Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Numerous bsod help!!!!


03 Jan 2012   #1

windows 7 64 bit
 
 
Numerous bsod help!!!!

i have a pc that i build from scratch by ordering the peaces online, i use it for my graphic designs, and when i use after effects about 10 mins in use i get BSOD. its either PFN_LIST_CORRUPT its IRQL_NOT_LESS_OR_EQUAL. i can have the pc on all day and nothing happens everything is good. but when i use after effects the blue screen always shows up and my pc restarts. is there any help i can get on this and why is this happening. i need to fix this problem because iam falling behind on videos i have to complete.

my pc SPEC is
windows 7 ultimate
64 bit
2tb internal hdd
2.5tb external hdd
core i7 930 2.80 GHz
ram 24GB
nvidia quadro 4000

My System SpecsSystem Spec
.

03 Jan 2012   #2

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by casper10451 View Post
i have a pc that i build from scratch by ordering the peaces online, i use it for my graphic designs, and when i use after effects about 10 mins in use i get BSOD. its either PFN_LIST_CORRUPT its IRQL_NOT_LESS_OR_EQUAL. i can have the pc on all day and nothing happens everything is good. but when i use after effects the blue screen always shows up and my pc restarts. is there any help i can get on this and why is this happening. i need to fix this problem because iam falling behind on videos i have to complete.

my pc SPEC is
windows 7 ultimate
64 bit
2tb internal hdd
2.5tb external hdd
core i7 930 2.80 GHz
ram 24GB
nvidia quadro 4000



We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:
Quote:
* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:
Quote:
* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.
My System SpecsSystem Spec
03 Jan 2012   #3

windows 7 64 bit
 
 

ok i added the dmp file i did it with the win NT6 BSOD i seen the post uptop. if you can help me out that would be cool
My System SpecsSystem Spec
.


03 Jan 2012   #4

windows 7 64 bit
 
 

Quote   Quote: Originally Posted by zigzag3143 View Post
Quote   Quote: Originally Posted by casper10451 View Post
i have a pc that i build from scratch by ordering the peaces online, i use it for my graphic designs, and when i use after effects about 10 mins in use i get BSOD. its either PFN_LIST_CORRUPT its IRQL_NOT_LESS_OR_EQUAL. i can have the pc on all day and nothing happens everything is good. but when i use after effects the blue screen always shows up and my pc restarts. is there any help i can get on this and why is this happening. i need to fix this problem because iam falling behind on videos i have to complete.

my pc SPEC is
windows 7 ultimate
64 bit
2tb internal hdd
2.5tb external hdd
core i7 930 2.80 GHz
ram 24GB
nvidia quadro 4000



We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:
Quote:
* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:
Quote:
* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

k i uploaded the file
My System SpecsSystem Spec
03 Jan 2012   #5

Windows 7 Home Premium 64 Bit
 
 

Code:
  1. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122311-33977-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe70 Debug session time: Fri Dec 23 14:47:04.123 2011 (UTC - 7:00) System Uptime: 0 days 1:06:24.465 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C4, {91, 0, fffffa80145ef060, 0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4894 ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_DETECTED_VIOLATION (c4) A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes. Arguments: Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout. Arg2: 0000000000000000 Arg3: fffffa80145ef060 Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0xc4_91 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff880073e1178 -- (.exr 0xfffff880073e1178) ExceptionAddress: fffff880012c22df (Ntfs!NtfsAllocateClusters+0x000000000000016b) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 TRAP_FRAME: fffff880073e1220 -- (.trap 0xfffff880073e1220) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80145393e8 rdx=fffffa80145393e8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880012c22df rsp=fffff880073e13b0 rbp=fffff880093e1960 r8=fffffa801453a990 r9=0000000000000000 r10=074a5f2000008660 r11=000000000000013b r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po cy Ntfs!NtfsAllocateClusters+0x16b: fffff880`012c22df 488b00 mov rax,qword ptr [rax] ds:00000000`00000000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002f2717a to fffff80002ed25c0 STACK_TEXT: fffff880`073e0288 fffff800`02f2717a : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`145ef060 : nt!KeBugCheckEx fffff880`073e0290 fffff800`02eff573 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4894 fffff880`073e02d0 fffff800`02f0c8cf : fffff880`073e1178 fffff880`073e0ee0 fffff880`073e1220 fffffa80`14539180 : nt!RtlDispatchException+0x33 fffff880`073e09b0 fffff800`02ed1c02 : fffff880`073e1178 fffff8a0`00206b70 fffff880`073e1220 fffffa80`140d32c0 : nt!KiDispatchException+0x16f fffff880`073e1040 fffff800`02ed077a : 00000000`00000000 fffff8a0`00206b70 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`073e1220 fffff880`012c22df : fffff8a0`00206b70 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a fffff880`073e13b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsAllocateClusters+0x16b STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+4894 fffff800`02f2717a cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4894 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894 BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894 Followup: MachineOwner ---------
  2. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35630-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e63000 PsLoadedModuleList = 0xfffff800`030a0e70 Debug session time: Fri Dec 23 22:10:51.367 2011 (UTC - 7:00) System Uptime: 0 days 7:21:59.756 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800ce713e8, fffff8800ce70c50, fffff880012c82dd} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800ce713e8 Arg3: fffff8800ce70c50 Arg4: fffff880012c82dd Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800ce713e8 -- (.exr 0xfffff8800ce713e8) ExceptionAddress: fffff880012c82dd (Ntfs!NtfsCommonCleanup+0x0000000000000bcd) ExceptionCode: c000001d (Illegal instruction) ExceptionFlags: 00000000 NumberParameters: 0 CONTEXT: fffff8800ce70c50 -- (.cxr 0xfffff8800ce70c50) rax=000000001f59fbba rbx=fffff8a0089e1a90 rcx=0000000000004c58 rdx=fffffa8016497b60 rsi=fffff8a0089e1bc0 rdi=fffff8800ce71c10 rip=fffff880012c82dd rsp=fffff8800ce71620 rbp=fffffa80133fcb30 r8=0000000000000000 r9=0000000000000000 r10=01ccc1fa67c25224 r11=fffff8800ce71600 r12=0000000000000004 r13=0000000000000000 r14=0000000000000007 r15=fffff8a0089e1e10 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!NtfsCommonCleanup+0xbcd: fffff880`012c82dd 82 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x24 PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. LAST_CONTROL_TRANSFER: from fffff88001239829 to fffff880012c82dd STACK_TEXT: fffff880`0ce71620 fffff880`01239829 : 00000000`00000001 fffff800`030074d3 fffff880`0ce71b70 fffff880`0ce61000 : Ntfs!NtfsCommonCleanup+0xbcd fffff880`0ce71a30 fffff800`02ee2cda : fffff880`0ce71b70 00000000`20206f49 00000000`00f800c4 fffff8a0`09fb7660 : Ntfs!NtfsCommonCleanupCallout+0x19 fffff880`0ce71a60 fffff880`012393e2 : fffff880`01239810 fffff880`0ce71b70 fffff8a0`00001900 fffffa80`146ad600 : nt!KeExpandKernelStackAndCalloutEx+0xda fffff880`0ce71b40 fffff880`012d8324 : fffff880`0ce71c10 fffff880`0ce71c10 fffff880`0ce71c10 fffffa80`167ebc10 : Ntfs!NtfsCommonCleanupOnNewStack+0x42 fffff880`0ce71bb0 fffff880`010b56af : fffff880`0ce71c10 fffffa80`167ebc10 fffffa80`1445ade0 00000000`00000000 : Ntfs!NtfsFsdCleanup+0x144 fffff880`0ce71e20 fffff800`031e688f : fffffa80`167ebc10 fffffa80`133fcb30 00000000`00000000 fffffa80`16026740 : fltmgr!FltpDispatch+0x9f fffff880`0ce71e80 fffff800`031cc754 : 00000000`00000001 fffffa80`172d3b30 fffffa80`000004d8 fffffa80`00000000 : nt!IopCloseFile+0x11f fffff880`0ce71f10 fffff800`031e6381 : fffffa80`172d3b30 fffffa80`00000001 fffff8a0`000019f0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4 fffff880`0ce71f90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCloseHandleTableEntry+0xb1 CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs fffff880012c82d8 - Ntfs!NtfsCommonCleanup+bc8 [ 0f:0d ] 1 error : !Ntfs (fffff880012c82d8) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800ce70c50 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  3. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34273-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e19000 PsLoadedModuleList = 0xfffff800`03056e70 Debug session time: Fri Dec 23 22:19:49.249 2011 (UTC - 7:00) System Uptime: 0 days 0:03:43.592 Loading Kernel Symbols ............................................................... ................................................................ .................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002e3d7f5, fffff8800b2b50e0, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002e3d7f5, Address of the instruction which caused the bugcheck Arg3: fffff8800b2b50e0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!NtResetWriteWatch+1e5 fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h] CONTEXT: fffff8800b2b50e0 -- (.cxr 0xfffff8800b2b50e0) rax=e2900005ffe22825 rbx=0000000000000000 rcx=fffff68000014400 rdx=fffff6fb7dbed000 rsi=fffffa8016c96b60 rdi=0000000000000000 rip=fffff80002e3d7f5 rsp=fffff8800b2b5ab0 rbp=fffff68000014408 r8=0000000000000001 r9=0000000000000001 r10=0000000000000002 r11=fffffffffffb3410 r12=0000000002881000 r13=fffff6fb400000a0 r14=0000000000000000 r15=fffffa8016c53ec8 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!NtResetWriteWatch+0x1e5: fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h] ss:0018:e28ff886`0b0d8315=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: sidebar.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002e88813 to fffff80002e3d7f5 STACK_TEXT: fffff880`0b2b5ab0 fffff800`02e88813 : ffffffff`ffffffff fffff680`00014400 fffffa80`16c96b60 fffffa80`16c53b30 : nt!NtResetWriteWatch+0x1e5 fffff880`0b2b5c20 00000000`77000b0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`02d8efc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77000b0a CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80002e3d7f8 - nt!NtResetWriteWatch+1e8 [ 24:04 ] 1 error : !nt (fffff80002e3d7f8) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800b2b50e0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  4. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-22261-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`03099e70 Debug session time: Sat Dec 24 11:04:51.092 2011 (UTC - 7:00) System Uptime: 0 days 2:07:50.450 Loading Kernel Symbols ............................................................... ................................................................ .................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 4a7988, 3, 569c07} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000004a7988, page frame number Arg3: 0000000000000003, current page state Arg4: 0000000000569c07, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AfterFX.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f5c13c to fffff80002ecc5c0 STACK_TEXT: fffff880`0df1e058 fffff800`02f5c13c : 00000000`0000004e 00000000`00000099 00000000`004a7988 00000000`00000003 : nt!KeBugCheckEx fffff880`0df1e060 fffff800`02e7c5df : fffffa80`095ed850 00000000`00000001 fffffa80`0df6c980 fffff683`ffc3eff8 : nt!MiBadShareCount+0x4c fffff880`0df1e0a0 fffff800`02efd7b5 : fffffa80`16d5bb30 000007ff`87dff000 d3f00003`52f58c46 fffff8a0`0237acf0 : nt! ?? ::FNODOBFM::`string'+0x204a1 fffff880`0df1e1b0 fffff800`02f0dfba : 00000000`00000000 000007ff`89bf7fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x96c fffff880`0df1e370 fffff800`02ecb813 : ffffffff`ffffffff 00000000`0082ad78 00000000`0082ad70 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0df1e460 00000000`778bf89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0082ad38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778bf89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f5c13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  5. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35833-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e54000 PsLoadedModuleList = 0xfffff800`03091e70 Debug session time: Sat Dec 24 12:40:41.825 2011 (UTC - 7:00) System Uptime: 0 days 1:33:56.230 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 534698, 0, 52f918} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 0000000000534698, page frame number Arg3: 0000000000000000, current page state Arg4: 000000000052f918, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: Setup.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f5413c to fffff80002ec45c0 STACK_TEXT: fffff880`1447a778 fffff800`02f5413c : 00000000`0000004e 00000000`00000099 00000000`00534698 00000000`00000000 : nt!KeBugCheckEx fffff880`1447a780 fffff800`02f36600 : 00000000`00000000 fffff680`00058e50 00000000`00000000 00000000`00000004 : nt!MiBadShareCount+0x4c fffff880`1447a7c0 fffff800`02ef5251 : 00000000`00000000 fffff680`00058ff8 fffffa80`178a7060 fffff880`1447aca0 : nt! ?? ::FNODOBFM::`string'+0x31e8a fffff880`1447a970 fffff800`02f05fba : 00000000`00000000 00000000`0b229fff fffffa80`00000000 fffffa80`178a7060 : nt!MiDeleteVirtualAddresses+0x408 fffff880`1447ab30 fffff800`02ec3813 : ffffffff`ffffffff 00000000`0013e030 00000000`0013e028 fffff900`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`1447ac20 00000000`77a0f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0013dff8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a0f89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f5413c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  6. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-73866-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03041e70 Debug session time: Sat Dec 24 13:03:58.868 2011 (UTC - 7:00) System Uptime: 0 days 0:18:55.289 Loading Kernel Symbols .............................................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800fb423e8, fffff8800fb41c50, fffff800031551c6} Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800fb423e8 Arg3: fffff8800fb41c50 Arg4: fffff800031551c6 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800fb423e8 -- (.exr 0xfffff8800fb423e8) Cannot read Exception record @ fffff8800fb423e8 CONTEXT: fffff8800fb41c50 -- (.cxr 0xfffff8800fb41c50) Unable to read context, Win32 error 0n30 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x24 PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002e820ca to fffff880041cf9c2 STACK_TEXT: fffff800`043ecc98 fffff800`02e820ca : 00000000`00298420 fffffa80`1527f8c8 fffff800`02ffcc40 00000000`00000001 : 0xfffff880`041cf9c2 fffff800`043ecca0 fffff800`02e7cd5c : fffff800`02feee80 fffff800`00000000 00000000`00000000 fffff880`10bc44d0 : nt!PoIdle+0x53a fffff800`043ecd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003155118 - nt!IoCheckShareAccessEx+78 [ 00:02 ] 1 error : !nt (fffff80003155118) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800fb41c50 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  7. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-23134-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030a2e70 Debug session time: Sat Dec 24 13:18:15.595 2011 (UTC - 7:00) System Uptime: 0 days 0:13:10.000 Loading Kernel Symbols ............................................................... ................................................................ ................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 61bd07, 2, 61be07} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 000000000061bd07, page frame number Arg3: 0000000000000002, current page state Arg4: 000000000061be07, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: nvvsvc.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f6513c to fffff80002ed55c0 STACK_TEXT: fffff880`0b4b7f28 fffff800`02f6513c : 00000000`0000004e 00000000`00000099 00000000`0061bd07 00000000`00000002 : nt!KeBugCheckEx fffff880`0b4b7f30 fffff800`02f4794e : 00000000`00000000 fffff680`00000fd8 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c fffff880`0b4b7f70 fffff800`02ea9bb3 : fffffa80`1578f930 fffff700`00000574 0000007f`fffffff8 fffff8a0`00133178 : nt! ?? ::FNODOBFM::`string'+0x321f5 fffff880`0b4b8000 fffff800`02ea860e : fffffa80`1578f930 fffffa80`00000000 fffff8a0`0000020d fffff880`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307 fffff880`0b4b88b0 fffff800`031b7a8b : fffff8a0`00d19610 fffff880`0b4b8c20 00000000`00000000 fffffa80`1522a060 : nt!MmCleanProcessAddressSpace+0x96 fffff880`0b4b8900 fffff800`03190131 : 00000000`00000000 00000000`00000001 000007ff`fffd3000 00000000`00000000 : nt!PspExitThread+0x92f fffff880`0b4b89c0 fffff800`02eb211b : fffffa80`1522b890 fffff880`0b4b8ca0 fffffa80`15b3c4e0 fffff800`031edb7e : nt!PsExitSpecialApc+0x1d fffff880`0b4b89f0 fffff800`02eb2560 : 00000000`00000000 fffff880`0b4b8a70 fffff800`031901b8 00000000`00000001 : nt!KiDeliverApc+0x2eb fffff880`0b4b8a70 fffff800`02ed48b7 : 00000000`000004a0 00000000`0114f170 00000000`00000000 0000007f`ffffffff : nt!KiInitiateUserApc+0x70 fffff880`0b4b8bb0 00000000`76fafa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c 00000000`0114fe58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fafa4a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f6513c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  8. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34881-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e70 Debug session time: Sat Dec 24 14:22:42.598 2011 (UTC - 7:00) System Uptime: 0 days 0:31:35.003 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c000001d, fffff880010287ed, fffff88009706720, 0} Probably caused by : hardware ( fltmgr!FltpNormalizeNameFromCache+1d ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c000001d, Exception code that caused the bugcheck Arg2: fffff880010287ed, Address of the instruction which caused the bugcheck Arg3: fffff88009706720, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. FAULTING_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? CONTEXT: fffff88009706720 -- (.cxr 0xfffff88009706720) rax=0000000000000000 rbx=0000000000000040 rcx=fffffa8013c97bf0 rdx=0000000000000080 rsi=fffffa8013c97bf0 rdi=0000000000000040 rip=fffff880010287ed rsp=fffff880097070f0 rbp=0000000000000017 r8=000000000000002e r9=fffffa8016e925e0 r10=0000000000000051 r11=fffff88009707208 r12=0000000000000000 r13=fffffa8013886401 r14=fffffa8014764668 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 fltmgr!FltpNormalizeNameFromCache+0x1d: fffff880`010287ed d9 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 MISALIGNED_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880010287ed STACK_TEXT: fffff880`097070f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpNormalizeNameFromCache+0x1d FOLLOWUP_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: fltmgr!FltpNormalizeNameFromCache+1d FOLLOWUP_NAME: MachineOwner IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: .cxr 0xfffff88009706720 ; kb MODULE_NAME: hardware FAILURE_BUCKET_ID: X64_IP_MISALIGNED BUCKET_ID: X64_IP_MISALIGNED Followup: MachineOwner ---------
  9. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-42229-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70 Debug session time: Sat Dec 24 17:32:50.778 2011 (UTC - 7:00) System Uptime: 0 days 1:30:29.821 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 3b8202, 3, 575d1b} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000003b8202, page frame number Arg3: 0000000000000003, current page state Arg4: 0000000000575d1b, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AfterFX.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f1e13c to fffff80002e8e5c0 STACK_TEXT: fffff880`0ebb2778 fffff800`02f1e13c : 00000000`0000004e 00000000`00000099 00000000`003b8202 00000000`00000003 : nt!KeBugCheckEx fffff880`0ebb2780 fffff800`02f00609 : 00000000`00000000 fffff683`fdae8de0 00000000`00000000 fffff700`0363cff8 : nt!MiBadShareCount+0x4c fffff880`0ebb27c0 fffff800`02ebf251 : fffff700`01080000 fffff683`fdae8ff8 fffffa80`16be1ab0 fffffa80`16be1ab0 : nt! ?? ::FNODOBFM::`string'+0x31e93 fffff880`0ebb2970 fffff800`02ecffba : 00000000`00000000 000007fb`5d38bfff fffffa80`00000000 fffffa80`16be1ab0 : nt!MiDeleteVirtualAddresses+0x408 fffff880`0ebb2b30 fffff800`02e8d813 : ffffffff`ffffffff 00000000`00828968 00000000`00828960 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0ebb2c20 00000000`770af89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`00828928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770af89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f1e13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  10. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-21418-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e51000 PsLoadedModuleList = 0xfffff800`0308ee70 Debug session time: Sat Dec 24 17:58:53.887 2011 (UTC - 7:00) System Uptime: 0 days 0:24:26.292 Loading Kernel Symbols .............................................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 4eb143, 2, 4ed2c2} Probably caused by : ntkrnlmp.exe ( nt!PoIdle+53a ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000004eb143, page frame number Arg3: 0000000000000002, current page state Arg4: 00000000004ed2c2, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002ecf0ca to fffff88003ce09c2 STACK_TEXT: fffff800`00b9cc98 fffff800`02ecf0ca : 00000000`00298465 fffffa80`15428dd8 fffffa80`1554e480 fffffa80`13a04170 : 0xfffff880`03ce09c2 fffff800`00b9cca0 fffff800`02ec9d5c : fffff800`0303be80 fffff800`00000000 00000000`00000000 fffff880`0fe55480 : nt!PoIdle+0x53a fffff800`00b9cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c STACK_COMMAND: kb FOLLOWUP_IP: nt!PoIdle+53a fffff800`02ecf0ca 0fba25761518000f bt dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`03050648)],0Fh SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!PoIdle+53a FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a Followup: MachineOwner ---------
  11. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-25053-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`03092e70 Debug session time: Mon Dec 26 07:23:45.366 2011 (UTC - 7:00) System Uptime: 0 days 0:02:00.709 Loading Kernel Symbols ............................................................... ................................................................ ................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {15, 2, 1, fffff80002ecd7e0} Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000015, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002ecd7e0, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fd0e0 0000000000000015 CURRENT_IRQL: 2 FAULTING_IP: nt!KiSearchForNewThread+2d0 fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0xA PROCESS_NAME: BitCometServic TRAP_FRAME: fffff8801349c780 -- (.trap 0xfffff8801349c780) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000006 rbx=0000000000000000 rcx=0000000000000000 rdx=fffff88002f68700 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ecd7e0 rsp=fffff8801349c910 rbp=0000000000000100 r8=fffffa801722f820 r9=0000000000000008 r10=0000000000000000 r11=fffff88003115101 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!KiSearchForNewThread+0x2d0: fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1 ds:0001:00000000`00000015=?? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002ec4b29 to fffff80002ec55c0 STACK_TEXT: fffff880`1349c638 fffff800`02ec4b29 : 00000000`0000000a 00000000`00000015 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`1349c640 fffff800`02ec37a0 : 00000000`00000002 fffffa80`1722f780 fffffa80`133ab100 fffff800`02fcef6e : nt!KiBugCheckDispatch+0x69 fffff880`1349c780 fffff800`02ecd7e0 : fffff880`1349cdb0 fffffa80`17029660 fffff800`03042968 00000000`00000000 : nt!KiPageFault+0x260 fffff880`1349c910 fffff800`02ecc68c : fffffa80`17029660 fffffa80`17029660 00000000`00000000 00000000`00000006 : nt!KiSearchForNewThread+0x2d0 fffff880`1349c980 fffff800`02eceb9f : fffffa80`1711c270 00000000`00000000 00000000`00000059 00000000`00000002 : nt!KiCommitThreadWait+0x17c fffff880`1349ca10 fffff800`02e8e222 : fffffa80`15dd3100 00000000`0000001b 00000000`00010200 fffff880`03115100 : nt!KeWaitForSingleObject+0x19f fffff880`1349cab0 fffff800`02ecd44c : ffffffff`ffb3b4c0 fffffa80`1503c820 fffffa80`15dd31a0 fffff900`c0904370 : nt!ExpWaitForResource+0xae fffff880`1349cb20 fffff800`02ed1077 : 00000000`72173e30 fffffa80`17029660 00000000`00000000 fffff800`031bcf1c : nt!ExAcquireResourceExclusiveLite+0x14f fffff880`1349cb90 fffff960`00171be9 : fffff880`1349cbf8 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 : nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x23 fffff880`1349cbc0 fffff880`1349cbf8 : 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 : win32k+0xd1be9 fffff880`1349cbc8 00000000`00000000 : fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 00000000`00000000 : 0xfffff880`1349cbf8 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80002ecd7e0 - nt!KiSearchForNewThread+2d0 [ f0:d0 ] 1 error : !nt (fffff80002ecd7e0) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  12. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-44803-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70 Debug session time: Mon Dec 26 09:18:41.374 2011 (UTC - 7:00) System Uptime: 0 days 0:17:05.401 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c000001d, fffff8000318325d, fffff8800baf3ef0, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c000001d, Exception code that caused the bugcheck Arg2: fffff8000318325d, Address of the instruction which caused the bugcheck Arg3: fffff8800baf3ef0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. FAULTING_IP: nt!ObpCreateHandle+fd fffff800`0318325d 82 ??? CONTEXT: fffff8800baf3ef0 -- (.cxr 0xfffff8800baf3ef0) rax=000000001f59f9ba rbx=fffffa80182503a0 rcx=0000000000000000 rdx=fffffa8019549560 rsi=0000000000000040 rdi=fffff8a000db7c50 rip=fffff8000318325d rsp=fffff8800baf48c0 rbp=fffff80002e1e000 r8=0000000000000000 r9=0000000000000001 r10=0000000000000001 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000001 r15=fffff80003040300 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!ObpCreateHandle+0xfd: fffff800`0318325d 82 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000318325d STACK_TEXT: fffff880`0baf48c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0xfd CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003183258 - nt!ObpCreateHandle+f8 [ 0f:0d ] 1 error : !nt (fffff80003183258) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800baf3ef0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  13. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-17955-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`0325ce70 Debug session time: Wed Dec 28 06:34:07.112 2011 (UTC - 7:00) System Uptime: 0 days 0:06:08.454 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800c18c048, fffff8800c18b8b0, fffff8800121ebc3} Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800c18c048 Arg3: fffff8800c18b8b0 Arg4: fffff8800121ebc3 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800c18c048 -- (.exr 0xfffff8800c18c048) ExceptionAddress: fffff8800121ebc3 (Ntfs!NtfsCommonRead+0x00000000000000c3) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000005 Attempt to read from address 0000000000000005 CONTEXT: fffff8800c18b8b0 -- (.cxr 0xfffff8800c18b8b0) rax=0000000000000001 rbx=fffff8a00352a140 rcx=0000000000000001 rdx=0000000000000080 rsi=0000000000000000 rdi=0000000000000201 rip=fffff8800121ebc3 rsp=fffff8800c18c280 rbp=fffff8800c18c450 r8=fffffa80138b8c10 r9=0000000000000000 r10=fffffa80138b8fb0 r11=fffff8800c18c418 r12=0000000000000000 r13=fffff8a00352a140 r14=0000000000000000 r15=fffffa8013a5ca40 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 Ntfs!NtfsCommonRead+0xc3: fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 ds:002b:00000000`00000005=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000005 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c70e0 0000000000000005 FOLLOWUP_IP: Ntfs!NtfsCommonRead+c3 fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 FAULTING_IP: Ntfs!NtfsCommonRead+c3 fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 BUGCHECK_STR: 0x24 DEFAULT_BUCKET_ID: CODE_CORRUPTION LAST_CONTROL_TRANSFER: from fffff88001221cf8 to fffff8800121ebc3 STACK_TEXT: fffff880`0c18c280 fffff880`01221cf8 : fffffa80`13a5ca40 fffffa80`138b8c10 fffff880`0c18c450 fffffa80`13c31600 : Ntfs!NtfsCommonRead+0xc3 fffff880`0c18c420 fffff880`010c823f : fffffa80`138b8fb0 fffffa80`138b8c10 fffffa80`13c31650 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8 fffff880`0c18c4d0 fffff880`010c66df : fffffa80`143fab60 fffffa80`138b8c10 fffffa80`143fab00 fffffa80`138b8c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`0c18c560 fffff800`030810c2 : fffffa80`138b8c30 fffffa80`13839c00 00000000`00000403 fffff8a0`03db0f68 : fltmgr!FltpDispatch+0xcf fffff880`0c18c5c0 fffff800`0332be37 : fffffa80`13acb300 fffffa80`13acb300 fffffa80`15174f51 00000000`00000001 : nt!IoPageRead+0x252 fffff880`0c18c650 fffff800`032ec1fb : 00000000`00000001 00000000`00000001 fffffa80`16e66430 00000000`00000007 : nt!MiPfExecuteReadList+0xff fffff880`0c18c6b0 fffff800`034ed67d : 00000000`00000018 00000000`00000018 fffffa80`16e66430 fffff880`0c18c778 : nt!MmPrefetchPages+0xfb fffff880`0c18c710 fffff800`034f569e : fffff8a0`00000000 fffff8a0`00000000 fffff8a0`0000012d fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x21d fffff880`0c18c810 fffff800`034f6237 : 00000000`00000000 fffff880`0c18cca0 fffff880`0c18ca08 fffff8a0`00fbe060 : nt!PfpPrefetchRequestPerform+0x30e fffff880`0c18c960 fffff800`0350280e : fffff880`0c18ca08 00000000`00000001 fffffa80`16ff63f0 00000000`00000000 : nt!PfpPrefetchRequest+0x176 fffff880`0c18c9d0 fffff800`03506f3e : 00000000`00000000 00000000`0f2ff410 00000000`0000004f fffffa80`1543fb01 : nt!PfSetSuperfetchInformation+0x1ad fffff880`0c18cab0 fffff800`0308e813 : fffffa80`137e0b60 00000000`00000000 00000000`00000001 00000000`00000001 : nt!NtSetSystemInformation+0xb91 fffff880`0c18cc20 00000000`76e00daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0f2ff3e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e00daa CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs fffff8800121eb58 - Ntfs!NtfsCommonRead+58 [ 85:87 ] 1 error : !Ntfs (fffff8800121eb58) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800c18b8b0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  14. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-36644-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03249e70 Debug session time: Wed Dec 28 12:17:19.795 2011 (UTC - 7:00) System Uptime: 0 days 0:28:08.278 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff30027bb9440, 0, fffff80003093798, 7} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff30027bb9440, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff80003093798, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000007, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b40e0 fffff30027bb9440 FAULTING_IP: nt!KeAcquireGuardedMutex+28 fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h] MM_INTERNAL_CODE: 7 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: mscorsvw.exe CURRENT_IRQL: 0 DEVICE_OBJECT: fffffa8016512ff8 TRAP_FRAME: fffff88011564270 -- (.trap 0xfffff88011564270) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80146783e8 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80003093798 rsp=fffff88011564400 rbp=fffffa8016655010 r8=fffffa8017881018 r9=fffff88011564438 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!KeAcquireGuardedMutex+0x28: fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h] ss:0018:fffff880`11564430=fffff8a0114a0750 Resetting default scope LAST_CONTROL_TRANSFER: from fffff800030fb729 to fffff8000307c5c0 STACK_TEXT: fffff880`11564108 fffff800`030fb729 : 00000000`00000050 fffff300`27bb9440 00000000`00000000 fffff880`11564270 : nt!KeBugCheckEx fffff880`11564110 fffff800`0307a6ae : 00000000`00000000 fffffa80`146783e8 fffff8a0`114a0700 fffffa80`16655010 : nt! ?? ::FNODOBFM::`string'+0x40ccb fffff880`11564270 fffff800`03093798 : 00000000`00000000 00000000`00000000 fffffa80`14678180 fffffa80`16655010 : nt!KiPageFault+0x16e fffff880`11564400 fffff880`012ea268 : fffff8a0`114a0750 00000000`00000000 00000000`0000119e 00000000`00001119 : nt!KeAcquireGuardedMutex+0x28 fffff880`11564430 fffff880`012e51d9 : fffffa80`16655010 fffffa80`14678180 fffff8a0`114a0620 00000000`00001119 : Ntfs!NtfsAllocateClusters+0xf4 fffff880`11564570 fffff880`01245750 : fffffa80`16655010 fffffa80`165821c0 00000000`00000001 00000000`00001119 : Ntfs!NtfsAddAllocation+0x299 fffff880`11564680 fffff880`01243791 : 00000000`00000000 fffff880`115648c0 00000000`00000000 00000000`00000000 : Ntfs!NtfsAddAllocationForNonResidentWrite+0xfc fffff880`115646e0 fffff880`01246663 : fffffa80`16655010 fffffa80`16512c10 fffff880`11564801 fffff880`11564800 : Ntfs!NtfsCommonWrite+0x287b fffff880`11564890 fffff880`0104923f : fffffa80`16512fb0 fffffa80`16512c10 fffffa80`1664a770 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3 fffff880`11564950 fffff880`010476df : fffffa80`144268e0 00000000`00000001 fffffa80`14426800 fffffa80`16512c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`115649e0 fffff800`0338fb29 : 00000000`00000001 fffffa80`165821c0 00000000`00000001 fffffa80`16512c10 : fltmgr!FltpDispatch+0xcf fffff880`11564a40 fffff800`033908c3 : fffffa80`16512ff8 00000000`00000000 fffffa80`165821c0 fffff880`02f64180 : nt!IopSynchronousServiceTail+0xf9 fffff880`11564ab0 fffff800`0307b813 : 000007fe`f564a701 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2 fffff880`11564bb0 00000000`774af73a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`002cd538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774af73a STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003093798 - nt!KeAcquireGuardedMutex+28 [ 48:4a ] 1 error : !nt (fffff80003093798) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  15. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010212-33368-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`03001000 PsLoadedModuleList = 0xfffff800`0323ee70 Debug session time: Mon Jan 2 20:58:57.295 2012 (UTC - 7:00) System Uptime: 0 days 5:32:37.836 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {24, 6, 1, fffff8800ff32c16} Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvlddmkm.sys *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys Probably caused by : nvlddmkm.sys ( nvlddmkm+cec16 ) Followup: MachineOwner --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000024, memory referenced Arg2: 0000000000000006, IRQL Arg3: 0000000000000001, value 0 = read operation, 1 = write operation Arg4: fffff8800ff32c16, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a90e0 0000000000000024 CURRENT_IRQL: 6 FAULTING_IP: nvlddmkm+cec16 fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TRAP_FRAME: fffff8800313d0e0 -- (.trap 0xfffff8800313d0e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8015304480 rbx=0000000000000000 rcx=fffff8800313d300 rdx=fffffdffecc80380 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8800ff32c16 rsp=fffff8800313d270 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=0000000002020000 r11=0000000000000001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc nvlddmkm+0xcec16: fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp ss:0018:fffff880`0313d2e0=0000000000000000 Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003070b29 to fffff800030715c0 STACK_TEXT: fffff880`0313cf98 fffff800`03070b29 : 00000000`0000000a 00000000`00000024 00000000`00000006 00000000`00000001 : nt!KeBugCheckEx fffff880`0313cfa0 fffff800`0306f7a0 : fffffa80`1628b330 fffff880`0313d430 fffffa80`164bd000 fffff880`04528691 : nt!KiBugCheckDispatch+0x69 fffff880`0313d0e0 fffff880`0ff32c16 : fffff880`0313d430 fffff880`0313d430 00000000`00000000 fffffa80`15339000 : nt!KiPageFault+0x260 fffff880`0313d270 fffff880`0313d430 : fffff880`0313d430 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 : nvlddmkm+0xcec16 fffff880`0313d278 fffff880`0313d430 : 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 : 0xfffff880`0313d430 fffff880`0313d280 00000000`00000000 : fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 00000000`00000000 : 0xfffff880`0313d430 STACK_COMMAND: kb FOLLOWUP_IP: nvlddmkm+cec16 fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nvlddmkm+cec16 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nvlddmkm IMAGE_NAME: nvlddmkm.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ee42661 FAILURE_BUCKET_ID: X64_0xD1_nvlddmkm+cec16 BUCKET_ID: X64_0xD1_nvlddmkm+cec16 Followup: MachineOwner ---------
  16. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-35271-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`03296e70 Debug session time: Tue Jan 3 13:47:56.728 2012 (UTC - 7:00) System Uptime: 0 days 16:41:41.070 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff96002305470, 0, fffff96000135093, 2} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff96002305470, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff96000135093, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033010e0 fffff96002305470 FAULTING_IP: win32k!NtUserCallOneParam+23 fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: iexplore.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff8800e2f3a60 -- (.trap 0xfffff8800e2f3a60) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8015e77300 rdx=000000000000002e rsi=0000000000000000 rdi=0000000000000000 rip=fffff96000135093 rsp=fffff8800e2f3bf0 rbp=fffff8800e2f3ca0 r8=0000000000000002 r9=0000000000000006 r10=fffff96000135070 r11=000000007ef23000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po cy win32k!NtUserCallOneParam+0x23: fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470] ds:015c:fffff960`02305470=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800031487d2 to fffff800030c95c0 STACK_TEXT: fffff880`0e2f38f8 fffff800`031487d2 : 00000000`00000050 fffff960`02305470 00000000`00000000 fffff880`0e2f3a60 : nt!KeBugCheckEx fffff880`0e2f3900 fffff800`030c76ae : 00000000`00000000 00000000`00000407 fffffa80`16d64b00 fffff800`03243e80 : nt! ?? ::FNODOBFM::`string'+0x40d80 fffff880`0e2f3a60 fffff960`00135093 : fffffa80`16d64b60 fffff880`0e2f3ca0 00000000`00000100 00000000`00000000 : nt!KiPageFault+0x16e fffff880`0e2f3bf0 fffff800`030c8813 : fffffa80`16d64b60 00000000`0aebc3a0 00000000`00000000 fffffa80`14578e10 : win32k!NtUserCallOneParam+0x23 fffff880`0e2f3c20 00000000`748cfdfa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`10a5e018 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748cfdfa STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k fffff96000135098 - win32k!NtUserCallOneParam+28 [ 00:02 ] 1 error : !win32k (fffff96000135098) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  17. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-37019-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`0324ae70 Debug session time: Tue Jan 3 19:57:21.653 2012 (UTC - 7:00) System Uptime: 0 days 4:18:15.058 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 86682, 0, 86702} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 0000000000086682, page frame number Arg3: 0000000000000000, current page state Arg4: 0000000000086702, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: Bridge.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff8000310d13c to fffff8000307d5c0 STACK_TEXT: fffff880`0fcae778 fffff800`0310d13c : 00000000`0000004e 00000000`00000099 00000000`00086682 00000000`00000000 : nt!KeBugCheckEx fffff880`0fcae780 fffff800`030ef600 : 00000000`00000000 fffff680`0013f1c8 00000000`00000000 fffff800`031f7e80 : nt!MiBadShareCount+0x4c fffff880`0fcae7c0 fffff800`030ae251 : 00000000`00000000 fffff680`0013f2f0 fffffa80`14ca6b30 fffff900`c0218d80 : nt! ?? ::FNODOBFM::`string'+0x31e8a fffff880`0fcae970 fffff800`030befba : 00000000`00000000 00000000`27e5efff fffffa80`00000000 fffffa80`14ca6b30 : nt!MiDeleteVirtualAddresses+0x408 fffff880`0fcaeb30 fffff800`0307c813 : ffffffff`ffffffff 00000000`07c3e810 00000000`07c3e808 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0fcaec20 00000000`7783f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`07c3e7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7783f89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`0310d13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
The main things that stand out are: memory_corruption, hardware, a few memory_corruption related to NTFS (your hard drive) errors, and a couple display card related crashes. Do the following:
  1. Note: If you are overclocking any hardware, stop by resetting your BIOS to defaults and removing overclocking through any software in Windows
  2. For your memory issues, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
  3. Follow the steps in Stop 0x124 - what it means and what to try for your hardware stop
  4. Run Disk Check with both boxes checked to fix any hard drive errors (may want to run overnight if you have a large drive as it takes a while)
  5. For the display card problems:
    a. Download and install Driver Sweeper
    b. Download the latest driver for your display card
    c. Click Start Menu
    d. Right Click My Computer
    e. Click Manage
    f. Click Device Manager from the list on the left
    g. Click the + next to Display adapter
    h. Right click your display/graphics card device
    i. Click Uninstall
    j. Check the box to Delete driver software for the device
    k. Click OK
    l. Restart your computer in safe mode
    m. Run Driver Sweeper, select display card manufacturer's drivers, analyze, clean
    n. Restart your computer
    o. Install the latest drivers
My System SpecsSystem Spec
03 Jan 2012   #6

windows 7 64 bit
 
 

Quote   Quote: Originally Posted by writhziden View Post
Code:
  1. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122311-33977-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe70 Debug session time: Fri Dec 23 14:47:04.123 2011 (UTC - 7:00) System Uptime: 0 days 1:06:24.465 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C4, {91, 0, fffffa80145ef060, 0} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4894 ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_DETECTED_VIOLATION (c4) A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes. Arguments: Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by the operating system. The only supported way to extend a kernel mode stack is by using KeExpandKernelStackAndCallout. Arg2: 0000000000000000 Arg3: fffffa80145ef060 Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0xc4_91 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff880073e1178 -- (.exr 0xfffff880073e1178) ExceptionAddress: fffff880012c22df (Ntfs!NtfsAllocateClusters+0x000000000000016b) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000 Attempt to read from address 0000000000000000 TRAP_FRAME: fffff880073e1220 -- (.trap 0xfffff880073e1220) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80145393e8 rdx=fffffa80145393e8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880012c22df rsp=fffff880073e13b0 rbp=fffff880093e1960 r8=fffffa801453a990 r9=0000000000000000 r10=074a5f2000008660 r11=000000000000013b r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po cy Ntfs!NtfsAllocateClusters+0x16b: fffff880`012c22df 488b00 mov rax,qword ptr [rax] ds:00000000`00000000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002f2717a to fffff80002ed25c0 STACK_TEXT: fffff880`073e0288 fffff800`02f2717a : 00000000`000000c4 00000000`00000091 00000000`00000000 fffffa80`145ef060 : nt!KeBugCheckEx fffff880`073e0290 fffff800`02eff573 : 00000000`00000000 00000000`00000000 00000000`00000003 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4894 fffff880`073e02d0 fffff800`02f0c8cf : fffff880`073e1178 fffff880`073e0ee0 fffff880`073e1220 fffffa80`14539180 : nt!RtlDispatchException+0x33 fffff880`073e09b0 fffff800`02ed1c02 : fffff880`073e1178 fffff8a0`00206b70 fffff880`073e1220 fffffa80`140d32c0 : nt!KiDispatchException+0x16f fffff880`073e1040 fffff800`02ed077a : 00000000`00000000 fffff8a0`00206b70 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`073e1220 fffff880`012c22df : fffff8a0`00206b70 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a fffff880`073e13b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsAllocateClusters+0x16b STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+4894 fffff800`02f2717a cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4894 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894 BUCKET_ID: X64_0xc4_91_nt!_??_::FNODOBFM::_string_+4894 Followup: MachineOwner ---------
  2. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35630-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e63000 PsLoadedModuleList = 0xfffff800`030a0e70 Debug session time: Fri Dec 23 22:10:51.367 2011 (UTC - 7:00) System Uptime: 0 days 7:21:59.756 Loading Kernel Symbols ............................................................... ................................................................ ................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800ce713e8, fffff8800ce70c50, fffff880012c82dd} *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800ce713e8 Arg3: fffff8800ce70c50 Arg4: fffff880012c82dd Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800ce713e8 -- (.exr 0xfffff8800ce713e8) ExceptionAddress: fffff880012c82dd (Ntfs!NtfsCommonCleanup+0x0000000000000bcd) ExceptionCode: c000001d (Illegal instruction) ExceptionFlags: 00000000 NumberParameters: 0 CONTEXT: fffff8800ce70c50 -- (.cxr 0xfffff8800ce70c50) rax=000000001f59fbba rbx=fffff8a0089e1a90 rcx=0000000000004c58 rdx=fffffa8016497b60 rsi=fffff8a0089e1bc0 rdi=fffff8800ce71c10 rip=fffff880012c82dd rsp=fffff8800ce71620 rbp=fffffa80133fcb30 r8=0000000000000000 r9=0000000000000000 r10=01ccc1fa67c25224 r11=fffff8800ce71600 r12=0000000000000004 r13=0000000000000000 r14=0000000000000007 r15=fffff8a0089e1e10 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 Ntfs!NtfsCommonCleanup+0xbcd: fffff880`012c82dd 82 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x24 PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. LAST_CONTROL_TRANSFER: from fffff88001239829 to fffff880012c82dd STACK_TEXT: fffff880`0ce71620 fffff880`01239829 : 00000000`00000001 fffff800`030074d3 fffff880`0ce71b70 fffff880`0ce61000 : Ntfs!NtfsCommonCleanup+0xbcd fffff880`0ce71a30 fffff800`02ee2cda : fffff880`0ce71b70 00000000`20206f49 00000000`00f800c4 fffff8a0`09fb7660 : Ntfs!NtfsCommonCleanupCallout+0x19 fffff880`0ce71a60 fffff880`012393e2 : fffff880`01239810 fffff880`0ce71b70 fffff8a0`00001900 fffffa80`146ad600 : nt!KeExpandKernelStackAndCalloutEx+0xda fffff880`0ce71b40 fffff880`012d8324 : fffff880`0ce71c10 fffff880`0ce71c10 fffff880`0ce71c10 fffffa80`167ebc10 : Ntfs!NtfsCommonCleanupOnNewStack+0x42 fffff880`0ce71bb0 fffff880`010b56af : fffff880`0ce71c10 fffffa80`167ebc10 fffffa80`1445ade0 00000000`00000000 : Ntfs!NtfsFsdCleanup+0x144 fffff880`0ce71e20 fffff800`031e688f : fffffa80`167ebc10 fffffa80`133fcb30 00000000`00000000 fffffa80`16026740 : fltmgr!FltpDispatch+0x9f fffff880`0ce71e80 fffff800`031cc754 : 00000000`00000001 fffffa80`172d3b30 fffffa80`000004d8 fffffa80`00000000 : nt!IopCloseFile+0x11f fffff880`0ce71f10 fffff800`031e6381 : fffffa80`172d3b30 fffffa80`00000001 fffff8a0`000019f0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4 fffff880`0ce71f90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCloseHandleTableEntry+0xb1 CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs fffff880012c82d8 - Ntfs!NtfsCommonCleanup+bc8 [ 0f:0d ] 1 error : !Ntfs (fffff880012c82d8) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800ce70c50 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  3. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34273-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e19000 PsLoadedModuleList = 0xfffff800`03056e70 Debug session time: Fri Dec 23 22:19:49.249 2011 (UTC - 7:00) System Uptime: 0 days 0:03:43.592 Loading Kernel Symbols ............................................................... ................................................................ .................. Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002e3d7f5, fffff8800b2b50e0, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002e3d7f5, Address of the instruction which caused the bugcheck Arg3: fffff8800b2b50e0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!NtResetWriteWatch+1e5 fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h] CONTEXT: fffff8800b2b50e0 -- (.cxr 0xfffff8800b2b50e0) rax=e2900005ffe22825 rbx=0000000000000000 rcx=fffff68000014400 rdx=fffff6fb7dbed000 rsi=fffffa8016c96b60 rdi=0000000000000000 rip=fffff80002e3d7f5 rsp=fffff8800b2b5ab0 rbp=fffff68000014408 r8=0000000000000001 r9=0000000000000001 r10=0000000000000002 r11=fffffffffffb3410 r12=0000000002881000 r13=fffff6fb400000a0 r14=0000000000000000 r15=fffffa8016c53ec8 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!NtResetWriteWatch+0x1e5: fffff800`02e3d7f5 488b740440 mov rsi,qword ptr [rsp+rax+40h] ss:0018:e28ff886`0b0d8315=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: sidebar.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002e88813 to fffff80002e3d7f5 STACK_TEXT: fffff880`0b2b5ab0 fffff800`02e88813 : ffffffff`ffffffff fffff680`00014400 fffffa80`16c96b60 fffffa80`16c53b30 : nt!NtResetWriteWatch+0x1e5 fffff880`0b2b5c20 00000000`77000b0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`02d8efc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77000b0a CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80002e3d7f8 - nt!NtResetWriteWatch+1e8 [ 24:04 ] 1 error : !nt (fffff80002e3d7f8) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800b2b50e0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  4. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-22261-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e5c000 PsLoadedModuleList = 0xfffff800`03099e70 Debug session time: Sat Dec 24 11:04:51.092 2011 (UTC - 7:00) System Uptime: 0 days 2:07:50.450 Loading Kernel Symbols ............................................................... ................................................................ .................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 4a7988, 3, 569c07} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000004a7988, page frame number Arg3: 0000000000000003, current page state Arg4: 0000000000569c07, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AfterFX.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f5c13c to fffff80002ecc5c0 STACK_TEXT: fffff880`0df1e058 fffff800`02f5c13c : 00000000`0000004e 00000000`00000099 00000000`004a7988 00000000`00000003 : nt!KeBugCheckEx fffff880`0df1e060 fffff800`02e7c5df : fffffa80`095ed850 00000000`00000001 fffffa80`0df6c980 fffff683`ffc3eff8 : nt!MiBadShareCount+0x4c fffff880`0df1e0a0 fffff800`02efd7b5 : fffffa80`16d5bb30 000007ff`87dff000 d3f00003`52f58c46 fffff8a0`0237acf0 : nt! ?? ::FNODOBFM::`string'+0x204a1 fffff880`0df1e1b0 fffff800`02f0dfba : 00000000`00000000 000007ff`89bf7fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x96c fffff880`0df1e370 fffff800`02ecb813 : ffffffff`ffffffff 00000000`0082ad78 00000000`0082ad70 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0df1e460 00000000`778bf89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0082ad38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778bf89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f5c13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  5. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-35833-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e54000 PsLoadedModuleList = 0xfffff800`03091e70 Debug session time: Sat Dec 24 12:40:41.825 2011 (UTC - 7:00) System Uptime: 0 days 1:33:56.230 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 534698, 0, 52f918} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 7: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 0000000000534698, page frame number Arg3: 0000000000000000, current page state Arg4: 000000000052f918, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: Setup.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f5413c to fffff80002ec45c0 STACK_TEXT: fffff880`1447a778 fffff800`02f5413c : 00000000`0000004e 00000000`00000099 00000000`00534698 00000000`00000000 : nt!KeBugCheckEx fffff880`1447a780 fffff800`02f36600 : 00000000`00000000 fffff680`00058e50 00000000`00000000 00000000`00000004 : nt!MiBadShareCount+0x4c fffff880`1447a7c0 fffff800`02ef5251 : 00000000`00000000 fffff680`00058ff8 fffffa80`178a7060 fffff880`1447aca0 : nt! ?? ::FNODOBFM::`string'+0x31e8a fffff880`1447a970 fffff800`02f05fba : 00000000`00000000 00000000`0b229fff fffffa80`00000000 fffffa80`178a7060 : nt!MiDeleteVirtualAddresses+0x408 fffff880`1447ab30 fffff800`02ec3813 : ffffffff`ffffffff 00000000`0013e030 00000000`0013e028 fffff900`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`1447ac20 00000000`77a0f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0013dff8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a0f89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f5413c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  6. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-73866-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e04000 PsLoadedModuleList = 0xfffff800`03041e70 Debug session time: Sat Dec 24 13:03:58.868 2011 (UTC - 7:00) System Uptime: 0 days 0:18:55.289 Loading Kernel Symbols .............................................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800fb423e8, fffff8800fb41c50, fffff800031551c6} Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800fb423e8 Arg3: fffff8800fb41c50 Arg4: fffff800031551c6 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800fb423e8 -- (.exr 0xfffff8800fb423e8) Cannot read Exception record @ fffff8800fb423e8 CONTEXT: fffff8800fb41c50 -- (.cxr 0xfffff8800fb41c50) Unable to read context, Win32 error 0n30 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x24 PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002e820ca to fffff880041cf9c2 STACK_TEXT: fffff800`043ecc98 fffff800`02e820ca : 00000000`00298420 fffffa80`1527f8c8 fffff800`02ffcc40 00000000`00000001 : 0xfffff880`041cf9c2 fffff800`043ecca0 fffff800`02e7cd5c : fffff800`02feee80 fffff800`00000000 00000000`00000000 fffff880`10bc44d0 : nt!PoIdle+0x53a fffff800`043ecd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003155118 - nt!IoCheckShareAccessEx+78 [ 00:02 ] 1 error : !nt (fffff80003155118) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800fb41c50 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  7. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-23134-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030a2e70 Debug session time: Sat Dec 24 13:18:15.595 2011 (UTC - 7:00) System Uptime: 0 days 0:13:10.000 Loading Kernel Symbols ............................................................... ................................................................ ................ Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 61bd07, 2, 61be07} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 000000000061bd07, page frame number Arg3: 0000000000000002, current page state Arg4: 000000000061be07, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: nvvsvc.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f6513c to fffff80002ed55c0 STACK_TEXT: fffff880`0b4b7f28 fffff800`02f6513c : 00000000`0000004e 00000000`00000099 00000000`0061bd07 00000000`00000002 : nt!KeBugCheckEx fffff880`0b4b7f30 fffff800`02f4794e : 00000000`00000000 fffff680`00000fd8 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c fffff880`0b4b7f70 fffff800`02ea9bb3 : fffffa80`1578f930 fffff700`00000574 0000007f`fffffff8 fffff8a0`00133178 : nt! ?? ::FNODOBFM::`string'+0x321f5 fffff880`0b4b8000 fffff800`02ea860e : fffffa80`1578f930 fffffa80`00000000 fffff8a0`0000020d fffff880`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307 fffff880`0b4b88b0 fffff800`031b7a8b : fffff8a0`00d19610 fffff880`0b4b8c20 00000000`00000000 fffffa80`1522a060 : nt!MmCleanProcessAddressSpace+0x96 fffff880`0b4b8900 fffff800`03190131 : 00000000`00000000 00000000`00000001 000007ff`fffd3000 00000000`00000000 : nt!PspExitThread+0x92f fffff880`0b4b89c0 fffff800`02eb211b : fffffa80`1522b890 fffff880`0b4b8ca0 fffffa80`15b3c4e0 fffff800`031edb7e : nt!PsExitSpecialApc+0x1d fffff880`0b4b89f0 fffff800`02eb2560 : 00000000`00000000 fffff880`0b4b8a70 fffff800`031901b8 00000000`00000001 : nt!KiDeliverApc+0x2eb fffff880`0b4b8a70 fffff800`02ed48b7 : 00000000`000004a0 00000000`0114f170 00000000`00000000 0000007f`ffffffff : nt!KiInitiateUserApc+0x70 fffff880`0b4b8bb0 00000000`76fafa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c 00000000`0114fe58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fafa4a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f6513c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  8. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-34881-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e70 Debug session time: Sat Dec 24 14:22:42.598 2011 (UTC - 7:00) System Uptime: 0 days 0:31:35.003 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c000001d, fffff880010287ed, fffff88009706720, 0} Probably caused by : hardware ( fltmgr!FltpNormalizeNameFromCache+1d ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c000001d, Exception code that caused the bugcheck Arg2: fffff880010287ed, Address of the instruction which caused the bugcheck Arg3: fffff88009706720, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. FAULTING_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? CONTEXT: fffff88009706720 -- (.cxr 0xfffff88009706720) rax=0000000000000000 rbx=0000000000000040 rcx=fffffa8013c97bf0 rdx=0000000000000080 rsi=fffffa8013c97bf0 rdi=0000000000000040 rip=fffff880010287ed rsp=fffff880097070f0 rbp=0000000000000017 r8=000000000000002e r9=fffffa8016e925e0 r10=0000000000000051 r11=fffff88009707208 r12=0000000000000000 r13=fffffa8013886401 r14=fffffa8014764668 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 fltmgr!FltpNormalizeNameFromCache+0x1d: fffff880`010287ed d9 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 MISALIGNED_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880010287ed STACK_TEXT: fffff880`097070f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpNormalizeNameFromCache+0x1d FOLLOWUP_IP: fltmgr!FltpNormalizeNameFromCache+1d fffff880`010287ed d9 ??? SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: fltmgr!FltpNormalizeNameFromCache+1d FOLLOWUP_NAME: MachineOwner IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: .cxr 0xfffff88009706720 ; kb MODULE_NAME: hardware FAILURE_BUCKET_ID: X64_IP_MISALIGNED BUCKET_ID: X64_IP_MISALIGNED Followup: MachineOwner ---------
  9. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-42229-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70 Debug session time: Sat Dec 24 17:32:50.778 2011 (UTC - 7:00) System Uptime: 0 days 1:30:29.821 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 3b8202, 3, 575d1b} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000003b8202, page frame number Arg3: 0000000000000003, current page state Arg4: 0000000000575d1b, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AfterFX.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff80002f1e13c to fffff80002e8e5c0 STACK_TEXT: fffff880`0ebb2778 fffff800`02f1e13c : 00000000`0000004e 00000000`00000099 00000000`003b8202 00000000`00000003 : nt!KeBugCheckEx fffff880`0ebb2780 fffff800`02f00609 : 00000000`00000000 fffff683`fdae8de0 00000000`00000000 fffff700`0363cff8 : nt!MiBadShareCount+0x4c fffff880`0ebb27c0 fffff800`02ebf251 : fffff700`01080000 fffff683`fdae8ff8 fffffa80`16be1ab0 fffffa80`16be1ab0 : nt! ?? ::FNODOBFM::`string'+0x31e93 fffff880`0ebb2970 fffff800`02ecffba : 00000000`00000000 000007fb`5d38bfff fffffa80`00000000 fffffa80`16be1ab0 : nt!MiDeleteVirtualAddresses+0x408 fffff880`0ebb2b30 fffff800`02e8d813 : ffffffff`ffffffff 00000000`00828968 00000000`00828960 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0ebb2c20 00000000`770af89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`00828928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770af89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`02f1e13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
  10. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122411-21418-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e51000 PsLoadedModuleList = 0xfffff800`0308ee70 Debug session time: Sat Dec 24 17:58:53.887 2011 (UTC - 7:00) System Uptime: 0 days 0:24:26.292 Loading Kernel Symbols .............................................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 4eb143, 2, 4ed2c2} Probably caused by : ntkrnlmp.exe ( nt!PoIdle+53a ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 00000000004eb143, page frame number Arg3: 0000000000000002, current page state Arg4: 00000000004ed2c2, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002ecf0ca to fffff88003ce09c2 STACK_TEXT: fffff800`00b9cc98 fffff800`02ecf0ca : 00000000`00298465 fffffa80`15428dd8 fffffa80`1554e480 fffffa80`13a04170 : 0xfffff880`03ce09c2 fffff800`00b9cca0 fffff800`02ec9d5c : fffff800`0303be80 fffff800`00000000 00000000`00000000 fffff880`0fe55480 : nt!PoIdle+0x53a fffff800`00b9cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x2c STACK_COMMAND: kb FOLLOWUP_IP: nt!PoIdle+53a fffff800`02ecf0ca 0fba25761518000f bt dword ptr [nt!PerfGlobalGroupMask+0x8 (fffff800`03050648)],0Fh SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!PoIdle+53a FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a BUCKET_ID: X64_0x4E_99_nt!PoIdle+53a Followup: MachineOwner ---------
  11. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-25053-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`03092e70 Debug session time: Mon Dec 26 07:23:45.366 2011 (UTC - 7:00) System Uptime: 0 days 0:02:00.709 Loading Kernel Symbols ............................................................... ................................................................ ................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {15, 2, 1, fffff80002ecd7e0} Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys Probably caused by : memory_corruption Followup: memory_corruption --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000015, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002ecd7e0, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fd0e0 0000000000000015 CURRENT_IRQL: 2 FAULTING_IP: nt!KiSearchForNewThread+2d0 fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0xA PROCESS_NAME: BitCometServic TRAP_FRAME: fffff8801349c780 -- (.trap 0xfffff8801349c780) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000006 rbx=0000000000000000 rcx=0000000000000000 rdx=fffff88002f68700 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ecd7e0 rsp=fffff8801349c910 rbp=0000000000000100 r8=fffffa801722f820 r9=0000000000000008 r10=0000000000000000 r11=fffff88003115101 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!KiSearchForNewThread+0x2d0: fffff800`02ecd7e0 d0480f ror byte ptr [rax+0Fh],1 ds:0001:00000000`00000015=?? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002ec4b29 to fffff80002ec55c0 STACK_TEXT: fffff880`1349c638 fffff800`02ec4b29 : 00000000`0000000a 00000000`00000015 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`1349c640 fffff800`02ec37a0 : 00000000`00000002 fffffa80`1722f780 fffffa80`133ab100 fffff800`02fcef6e : nt!KiBugCheckDispatch+0x69 fffff880`1349c780 fffff800`02ecd7e0 : fffff880`1349cdb0 fffffa80`17029660 fffff800`03042968 00000000`00000000 : nt!KiPageFault+0x260 fffff880`1349c910 fffff800`02ecc68c : fffffa80`17029660 fffffa80`17029660 00000000`00000000 00000000`00000006 : nt!KiSearchForNewThread+0x2d0 fffff880`1349c980 fffff800`02eceb9f : fffffa80`1711c270 00000000`00000000 00000000`00000059 00000000`00000002 : nt!KiCommitThreadWait+0x17c fffff880`1349ca10 fffff800`02e8e222 : fffffa80`15dd3100 00000000`0000001b 00000000`00010200 fffff880`03115100 : nt!KeWaitForSingleObject+0x19f fffff880`1349cab0 fffff800`02ecd44c : ffffffff`ffb3b4c0 fffffa80`1503c820 fffffa80`15dd31a0 fffff900`c0904370 : nt!ExpWaitForResource+0xae fffff880`1349cb20 fffff800`02ed1077 : 00000000`72173e30 fffffa80`17029660 00000000`00000000 fffff800`031bcf1c : nt!ExAcquireResourceExclusiveLite+0x14f fffff880`1349cb90 fffff960`00171be9 : fffff880`1349cbf8 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 : nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x23 fffff880`1349cbc0 fffff880`1349cbf8 : 00000000`00000000 fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 : win32k+0xd1be9 fffff880`1349cbc8 00000000`00000000 : fffff800`0303fe80 fffff880`1349cc38 00000000`00000000 00000000`00000000 : 0xfffff880`1349cbf8 STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80002ecd7e0 - nt!KiSearchForNewThread+2d0 [ f0:d0 ] 1 error : !nt (fffff80002ecd7e0) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  12. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122611-44803-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`02e1e000 PsLoadedModuleList = 0xfffff800`0305be70 Debug session time: Mon Dec 26 09:18:41.374 2011 (UTC - 7:00) System Uptime: 0 days 0:17:05.401 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c000001d, fffff8000318325d, fffff8800baf3ef0, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c000001d, Exception code that caused the bugcheck Arg2: fffff8000318325d, Address of the instruction which caused the bugcheck Arg3: fffff8800baf3ef0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. FAULTING_IP: nt!ObpCreateHandle+fd fffff800`0318325d 82 ??? CONTEXT: fffff8800baf3ef0 -- (.cxr 0xfffff8800baf3ef0) rax=000000001f59f9ba rbx=fffffa80182503a0 rcx=0000000000000000 rdx=fffffa8019549560 rsi=0000000000000040 rdi=fffff8a000db7c50 rip=fffff8000318325d rsp=fffff8800baf48c0 rbp=fffff80002e1e000 r8=0000000000000000 r9=0000000000000001 r10=0000000000000001 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000001 r15=fffff80003040300 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!ObpCreateHandle+0xfd: fffff800`0318325d 82 ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff8000318325d STACK_TEXT: fffff880`0baf48c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0xfd CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003183258 - nt!ObpCreateHandle+f8 [ 0f:0d ] 1 error : !nt (fffff80003183258) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800baf3ef0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  13. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-17955-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`0325ce70 Debug session time: Wed Dec 28 06:34:07.112 2011 (UTC - 7:00) System Uptime: 0 days 0:06:08.454 Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800c18c048, fffff8800c18b8b0, fffff8800121ebc3} Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800c18c048 Arg3: fffff8800c18b8b0 Arg4: fffff8800121ebc3 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800c18c048 -- (.exr 0xfffff8800c18c048) ExceptionAddress: fffff8800121ebc3 (Ntfs!NtfsCommonRead+0x00000000000000c3) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000005 Attempt to read from address 0000000000000005 CONTEXT: fffff8800c18b8b0 -- (.cxr 0xfffff8800c18b8b0) rax=0000000000000001 rbx=fffff8a00352a140 rcx=0000000000000001 rdx=0000000000000080 rsi=0000000000000000 rdi=0000000000000201 rip=fffff8800121ebc3 rsp=fffff8800c18c280 rbp=fffff8800c18c450 r8=fffffa80138b8c10 r9=0000000000000000 r10=fffffa80138b8fb0 r11=fffff8800c18c418 r12=0000000000000000 r13=fffff8a00352a140 r14=0000000000000000 r15=fffffa8013a5ca40 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 Ntfs!NtfsCommonRead+0xc3: fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 ds:002b:00000000`00000005=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000005 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c70e0 0000000000000005 FOLLOWUP_IP: Ntfs!NtfsCommonRead+c3 fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 FAULTING_IP: Ntfs!NtfsCommonRead+c3 fffff880`0121ebc3 f6410401 test byte ptr [rcx+4],1 BUGCHECK_STR: 0x24 DEFAULT_BUCKET_ID: CODE_CORRUPTION LAST_CONTROL_TRANSFER: from fffff88001221cf8 to fffff8800121ebc3 STACK_TEXT: fffff880`0c18c280 fffff880`01221cf8 : fffffa80`13a5ca40 fffffa80`138b8c10 fffff880`0c18c450 fffffa80`13c31600 : Ntfs!NtfsCommonRead+0xc3 fffff880`0c18c420 fffff880`010c823f : fffffa80`138b8fb0 fffffa80`138b8c10 fffffa80`13c31650 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8 fffff880`0c18c4d0 fffff880`010c66df : fffffa80`143fab60 fffffa80`138b8c10 fffffa80`143fab00 fffffa80`138b8c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`0c18c560 fffff800`030810c2 : fffffa80`138b8c30 fffffa80`13839c00 00000000`00000403 fffff8a0`03db0f68 : fltmgr!FltpDispatch+0xcf fffff880`0c18c5c0 fffff800`0332be37 : fffffa80`13acb300 fffffa80`13acb300 fffffa80`15174f51 00000000`00000001 : nt!IoPageRead+0x252 fffff880`0c18c650 fffff800`032ec1fb : 00000000`00000001 00000000`00000001 fffffa80`16e66430 00000000`00000007 : nt!MiPfExecuteReadList+0xff fffff880`0c18c6b0 fffff800`034ed67d : 00000000`00000018 00000000`00000018 fffffa80`16e66430 fffff880`0c18c778 : nt!MmPrefetchPages+0xfb fffff880`0c18c710 fffff800`034f569e : fffff8a0`00000000 fffff8a0`00000000 fffff8a0`0000012d fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x21d fffff880`0c18c810 fffff800`034f6237 : 00000000`00000000 fffff880`0c18cca0 fffff880`0c18ca08 fffff8a0`00fbe060 : nt!PfpPrefetchRequestPerform+0x30e fffff880`0c18c960 fffff800`0350280e : fffff880`0c18ca08 00000000`00000001 fffffa80`16ff63f0 00000000`00000000 : nt!PfpPrefetchRequest+0x176 fffff880`0c18c9d0 fffff800`03506f3e : 00000000`00000000 00000000`0f2ff410 00000000`0000004f fffffa80`1543fb01 : nt!PfSetSuperfetchInformation+0x1ad fffff880`0c18cab0 fffff800`0308e813 : fffffa80`137e0b60 00000000`00000000 00000000`00000001 00000000`00000001 : nt!NtSetSystemInformation+0xb91 fffff880`0c18cc20 00000000`76e00daa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0f2ff3e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e00daa CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs fffff8800121eb58 - Ntfs!NtfsCommonRead+58 [ 85:87 ] 1 error : !Ntfs (fffff8800121eb58) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800c18b8b0 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  14. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\122811-36644-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03249e70 Debug session time: Wed Dec 28 12:17:19.795 2011 (UTC - 7:00) System Uptime: 0 days 0:28:08.278 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff30027bb9440, 0, fffff80003093798, 7} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff30027bb9440, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff80003093798, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000007, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032b40e0 fffff30027bb9440 FAULTING_IP: nt!KeAcquireGuardedMutex+28 fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h] MM_INTERNAL_CODE: 7 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: mscorsvw.exe CURRENT_IRQL: 0 DEVICE_OBJECT: fffffa8016512ff8 TRAP_FRAME: fffff88011564270 -- (.trap 0xfffff88011564270) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80146783e8 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80003093798 rsp=fffff88011564400 rbp=fffffa8016655010 r8=fffffa8017881018 r9=fffff88011564438 r10=0000000000000000 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac po cy nt!KeAcquireGuardedMutex+0x28: fffff800`03093798 4a8b5c2430 mov rbx,qword ptr [rsp+r12+30h] ss:0018:fffff880`11564430=fffff8a0114a0750 Resetting default scope LAST_CONTROL_TRANSFER: from fffff800030fb729 to fffff8000307c5c0 STACK_TEXT: fffff880`11564108 fffff800`030fb729 : 00000000`00000050 fffff300`27bb9440 00000000`00000000 fffff880`11564270 : nt!KeBugCheckEx fffff880`11564110 fffff800`0307a6ae : 00000000`00000000 fffffa80`146783e8 fffff8a0`114a0700 fffffa80`16655010 : nt! ?? ::FNODOBFM::`string'+0x40ccb fffff880`11564270 fffff800`03093798 : 00000000`00000000 00000000`00000000 fffffa80`14678180 fffffa80`16655010 : nt!KiPageFault+0x16e fffff880`11564400 fffff880`012ea268 : fffff8a0`114a0750 00000000`00000000 00000000`0000119e 00000000`00001119 : nt!KeAcquireGuardedMutex+0x28 fffff880`11564430 fffff880`012e51d9 : fffffa80`16655010 fffffa80`14678180 fffff8a0`114a0620 00000000`00001119 : Ntfs!NtfsAllocateClusters+0xf4 fffff880`11564570 fffff880`01245750 : fffffa80`16655010 fffffa80`165821c0 00000000`00000001 00000000`00001119 : Ntfs!NtfsAddAllocation+0x299 fffff880`11564680 fffff880`01243791 : 00000000`00000000 fffff880`115648c0 00000000`00000000 00000000`00000000 : Ntfs!NtfsAddAllocationForNonResidentWrite+0xfc fffff880`115646e0 fffff880`01246663 : fffffa80`16655010 fffffa80`16512c10 fffff880`11564801 fffff880`11564800 : Ntfs!NtfsCommonWrite+0x287b fffff880`11564890 fffff880`0104923f : fffffa80`16512fb0 fffffa80`16512c10 fffffa80`1664a770 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3 fffff880`11564950 fffff880`010476df : fffffa80`144268e0 00000000`00000001 fffffa80`14426800 fffffa80`16512c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`115649e0 fffff800`0338fb29 : 00000000`00000001 fffffa80`165821c0 00000000`00000001 fffffa80`16512c10 : fltmgr!FltpDispatch+0xcf fffff880`11564a40 fffff800`033908c3 : fffffa80`16512ff8 00000000`00000000 fffffa80`165821c0 fffff880`02f64180 : nt!IopSynchronousServiceTail+0xf9 fffff880`11564ab0 fffff800`0307b813 : 000007fe`f564a701 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2 fffff880`11564bb0 00000000`774af73a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`002cd538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774af73a STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt fffff80003093798 - nt!KeAcquireGuardedMutex+28 [ 48:4a ] 1 error : !nt (fffff80003093798) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  15. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010212-33368-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`03001000 PsLoadedModuleList = 0xfffff800`0323ee70 Debug session time: Mon Jan 2 20:58:57.295 2012 (UTC - 7:00) System Uptime: 0 days 5:32:37.836 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck D1, {24, 6, 1, fffff8800ff32c16} Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvlddmkm.sys *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys Probably caused by : nvlddmkm.sys ( nvlddmkm+cec16 ) Followup: MachineOwner --------- 6: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: 0000000000000024, memory referenced Arg2: 0000000000000006, IRQL Arg3: 0000000000000001, value 0 = read operation, 1 = write operation Arg4: fffff8800ff32c16, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032a90e0 0000000000000024 CURRENT_IRQL: 6 FAULTING_IP: nvlddmkm+cec16 fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xD1 PROCESS_NAME: System TRAP_FRAME: fffff8800313d0e0 -- (.trap 0xfffff8800313d0e0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8015304480 rbx=0000000000000000 rcx=fffff8800313d300 rdx=fffffdffecc80380 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8800ff32c16 rsp=fffff8800313d270 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=0000000002020000 r11=0000000000000001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc nvlddmkm+0xcec16: fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp ss:0018:fffff880`0313d2e0=0000000000000000 Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003070b29 to fffff800030715c0 STACK_TEXT: fffff880`0313cf98 fffff800`03070b29 : 00000000`0000000a 00000000`00000024 00000000`00000006 00000000`00000001 : nt!KeBugCheckEx fffff880`0313cfa0 fffff800`0306f7a0 : fffffa80`1628b330 fffff880`0313d430 fffffa80`164bd000 fffff880`04528691 : nt!KiBugCheckDispatch+0x69 fffff880`0313d0e0 fffff880`0ff32c16 : fffff880`0313d430 fffff880`0313d430 00000000`00000000 fffffa80`15339000 : nt!KiPageFault+0x260 fffff880`0313d270 fffff880`0313d430 : fffff880`0313d430 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 : nvlddmkm+0xcec16 fffff880`0313d278 fffff880`0313d430 : 00000000`00000000 fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 : 0xfffff880`0313d430 fffff880`0313d280 00000000`00000000 : fffffa80`15339000 fffff880`0ff32b92 fffffa80`15339000 00000000`00000000 : 0xfffff880`0313d430 STACK_COMMAND: kb FOLLOWUP_IP: nvlddmkm+cec16 fffff880`0ff32c16 48896c2470 mov qword ptr [rsp+70h],rbp SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nvlddmkm+cec16 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nvlddmkm IMAGE_NAME: nvlddmkm.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ee42661 FAILURE_BUCKET_ID: X64_0xD1_nvlddmkm+cec16 BUCKET_ID: X64_0xD1_nvlddmkm+cec16 Followup: MachineOwner ---------
  16. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-35271-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`03059000 PsLoadedModuleList = 0xfffff800`03296e70 Debug session time: Tue Jan 3 13:47:56.728 2012 (UTC - 7:00) System Uptime: 0 days 16:41:41.070 Loading Kernel Symbols ............................................................... ................................................................ ..................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff96002305470, 0, fffff96000135093, 2} Could not read faulting driver name Probably caused by : memory_corruption Followup: memory_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff96002305470, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff96000135093, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033010e0 fffff96002305470 FAULTING_IP: win32k!NtUserCallOneParam+23 fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470] MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x50 PROCESS_NAME: iexplore.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff8800e2f3a60 -- (.trap 0xfffff8800e2f3a60) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8015e77300 rdx=000000000000002e rsi=0000000000000000 rdi=0000000000000000 rip=fffff96000135093 rsp=fffff8800e2f3bf0 rbp=fffff8800e2f3ca0 r8=0000000000000002 r9=0000000000000006 r10=fffff96000135070 r11=000000007ef23000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po cy win32k!NtUserCallOneParam+0x23: fffff960`00135093 ff15d7031d02 call qword ptr [fffff960`02305470] ds:015c:fffff960`02305470=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800031487d2 to fffff800030c95c0 STACK_TEXT: fffff880`0e2f38f8 fffff800`031487d2 : 00000000`00000050 fffff960`02305470 00000000`00000000 fffff880`0e2f3a60 : nt!KeBugCheckEx fffff880`0e2f3900 fffff800`030c76ae : 00000000`00000000 00000000`00000407 fffffa80`16d64b00 fffff800`03243e80 : nt! ?? ::FNODOBFM::`string'+0x40d80 fffff880`0e2f3a60 fffff960`00135093 : fffffa80`16d64b60 fffff880`0e2f3ca0 00000000`00000100 00000000`00000000 : nt!KiPageFault+0x16e fffff880`0e2f3bf0 fffff800`030c8813 : fffffa80`16d64b60 00000000`0aebc3a0 00000000`00000000 fffffa80`14578e10 : win32k!NtUserCallOneParam+0x23 fffff880`0e2f3c20 00000000`748cfdfa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`10a5e018 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x748cfdfa STACK_COMMAND: kb CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k fffff96000135098 - win32k!NtUserCallOneParam+28 [ 00:02 ] 1 error : !win32k (fffff96000135098) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------
  17. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\casper10451\Windows_NT6_BSOD_jcgriff2\010312-37019-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16841.amd64fre.win7_gdr.110622-1503 Machine Name: Kernel base = 0xfffff800`0300d000 PsLoadedModuleList = 0xfffff800`0324ae70 Debug session time: Tue Jan 3 19:57:21.653 2012 (UTC - 7:00) System Uptime: 0 days 4:18:15.058 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 4E, {99, 86682, 0, 86702} Probably caused by : memory_corruption ( nt!MiBadShareCount+4c ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PFN_LIST_CORRUPT (4e) Typically caused by drivers passing bad memory descriptor lists (ie: calling MmUnlockPages twice with the same list, etc). If a kernel debugger is available get the stack trace. Arguments: Arg1: 0000000000000099, A PTE or PFN is corrupt Arg2: 0000000000086682, page frame number Arg3: 0000000000000000, current page state Arg4: 0000000000086702, 0 Debugging Details: ------------------ BUGCHECK_STR: 0x4E_99 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: Bridge.exe CURRENT_IRQL: 2 LAST_CONTROL_TRANSFER: from fffff8000310d13c to fffff8000307d5c0 STACK_TEXT: fffff880`0fcae778 fffff800`0310d13c : 00000000`0000004e 00000000`00000099 00000000`00086682 00000000`00000000 : nt!KeBugCheckEx fffff880`0fcae780 fffff800`030ef600 : 00000000`00000000 fffff680`0013f1c8 00000000`00000000 fffff800`031f7e80 : nt!MiBadShareCount+0x4c fffff880`0fcae7c0 fffff800`030ae251 : 00000000`00000000 fffff680`0013f2f0 fffffa80`14ca6b30 fffff900`c0218d80 : nt! ?? ::FNODOBFM::`string'+0x31e8a fffff880`0fcae970 fffff800`030befba : 00000000`00000000 00000000`27e5efff fffffa80`00000000 fffffa80`14ca6b30 : nt!MiDeleteVirtualAddresses+0x408 fffff880`0fcaeb30 fffff800`0307c813 : ffffffff`ffffffff 00000000`07c3e810 00000000`07c3e808 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`0fcaec20 00000000`7783f89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`07c3e7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7783f89a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiBadShareCount+4c fffff800`0310d13c cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt!MiBadShareCount+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4c Followup: MachineOwner ---------
The main things that stand out are: memory_corruption, hardware, a few memory_corruption related to NTFS (your hard drive) errors, and a couple display card related crashes. Do the following:

  1. Note: If you are overclocking any hardware, stop by resetting your BIOS to defaults and removing overclocking through any software in Windows
  2. For your memory issues, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
  3. Follow the steps in Stop 0x124 - what it means and what to try for your hardware stop
  4. Run Disk Check with both boxes checked to fix any hard drive errors (may want to run overnight if you have a large drive as it takes a while)
  5. For the display card problems:
    a. Download and install Driver Sweeper
    b. Download the latest driver for your display card
    c. Click Start Menu
    d. Right Click My Computer
    e. Click Manage
    f. Click Device Manager from the list on the left
    g. Click the + next to Display adapter
    h. Right click your display/graphics card device
    i. Click Uninstall
    j. Check the box to Delete driver software for the device
    k. Click OK
    l. Restart your computer in safe mode
    m. Run Driver Sweeper, select display card manufacturer's drivers, analyze, clean
    n. Restart your computer
    o. Install the latest drivers

thanx i will do that if it keeps happening ill let you know. and thanx for using your time to help me out
My System SpecsSystem Spec
04 Jan 2012   #7

Windows 7 Home Premium 64 Bit
 
 

Quote   Quote: Originally Posted by casper10451 View Post

thanx i will do that if it keeps happening ill let you know. and thanx for using your time to help me out
You're welcome. You should also consider updating to SP1.
Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 (KB947821) [August 2011]

Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [August 2011]

Steps to follow before you install Windows 7 Service Pack 1 from the Microsoft Download Center

Service Pack 1 Download site
Links to Service Pack 1 (SP1) and preparation for SP1 courtesy of JMH
My System SpecsSystem Spec
Reply

 Numerous bsod help!!!!




Thread Tools



Similar help and support threads for2: Numerous bsod help!!!!
Thread Forum
Numerous BSOD's, with several different error reports BSOD Help and Support
Solved numerous BSOD crashes, also while playing c&c4 BSOD Help and Support
BSOD from numerous addresses, ntoskrnl.exe #1 cause BSOD Help and Support
Numerous BSOD issues... Drivers
BSOD numerous times on a new machine BSOD Help and Support
BSOD numerous times a day! BSOD Help and Support
numerous BSOD's dmp files attached please help. BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 11:02 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33