Code:
-
Loading Dump File [F:\BSODDmpFiles\DeadPirater\Windows_NT6_BSOD_jcgriff2\020612-21625-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c0a000 PsLoadedModuleList = 0x82d49570
Debug session time: Mon Feb 6 14:51:48.239 2012 (GMT-7)
System Uptime: 1 days 20:28:39.325
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000003, the pool freelist is corrupt.
Arg2: 82d371f0, the pool entry being checked.
Arg3: 82d371f0, the read back flink freelist value (should be the same as 2).
Arg4: 00000000, the read back blink freelist value (should be the same as 2).
Debugging Details:
------------------
BUGCHECK_STR: 0x19_3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82cbb3c1 to 82d2166e
STACK_TEXT:
b2c6f768 82cbb3c1 00000000 00000028 58434f46 nt!ExAllocatePoolWithTag+0x664
b2c6f78c 8c0fa3b2 85a04d48 85827638 85b44310 nt!FsRtlInsertPerFileObjectContext+0x44
b2c6f7ac 8c0f6e33 00000034 85a04d48 b2c6f7e8 fltmgr!TargetedIOCtrlAttachAsFoCtx+0x84
b2c6f80c 8c0f8033 00000000 00000000 85b44290 fltmgr!FltpNormalizeNameFromCache+0x135
b2c6f838 8c0f8df4 01b44290 00000000 85b44290 fltmgr!FltpExpandShortNames+0x2b5
b2c6f854 8c0f9505 85b40000 00000000 85ebeefc fltmgr!FltpGetNormalizedFileNameWorker+0xae
b2c6f86c 8c0f6765 85b44290 00000000 85b44290 fltmgr!FltpGetNormalizedFileName+0x19
b2c6f884 8c0e0b21 85b44290 00000000 00000000 fltmgr!FltpCreateFileNameInformation+0x81
b2c6f8b4 8c0e0fa3 85d1bfd4 00000000 b2c6f94c fltmgr!FltpGetFileNameInformation+0x321
b2c6f8dc 8c113c87 0008ece0 00000401 b2c6f910 fltmgr!FltGetFileNameInformation+0x12b
b2c6f92c 8c113edd 8608ece0 b2c6f94c 0003a99c fileinfo!FIStreamGetInfo+0x109
b2c6f968 8c0da324 8608ece0 b2c6f98c 553d0b96 fileinfo!FIPostCreateCallback+0x171
b2c6f9d0 8c0dd512 0008ec80 8608ec80 1000000c fltmgr!FltpPerformPostCallbacks+0x24a
b2c6f9e4 8c0ddb46 8608ec80 8598b008 b2c6fa24 fltmgr!FltpProcessIoCompletion+0x10
b2c6f9f4 8c0de29c 8663b2a8 8598b008 8608ec80 fltmgr!FltpPassThroughCompletion+0x98
b2c6fa24 8c0f18c9 b2c6fa44 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a
b2c6fa70 82c38f44 8663b2a8 8662e9d8 85a17e1c fltmgr!FltpCreate+0x2db
b2c6fa88 82e0c72d 9791a2ec b2c6fc30 00000000 nt!IofCallDriver+0x63
b2c6fb60 82e0f908 86617688 856af040 88c9f740 nt!IopParseDevice+0xed7
b2c6fbdc 82e4e2d2 00000000 b2c6fc30 00000040 nt!ObpLookupObjectName+0x4fa
b2c6fc38 82e09cce 03d5f988 856af040 b2c6fc01 nt!ObOpenObjectByName+0x159
b2c6fcb4 82e54c53 03d5f9e4 80100080 03d5f988 nt!IopCreateFile+0x673
b2c6fd00 82c3f79a 03d5f9e4 80100080 03d5f988 nt!NtCreateFile+0x34
b2c6fd00 772b64f4 03d5f9e4 80100080 03d5f988 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
03d5f9ec 00000000 00000000 00000000 00000000 0x772b64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
fileinfo!FIStreamGetInfo+109
8c113c87 85c0 test eax,eax
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: fileinfo!FIStreamGetInfo+109
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fileinfo
IMAGE_NAME: fileinfo.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc18f
FAILURE_BUCKET_ID: 0x19_3_fileinfo!FIStreamGetInfo+109
BUCKET_ID: 0x19_3_fileinfo!FIStreamGetInfo+109
Followup: MachineOwner
---------
-
Loading Dump File [F:\BSODDmpFiles\DeadPirater\Windows_NT6_BSOD_jcgriff2\012312-25437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c09000 PsLoadedModuleList = 0x82d48570
Debug session time: Mon Jan 23 03:54:37.230 2012 (GMT-7)
System Uptime: 1 days 21:22:35.395
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
........
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 00000000, Object type of the object whose reference count is being lowered
Arg2: 8841d608, Object whose reference count is being lowered
Arg3: 00000002, Reserved
Arg4: ffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82c5f36c to 82cda574
STACK_TEXT:
a90f7c6c 82c5f36c 00000018 00000000 8841d608 nt!KeBugCheckEx+0x1e
a90f7c90 82c5f31a 8841d608 82e21ebc a0676728 nt!ObfDereferenceObjectWithTag+0x4b
a90f7c98 82e21ebc a0676728 85b1e7f0 0000a684 nt!ObfDereferenceObject+0xd
a90f7cdc 82e4cdd9 a0676728 894e2d08 870cc4a0 nt!ObpCloseHandleTableEntry+0x21d
a90f7d0c 82e4cf7f 870cc4a0 85b1e701 062cf51c nt!ObpCloseHandle+0x7f
a90f7d28 82c3e79a 0000a684 062cf520 776e64f4 nt!NtClose+0x4e
a90f7d28 776e64f4 0000a684 062cf520 776e64f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
062cf520 00000000 00000000 00000000 00000000 0x776e64f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObfDereferenceObjectWithTag+4b
82c5f36c cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+4b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b1e0907
FAILURE_BUCKET_ID: 0x18_nt!ObfDereferenceObjectWithTag+4b
BUCKET_ID: 0x18_nt!ObfDereferenceObjectWithTag+4b
Followup: MachineOwner
---------
-
Loading Dump File [F:\BSODDmpFiles\DeadPirater\Windows_NT6_BSOD_jcgriff2\012112-22609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16481.x86fre.win7_gdr.091207-1941
Machine Name:
Kernel base = 0x82c09000 PsLoadedModuleList = 0x82d48570
Debug session time: Sat Jan 21 06:41:06.953 2012 (GMT-7)
System Uptime: 0 days 0:00:13.921
Loading Kernel Symbols
....................................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 124, {0, 8662a8fc, 0, 0}
Probably caused by : hardware
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 00000000, Machine Check Exception
Arg2: 8662a8fc, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000, High order 32-bits of the MCi_STATUS value.
Arg4: 00000000, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
BUGCHECK_STR: 0x124_GenuineIntel
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
CURRENT_IRQL: 0
STACK_TEXT:
80f8fcc4 82ccc1c5 8662a8e0 82d66f88 82d66f80 nt!WheapCreateTriageDumpFromPreviousSession+0x32
80f8fce4 82cccfe1 82d66f80 8662a8e0 82d66fb0 nt!WheapProcessWorkQueueItem+0x56
80f8fd00 82c64083 82d66f80 00000000 856aed48 nt!WheapWorkQueueWorkerRoutine+0x1f
80f8fd50 82df0d16 00000001 a5aa80ed 00000000 nt!ExpWorkerThread+0x10d
80f8fd90 82c92159 82c63f76 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_PRV
BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_PRV
Followup: MachineOwner
---------
- Possible causes are Memory Problems... Drivers...
- Possible causes are Memory Problems... Drivers...
- Hardware stop. See Stop 0x124 - what it means and what to try
Thanks to Dave76 for help understanding possible causes.
Update your Atheros wireless driver from
ATHEROS Wireless drivers for Windows. Yours is the AR5007G
Update your Realtek RTL8168C(P)/8111C(P) Family PCI-E Gigabit Ethernet NIC (NDIS 6.20) driver from
Realtek
Find an update for your CD/DVD software containing
GEARAspiWDM.sys from the link provided. Let us know if you need help determining which software this is a part of.
Code:
Rt86win7 94e72000 94e97000 Thu Feb 26 02:04:22 2009 (49a65b16) 0002bdef Rt86win7.sys
GEARAspiWDM 94fe7000 94fec280 Mon May 18 06:16:53 2009 (4a1151b5) 00008fb0 GEARAspiWDM.sys
athr 94ec3000 94fd3000 Tue Jun 09 12:04:52 2009 (4a2ea444) 0011a043 athr.sys
Please remove any CD/DVD virtualization software, such as Daemon Tools/Alcohol 120%, as they use a driver called sptd.sys that is known to cause BSODs. Use add/remove programs to remove the software. After removing the software, use the
sptd.sys uninstaller to remove sptd.sys from the system.
I prefer
TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.
Many use
MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.
Check to see if the system is stable after doing the above steps. If you continue to have crashes, continue with the following steps to troubleshoot the blue screen crashes.
- If you are overclocking any hardware, please stop.
- Stop 0x124 - what it means and what to try
- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
If you swap any memory components, follow these steps for ESD safety:- Shut down and turn off your computer.
- Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
- Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
- Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
- Update to Service Pack 1 (SP1)
Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 (KB947821) [August 2011]
Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [August 2011]
Steps to follow before you install Windows 7 Service Pack 1 from the Microsoft Download Center
Service Pack 1 Download site
Links to Service Pack 1 (SP1) and preparation for SP1 courtesy of JMH
- Install all Windows updates since SP1.
- See if installing the service pack and all updates provides stability before proceeding to the next step.
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
