Help with Bsod

hazzertz · 23 Jun 2011

Hey guys if you can please help here id greatly appreciate it.

Windows 7 x64 bit
Original OEM install (preinstalled) got it from newegg
Had it for little over year, I tried reinstalling windows 7 from cd that came with the computer but still experiencing bsod

please help

Wallonn7 · 23 Jun 2011

Hi hazzertz and welcome to SF! :)
Enable Driver Verifier.

I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Bugcheck Analysis

Code:

Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`02c4c000 PsLoadedModuleList = 0xfffff800`02e89e50
Debug session time: Thu Jun 23 21:14:41.427 2011 (UTC - 3:00)
System Uptime: 0 days 0:08:40.972
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 0, fffffa8003b63b60, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4894 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
    the operating system. The only supported way to extend a kernel
    mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa8003b63b60
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88002db66f8 -- (.exr 0xfffff88002db66f8)
ExceptionAddress: fffff8800102bc07 (Ntfs!NtfsInitializeTopLevelIrp+0x0000000000000097)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000004
Attempt to read from address 0000000000000004

TRAP_FRAME:  fffff88002db67a0 -- (.trap 0xfffff88002db67a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff88002db6db8
rdx=0000000000000028 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800102bc07 rsp=fffff88002db6930 rbp=fffff88002db6a01
 r8=0000000000000000  r9=fffffa8003b63b60 r10=fffffa8004514e40
r11=fffffa8006745010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
Ntfs!NtfsInitializeTopLevelIrp+0x97:
fffff880`0102bc07 817f044e544653  cmp     dword ptr [rdi+4],5346544Eh ds:1f20:00000000`00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d1132a to fffff80002cbc700

STACK_TEXT:  
fffff880`02db5808 fffff800`02d1132a : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`03b63b60 : nt!KeBugCheckEx
fffff880`02db5810 fffff800`02ce9733 : fffffa80`03cf4d80 fffff880`00dd899a fffff880`00000003 fffff880`02db5928 : nt! ?? ::FNODOBFM::`string'+0x4894
fffff880`02db5850 fffff800`02cf6a6f : fffff880`02db66f8 fffff880`02db6460 fffff880`02db67a0 00000000`00000000 : nt!RtlDispatchException+0x33
fffff880`02db5f30 fffff800`02cbbd42 : fffff880`02db66f8 fffff880`02db6998 fffff880`02db67a0 00000000`00000000 : nt!KiDispatchException+0x16f
fffff880`02db65c0 fffff800`02cba8ba : 00000000`00000000 fffff880`02db6998 fffff880`02db6800 fffff8a0`06a63b48 : nt!KiExceptionDispatch+0xc2
fffff880`02db67a0 fffff880`0102bc07 : 00000000`00008201 fffffa80`05603010 00000001`00000000 00000000`0000001c : nt!KiPageFault+0x23a
fffff880`02db6930 fffff880`01026d29 : 00000000`00000000 fffff880`02db6a40 fffffa80`06745010 fffffa80`05603010 : Ntfs!NtfsInitializeTopLevelIrp+0x97
fffff880`02db6970 fffff880`00c0e23f : fffff880`02db6aa0 fffffa80`03bebc10 00000000`00000000 00000000`00000006 : Ntfs!NtfsFsdSetInformation+0x39
fffff880`02db69f0 fffff880`00c0c6df : fffffa80`049e7750 fffff800`02cafa87 fffffa80`049e7700 fffffa80`03bebc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`02db6a80 fffff800`02cb085b : fffffa80`049e7750 fffffa80`049e7750 fffffa80`06376990 fffff880`02db6c58 : fltmgr!FltpDispatch+0xcf
fffff880`02db6ae0 fffff800`02cafa87 : fffffa80`06376930 00000000`00168018 00000000`00000001 fffffa80`03b63b60 : nt!CcSetValidData+0x11b
fffff880`02db6b50 fffff800`02cb051c : fffff880`0381ad00 fffff880`02db6c58 00000000`00000000 fffff800`00000000 : nt!CcWriteBehind+0x327
fffff880`02db6c00 fffff800`02cc9961 : fffffa80`03b5eee0 fffff800`02cb0354 fffff800`02ec3140 00000000`00000002 : nt!CcWorkerThread+0x1c8
fffff880`02db6cb0 fffff800`02f5fbc6 : 00000000`00000000 fffffa80`03b63b60 00000000`00000080 fffffa80`03ae89e0 : nt!ExpWorkerThread+0x111
fffff880`02db6d40 fffff800`02c9abc6 : fffff880`009e8180 fffffa80`03b63b60 fffff880`009f2f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02db6d80 00000000`00000000 : fffff880`02db7000 fffff880`02db1000 fffff880`02daf000 fffff880`02db5d20 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4894
fffff800`02d1132a cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4894

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34

FAILURE_BUCKET_ID:  X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894

BUCKET_ID:  X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894

Followup: MachineOwner

hazzertz · 24 Jun 2011

Hey Wallonn7,

Thank you so much for your reply, I appreciate your help; here is the dump files. I received a blue screen of death before running the verifier and I have included it as well just in case you may need it. The latest
BSOD occurred while i was running the verifier. Thanks again for all your assistance. It is truly appreciated.

Wallonn7 · 24 Jun 2011

hazzertz said:

Hey Wallonn7,

Thank you so much for your reply, I appreciate your help; here is the dump files. I received a blue screen of death before running the verifier and I have included it as well just in case you may need it. The latest
BSOD occurred while i was running the verifier. Thanks again for all your assistance. It is truly appreciated.

The two dumps were WOW updater as a cause. Unplug the network cable to prevent the updater to connect to the internet and do not play the game until we get a BSOD after enabling Driver Verifier.