I apologize that no one saw your thread had not received help. When you respond multiple times to your own thread, many of us helping see multiple replies and conclude that someone is already helping you.
Code:
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-25958-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c63000 PsLoadedModuleList = 0xfffff800`02ea8670
Debug session time: Sun Jan 22 14:18:14.380 2012 (UTC - 7:00)
System Uptime: 0 days 0:17:45.301
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 109b, 0, fffff8a00e223710}
GetPointerFromAddress: unable to read from fffff80002f12100
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+43a )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: fffff8a00e223710, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: fffff8a00e223710
FREED_POOL_TAG: CM39
BUGCHECK_STR: 0xc2_7_CM39
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: VSSVC.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e0dbe9 to fffff80002cdfc40
STACK_TEXT:
fffff880`08427558 fffff800`02e0dbe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`00000000 : nt!KeBugCheckEx
fffff880`08427560 fffff880`012aa27a : fffffa80`07b99180 fffff880`08427a80 fffff8a0`044a74e0 00000000`00000009 : nt!ExDeferredFreePool+0x1201
fffff880`08427610 fffff880`01299357 : fffffa80`075422d0 fffff8a0`044a7610 fffff8a0`044a74e0 fffffa80`07b99180 : Ntfs!NtfsCommonClose+0x43a
fffff880`084276e0 fffff880`01288291 : fffffa80`07b99180 00000000`00000400 fffff800`02e68901 00000000`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`084277b0 fffff880`01290fad : fffffa80`06cce010 fffffa80`07b99180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x75
fffff880`084278e0 fffff880`012916b4 : fffffa80`06cce010 fffffa80`0b1bec10 fffffa80`095189b0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`084279c0 fffff880`0108dbcf : fffffa80`0b1befb0 fffffa80`0b1bec10 fffffa80`06cce010 fffff880`084279e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`08427a30 fffff880`0108c6df : fffffa80`07940de0 00000000`00000000 fffffa80`07940d00 fffffa80`0b1bec10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`08427ac0 fffff800`02fe821b : 00000000`00000002 fffffa80`095189b0 00000000`00000000 fffffa80`0b1bec10 : fltmgr!FltpDispatch+0xcf
fffff880`08427b20 fffff800`02f7cb85 : fffffa80`0b1bec10 fffffa80`08d5db60 fffffa80`095189b0 fffff880`02fd5180 : nt!IopSynchronousServiceTail+0xfb
fffff880`08427b90 fffff800`02cdeed3 : fffffa80`08d5db60 00000000`ffe62270 fffffa80`07940de0 fffffa80`095189b0 : nt!NtFlushBuffersFile+0x171
fffff880`08427c20 00000000`774c17ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0213f848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c17ca
STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs!NtfsCommonClose+43a
fffff880`012aa27a 488b07 mov rax,qword ptr [rdi]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Ntfs!NtfsCommonClose+43a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
FAILURE_BUCKET_ID: X64_0xc2_7_CM39_Ntfs!NtfsCommonClose+43a
BUCKET_ID: X64_0xc2_7_CM39_Ntfs!NtfsCommonClose+43a
Followup: MachineOwner
---------
-
Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-22011-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0341c000 PsLoadedModuleList = 0xfffff800`03661670
Debug session time: Sun Jan 22 18:42:09.975 2012 (UTC - 7:00)
System Uptime: 0 days 1:22:36.912
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800037934ce, 0, 90}
Probably caused by : win32k.sys ( win32k!DrvEnumDisplayDevices+655 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800037934ce, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000090, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObpLookupObjectName+21e
fffff800`037934ce 498bb890000000 mov rdi,qword ptr [r8+90h]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000090
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036cb100
0000000000000090
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
BUGCHECK_STR: 0x1E_c0000005
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800af4b910 -- (.trap 0xfffff8800af4b910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000d4 rbx=0000000000000000 rcx=fffff8a0011b4db0
rdx=000000000000007a rsi=0000000000000000 rdi=0000000000000000
rip=fffff800037934ce rsp=fffff8800af4baa0 rbp=fffffa800ac461c8
r8=0000000000000000 r9=0000000000000000 r10=fffff8a00009f160
r11=00000000000f003f r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!ObpLookupObjectName+0x21e:
fffff800`037934ce 498bb890000000 mov rdi,qword ptr [r8+90h] ds:00000000`00000090=????????????????
Resetting default scope
LOCK_ADDRESS: fffff80003697b80 -- (!locks fffff80003697b80)
Resource @ nt!PiEngineLock (0xfffff80003697b80) Available
WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.
WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.
1 total locks
PNP_TRIAGE:
Lock address : 0xfffff80003697b80
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff800034e4588 to fffff80003498c40
STACK_TEXT:
fffff880`0af4b088 fffff800`034e4588 : 00000000`0000001e ffffffff`c0000005 fffff800`037934ce 00000000`00000000 : nt!KeBugCheckEx
fffff880`0af4b090 fffff800`034982c2 : fffff880`0af4b868 fffff800`0341c000 fffff880`0af4b910 fffff8a0`0009f130 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0af4b730 fffff800`03496e3a : 00000000`00000000 00000000`00000090 00000000`00000000 fffff800`0341c000 : nt!KiExceptionDispatch+0xc2
fffff880`0af4b910 fffff800`037934ce : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0af4baa0 fffff800`03794a56 : ffffffff`80000034 fffffa80`0ac46010 fffff880`0af4bd70 fffffa80`0674d7b0 : nt!ObpLookupObjectName+0x21e
fffff880`0af4bb90 fffff800`037682bc : fffff8a0`00023010 00000000`00000000 fffff8a0`0a347100 fffff800`035c7fbd : nt!ObOpenObjectByName+0x306
fffff880`0af4bc60 fffff800`03773392 : fffff880`0af4c078 00000000`00020019 fffff880`0af4bfb0 00000000`00000000 : nt!CmOpenKey+0x28a
fffff880`0af4bdb0 fffff800`03497ed3 : fffff8a0`00152130 fffff800`036e94de fffff8a0`00000019 fffff880`0af4be70 : nt!NtOpenKey+0x12
fffff880`0af4bdf0 fffff800`03494470 : fffff800`03707e58 00000000`00000100 00000000`00000348 fffffa80`066a39e0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0af4bf88 fffff800`03707e58 : 00000000`00000100 00000000`00000348 fffffa80`066a39e0 00000000`00000000 : nt!KiServiceLinkage
fffff880`0af4bf90 fffff800`03707e11 : 00000000`00000000 00000000`00000100 00000000`00000000 00000000`00000000 : nt!IopOpenRegistryKeyEx+0x38
fffff880`0af4bff0 fffff800`03708141 : 00000000`00000001 fffffa80`074e6060 fffffa80`072016e0 00000000`00000401 : nt!PnpDeviceObjectToDeviceInstance+0x39
fffff880`0af4c020 fffff800`03708318 : 00000000`00000000 00000000`00000007 fffffa80`072016e0 00000000`00000000 : nt!PiGetDeviceRegistryProperty+0x75
fffff880`0af4c180 fffff960`002418c5 : 00000000`00000042 00000000`00000000 fffff900`c2295010 00000000`0000007f : nt!IoGetDeviceProperty+0xbc
fffff880`0af4c260 fffff960`00161bb8 : 00000000`00000000 00000000`00000000 fffff880`0af4c480 fffffa80`0a59fa90 : win32k!DrvEnumDisplayDevices+0x655
fffff880`0af4c450 fffff800`03497ed3 : fffffa80`0b697990 fffff880`0af4c520 00000000`00000000 00000000`00000020 : win32k!NtUserEnumDisplayDevices+0x98
fffff880`0af4c4a0 00000000`755c0d4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`030bcb98 fffff800`03490210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x755c0d4a
fffff880`0af4c880 fffff900`c065f0c0 : 00000000`00000000 00000058`00000578 fffff800`034a282b 00000000`00002bf2 : nt!KiCallUserMode
fffff880`0af4c888 00000000`00000000 : 00000058`00000578 fffff800`034a282b 00000000`00002bf2 fffff880`0af4cdb0 : 0xfffff900`c065f0c0
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!DrvEnumDisplayDevices+655
fffff960`002418c5 3d230000c0 cmp eax,0C0000023h
SYMBOL_STACK_INDEX: e
SYMBOL_NAME: win32k!DrvEnumDisplayDevices+655
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a
FAILURE_BUCKET_ID: X64_0x1E_c0000005_win32k!DrvEnumDisplayDevices+655
BUCKET_ID: X64_0x1E_c0000005_win32k!DrvEnumDisplayDevices+655
Followup: MachineOwner
---------
-
Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-20326-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03459000 PsLoadedModuleList = 0xfffff800`0369e670
Debug session time: Sun Jan 22 21:14:31.916 2012 (UTC - 7:00)
System Uptime: 0 days 0:46:15.243
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, 109b, acee, fffff8a00a8e9b30}
GetPointerFromAddress: unable to read from fffff80003708100
Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+168 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000000acee, Memory contents of the pool block
Arg4: fffff8a00a8e9b30, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: fffff8a00a8e9b30
FREED_POOL_TAG: MPsc
BUGCHECK_STR: 0xc2_7_MPsc
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: mscorsvw.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80003603be9 to fffff800034d5c40
STACK_TEXT:
fffff880`07465998 fffff800`03603be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0000acee : nt!KeBugCheckEx
fffff880`074659a0 fffff800`037d23d8 : fffffa80`07604e60 00000000`00000001 fffffa80`0789d030 fffffa80`07604e60 : nt!ExDeferredFreePool+0x1201
fffff880`07465a50 fffff800`034dfaf4 : 00000000`00000001 fffffa80`0a5b7960 fffffa80`0671bc90 fffffa80`072b3600 : nt!IopDeleteFile+0x168
fffff880`07465ae0 fffff800`037ccf44 : fffffa80`0a5b7960 00000000`00000000 fffffa80`0d564b60 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`07465b40 fffff800`037cd4f4 : 00000000`00000410 fffffa80`0a5b7960 fffff8a0`0845ce60 00000000`00000410 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`07465bd0 fffff800`034d4ed3 : fffffa80`0d564b60 fffff880`07465ca0 00000000`00000410 00000000`0263db98 : nt!ObpCloseHandle+0x94
fffff880`07465c20 00000000`7771140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01ead888 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7771140a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!IopDeleteFile+168
fffff800`037d23d8 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!IopDeleteFile+168
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xc2_7_MPsc_nt!IopDeleteFile+168
BUCKET_ID: X64_0xc2_7_MPsc_nt!IopDeleteFile+168
Followup: MachineOwner
---------
- Possible cause is Drivers... Yours was prompted by the Volume Shadow Copy service. This is likely backup related, but it could also be due to corrupted Windows files.
- Possible causes are Memory problems... Viruses... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash. - Possible cause is Drivers... Yours was prompted by a part of the .NET framework. Could be due to corrupted Windows files.
Thanks to Dave76 for help understanding possible causes.
We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.
- If you are overclocking anything, please stop.
- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
- Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a.
Backup your system and user files
b.
Create a system restore point
c. If you do not have a Windows 7 DVD,
Create a system repair disc
d. Run
Driver Verifier
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using
System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
Quote