BSOD, please help

ecksdee · 12 Sep 2010

I'm getting a BSOD. Help is very much appreciated. Thanks in advance.

- x64
- originally XP on system
- Full retail

- Age of system 3-4 years old
- Age of OS installation around 3 months

zigzag3143 · 13 Sep 2010

ecksdee said:

I'm getting a BSOD. Help is very much appreciated. Thanks in advance.

- x64
- originally XP on system
- Full retail

- Age of system 3-4 years old
- Age of OS installation around 3 months

All of these either directly or indirectly point to memory corruption. I suspect it was caused by these two drivers

ASACPI.sys Sun Mar 27 22:30:36 2005

The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).

Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
[/quote]
You can use MagicDisc as an alternative.

Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

Suspect drivers

Code:

ACPI.sys        fffff880`0102f000    fffff880`01086000    0x00057000    0x4a5bc106    7/13/2009 19:19:34                        
sptd.sys        fffff880`010b6000    fffff880`011dc000    0x00126000    0x4ad24632    10/11/2009 16:55:14

Analysis

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\072910-18673-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c4f000 PsLoadedModuleList = 0xfffff800`02e8ce50
Debug session time: Thu Jul 29 19:15:58.196 2010 (GMT-4)
System Uptime: 0 days 3:35:54.038
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002fbb463, 0, 11}

Probably caused by : memory_corruption ( nt!MmCreateSection+3b7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002fbb463, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000011, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MmCreateSection+3b7
fffff800`02fbb463 488b4010        mov     rax,qword ptr [rax+10h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000011

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef70e0
 0000000000000011 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88007d2d158 -- (.exr 0xfffff88007d2d158)
ExceptionAddress: fffff80002fbb463 (nt!MmCreateSection+0x00000000000003b7)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000011
Attempt to read from address 0000000000000011

TRAP_FRAME:  fffff88007d2d200 -- (.trap 0xfffff88007d2d200)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000038
rdx=0000000000000088 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fbb463 rsp=fffff88007d2d390 rbp=0000000001000000
 r8=0000000000000208  r9=fffff88007d2d178 r10=fffffa8003320700
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!MmCreateSection+0x3b7:
fffff800`02fbb463 488b4010        mov     rax,qword ptr [rax+10h] ds:00000000`00000011=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cf9929 to fffff80002cbf600

STACK_TEXT:  
fffff880`07d2c988 fffff800`02cf9929 : 00000000`0000001e ffffffff`c0000005 fffff800`02fbb463 00000000`00000000 : nt!KeBugCheckEx
fffff880`07d2c990 fffff800`02cbec42 : fffff880`07d2d158 00000000`0000000c fffff880`07d2d200 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`07d2d020 fffff800`02cbd7ba : 00000000`00000000 00000000`0000000c 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`07d2d200 fffff800`02fbb463 : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`07d2d390 fffff800`02fb0b83 : fffff880`07d2d5f0 00000000`00000000 fffff880`07d2d698 fffffa80`03c65628 : nt!MmCreateSection+0x3b7
fffff880`07d2d5a0 fffff800`0311d0e3 : 00000000`00000000 fffff8a0`036029f0 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x162
fffff880`07d2d620 fffff800`0311d671 : 00000000`00000000 fffff8a0`036029f0 fffffa80`056f78c0 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`07d2d710 fffff800`0312578e : fffff8a0`00000000 fffff8a0`0000002e fffff8a0`000000dc 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x121
fffff880`07d2d810 fffff800`03126327 : 00000000`00000000 fffff880`07d2dca0 fffff880`07d2da08 fffff8a0`00f21060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`07d2d960 fffff800`031328fe : fffff880`07d2da08 fffff880`07d2da01 fffffa80`0550afe0 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`07d2d9d0 fffff800`0313702e : 00000000`00000000 00000000`02d7f890 00000000`0000004f 00000000`0a858001 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`07d2dab0 fffff800`02cbe853 : fffffa80`05696060 00000000`00000000 fffffa80`03650c01 00000000`0a13bbf0 : nt!NtSetSystemInformation+0xb91
fffff880`07d2dc20 00000000`776d15aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02d7f868 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776d15aa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCreateSection+3b7
fffff800`02fbb463 488b4010        mov     rax,qword ptr [rax+10h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MmCreateSection+3b7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_nt!MmCreateSection+3b7

BUCKET_ID:  X64_0x1E_nt!MmCreateSection+3b7

Followup: MachineOwner
---------