Windows 7: Bluescreen crash (Minidump) help needed

Krisstal · 06 Jul 2011

Hey Forum,

I got this pc 1 day ago and since starting following problem appears in irregular times:
The Pc crashes with a bluescreen and restarts.After restarting the solution programm says something about Minidump. After disabling the auto restart after crashes, the problem still occurs. So I loaded the windows debugging tool. I hope that someone can read out this dmp data.

This is the Dmp data:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\070511-24835-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0xfffff800`0321b000 PsLoadedModuleList = 0xfffff800`03460e90
Debug session time: Tue Jul 5 19:18:02.147 2011 (UTC + 2:00)
System Uptime: 0 days 0:31:38.004
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffff8a00212e660, fffff8a00212e730, 50d041d}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!PVOID ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_POOL_TRACKER_BIG_PAGES ***
*** ***
*************************************************************************
Cannot get _POOL_TRACKER_BIG_PAGES type size
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+80640 )

Followup: MachineOwner
---------

I hope you guys can help me. If I posted something wrong please correct me.

Greetings Krisstal

**yowanvista** · 06 Jul 2011

Please follow these instructions
http://www.sevenforums.com/crashes-d...tructions.html

Krisstal · 06 Jul 2011

Allright, here is the zip: I hope i did everything right at one point i struggled because i dont know where to save the html document exactly.

**yowanvista** · 06 Jul 2011

Remove Asus Utilities such as Asus Update or PC Probe, they tend to cause system instability
Are you overlocking anything?

Enable Driver Verifier then upload the new dumps which are created
Driver Verifier - Enable and Disable

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffff8a00212e660, fffff8a00212e730, 50d041d}

GetPointerFromAddress: unable to read from fffff800034cc0e8
Probably caused by : Ntfs.sys ( Ntfs!RemoveReferenceSharedSecurityUnsafe+1e )


BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffff8a00212e660, The pool entry we were looking for within the page.
Arg3: fffff8a00212e730, The next pool entry.
Arg4: 00000000050d041d, (reserved)

Debugging Details:
------------------


BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffff8a00212e660 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800033c5cae to fffff8000329b640

STACK_TEXT:  
fffff880`076463c8 fffff800`033c5cae : 00000000`00000019 00000000`00000020 fffff8a0`0212e660 fffff8a0`0212e730 : nt!KeBugCheckEx
fffff880`076463d0 fffff880`01241076 : 00000000`00000000 00000000`00000000 00000000`5346744e 00000000`00000000 : nt!ExDeferredFreePool+0x12da
fffff880`07646480 fffff880`012410ad : fffffa80`04d873a8 fffff880`07646770 fffff880`07646770 fffff880`07646770 : Ntfs!RemoveReferenceSharedSecurityUnsafe+0x1e
fffff880`076464b0 fffff880`012b43cd : 00000000`00000000 fffff880`07646770 fffff880`07646770 fffff880`07646770 : Ntfs!NtfsDereferenceSharedSecurity+0x25
fffff880`076464e0 fffff880`012b3f6c : fffff880`07646770 fffff8a0`02128390 fffff8a0`02128010 fffff8a0`02128300 : Ntfs!NtfsModifySecurity+0x2b1
fffff880`07646620 fffff880`012cb3a9 : fffff880`07646770 fffffa80`04667c10 fffff8a0`02128010 fffffa80`04d87180 : Ntfs!NtfsCommonSetSecurityInfo+0x150
fffff880`076466d0 fffff880`012cbf01 : fffff880`07646770 fffffa80`04667c10 fffffa80`04667c10 00000000`00000000 : Ntfs!NtfsFsdDispatchSwitch+0x169
fffff880`07646750 fffff880`010fcbcf : fffff880`076469f0 fffff880`010fd329 fffff880`07646900 fffff880`010fcb15 : Ntfs!NtfsFsdDispatch+0x2d
fffff880`07646940 fffff880`010fb6df : fffffa80`04c138f0 00000000`00000000 fffffa80`04c13800 fffffa80`04667c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`076469d0 fffff800`0357ad43 : fffffa80`06a8b520 00000000`00000000 00000000`00000000 fffffa80`04667c10 : fltmgr!FltpDispatch+0xcf
fffff880`07646a30 fffff800`0353774e : 00000000`00000000 00000000`022de754 fffff880`07646b58 fffff8a0`02aee9d0 : nt!IopGetSetSecurityObject+0x183
fffff880`07646af0 fffff800`03537640 : fffffa80`03ec0000 00000000`20000004 00000000`00000001 fffffa80`03ecde01 : nt!ObSetSecurityObjectByPointer+0x5a
fffff880`07646b50 fffff800`0329a8d3 : 00000000`000004dc fffffa80`03ec8680 00000000`fff6e000 00000000`00000004 : nt!NtSetSecurityObject+0x108
fffff880`07646c20 00000000`77b229da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0846e3f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b229da


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!RemoveReferenceSharedSecurityUnsafe+1e
fffff880`01241076 48832300        and     qword ptr [rbx],0

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!RemoveReferenceSharedSecurityUnsafe+1e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce792f9

FAILURE_BUCKET_ID:  X64_0x19_20_Ntfs!RemoveReferenceSharedSecurityUnsafe+1e

BUCKET_ID:  X64_0x19_20_Ntfs!RemoveReferenceSharedSecurityUnsafe+1e

Followup: MachineOwner
---------

Krisstal · 06 Jul 2011

Okay I enabled the driver verifier, deleted my Asus Utilities ( Asus epu 4 engine). Since then I had no crashes, hope this problem is sovled. Thanks a lot though

**yowanvista** · 07 Jul 2011

Quote: Originally Posted by Krisstal

Okay I enabled the driver verifier, deleted my Asus Utilities ( Asus epu 4 engine). Since then I had no crashes, hope this problem is sovled. Thanks a lot though

If you get no more BSODs turn off driver verifier

Krisstal · 07 Jul 2011

Unfortuantly the system crashed again with a BSOD today :S my Mainboard is Asus manufacured maybe this is important? I'll add the zip data from today down here.

Krisstal · 07 Jul 2011

Perfmon / Report also says, that my Processor(Cpu) has averagely many "interruptions" per second (the Pc has 6cores) there are 61390 interruptions per sec. makes 10232 per core.

**yowanvista** · 07 Jul 2011

Quote: Originally Posted by Krisstal

Perfmon / Report also says, that my Processor(Cpu) has averagely many "interruptions" per second (the Pc has 6cores) there are 61390 interruptions per sec. makes 10232 per core.

I recommend running a CPU test
http://www.sevenforums.com/tutorials...t-prime95.html

Krisstal · 07 Jul 2011

okay i'm doing a Stresstest with Prime95 but speedfan isnt working on my windows7(64) dont know why. so i cant check the temperature in my cpu.

Windows 7: Bluescreen crash (Minidump) help needed

Bluescreen crash (Minidump) help needed problems?