_IP: 
mfehidk+16522
fffff880`01167522 ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  mfehidk+16522

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: mfehidk

IMAGE_NAME:  mfehidk.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bd1d9f4

FAILURE_BUCKET_ID:  X64_0x135_mfehidk+16522

BUCKET_ID:  X64_0x135_mfehidk+16522

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Minidumps.zip\Minidumps\081510-20514-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c03000 PsLoadedModuleList = 0xfffff800`02e40e50
Debug session time: Sun Aug 15 09:49:57.272 2010 (GMT-4)
System Uptime: 0 days 0:19:45.271
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002f3b227, fffff88007d84cc0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspDereferenceQuotaBlock+17 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002f3b227, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88007d84cc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!PspDereferenceQuotaBlock+17
fffff800`02f3b227 f0838108020000ff lock add dword ptr [rcx+208h],0FFFFFFFFh

CONTEXT:  fffff88007d84cc0 -- (.cxr 0xfffff88007d84cc0)
rax=00000000ffffffff rbx=00000000ffffffff rcx=00000000ffffffff
rdx=fffff80002c03000 rsi=0000000000000000 rdi=fffffa80036f8570
rip=fffff80002f3b227 rsp=fffff88007d85690 rbp=fffffa80036939a0
 r8=fffff8a0028c2600  r9=0000000000000000 r10=0000000000000180
r11=fffff88007d85768 r12=0000000000000000 r13=0000000000000000
r14=fffffa80036939a0 r15=0000000000000070
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!PspDereferenceQuotaBlock+0x17:
fffff800`02f3b227 f0838108020000ff lock add dword ptr [rcx+208h],0FFFFFFFFh ds:002b:00000001`00000207=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  sprtcmd.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002f3b227

STACK_TEXT:  
fffff880`07d85690 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PspDereferenceQuotaBlock+0x17


FOLLOWUP_IP: 
nt!PspDereferenceQuotaBlock+17
fffff800`02f3b227 f0838108020000ff lock add dword ptr [rcx+208h],0FFFFFFFFh

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!PspDereferenceQuotaBlock+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88007d84cc0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!PspDereferenceQuotaBlock+17

BUCKET_ID:  X64_0x3B_nt!PspDereferenceQuotaBlock+17

Followup: MachineOwner
---------

Let's begin by testing your RAM. Read the tutorial in the link below and run Memtest86+.

RAM - Test with Memtest86+

Errors will show up on your screen in red. Post back with your results.

Uninstall McAfee using the uninstall tool: Info > Tool. McAfee is none to cause crashes on may Win 7 systems. Download and install Microsoft Security Essentials in its place and make sure Windows Firewall is turned on.

You have some outdated drivers on your system. Generally speaking, outdated drivers can and do cause conflicts, memory corruption and crashes.

Apfiltr.sys Thu Feb 05 05:54:07 2009
BCM42RLY.sys Tue Jul 07 20:34:55 2009
bcmwl664.sys Tue Jul 07 20:45:04 2009
CtClsFlt.sys Mon Jun 15 01:06:41 2009
iaStor.sys Thu Jun 04 21:53:40 2009
igdkmd64.sys Wed Jun 03 14:16:49 2009
PxHlpa64.sys Tue Jun 23 19:16:35 2009
RtsUStor.sys Fri May 08 04:15:18 2009
stwrt64.sys Mon Jun 29 13:52:05 2009
yk62x64.sys Wed May 20 04:14:06 2009

Update as many of these drivers as you can.

How To Find Drivers:

- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

Please ask if you need help with updating drivers.

Jonathan_King · 31 Aug 2010

Looks like McAfee is causing the issue. Please remove it with this tool: http://download.mcafee.com/products/...tches/MCPR.exe

Replace it with MSE: http://www.microsoft.com/security_essentials