BSOD help me reading it

fimble · 14 Feb 2011

Here's another...Verifier.exe is still on. Who can help me ?

To turn off Driver Verifier when finished, Open a Command Prompt or Run... and type verifier /reset and press OK or Enter.
OR
GoTo Start and in the Search Window type verifier.exe. Select Delete existing settings and press "Finish".

3TnT · 14 Feb 2011

DeanP said:

Please upload the new dumps and I will take a look at it.

I put it in my last post in quote.

fimble said:

Here's another...Verifier.exe is still on. Who can help me ?

To turn off Driver Verifier when finished, Open a Command Prompt or Run... and type verifier /reset and press OK or Enter.
OR
GoTo Start and in the Search Window type verifier.exe. Select Delete existing settings and press "Finish".

Yes I know, I let it run for now...

3TnT · 16 Feb 2011

2 news BSOD (see attach files or below) :

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [Z:\021311-25802-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a60000 PsLoadedModuleList = 0xfffff800`02c9de50
Debug session time: Fri Feb 11 11:04:42.472 2011 (UTC - 5:00)
System Uptime: 0 days 18:05:11.830
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
...................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89de0f556, b3b7465ef05dc7bc, fffff80002dcaf00, 1}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See Patching Policy for x64-Based Systems: Information for Driver Developers
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89de0f556, Reserved
Arg2: b3b7465ef05dc7bc, Reserved
Arg3: fffff80002dcaf00, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification

Debugging Details:
------------------

BUGCHECK_STR: 0x109

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002ad0740

STACK_TEXT:
fffff880`031b65d8 00000000`00000000 : 00000000`00000109 a3a039d8`9de0f556 b3b7465e`f05dc7bc fffff800`02dcaf00 : nt!KeBugCheckEx

STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: BAD_STACK

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [Z:\021611-60809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02a63000 PsLoadedModuleList = 0xfffff800`02ca0e50
Debug session time: Tue Feb 15 20:59:19.807 2011 (UTC - 5:00)
System Uptime: 0 days 2:54:56.165
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88008b25380, 0, fffff80002dec035, 0}

Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88008b25380, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002dec035, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0b0e0
fffff88008b25380

FAULTING_IP:
nt!IopXxxControlFile+f5
fffff800`02dec035 488b8c2470090000 mov rcx,qword ptr [rsp+970h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x50

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffff88008b24880 -- (.trap 0xfffff88008b24880)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000001d27068
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002dec035 rsp=fffff88008b24a10 rbp=fffff88008b24ca0
r8=0000000000000000 r9=0000000001d27068 r10=fffff80002db57b4
r11=fffff88008b24b38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!IopXxxControlFile+0xf5:
fffff800`02dec035 488b8c2470090000 mov rcx,qword ptr [rsp+970h] ss:0018:fffff880`08b25380=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002b53f14 to fffff80002ad3740

STACK_TEXT:
fffff880`08b24718 fffff800`02b53f14 : 00000000`00000050 fffff880`08b25380 00000000`00000000 fffff880`08b24880 : nt!KeBugCheckEx
fffff880`08b24720 fffff800`02ad182e : 00000000`00000000 00000000`00000e48 00000000`00000000 fffff880`08b24900 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`08b24880 fffff800`02dec035 : 00000000`00000008 fffffa80`0828eb60 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`08b24a10 fffff800`02db580a : fffff880`08b24bd8 00000000`00000000 00000000`00000000 00000000`01d27068 : nt!IopXxxControlFile+0xf5
fffff880`08b24b40 fffff800`02ad2993 : 00000000`01d27068 00000000`00000000 00000000`00000000 fffff980`1c140f88 : nt!NtFsControlFile+0x56
fffff880`08b24bb0 00000000`7753fa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`031ff698 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7753fa4a

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002dec03a - nt!IopXxxControlFile+fa
[ 01:09 ]
1 error : !nt (fffff80002dec03a)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------