Help with BSOD

ollieh · 18 Nov 2010

I spoke too soon. Another crash. I have attached the dump files zip.
Thanks again for your help.

Jonathan_King · 21 Nov 2010

Hello,

All I can see from the software end of things is some older Marvell Yukon NIC drivers:

Code:

yk62x64.sys     Mon Sep 28 04:19:31 2009 (4AC07193)

I suggest you download some newer ones from here: http://extranet.marvell.com/drivers/

If the BSODs persist, could you enable driver verifier?

Driver Verifier - Enable and Disable

...Summary of the dumps

Code:


Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Debug session time: Sat Nov  6 19:47:10.068 2010 (UTC - 5:00)
System Uptime: 1 days 6:33:29.192
Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
BUGCHECK_STR:  0x7f_8
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  wmplayer.exe
FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

ollieh · 22 Nov 2010

I updated the Marvell NIC drivers.

I have also enabled driver verifier and the computer has been running continuously for the past 72 hours.

It did experience 2 additional BSODs.

I have attached the latest dump files.

Thanks again for everyone's help.

CarlTR6 · 22 Nov 2010

Both of these dumps blame memory management. All of your drivers look up to date. Follow Jonathan's suggestion and enable Driver Verifier. Follow the instructions in the tutorial he referenced; exempt all Microsoft drivers. Upload any and all dumps triggered by Driver Verifier.

ollieh · 22 Nov 2010

Thanks for your help.

I have had drive verifier enabled on my computer since Friday. Following the tutorial, all of the drivers were selected except the Microsoft drivers, amdxata.sys, and secdrv.sys.

How do I know if any of the dumps were triggered by drive verifier?

CarlTR6 · 22 Nov 2010

If you have had dumps since you enabled Driver Verifier, upload them. The dumps will tell us if they are Verifier enabled.

ollieh · 29 Nov 2010

Had 3 more BSODs.
I have attached the dump files.

Thanks.

CarlTR6 · 29 Nov 2010

Your last three dumps are not driver verifier enabled dumps and they all blame memory corruption, but do not give the cause of the memory corruption. I looked at five Driver Verifier enabled dumps. All five directly pointed to archlp.sys, which belongs to Arcsoft TotalMedia Theatre (I think) as the offending driver. In researching archlp.sys, I find that it has had conflicts with third party security programs and third party antivirus programs. I know you are running MSE; so that should rule out an antivirus conflict. What is InstallShield? Is this some kind of a security program? If it is, it is possible that it is conflicting with TMT. There is definitely something wrong with archlp.sys and TMT on your system.

You can try uninstalling InstallShield and see if this helps your system.. I recommend this if it is a security program. If this does not help, uninstall TMT. Post back and let us know. If neither of these work, it is time to test hardware.

Driver Verifier enabled dump:

Code:

Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03019000 PsLoadedModuleList = 0xfffff800`0324deb0
Debug session time: Wed Nov 24 08:05:15.239 2010 (GMT-5)
System Uptime: 0 days 11:30:17.378
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {f6, 168, fffffa8009e97060, fffff8800185b01b}

Unable to load image archlp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for archlp.sys
*** ERROR: Module load completed but symbols could not be loaded for archlp.sys
Probably caused by : archlp.sys ( archlp+1401b )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000f6, Referencing user handle as KernelMode.
Arg2: 0000000000000168, Handle value being referenced.
Arg3: fffffa8009e97060, Address of the current process.
Arg4: fffff8800185b01b, Address inside the driver that is performing the incorrect reference.

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_f6

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  uDigital Theat

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000350a3dc to fffff8000307f580

STACK_TEXT:  
fffff880`0acf6d28 fffff800`0350a3dc : 00000000`000000c4 00000000`000000f6 00000000`00000168 fffffa80`09e97060 : nt!KeBugCheckEx
fffff880`0acf6d30 fffff800`0351fae4 : 00000000`00000168 fffffa80`09e97060 00000000`00000004 fffff800`0307d77d : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0acf6d70 fffff800`032dba10 : 00000000`00000000 fffff880`0acf6f70 fffff880`0acf7100 fffff880`0acf7438 : nt!VfCheckUserHandle+0x1b4
fffff880`0acf6e50 fffff800`033624e8 : fffffa80`08d39f00 00000000`00000000 fffffa80`05551f30 fffffa80`085cd300 : nt! ?? ::NNGAKEGL::`string'+0x2050e
fffff880`0acf6f20 fffff800`0307e7d3 : 00000000`00000168 00000000`00000000 fffff880`0acf7438 00000000`00000018 : nt!NtQueryInformationFile+0x1e4
fffff880`0acf7060 fffff800`0307ad70 : fffff800`0350f2c2 fffffa80`85f19ead 00000000`311135ef 00000000`000002c3 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0acf7268 fffff800`0350f2c2 : fffffa80`85f19ead 00000000`311135ef 00000000`000002c3 00000000`1f324256 : nt!KiServiceLinkage
fffff880`0acf7270 fffff880`0185b01b : 00000000`00000000 00000000`00000002 00000000`00000000 fffff980`02de5a50 : nt!VfZwQueryInformationFile+0x62
fffff880`0acf72b0 00000000`00000000 : 00000000`00000002 00000000`00000000 fffff980`02de5a50 00000000`00000005 : archlp+0x1401b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
archlp+1401b
fffff880`0185b01b 68f9811dbc      push    0FFFFFFFFBC1D81F9h

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  archlp+1401b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: archlp

IMAGE_NAME:  archlp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b4c2dd1

FAILURE_BUCKET_ID:  X64_0xc4_f6_archlp+1401b

BUCKET_ID:  X64_0xc4_f6_archlp+1401b

Followup: MachineOwner
---------

Your last three dumps:

Code:

Debug session time: Fri Nov 26 18:00:03.833 2010 (GMT-5)
System Uptime: 2 days 5:25:09.972
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
...................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {c0a80170, 2, 1, fffff880015489bf}

Unable to load image yk62x64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for yk62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for yk62x64.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000c0a80170, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880015489bf, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032f80e0
 00000000c0a80170 

CURRENT_IRQL:  2

FAULTING_IP: 
NETIO!ConvertTableToEnumTemplate+b0
fffff880`015489bf 18413b          sbb     byte ptr [rcx+3Bh],al

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880030ae950 -- (.trap 0xfffff880030ae950)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80085c93f0 rbx=0000000000000000 rcx=00000000c0a80135
rdx=fffffa80085c93f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880015489bf rsp=fffff880030aeae0 rbp=0000000000000001
 r8=0000000000000801  r9=fffff8000324f880 r10=fffff8000324f6c8
r11=00000000000000ff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
NETIO!ConvertTableToEnumTemplate+0xb0:
fffff880`015489bf 18413b          sbb     byte ptr [rcx+3Bh],al ds:ef30:00000000`c0a80170=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030beae9 to fffff800030bf580

STACK_TEXT:  
fffff880`030ae808 fffff800`030beae9 : 00000000`0000000a 00000000`c0a80170 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`030ae810 fffff800`030bd760 : 00000000`00000001 00000000`c0a80170 fffffa80`06e68100 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`030ae950 fffff880`015489bf : 00000000`00000000 fffffa80`085c93f0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`030aeae0 fffff880`015484f5 : fffffa80`054b1960 fffffa80`085c93f0 00000000`00000000 00000000`00000078 : NETIO!ConvertTableToEnumTemplate+0xb0
fffff880`030aeb40 fffff880`0154870d : 00000000`00000000 fffff880`030aecac fffff880`030aec50 fffff880`030aefe0 : NETIO!ConstructNewCacheEntry+0x45
fffff880`030aebc0 fffff880`01542dae : 00000000`00000000 fffff880`030aefe0 fffff880`030aefb0 00000000`00000000 : NETIO!ProcessCacheMiss+0x8d
fffff880`030aec10 fffff880`01579a0d : fffff880`030af200 fffff880`030af200 00000000`00000000 00000000`00000000 : NETIO!KfdClassify+0xb31
fffff880`030aef80 fffff880`01579cb5 : fffff880`03088180 fffff800`03138ddf 00000000`00000000 fffff800`030962d2 : NETIO!StreamIsFilterPresent+0xad
fffff880`030af1e0 fffff880`01579db4 : fffffa80`09173010 fffffa80`06c1c2c0 00000000`0000ded7 fffff880`030af358 : NETIO!StreamIsFilterPresentV4+0x105
fffff880`030af2a0 fffff880`01706875 : fffffa80`09173010 fffff880`017477b0 fffffa80`06a01170 00000000`00000000 : NETIO!WfpStreamIsFilterPresent+0xd4
fffff880`030af2f0 fffff880`01690c2f : 00000000`00000001 fffff880`0167a97b fffffa80`09173010 fffffa80`09173010 : tcpip!WfpAlepFlowEstablishedNotification+0x8d5
fffff880`030af740 fffff880`01658b28 : fffff880`017477b0 fffffa80`06aa2e20 00000000`0000ded7 fffff880`0166f121 : tcpip! ?? ::FNODOBFM::`string'+0xc32f
fffff880`030af890 fffff880`0166c568 : 00000000`00000010 fffffa80`083e4cf0 00000000`00000001 fffffa80`08f69fe0 : tcpip!TcpCreateAndConnectTcbComplete+0x1b8
fffff880`030af9a0 fffff880`01679334 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`090887b0 : tcpip!TcpTcbCarefulDatagram+0x7f8
fffff880`030afb50 fffff880`0167d86a : fffffa80`06bf3f00 00000000`00000000 fffffa80`06a8b901 00000000`00000000 : tcpip!TcpTcbReceive+0x694
fffff880`030afd00 fffff880`0167d3b7 : fffff880`059744a2 fffffa80`06bf9000 00000000`00000000 fffff880`01660700 : tcpip!TcpMatchReceive+0x1fa
fffff880`030afe50 fffff880`0165f6c7 : fffffa80`06bf0424 fffffa80`06beded7 fffffa80`06bf0424 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x177
fffff880`030aff00 fffff880`0165f799 : fffff880`030b0080 fffff880`0176d9a0 fffff880`030b0090 00001f80`00cd0298 : tcpip!IppDeliverListToProtocol+0x97
fffff880`030affc0 fffff880`0165fc90 : 00000041`00000041 fffff800`00000041 fffff880`0435c30c fffff880`030b0080 : tcpip!IppProcessDeliverList+0x59
fffff880`030b0030 fffff880`0165eb21 : fffff880`030b02d0 fffffa80`06bf9000 fffff880`0176d9a0 00000000`07166001 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`030b0110 fffff880`0165d592 : fffffa80`06da03a0 00000000`00000000 fffffa80`07166001 fffff800`00000001 : tcpip!IpFlcReceivePackets+0x651
fffff880`030b0310 fffff880`01676e5a : fffffa80`07166010 fffff880`030b0440 fffffa80`07166010 fffff880`014a0000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`030b03f0 fffff800`030cedaa : fffff980`04c26e20 fffff880`030ab000 00000000`00004800 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`030b0440 fffff880`01676882 : fffff880`01676d80 fffff880`030b0550 00001f80`00100002 0053002b`002b0010 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`030b0520 fffff880`015070eb : fffff980`04f788d0 00000000`00000000 fffffa80`06e681a0 0053002b`002b0010 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`030b0590 fffff880`014d0fc6 : fffff880`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`030b0600 fffff880`0144aef1 : fffffa80`06e681a0 00000000`00000002 00000000`00000001 fffff880`0144b37a : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`030b0a80 fffff880`0431e7ee : fffffa80`07077000 fffff980`04c26e20 fffff980`04c26e20 fffffa80`07077d30 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1
fffff880`030b0ad0 fffffa80`07077000 : fffff980`04c26e20 fffff980`04c26e20 fffffa80`07077d30 00000000`00000001 : yk62x64+0x187ee
fffff880`030b0ad8 fffff980`04c26e20 : fffff980`04c26e20 fffffa80`07077d30 00000000`00000001 fffffa80`00000400 : 0xfffffa80`07077000
fffff880`030b0ae0 fffff980`04c26e20 : fffffa80`07077d30 00000000`00000001 fffffa80`00000400 00000000`00000000 : 0xfffff980`04c26e20
fffff880`030b0ae8 fffffa80`07077d30 : 00000000`00000001 fffffa80`00000400 00000000`00000000 00000000`0000000a : 0xfffff980`04c26e20
fffff880`030b0af0 00000000`00000001 : fffffa80`00000400 00000000`00000000 00000000`0000000a fffffa80`07078570 : 0xfffffa80`07077d30
fffff880`030b0af8 fffffa80`00000400 : 00000000`00000000 00000000`0000000a fffffa80`07078570 fffff880`0431e5ff : 0x1
fffff880`030b0b00 00000000`00000000 : 00000000`0000000a fffffa80`07078570 fffff880`0431e5ff fffff880`030b0c70 : 0xfffffa80`00000400


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !NETIO
    fffff880015489bd - NETIO!ConvertTableToEnumTemplate+ae
    [ 83:87 ]
1 error : !NETIO (fffff880015489bd)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Debug session time: Sat Nov 27 16:35:03.853 2010 (GMT-5)
System Uptime: 0 days 22:30:42.993
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffe48022955850, 1, fffff80003369a6a, 7}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffe48022955850, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80003369a6a, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ba0e0
 ffffe48022955850 

FAULTING_IP: 
nt!ObQueryDeviceMapInformation+e
fffff800`03369a6a 184c8960        sbb     byte ptr [rcx+rcx*4+60h],cl

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x50

PROCESS_NAME:  AnyDVDtray.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800ab42540 -- (.trap 0xfffff8800ab42540)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800ab42738 rbx=0000000000000000 rcx=fffffa8006eaab30
rdx=0000000000daf0a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003369a6a rsp=fffff8800ab426d0 rbp=fffff8800ab42ca0
 r8=00000000000000ff  r9=0000000000000001 r10=fffff80003393d20
r11=fffff800030807b8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ObQueryDeviceMapInformation+0xe:
fffff800`03369a6a 184c8960        sbb     byte ptr [rcx+rcx*4+60h],cl ds:9a5c:ffffe480`22955850=??
Resetting default scope

MISALIGNED_IP: 
nt!ObQueryDeviceMapInformation+e
fffff800`03369a6a 184c8960        sbb     byte ptr [rcx+rcx*4+60h],cl

LAST_CONTROL_TRANSFER:  from fffff8000309c111 to fffff80003081580

STACK_TEXT:  
fffff880`0ab423e8 fffff800`0309c111 : 00000000`00000050 ffffe480`22955850 00000000`00000001 fffff880`0ab42540 : nt!KeBugCheckEx
fffff880`0ab423f0 fffff800`0307f66e : 00000000`00000001 ffffe480`22955850 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x6a2
fffff880`0ab42540 fffff800`03369a6a : 00000000`0000138b 00000000`00000000 fffff6fc`00019c98 fffff880`0ab42a10 : nt!KiPageFault+0x16e
fffff880`0ab426d0 00000000`0000138b : 00000000`00000000 fffff6fc`00019c98 fffff880`0ab42a10 00000000`00000000 : nt!ObQueryDeviceMapInformation+0xe
fffff880`0ab426d8 00000000`00000000 : fffff6fc`00019c98 fffff880`0ab42a10 00000000`00000000 fffff880`0ab42ca0 : 0x138b


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80003369a9d - nt!ObQueryDeviceMapInformation+41
    [ 3b:7b ]
1 error : !nt (fffff80003369a9d)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Debug session time: Mon Nov 29 10:05:34.869 2010 (GMT-5)
System Uptime: 0 days 2:24:27.009
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88000e31a9d, fffff88003369818, fffff88003369080}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88000e31a9d, The address that the exception occurred at
Arg3: fffff88003369818, Exception Record Address
Arg4: fffff88003369080, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Wdf01000!FxRequest::CompleteInternal+691
fffff880`00e31a9d 0883c468415f    or      byte ptr [rbx+5F4168C4h],al

EXCEPTION_RECORD:  fffff88003369818 -- (.exr 0xfffff88003369818)
ExceptionAddress: fffff88000e31a9d (Wdf01000!FxRequest::CompleteInternal+0x0000000000000691)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000000005f4168c4
Attempt to write to address 000000005f4168c4

CONTEXT:  fffff88003369080 -- (.cxr 0xfffff88003369080)
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800733e781
rdx=fffffa80073a7d91 rsi=0000000000000001 rdi=0000000000000000
rip=fffff88000e31a9d rsp=fffff88003369a50 rbp=fffffa8007242620
 r8=fffffa80073a7d90  r9=fffff88000e8b320 r10=fffffa8007241260
r11=fffffa800733e780 r12=fffffa800733e790 r13=0000000000000000
r14=fffffa800733e858 r15=fffff980052cad80
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Wdf01000!FxRequest::CompleteInternal+0x691:
fffff880`00e31a9d 0883c468415f    or      byte ptr [rbx+5F4168C4h],al ds:002b:00000000`5f4168c4=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  000000005f4168c4

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ed0e0
 000000005f4168c4 

FOLLOWUP_IP: 
Wdf01000!FxRequest::CompleteInternal+691
fffff880`00e31a9d 0883c468415f    or      byte ptr [rbx+5F4168C4h],al

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88000e2213e to fffff88000e31a9d

STACK_TEXT:  
fffff880`03369a50 fffff880`00e2213e : 00000000`00000000 00000000`00000001 fffffa80`0725c501 fffff980`052cad80 : Wdf01000!FxRequest::CompleteInternal+0x691
fffff880`03369b00 fffff880`0187d503 : 00000000`00000000 fffffa80`0733e790 00000000`00000000 0000057f`f8cc1868 : Wdf01000!imp_WdfRequestCompleteWithInformation+0x1aa
fffff880`03369b70 fffff880`00e406fb : 00000000`00000000 00000000`00000001 fffffa80`072436b0 fffff800`0325a658 : cdrom!RequestProcessSerializedIoctl+0xcdb
fffff880`03369c50 fffff800`033b0743 : fffffa80`07242060 fffff800`032baf00 fffffa80`05532b60 fffffa80`05532b60 : Wdf01000!FxWorkItem::WorkItemThunk+0x113
fffff880`03369c80 fffff800`030c1981 : fffff800`033a7300 fffff800`033a73cc fffffa80`05532b60 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`03369cb0 fffff800`03358336 : 983a983a`b3c8b3c8 fffffa80`05532b60 00000000`00000080 fffffa80`05508040 : nt!ExpWorkerThread+0x111
fffff880`03369d40 fffff800`03091106 : fffff880`0316a180 fffffa80`05532b60 fffff880`031750c0 fc25fc25`6d2f6d2f : nt!PspSystemThreadStartup+0x5a
fffff880`03369d80 00000000`00000000 : fffff880`0336a000 fffff880`03364000 fffff880`03369560 00000000`00000000 : nt!KiStartSystemThread+0x16


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Wdf01000
    fffff88000e31a9d - Wdf01000!FxRequest::CompleteInternal+691
    [ 48:08 ]
1 error : !Wdf01000 (fffff88000e31a9d)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffff88003369080 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

ollieh · 30 Nov 2010

Thanks for your help.

I had several BSODs when I attempted to load arcsoft total media theatre, but I have had other BSODs when the program wasn't being loaded.

I uninstalled arcsoft total media theatre from my computer and deleted the offending archelp.sys driver.

I don't know what the InstallShield is doing on my computer. It's not listed under
"Programs and features" in "Control Panel." When searching for InstallShield with "Search programs and files," I found a subdirectory in C:\Programs Files (x86)\Installshield Installation Information which contain 14 folders with names such as {5C6F884D-680C-448B-B4C9-22296EE1B206} and {5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}. Could there be a problem with this directory?

I also ran memtest86 continuously overnight and it found no problems with my memory.

I also sent arcsoft an e-mail requesting technical assistance and am waiting for their reply.

I'm waiting to see if I have any more crashes with my computer now that Total Media Theatre 3 is completely uninstalled.

Thanks again for all of your help.

CarlTR6 · 30 Nov 2010

It looks as if InstallShield is an IT and developers tool for Windows installations. It is OK. InstallShield – MSI Windows Installer and InstallScript Software Installations – Flexera Software. I have not seen the InstallShield driver appear before. I have learned something; that is a good thing. Let's see what your system does since you have uninstalled TMT.