BSOD: ntoskrnl.exe; clean install corruption?

Couch3ater · 11 Jan 2012

So I received a solid state drive for Christmas last year and haven't had any luck with installing it. I'm doing everything I can to rule out that it was DOA considering that at this point it's probably past warranty and I don't really wanna drop the money on a new one.

Following a clean install on my past two machines, the computer runs fine for a little while but will then sporadically begin throwing blue screens as it desires. I've tried to replicate the crashes but have had no luck. There appears to be no conditions required for the system to crash, so my initial thought was some kind of hardware malfunction. This year I received an entirely new set up, and of the things to come over to the new machine were my SSD and my HDD. Took a day or two, got it up running, and, lo and behold, same issue.

I'm not sure if this has anything to do with moving the User file off the SSD so as to cut back some space. I've tried accomplishing this through registry hacks and even through moving the user file prior to completion of the installation of Windows, using junctions then changing some things in the registry. If you guys could point me in the direction of some help in this department as well, that would be splendid.

As I'm in class at the moment, I can post the syslogs when I get home. I'm just hoping that perhaps this might get the gears turning.

System Specs:
AMD Phenom II X6 1055T Thuban
ASUS M4A88TD-V EVO/USB3 AM3 AMD 880G
Mushkin Enhanced Silverline 12GB 240-Pin DDR3 SDRAM DDR3 1333
OCZ Agility 2 OCZSSD2-2AGTE60G
1TB Segate SATA HDD

Where it's a new system, I'll have to double check my system specs when I return from class. I'll also be uploading my dumps when I get done with class for the day, so I thank you for your patience.

JMH · 11 Jan 2012

Couch3ater said:

Where it's a new system, I'll have to double check my system specs when I return from class. I'll also be uploading my dumps when I get done with class for the day, so I thank you for your patience.

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

Couch3ater · 14 Jan 2012

I've attached my dump files to the original post. I apologize for my tardiness in getting these up here, the past few days have been a little busy. Again, thanks in advance for any help.

writhziden · 14 Jan 2012

Some good SSD tutorials are available on these forums. I compiled a few of them in SSD Links. Give props to those who put the tutorials together. :)

Couch3ater · 14 Jan 2012

writhziden said:

Some good SSD tutorials are available on these forums. I compiled a few of them in SSD Links. Give props to those who put the tutorials together. :)

Thanks for the reading. I've been looking for a good repository of SSD information. I'm glad I now know where to go. I'll give these all a look over.

writhziden · 14 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9547-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0285a000 PsLoadedModuleList = 0xfffff800`02a97e50
Debug session time: Tue Jan 10 18:46:51.153 2012 (UTC - 7:00)
System Uptime: 0 days 0:19:46.495
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {2b, 2, 0, fffff800028d5e13}

Probably caused by : ntkrnlmp.exe ( nt!KiProcessExpiredTimerList+103 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000002b, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800028d5e13, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b020e0
 000000000000002b 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiProcessExpiredTimerList+103
fffff800`028d5e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002d8c450 -- (.trap 0xfffff88002d8c450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000b rbx=0000000000000000 rcx=fffffa800ab6c0e0
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028d5e13 rsp=fffff88002d8c5e0 rbp=fffffa800ab64148
 r8=fffff88002d66301  r9=0000000000000002 r10=0000000000000018
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KiProcessExpiredTimerList+0x103:
fffff800`028d5e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh] ds:00000000`0000002b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800028c9ca9 to fffff800028ca740

STACK_TEXT:  
fffff880`02d8c308 fffff800`028c9ca9 : 00000000`0000000a 00000000`0000002b 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02d8c310 fffff800`028c8920 : 00000000`00000001 00000000`00000000 fffff880`02d8c580 fffff880`014e5fc6 : nt!KiBugCheckDispatch+0x69
fffff880`02d8c450 fffff800`028d5e13 : fffffa80`0ab6c100 fffffa80`09751788 fffffa80`09751788 00000000`00000102 : nt!KiPageFault+0x260
fffff880`02d8c5e0 fffff800`028d64be : 00000002`c334e59b fffff880`02d8cc58 00000000`00012918 fffff880`02d66888 : nt!KiProcessExpiredTimerList+0x103
fffff880`02d8cc30 fffff800`028d5cb7 : 00000000`c263b4c1 00000000`00012918 00000000`c263b46e 00000000`00000018 : nt!KiTimerExpiration+0x1be
fffff880`02d8ccd0 fffff800`028d2eea : fffff880`02d64180 fffff880`02d6f040 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff880`02d8cd80 00000000`00000000 : fffff880`02d8d000 fffff880`02d87000 fffff880`02d8cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiProcessExpiredTimerList+103
fffff800`028d5e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiProcessExpiredTimerList+103

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+103

BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+103

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9999-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0280a000 PsLoadedModuleList = 0xfffff800`02a47e50
Debug session time: Tue Jan 10 18:48:16.814 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:23.157
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {2c, 2, 0, fffff80002885e13}

Probably caused by : ntkrnlmp.exe ( nt!KiProcessExpiredTimerList+103 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000002c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002885e13, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ab20e0
 000000000000002c 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiProcessExpiredTimerList+103
fffff800`02885e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880009fc450 -- (.trap 0xfffff880009fc450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000b rbx=0000000000000000 rcx=fffffa800bc280e0
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002885e13 rsp=fffff880009fc5e0 rbp=fffffa800bc20148
 r8=fffff880009b4301  r9=0000000000000002 r10=00000000000000cc
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!KiProcessExpiredTimerList+0x103:
fffff800`02885e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh] ds:00000000`0000002b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002879ca9 to fffff8000287a740

STACK_TEXT:  
fffff880`009fc308 fffff800`02879ca9 : 00000000`0000000a 00000000`0000002c 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`009fc310 fffff800`02878920 : 00000000`00000006 00000000`00000001 fffffa80`0a70dd30 00000000`000009c4 : nt!KiBugCheckDispatch+0x69
fffff880`009fc450 fffff800`02885e13 : fffffa80`0bc28100 fffffa80`0b940798 fffffa80`0b940798 00000000`00000102 : nt!KiPageFault+0x260
fffff880`009fc5e0 fffff800`028864be : 00000000`0dcd8392 fffff880`009fcc58 00000000`000005cc fffff880`009b5f08 : nt!KiProcessExpiredTimerList+0x103
fffff880`009fcc30 fffff800`02885cb7 : 00000000`03f086c1 00000000`000005cc 00000000`03f08611 00000000`000000cc : nt!KiTimerExpiration+0x1be
fffff880`009fccd0 fffff800`02882eea : fffff880`009b2180 fffff880`009bd040 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff880`009fcd80 00000000`00000000 : fffff880`009fd000 fffff880`009f7000 fffff880`009fcd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiProcessExpiredTimerList+103
fffff800`02885e13 0fb6432b        movzx   eax,byte ptr [rbx+2Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiProcessExpiredTimerList+103

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+103

BUCKET_ID:  X64_0xA_nt!KiProcessExpiredTimerList+103

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9562-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02859000 PsLoadedModuleList = 0xfffff800`02a96e50
Debug session time: Tue Jan 10 18:55:11.268 2012 (UTC - 7:00)
System Uptime: 0 days 0:05:54.235
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002bc4883, 0, ffffffffffffffff}

Probably caused by : memory_corruption ( nt!MmCreateSection+3b7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002bc4883, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MmCreateSection+3b7
fffff800`02bc4883 488b4010        mov     rax,qword ptr [rax+10h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b010e0
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880069a1158 -- (.exr 0xfffff880069a1158)
ExceptionAddress: fffff80002bc4883 (nt!MmCreateSection+0x00000000000003b7)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880069a1200 -- (.trap 0xfffff880069a1200)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=5741564155415441 rbx=0000000000000000 rcx=0000000000000038
rdx=0000000000000070 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002bc4883 rsp=fffff880069a1390 rbp=0000000001000000
 r8=0000000000000160  r9=fffff880069a1178 r10=fffffa800a150a80
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MmCreateSection+0x3b7:
fffff800`02bc4883 488b4010        mov     rax,qword ptr [rax+10h] ds:57415641`55415451=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002903a39 to fffff800028c9740

STACK_TEXT:  
fffff880`069a0988 fffff800`02903a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02bc4883 00000000`00000000 : nt!KeBugCheckEx
fffff880`069a0990 fffff800`028c8d82 : fffff880`069a1158 00000000`0000000c fffff880`069a1200 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`069a1020 fffff800`028c768a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`069a1200 fffff800`02bc4883 : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`069a1390 fffff800`02bba013 : fffff880`069a15f0 00000000`00000000 fffff880`069a1698 fffffa80`0ab6c048 : nt!MmCreateSection+0x3b7
fffff880`069a15a0 fffff800`02d26a23 : 00000000`00000000 fffff8a0`026d27f0 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x162
fffff880`069a1620 fffff800`02d26fb1 : 00000000`00000000 fffff8a0`026d27f0 fffffa80`0b1be0e0 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`069a1710 fffff800`02d2f0ce : fffff8a0`00000000 fffff8a0`00000003 fffff8a0`0000007c fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x121
fffff880`069a1810 fffff800`02d2fc67 : 00000000`00000000 fffff880`069a1ca0 fffff880`069a1a08 fffff8a0`013c7060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`069a1960 fffff800`02d3c23e : fffff880`069a1a08 fffff880`069a1a01 fffffa80`0b9bc920 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`069a19d0 fffff800`02d4096e : 00000000`00000000 00000000`01b5f470 00000000`0000004f 00000000`069dd001 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`069a1ab0 fffff800`028c8993 : fffffa80`0bac4b60 00000000`00000000 000007fe`f95f7901 00000000`00000000 : nt!NtSetSystemInformation+0xb91
fffff880`069a1c20 00000000`770d144a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01b5f448 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770d144a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCreateSection+3b7
fffff800`02bc4883 488b4010        mov     rax,qword ptr [rax+10h]

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MmCreateSection+3b7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MmCreateSection+3b7

BUCKET_ID:  X64_0x1E_c0000005_nt!MmCreateSection+3b7

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-10202-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02809000 PsLoadedModuleList = 0xfffff800`02a46e50
Debug session time: Tue Jan 10 19:21:07.192 2012 (UTC - 7:00)
System Uptime: 0 days 0:24:55.534
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, fffff8a00aa6a000, 1, 0}

GetPointerFromAddress: unable to read from fffff80002ab10e0
GetUlongFromAddress: unable to read from fffff80002a1f1b0
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+72f8 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022, 
Arg2: fffff8a00aa6a000
Arg3: 0000000000000001
Arg4: 0000000000000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff80002a1f1b0

BUGCHECK_STR:  0x19_22

POOL_ADDRESS:  fffff8a00aa6a000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TrustedInstall

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800028cec80 to fffff80002879740

STACK_TEXT:  
fffff880`03b7b868 fffff800`028cec80 : 00000000`00000019 00000000`00000022 fffff8a0`0aa6a000 00000000`00000001 : nt!KeBugCheckEx
fffff880`03b7b870 fffff800`029ae518 : 00000000`00000000 fffff880`03b7b9c0 fffff880`03b7b930 fffff8a0`00000001 : nt! ?? ::FNODOBFM::`string'+0x72f8
fffff880`03b7b900 fffff800`02b07aa7 : 00000000`00000001 fffff8a0`09e5c0c0 00000000`31334d43 00000000`00000001 : nt!ExFreePoolWithTag+0x468
fffff880`03b7b9b0 fffff800`02b055b4 : fffff8a0`00000000 fffff880`03b7ba01 fffff8a0`00000001 fffff880`024ab000 : nt!HvFreeHive+0x147
fffff880`03b7ba30 fffff800`02b05191 : fffff8a0`07257990 fffff880`03b7bca0 00000000`00000000 00000000`00000006 : nt!CmUnloadKey+0x190
fffff880`03b7ba70 fffff800`02878993 : fffffa80`09a48b60 000007fe`fe203110 00000000`00000001 fffffa80`0adc5501 : nt!NtUnloadKey2+0x4e4
fffff880`03b7bc20 00000000`778615da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00addc58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778615da


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+72f8
fffff800`028cec80 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+72f8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72f8

BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+72f8

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9984-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0284c000 PsLoadedModuleList = 0xfffff800`02a89e50
Debug session time: Tue Jan 10 20:35:46.405 2012 (UTC - 7:00)
System Uptime: 0 days 1:13:37.731
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ba3ff5, fffff880078e3ed0, 0}

Probably caused by : memory_corruption ( nt!MiSwitchBaseAddress+49 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ba3ff5, Address of the instruction which caused the bugcheck
Arg3: fffff880078e3ed0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiSwitchBaseAddress+49
fffff800`02ba3ff5 48017810        add     qword ptr [rax+10h],rdi

CONTEXT:  fffff880078e3ed0 -- (.cxr 0xfffff880078e3ed0)
rax=0808080808080808 rbx=fffff8a002bd0e70 rcx=fffffa8009868a30
rdx=fffff8a002bd0fb0 rsi=fffff8a002b92860 rdi=0808080808080808
rip=fffff80002ba3ff5 rsp=fffff880078e48a0 rbp=fffffa8009868a30
 r8=fffff6fc4003f090  r9=fffff6fc4003f090 r10=00000000ffffffff
r11=fffffa80096d9ff8 r12=fffffa8009868a30 r13=fffff6fc4003f090
r14=fffff8a002bd0e70 r15=000007fefb380000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MiSwitchBaseAddress+0x49:
fffff800`02ba3ff5 48017810        add     qword ptr [rax+10h],rdi ds:002b:08080808`08080818=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002ba3ff5

STACK_TEXT:  
fffff880`078e48a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiSwitchBaseAddress+0x49


FOLLOWUP_IP: 
nt!MiSwitchBaseAddress+49
fffff800`02ba3ff5 48017810        add     qword ptr [rax+10h],rdi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiSwitchBaseAddress+49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff880078e3ed0 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiSwitchBaseAddress+49

BUCKET_ID:  X64_0x3B_nt!MiSwitchBaseAddress+49

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0284e000 PsLoadedModuleList = 0xfffff800`02a8be50
Debug session time: Tue Jan 10 21:20:23.383 2012 (UTC - 7:00)
System Uptime: 0 days 0:44:02.725
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89d31b737, 0, a7613d734f85f9e5, 101}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89d31b737, Reserved
Arg2: 0000000000000000, Reserved
Arg3: a7613d734f85f9e5, Failure type dependent information
Arg4: 0000000000000101, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800028be740

STACK_TEXT:  
fffff880`0317d5d8 00000000`00000000 : 00000000`00000109 a3a039d8`9d31b737 00000000`00000000 a7613d73`4f85f9e5 : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  BAD_STACK

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Couch3ater\DMP FILE\011012-9219-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02800000 PsLoadedModuleList = 0xfffff800`02a3de50
Debug session time: Tue Jan 10 22:19:10.905 2012 (UTC - 7:00)
System Uptime: 0 days 0:58:13.887
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 109, {a3a039d89b79a771, 0, 911872964d0d560e, 101}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89b79a771, Reserved
Arg2: 0000000000000000, Reserved
Arg3: 911872964d0d560e, Failure type dependent information
Arg4: 0000000000000101, Type of corrupted region, can be
	0 : A generic data region
	1 : Modification of a function or .pdata
	2 : A processor IDT
	3 : A processor GDT
	4 : Type 1 process list corruption
	5 : Type 2 process list corruption
	6 : Debug routine modification
	7 : Critical MSR modification

Debugging Details:
------------------


BUGCHECK_STR:  0x109

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002870740

STACK_TEXT:  
fffff880`02f925d8 00000000`00000000 : 00000000`00000109 a3a039d8`9b79a771 00000000`00000000 91187296`4d0d560e : nt!KeBugCheckEx


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  BAD_STACK

Followup: MachineOwner
---------

The last two are Bug Check 0x109: CRITICAL_STRUCTURE_CORRUPTION and could be due to drivers needing updating, Windows needing updating (I note you do not have SP1 installed yet), hard disk errors, or viruses/malware.

The other crashes have a wide assortment of possible causes. We will just have to go through troubleshooting steps and try to narrow down the cause. Before doing so I have some questions:

1. Have you updated the firmware for your SSD?
2. Have you updated your BIOS since installing all components?
3. What antivirus are you running?

Some things I can suggest regardless of your answers to these questions:

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Check for viruses.

Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
Download the Fakerean removal tool but do not run it yet.
Start your computer in Safe Mode
Unzip VIPRE Rescue and let it run.
Run a full scan with Malwarebytes.
Run the fakerean removal tool.

Couch3ater · 14 Jan 2012

writhziden said:

1. Have you updated the firmware for your SSD?
2. Have you updated your BIOS since installing all components?
3. What antivirus are you running?

As it stands, I've yet to install the firmware. As I was in the process of configuring after a new install when I ran into this issue, I haven't yet had time to install everything.

I believe the BIOS is up to date, but as a cautionary measure, I'll be sure to check to updates.

As for antivirus, again, as I have only just started to configure my install, I have yet to install it. I plan on installing Avast Free Antivirus as I usually have very few problems with Avast.

On another note, I am currently running check disk, and was actually in the process of doing so prior to your post. Once I've checked both disks, I can post both logs here. After check disk has completed, I plan on running Memtest and will check back with those results as well.

writhziden · 14 Jan 2012

Couch3ater said:

writhziden said:

1. Have you updated the firmware for your SSD?
2. Have you updated your BIOS since installing all components?
3. What antivirus are you running?

As it stands, I've yet to install the firmware. As I was in the process of configuring after a new install when I ran into this issue, I haven't yet had time to install everything.

I believe the BIOS is up to date, but as a cautionary measure, I'll be sure to check to updates.

As for antivirus, again, as I have only just started to configure my install, I have yet to install it. I plan on installing Avast Free Antivirus as I usually have very few problems with Avast.

On another note, I am currently running check disk, and was actually in the process of doing so prior to your post. Once I've checked both disks, I can post both logs here. After check disk has completed, I plan on running Memtest and will check back with those results as well.

I would not recommend installing Avast until after we sort out your stability issues. The Gurus on this forum suggest running Microsoft Security Essentials - Free Antivirus for Windows in the meantime to run along with Windows firewall. This will keep your computer protected and there are not any known stability problems at present.

Couch3ater · 14 Jan 2012

At the moment, I'm not too worried about antivirus as I have the computer unplugged from the internet. For now, I'll be using my laptop to download files and transfer them over so as to avoid any bad luck I may have on the internet.

I should also probably add; I'll be installing the most recent firmware for my SSD after I've finished running check disk.

writhziden · 14 Jan 2012

Couch3ater said:

At the moment, I'm not too worried about antivirus as I have the computer unplugged from the internet. For now, I'll be using my laptop to download files and transfer them over so as to avoid any bad luck I may have on the internet.

I should also probably add; I'll be installing the most recent firmware for my SSD after I've finished running check disk.

Alright, this is also a viable security measure and good troubleshooting step. I should be here when the disk check is completed or soon afterward. If any errors are found, you may want to run disk check again before doing the firmware update just to be safe.