Hi Remi
Your dumps have error code:
- 0x5 = This generally indicates that the thread was attached to a process in a situation where that is not allowed.
- 0xD1 = This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
A hardware device, its driver, or related software might have caused that error.
Let's begin with uninstall Kaspersky and replace it with MSE. (because MSE is known running better in windows kernel)
Have you run memtest at least 7 passes? (with different slot). RAM - Test with Memtest86+
Because I see memory access fault in the stack :
Code:
nt!KiPageFault+0x14a:
fffff800`028bb80a 85c0 test eax,eax
fffff800`028bb80c 0f8d0e010000 jge nt!KiPageFault+0x260 (fffff800`028bb920)
fffff800`028bb812 4c8d4d80 lea r9,[rbp-80h]
fffff800`028bb816 448a85f0000000 mov r8b,byte ptr [rbp+0F0h]
fffff800`028bb81d 4180e001 and r8b,1
fffff800`028bb821 488b5550 mov rdx,qword ptr [rbp+50h]
fffff800`028bb825 0fb64daa movzx ecx,byte ptr [rbp-56h]
fffff800`028bb829 e8d2bb0100 call nt!MmAccessFault (fffff800`028d7400)
The possibility =
- You have bad RAM
- Bad slot motherboard
- 3rd driver causing the fault
Enable driver verifier and use the windows as usual.
If there are any driver violation , your windows will crash and attach the new dumps here.
Driver Verifier - Enable and Disable
Logs
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffffa802612c300, 2, 1, fffff88004614338}
Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_Core_iMapTransfer+54 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa802612c300, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88004614338, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac50e0
fffffa802612c300
CURRENT_IRQL: 2
FAULTING_IP:
USBPORT!USBPORT_Core_iMapTransfer+54
fffff880`04614338 c7016d617030 mov dword ptr [rcx],3070616Dh
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: Wow.exe
TRAP_FRAME: fffff880009b0c60 -- (.trap 0xfffff880009b0c60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000eb29c518 rbx=0000000000000000 rcx=fffffa802612c300
rdx=00000000eb29c519 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88004614338 rsp=fffff880009b0df0 rbp=0000000000000000
r8=fffffa80050a01a0 r9=fffffa8004f72d20 r10=fffffa80050a01a0
r11=fffffa80050a01a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
USBPORT!USBPORT_Core_iMapTransfer+0x54:
fffff880`04614338 c7016d617030 mov dword ptr [rcx],3070616Dh ds:fffffa80`2612c300=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000288e469 to fffff8000288ef00
STACK_TEXT:
fffff880`009b0b18 fffff800`0288e469 : 00000000`0000000a fffffa80`2612c300 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009b0b20 fffff800`0288d0e0 : 00000000`00000000 fffffa80`050a0050 fffffa80`04f73e9b 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009b0c60 fffff880`04614338 : fffff880`009b0e48 fffffa80`050a01a0 fffffa80`050a0050 fffff880`0461154a : nt!KiPageFault+0x260
fffff880`009b0df0 fffff880`04611e86 : fffffa80`050a0050 fffffa80`050a0050 fffffa80`03f8a510 fffffa80`050a01a0 : USBPORT!USBPORT_Core_iMapTransfer+0x54
fffff880`009b0e70 fffff880`04602f89 : fffffa80`050a0050 00000000`00000000 fffffa80`050a0d02 fffffa80`050a0d20 : USBPORT!USBPORT_Core_UsbMapDpc_Worker+0x296
fffff880`009b0ed0 fffff800`0289a5dc : fffff880`035d3180 fffffa80`050a0d20 fffffa80`050a0d38 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff880`009b0f00 fffff800`02895065 : 000004d8`00000000 fffffa80`046e6b60 00000000`00000000 fffff880`04602db0 : nt!KiRetireDpcList+0x1bc
fffff880`009b0fb0 fffff800`02894e7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5
fffff880`12cd0a50 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
USBPORT!USBPORT_Core_iMapTransfer+54
fffff880`04614338 c7016d617030 mov dword ptr [rcx],3070616Dh
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: USBPORT!USBPORT_Core_iMapTransfer+54
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: USBPORT
IMAGE_NAME: USBPORT.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcc07
FAILURE_BUCKET_ID: X64_0xD1_USBPORT!USBPORT_Core_iMapTransfer+54
BUCKET_ID: X64_0xD1_USBPORT!USBPORT_Core_iMapTransfer+54
Followup: MachineOwner
---------