BSOD Windows 7 - ntoskrnl.exe+7cc40

writhziden · 25 Feb 2012

There are a lot of people with updates near 100 after SP1 right now. I have seen this in a number of reports the past few days. I am anticipating SP2 being released soon, but that is just speculation on my part. I have not heard anything yet regarding an SP2 for Windows 7.

When I am done getting all updates installed on my new system, I'll let you know how many I have.

garthrs · 25 Feb 2012

Thanks. I'm gonna roll with this install for a few days and accumulate some dump files... IF it runs stable for that time, I'll let you know. Here is to hoping!

writhziden · 25 Feb 2012

Sounds good. Best of luck!

In regards to SP2, there are unsubstantiated rumors that it will occur in May. Guess we'll all wait and see what Microsoft does.

garthrs · 27 Feb 2012

Update (SP1) Refused to auto-install so I had to manually install it after the hotfix...

But windows is up to date as of 8PM EST last night.

Thought you might like a peak at the dump files (all 12) I've acquired since the repair install.

I used your batch file to get the details incase anything had changed.

Thanks for the help. Hey, wanna buy a slightly used PC? It's gonna have a few dents in it....

writhziden · 27 Feb 2012

Code:


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\garthrs\Windows_NT6_BSOD_jcgriff2\022612-23337-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`0309a670
Debug session time: Sun Feb 26 18:32:19.829 2012 (UTC - 7:00)
System Uptime: 0 days 0:07:38.000
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50853, fffff880031938a8, fffff88003193100, fffffa8006c8e223}

Probably caused by : ntkrnlmp.exe ( nt!CcDeleteSharedCacheMap+14d )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050853
Arg2: fffff880031938a8
Arg3: fffff88003193100
Arg4: fffffa8006c8e223

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031938a8 -- (.exr 0xfffff880031938a8)
ExceptionAddress: fffffa8006c8e223
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000001
Attempt to write to address 0000000000000001

CONTEXT:  fffff88003193100 -- (.cxr 0xfffff88003193100)
rax=0000000000000001 rbx=0000000000000001 rcx=0000000000000000
rdx=fffff800030d37f0 rsi=fffffa8006c8e201 rdi=0000000000000000
rip=fffffa8006c8e223 rsp=fffff88003193ae8 rbp=fffffa80094dc890
 r8=000000001801a840  r9=0000000000000000 r10=0000000018009100
r11=fffff880031936c0 r12=0000000000000000 r13=fffffa80094dc890
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
fffffa80`06c8e223 0100            add     dword ptr [rax],eax ds:002b:00000000`00000001=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000001

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003104100
 0000000000000001 

FOLLOWUP_IP: 
nt!CcDeleteSharedCacheMap+14d
fffff800`02f16a01 2001            and     byte ptr [rcx],al

FAULTING_IP: 
+14d
fffffa80`06c8e223 0100            add     dword ptr [rax],eax

FAILED_INSTRUCTION_ADDRESS: 
+14d
fffffa80`06c8e223 0100            add     dword ptr [rax],eax

BUGCHECK_STR:  0x34

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff80002f16a01 to fffffa8006c8e223

STACK_TEXT:  
fffff880`03193ae8 fffff800`02f16a01 : 00000000`00000001 fffffa80`094dc890 fffffa80`06c8e201 fffffa80`094dc800 : 0xfffffa80`06c8e223
fffff880`03193af0 fffff800`02f172fe : fffffa80`06c8e220 fffffa80`06c8e220 fffff880`02fd5180 fffffa80`094dc800 : nt!CcDeleteSharedCacheMap+0x14d
fffff880`03193b50 fffff800`02f17938 : fffff880`00000000 fffff880`03193c58 fffffa80`07398270 fffff800`030d38b8 : nt!CcWriteBehind+0x54e
fffff880`03193c00 fffff800`02edc001 : fffffa80`06abfa60 fffff800`031c8901 fffff800`030d38c0 00000000`00000000 : nt!CcWorkerThread+0x1c8
fffff880`03193cb0 fffff800`0316cfee : 00000000`00000000 fffffa80`06ad4040 00000000`00000080 fffffa80`069ab9e0 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`02ec35e6 : fffff880`02f64180 fffffa80`06ad4040 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`03193740 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!CcDeleteSharedCacheMap+14d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff88003193100 ; kb

FAILURE_BUCKET_ID:  X64_0x34_BAD_IP_nt!CcDeleteSharedCacheMap+14d

BUCKET_ID:  X64_0x34_BAD_IP_nt!CcDeleteSharedCacheMap+14d

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\garthrs\Windows_NT6_BSOD_jcgriff2\022612-18829-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e65000 PsLoadedModuleList = 0xfffff800`030a2e70
Debug session time: Sun Feb 26 15:05:17.313 2012 (UTC - 7:00)
System Uptime: 0 days 0:18:00.656
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck FC, {fffff8a01c4906ca, c54000006b473921, fffff88009f70f30, 2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42357 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory.  The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8a01c4906ca, Virtual address for the attempted execute.
Arg2: c54000006b473921, PTE contents.
Arg3: fffff88009f70f30, (reserved)
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xFC

PROCESS_NAME:  OCCT.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88009f70f30 -- (.trap 0xfffff88009f70f30)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000080 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8a01c4906ca rsp=fffff88009f710c8 rbp=fffff8800984e000
 r8=ffffffffffa50000  r9=fffff8800984effc r10=0000000000000fff
r11=fffff8800984effc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
fffff8a0`1c4906ca 000404          add     byte ptr [rsp+rax],al ss:fffff880`09f710c8=71
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f55aaf to fffff80002ed55c0

STACK_TEXT:  
fffff880`09f70dc8 fffff800`02f55aaf : 00000000`000000fc fffff8a0`1c4906ca c5400000`6b473921 fffff880`09f70f30 : nt!KeBugCheckEx
fffff880`09f70dd0 fffff800`02ed36ae : 00000000`00000008 fffff800`031b9d71 fffff880`0984e000 00000000`00000fff : nt! ?? ::FNODOBFM::`string'+0x42357
fffff880`09f70f30 fffff8a0`1c4906ca : fffff800`031b9d71 fffff880`0984e000 ffffffff`ffa50000 00000000`00881000 : nt!KiPageFault+0x16e
fffff880`09f710c8 fffff800`031b9d71 : fffff880`0984e000 ffffffff`ffa50000 00000000`00881000 fffffa80`013e4650 : 0xfffff8a0`1c4906ca
fffff880`09f710d0 fffff800`031a7004 : 00000000`00000000 00000000`00000000 fffff6fc`40022ef8 fffff800`00000000 : nt!MiPerformFixups+0x65
fffff880`09f71120 fffff800`02eb75bd : 00000000`0006a177 00000000`00000881 fffff8a0`1c450450 00000000`00000002 : nt!MiRelocateImagePfn+0x114
fffff880`09f71180 fffff800`031b9ccd : fffffa80`0aeb16b0 fffff6fc`40022ef8 fffff8a0`00000002 00000000`00000000 : nt!MiValidateImagePages+0x2bd
fffff880`09f71220 fffff800`031b93e0 : ffffffff`ffffffff 00000000`00000001 fffff8a0`1c467000 00000000`0000003a : nt!MiSwitchBaseAddress+0x61
fffff880`09f71250 fffff800`031cd4fe : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!MiRelocateImageAgain+0x100
fffff880`09f712a0 fffff800`031c2d03 : fffff880`09f71500 00000000`00000000 fffff880`09f715a8 fffff880`09f714f8 : nt!MmCreateSection+0x302
fffff880`09f714b0 fffff800`03331c85 : fffff8a0`02566cb0 00000000`00000000 00000000`00000001 00000002`00000000 : nt!NtCreateSection+0x162
fffff880`09f71530 fffff800`03332037 : 00000000`00000010 fffff8a0`09a7a6b0 fffff880`09f716c0 00000000`0000002c : nt!PfSnGetSectionObject+0x2d5
fffff880`09f71620 fffff800`03332467 : fffff880`09f71740 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PfSnPrefetchSections+0x247
fffff880`09f71710 fffff800`0333288f : 00000001`21dcdcf9 fffffa80`0972f060 fffff8a0`0254a000 00000000`00000000 : nt!PfSnPrefetchScenario+0x187
fffff880`09f71980 fffff800`0312a65f : 00000000`00000000 00000000`b6aa0074 fffffa80`0b179960 00000000`00000000 : nt!PfSnBeginAppLaunch+0x35f
fffff880`09f71a50 fffff800`0319ffbc : fffffa80`094c1b60 fffffa80`0b179960 00000000`14050808 00000000`7efde000 : nt! ?? ::NNGAKEGL::`string'+0x4f310
fffff880`09f71a80 fffff800`02eb3c75 : fffff880`02dd5180 00000000`00000000 fffff800`0319fec0 fffffa80`094c1b60 : nt!PspUserThreadStartup+0xfc
fffff880`09f71ae0 fffff800`02eb3bf7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThread+0x16
fffff880`09f71c20 00000000`77932c80 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartUserThreadReturn
00000000`0025f638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77932c80


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+42357
fffff800`02f55aaf cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+42357

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+42357

BUCKET_ID:  X64_0xFC_nt!_??_::FNODOBFM::_string_+42357

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\garthrs\Windows_NT6_BSOD_jcgriff2\022612-19749-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e53000 PsLoadedModuleList = 0xfffff800`03090e70
Debug session time: Sun Feb 26 14:46:31.360 2012 (UTC - 7:00)
System Uptime: 0 days 3:53:44.702
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {4, 2, 8, 4}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000004, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000004, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fb0e0
 0000000000000004 

CURRENT_IRQL:  2

FAULTING_IP: 
+3534363563383837
00000000`00000004 ??              ???

PROCESS_NAME:  fraps.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

TRAP_FRAME:  fffff880009b07c0 -- (.trap 0xfffff880009b07c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8008333468
rdx=000000000000524c rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000004 rsp=fffff880009b0958 rbp=0000000000000000
 r8=fffffa8008333484  r9=fffff880040992d0 r10=000000000000001c
r11=fffffa8008333000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
00000000`00000004 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec2b29 to fffff80002ec35c0

FAILED_INSTRUCTION_ADDRESS: 
+3534363563383837
00000000`00000004 ??              ???

STACK_TEXT:  
fffff880`009b0678 fffff800`02ec2b29 : 00000000`0000000a 00000000`00000004 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`009b0680 fffff800`02ec17a0 : fffffa80`086e3940 fffffa80`08c37a10 fffff880`02fd5180 fffffa80`08c37a01 : nt!KiBugCheckDispatch+0x69
fffff880`009b07c0 00000000`00000004 : fffffa80`08c37a10 fffffa80`08042e40 00000000`00000000 fffff880`040992d0 : nt!KiPageFault+0x260
fffff880`009b0958 fffffa80`08c37a10 : fffffa80`08042e40 00000000`00000000 fffff880`040992d0 fffffa80`00000000 : 0x4
fffff880`009b0960 fffffa80`08042e40 : 00000000`00000000 fffff880`040992d0 fffffa80`00000000 fffffa80`089027c0 : 0xfffffa80`08c37a10
fffff880`009b0968 00000000`00000000 : fffff880`040992d0 fffffa80`00000000 fffffa80`089027c0 fffff880`05f7eb2e : 0xfffffa80`08042e40


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02ec17a0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

Followup: MachineOwner
---------

Possible causes are Memory problems... Drivers...
Caused by OCCT.exe (Power Supply Unit problem?)
Fraps.exe may have caused this one.

Code:

AODDriver2	fffff880`054c4000	fffff880`054f5000	Wed Jun 15 02:38:35 2011 (4df86f8b)	00012df4		AODDriver2.sys

It's back...

Can you test your computer with a different PSU? Borrow one from a friend if you can.

garthrs · 27 Feb 2012

I went into the Catalyst program and disabled Overdrive (AODDriver2). I can not uninstall the program as it is part of the catalyst program.

Does the OCCT only point to PSU? The reason I ask is because almost everytime I try to run it, the program stops responding. BTW, I looked around and none of my friends have a spare PSU with the required wattage. I may have to go buy one... They are not too cheap.
Fraps has been re-installed just in case.

writhziden · 27 Feb 2012

What tests cause the computer to freeze?

Are you monitoring the temperatures during the tests?

garthrs · 27 Feb 2012

Temps are all fine, nothing above 71.

It freezes in all tests. Just runs fine, then stops responding.

Most recent bug code...

022712-16816-01.dmp 2/27/2012 8:52:22 PM KMODE_EXCEPTION_NOT_HANDLED 0x0000001e ffffffff`c0000005 00000000`00000000 00000000`00000008 00000000`00000000 dxgmms1.sys dxgmms1.sys+c095 x64 ntoskrnl.exe+7cc40 C:\Windows\Minidump\022712-16816-01.dmp 4 15 7601 275,344

FOr some reason I cannot find just the video driver for my Radeon HD 6850... Could you point me to a link. The ccc has been identified as a problem causer...

writhziden · 27 Feb 2012

If you get 7-zip, you may be able to extract just the driver, or if you start the installation and do not finish it, you can probably get the driver files to extract into the AMD folder. Actually, if you uninstall all AMD software and drivers via AMD installation manager, the AMD folder should still exist within the C: drive. You should be able to install the driver from there using the steps in Driver Install - Device Manager (disregard all the steps about XP and using device manager to update, the steps are basically still the same except you won't have a .zip file but the AMD folder to peruse through). Also, ignore PART TWO of that tutorial.

garthrs · 27 Feb 2012

Thanks. I'll give that a try...

I'm gonna contact ibuypower this week about a replacement PSU. System is only about 15 months old.