Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: ntoskrnl.exe 0x0000001E BSOD

29 Dec 2011   #1

Windows 7 Home Premuim 64bit
 
 
ntoskrnl.exe 0x0000001E BSOD

Specs:
- Windows 7 Home Premium x64
- Original and only OS ever on the system
- Came pre-installed
- The entire system is about 2 months old
- The install is 2 months old.
- No other security system besides Microsoft Security Essentials

I'm getting a BSOD caused by the ntoskrnl.exe driver. Can't find any solutions. Could you guys help?

STOP error code is 0x0000001E.

Everything you need in the ZIP file.

(Note: It's not called minidump.zip because I have more than just the minidump in the zip file. I also have a dxdiag and some html files in there. All thing in there are relevant and helpful though.)


My System SpecsSystem Spec
.

29 Dec 2011   #2

Windows 7 Home Premium 64 Bit
 
 

Code:
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\122711-31044-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
Debug session time: Tue Dec 27 08:40:25.115 2011 (UTC - 7:00)
System Uptime: 0 days 0:02:33.644
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff8800287afb0, 0, 0}

Probably caused by : CLASSPNP.SYS ( CLASSPNP!ServiceTransferRequest+a8 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800287afb0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+3665613334393163
fffff880`0287afb0 d8be870280f8    fdivr   dword ptr [rsi-77FFD79h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef8100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

DEVICE_OBJECT: fffffa80055b8c50

EXCEPTION_RECORD:  fffff8800287bed8 -- (.exr 0xfffff8800287bed8)
ExceptionAddress: fffff880019ae198 (CLASSPNP!ServiceTransferRequest+0x00000000000000a8)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800287bf80 -- (.trap 0xfffff8800287bf80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffa8003cc275000 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa80055b88b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880019ae198 rsp=fffff8800287c110 rbp=fffffa80055b88b0
 r8=fffffa800433c060  r9=0000000000000200 r10=fffffa800433c1b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
CLASSPNP!ServiceTransferRequest+0xa8:
fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch] ds:c0e0:fffa8003`cc27502c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d514fb to fffff80002cc5c40

STACK_TEXT:  
fffff880`0287aef8 fffff800`02d514fb : 00000000`0000001e ffffffff`c0000005 fffff880`0287afb0 00000000`00000000 : nt!KeBugCheckEx
fffff880`0287af00 fffff800`02d19bb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`0287af40 fffff800`02cf1a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`0287af80 fffff800`02cf14fd : fffff800`02e08c24 fffff880`0287c3c0 00000000`00000000 fffff800`02c49000 : nt!_C_specific_handler+0x8c
fffff880`0287aff0 fffff800`02cf02d5 : fffff800`02e08c24 fffff880`0287b068 fffff880`0287bed8 fffff800`02c49000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0287b020 fffff800`02d01361 : fffff880`0287bed8 fffff880`0287b730 fffff880`00000000 fffffa80`055b8a58 : nt!RtlDispatchException+0x415
fffff880`0287b700 fffff800`02cc52c2 : fffff880`0287bed8 fffffa80`0433c1b0 fffff880`0287bf80 fffffa80`0433f8e0 : nt!KiDispatchException+0x135
fffff880`0287bda0 fffff800`02cc3bca : 00000000`00004000 fffff880`0287c0e8 fffffa80`00001000 fffffa80`03ebacfc : nt!KiExceptionDispatch+0xc2
fffff880`0287bf80 fffff880`019ae198 : fffffa80`04cad180 fffffa80`053aa4b0 fffffa80`053424d0 fffff880`0287c128 : nt!KiGeneralProtectionFault+0x10a
fffff880`0287c110 fffff880`019ae975 : fffffa80`0433c060 fffffa80`055b8a00 00000000`00000003 fffff880`00000001 : CLASSPNP!ServiceTransferRequest+0xa8
fffff880`0287c1b0 fffff880`00e010af : fffffa80`055b88b0 00000002`bfe1a200 fffffa80`055b8aa0 00000000`00000000 : CLASSPNP!ClassReadWrite+0xd5
fffff880`0287c200 fffff880`00e1618c : fffffa80`03e90e20 fffffa80`055b88b0 fffffa80`055b88b0 fffff8a0`002106b0 : partmgr!PmGlobalDispatch+0x9f
fffff880`0287c230 fffff880`0195e2bf : 00000002`bfe1a200 fffffa80`03e98b90 fffffa80`055b88b0 00000000`00000000 : volmgr!VmReadWrite+0x11c
fffff880`0287c270 fffff880`0195e53c : fffffa80`03e98b90 fffff880`0287c8e0 fffffa80`03c1a980 fffffa80`04347010 : fvevol!FveReadWrite+0x47
fffff880`0287c2b0 fffff880`0195e593 : 00000000`00000000 fffffa80`055b88b0 00000000`00000000 fffffa80`0566dfc0 : fvevol!FveFilterRundownReadWrite+0x1dc
fffff880`0287c310 fffff880`018b84a9 : fffffa80`055b8b78 fffffa80`055b88b0 fffffa80`04346190 fffffa80`055b88b0 : fvevol!FveFilterRundownWrite+0x2f
fffff880`0287c340 fffff880`0122539a : fffff880`0287c5b0 00000000`00006000 fffff880`0287c4d8 00000000`00000200 : volsnap! ?? ::FNODOBFM::`string'+0x19f8
fffff880`0287c390 fffff800`02cd2618 : fffff880`0287c560 fffff880`01223d06 fffffa80`053424d0 fffff8a0`0259f140 : Ntfs!NtfsStorageDriverCallout+0x16
fffff880`0287c3c0 fffff880`01224f09 : fffff880`01225384 00000000`00000200 00000000`00000200 00000002`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0287c4a0 fffff880`012243d6 : fffffa80`03eb5a70 00000000`00000000 fffff8a0`0259f140 00001000`00000000 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`0287c510 fffff880`012285f4 : fffffa80`053424d0 fffffa80`055b88b0 00000002`9d0d1826 fffff8a0`0259f010 : Ntfs!NtfsNonCachedIo+0x216
fffff880`0287c6e0 fffff880`012291a3 : fffffa80`053424d0 fffffa80`055b88b0 fffff880`0287c800 fffff880`00000200 : Ntfs!NtfsCommonWrite+0x2d91
fffff880`0287c890 fffff880`01098bcf : fffffa80`055b8c08 fffffa80`055b88b0 fffffa80`05a90c30 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`0287c950 fffff880`010976df : fffffa80`04348c40 00000000`00000001 fffffa80`04348c00 fffffa80`055b88b0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0287c9e0 fffff800`02fce21b : 00000000`00000001 fffffa80`054f2620 00000000`00000001 fffffa80`055b88b0 : fltmgr!FltpDispatch+0xcf
fffff880`0287ca40 fffff800`02fd8c83 : fffffa80`055b8c50 00000000`00000000 fffffa80`054f2620 fffff880`009e9180 : nt!IopSynchronousServiceTail+0xfb
fffff880`0287cab0 fffff800`02cc4ed3 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`0287cbb0 00000000`76ea139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00d7f7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea139a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CLASSPNP!ServiceTransferRequest+a8
fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch]

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  CLASSPNP!ServiceTransferRequest+a8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929b

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8

BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8

Followup: MachineOwner
---------
The problems were system related. To rule out system corruption, run SFC /SCANNOW Command - System File Checker to check system files. You may have to run it up to three times to fix any errors.
My System SpecsSystem Spec
30 Dec 2011   #3

Windows 7 Home Premuim 64bit
 
 

Windows Resource Protection did not find any integrity violations.
My System SpecsSystem Spec
.


30 Dec 2011   #4
JMH

Win 7 Ultimate 64-bit. SP1.
 
 

FYI.
Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED

* This indicates that a kernel-mode program generated an exception which the error handler did not catch.

* The following actions might prevent an error like this from happening again:

> Download and install updates and device drivers for your computer from Windows Update.
> Scan your computer for computer viruses.
> Check your hard disk for errors.

Disk Check

> For good measure download the free version of Malwarebytes.

Update it immediately.
Run a full system scan.

Tell us the results at the end please.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!
My System SpecsSystem Spec
30 Dec 2011   #5

Windows 7 Home Premuim 64bit
 
 

Im going to run the disk check now.

I already have the full paid for version of Malwarebytes, and I run scans all the time. But I'll scan again for good measure.
My System SpecsSystem Spec
30 Dec 2011   #6
JMH

Win 7 Ultimate 64-bit. SP1.
 
 

Good luck!
My System SpecsSystem Spec
30 Dec 2011   #7

Windows 7 Home Premuim 64bit
 
 

Neither Malwarebytes nor Chkdsk found anything.
My System SpecsSystem Spec
30 Dec 2011   #8

Windows 7 Home Premium 64 Bit
 
 

Since everything checks out, we will have to do a more thorough investigation to determine the cause of your blue screens. Run Driver verifier as follows:
1. Backup your system and user files
2. Create a system restore point
3. If you do not have a Windows 7 DVD, Create a system repair disc
4. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the above steps.

You may need to run the driver checks in groups instead of all at once as running all at once often causes blue screens to occur without creating dmp files. Recommend running approximately 1/3 of the non-Microsoft drivers at a time and posting any blue screen dmp files that you get after each set.
My System SpecsSystem Spec
30 Dec 2011   #9

Win 8 Release candidate 8400
 
 

Just a thought in passing. The first parameter in the DMP file is a memory exception and upon further examination it was called by bitlocker.

JUST TO TEST, I would disable bitlocker.
My System SpecsSystem Spec
30 Dec 2011   #10

Windows 7 Home Premuim 64bit
 
 

I don't have bitlocker on my computer.
My System SpecsSystem Spec
Reply

 ntoskrnl.exe 0x0000001E BSOD




Thread Tools



Similar help and support threads for2: ntoskrnl.exe 0x0000001E BSOD
Thread Forum
BSOD Stop: 0x0000001E on ntoskrnl.exe BSOD Help and Support
Solved BSOD ntoskrnl.exe 0x0000001e BSOD Help and Support
BSOD iaStoreA.sys and ntoskrnl.exe 0x0000001e BSOD Help and Support
BSOD, 0x0000001E, ntoskrnl.exe BSOD Help and Support
BSOD | KMODE_EXCEPTION_NOT_HANDLED | ntoskrnl.exe+7cd40 | 0x0000001E BSOD Help and Support
BSOD! Error 0x0000001e. Someting with ntoskrnl.exe BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:03 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33