BSOD sometime on my system

symetric · 21 Feb 2012

Hello, I'm posting my result for my BSOD like DustSailor say...

My System is Win 7 Pro 64 bits
Original OS , Retail Version
The Age of my system is about 2 year ?
When I bought the retail version, I format my HD and start a clean update.

Thank you very much

I have also a thread here : Windows Update don't work anymore since Dec 16 ? because my Windows Update doesnt work anymore...

writhziden · 22 Feb 2012

Code:


Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\022012-25708-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0324e000 PsLoadedModuleList = 0xfffff800`03493670
Debug session time: Mon Feb 20 20:11:27.905 2012 (GMT-7)
System Uptime: 1 days 4:07:37.731
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {d, 2, 1, fffff800032d272c}

Probably caused by : ntkrnlmp.exe ( nt!KeWaitForSingleObject+17c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000000000000d, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800032d272c, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'WUDFRd' and 'WUDFRd.sys' overlap

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034fd100
 000000000000000d 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeWaitForSingleObject+17c
fffff800`032d272c 4c8938          mov     qword ptr [rax],r15

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800ab2ce90 -- (.trap 0xfffff8800ab2ce90)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000d rbx=0000000000000000 rcx=fffffa800a9fb3f0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032d272c rsp=fffff8800ab2d020 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff80003440e80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x17c:
fffff800`032d272c 4c8938          mov     qword ptr [rax],r15 ds:d100:00000000`0000000d=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032ca1e9 to fffff800032cac40

STACK_TEXT:  
fffff880`0ab2cd48 fffff800`032ca1e9 : 00000000`0000000a 00000000`0000000d 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0ab2cd50 fffff800`032c8e60 : fffffa80`024d2cf0 fffff781`c0000000 fffff800`035005c0 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0ab2ce90 fffff800`032d272c : fffff800`035005c0 fffff800`035005c0 fffffa80`075dc3d0 00000000`00000001 : nt!KiPageFault+0x260
fffff880`0ab2d020 fffff800`0329d61e : fffff6fc`5006b100 00000000`00000022 fffff800`03500500 fffff880`0ab2d200 : nt!KeWaitForSingleObject+0x17c
fffff880`0ab2d0c0 fffff800`033341d9 : fffff6fc`5006b0c0 00000000`00000000 ffff0800`00000011 00000000`00000000 : nt!KiAcquireFastMutex+0x4e
fffff880`0ab2d100 fffff880`016d9b1f : 00000000`00000000 fffff880`0ab2d200 fffffa80`06f60780 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2874f
fffff880`0ab2d140 fffff880`016d7852 : fffff8a0`0d618000 00000000`01000000 fffffa80`07b46d50 fffffa80`0c4e1c30 : fltmgr!FltpGetStartingCallbackNode+0x3f
fffff880`0ab2d1d0 fffff800`032eb453 : fffff880`0ab2d188 fffffa80`07862c80 fffff880`0ab2d370 00000000`00000000 : fltmgr!FltpPreFsFilterOperation+0xa2
fffff880`0ab2d260 fffff800`035e7644 : fffff880`016d7b70 00000000`00000000 fffff880`0ab2d2f8 fffff880`016d77b0 : nt!FsFilterPerformCallbacks+0xd3
fffff880`0ab2d2c0 fffff800`032aebae : fffffa80`06f60780 fffff880`0ab2d840 fffffa80`0c4e1c01 fffff880`0ab2d600 : nt!FsRtlAcquireFileExclusiveCommon+0xe8
fffff880`0ab2d560 fffff800`035a65d5 : fffffa80`06f60780 fffff880`0ab2d840 fffffa80`0c4e1c30 00000000`01000000 : nt!CcZeroEndOfLastPage+0x56
fffff880`0ab2d5a0 fffff800`037279c3 : 00000000`00000000 fffff8a0`0d818300 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x1b0
fffff880`0ab2d620 fffff800`03727f51 : 00000000`00000000 fffff8a0`0d818300 fffffa80`0cdbc630 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`0ab2d710 fffff800`0373006e : fffff8a0`00000000 fffff8a0`00000008 fffff8a0`00000060 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x121
fffff880`0ab2d810 fffff800`03730c07 : 00000000`00000000 fffff880`0ab2dca0 fffff880`0ab2da08 fffff8a0`02fae510 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`0ab2d960 fffff800`0373d1de : fffff880`0ab2da08 00000000`00000001 fffffa80`0c587920 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`0ab2d9d0 fffff800`03741a0a : 00000000`00000000 00000000`0000004f 00000000`00000000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`0ab2dab0 fffff800`032c9ed3 : fffffa80`075dc3d0 00000000`00000000 00000000`00000001 00000000`00000001 : nt!NtSetSystemInformation+0xc8d
fffff880`0ab2dc20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KeWaitForSingleObject+17c
fffff800`032d272c 4c8938          mov     qword ptr [rax],r15

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KeWaitForSingleObject+17c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xA_nt!KeWaitForSingleObject+17c

BUCKET_ID:  X64_0xA_nt!KeWaitForSingleObject+17c

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\021912-24351-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03202000 PsLoadedModuleList = 0xfffff800`03447670
Debug session time: Sun Feb 19 16:01:45.038 2012 (GMT-7)
System Uptime: 0 days 16:37:46.474
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, ce588c0, fffff8a00ce58870}

GetPointerFromAddress: unable to read from fffff800034b1100
Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+168 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000ce588c0, Memory contents of the pool block
Arg4: fffff8a00ce58870, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffff8a00ce58870 

FREED_POOL_TAG:  FMfn

BUGCHECK_STR:  0xc2_7_FMfn

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800033acbe9 to fffff8000327ec40

STACK_TEXT:  
fffff880`037fca18 fffff800`033acbe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0ce588c0 : nt!KeBugCheckEx
fffff880`037fca20 fffff800`0357b3d8 : fffffa80`076f6560 00000000`00000001 fffffa80`20707249 fffffa80`076f6560 : nt!ExDeferredFreePool+0x1201
fffff880`037fcad0 fffff800`03288af4 : 00000000`00000001 00000000`00000000 fffffa80`06a18080 00000000`00000000 : nt!IopDeleteFile+0x168
fffff880`037fcb60 fffff800`0351e285 : 00000000`00000000 00000000`0008c081 fffffa80`0cb6ddc0 fffffa80`06d44410 : nt!ObfDereferenceObject+0xd4
fffff880`037fcbc0 fffff800`032cc18d : fffffa80`0cb6ddc8 00000000`00000001 00000000`00000000 00000000`00000631 : nt!MiSegmentDelete+0xa1
fffff880`037fcc00 fffff800`032cc051 : 00000000`00000000 00000000`00000080 fffffa80`06a08890 fffffa80`00000012 : nt!MiProcessDereferenceList+0x131
fffff880`037fccc0 fffff800`03519fee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiDereferenceSegmentThread+0x10d
fffff880`037fcd40 fffff800`032705e6 : fffff880`03564180 fffffa80`06a22b60 fffff880`0356efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`037fcd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IopDeleteFile+168
fffff800`0357b3d8 488b8bb0000000  mov     rcx,qword ptr [rbx+0B0h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!IopDeleteFile+168

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xc2_7_FMfn_nt!IopDeleteFile+168

BUCKET_ID:  X64_0xc2_7_FMfn_nt!IopDeleteFile+168

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\021212-19968-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0324f000 PsLoadedModuleList = 0xfffff800`03494670
Debug session time: Sun Feb 12 16:45:54.974 2012 (GMT-7)
System Uptime: 0 days 3:14:38.410
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 19e81, 18cf800033902}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+46f0d )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000019e81
Arg4: 00018cf800033902

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000325f74c to fffff800032cbc40

STACK_TEXT:  
fffff880`0abfd338 fffff800`0325f74c : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`00019e81 : nt!KeBugCheckEx
fffff880`0abfd340 fffff800`032c9d6e : 00000000`00000001 00000000`0e060000 00000000`00000001 00000000`00000088 : nt! ?? ::FNODOBFM::`string'+0x46f0d
fffff880`0abfd4a0 00000000`75c69b60 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0c48c048 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75c69b60


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+46f0d
fffff800`0325f74c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+46f0d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+46f0d

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+46f0d

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\021212-21122-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03208000 PsLoadedModuleList = 0xfffff800`0344d670
Debug session time: Sun Feb 12 13:29:35.345 2012 (GMT-7)
System Uptime: 6 days 6:17:43.171
Loading Kernel Symbols
...............................................................
................................................................
...........................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800a468328, fffff8800a467b80, fffff80003276a9e}

Probably caused by : Ntfs.sys ( Ntfs!NtfsExtendedCompleteRequestInternal+114 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800a468328
Arg3: fffff8800a467b80
Arg4: fffff80003276a9e

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800a468328 -- (.exr 0xfffff8800a468328)
ExceptionAddress: fffff80003276a9e (nt!ExfAcquirePushLockExclusive+0x00000000000001e3)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000900000028
Attempt to write to address 0000000900000028

CONTEXT:  fffff8800a467b80 -- (.cxr 0xfffff8800a467b80)
rax=fffff8800a468590 rbx=0000000900000003 rcx=0000000900000000
rdx=fffff8800a468597 rsi=0000000000000000 rdi=fffffa800e653ab0
rip=fffff80003276a9e rsp=fffff8800a468560 rbp=fffffa8007b7e010
 r8=fffff8800a4685b0  r9=0000000000000000 r10=fffffa800ecfa388
r11=fffff8800a4687f8 r12=fffffa8007b7e580 r13=0000000000000000
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExfAcquirePushLockExclusive+0x1e3:
fffff800`03276a9e 48894128        mov     qword ptr [rcx+28h],rax ds:002b:00000009`00000028=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000900000028

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b7100
 0000000900000028 

FOLLOWUP_IP: 
Ntfs!NtfsExtendedCompleteRequestInternal+114
fffff880`01618e84 488b5c2450      mov     rbx,qword ptr [rsp+50h]

FAULTING_IP: 
nt!ExfAcquirePushLockExclusive+1e3
fffff800`03276a9e 48894128        mov     qword ptr [rcx+28h],rax

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff88000c29a60 to fffff80003276a9e

STACK_TEXT:  
fffff880`0a468560 fffff880`00c29a60 : ffffffff`ffffffff fffffa80`00000000 fffffa80`0717cb00 fffffa80`0e653a50 : nt!ExfAcquirePushLockExclusive+0x1e3
fffff880`0a4685e0 fffff880`00c332bf : fffffa80`0717cb00 fffffa80`0e653a50 00000000`00000000 00000000`00000000 : fltmgr! ?? ::NNGAKEGL::`string'+0x9aa
fffff880`0a468620 fffff880`00c2aa10 : fffffa80`0ecfa380 fffffa80`07b7e010 00000000`00000000 fffffa80`0f72d4e0 : fltmgr!FltpPurgeVolumeNameCache+0x7f
fffff880`0a468660 fffff880`00c25b9b : fffffa80`07b7e010 00000000`00000000 fffffa80`0f72d4e0 00000000`00000000 : fltmgr! ?? ::NNGAKEGL::`string'+0x1a04
fffff880`0a4686a0 fffff880`00c05eca : fffffa80`0771b600 fffffa80`079c6de0 00000000`00000000 0070006d`0075004a : fltmgr!FltpReinstateNameCachingAllFrames+0x4b
fffff880`0a4686d0 fffff800`03288021 : 00000000`00000000 fffff800`03580c81 00000000`00000000 fffff880`00c05132 : fltmgr!FltpPassThroughCompletion+0x8a
fffff880`0a468710 fffff880`01618e84 : fffffa80`071164a0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`0a468800 fffff880`016a520c : fffff8a0`127145b0 fffffa80`07b86180 00000000`00000000 00000000`00000701 : Ntfs!NtfsExtendedCompleteRequestInternal+0x114
fffff880`0a468840 fffff880`01616574 : fffffa80`071164a0 fffffa80`0f0ed270 fffff880`0a468901 fffff880`0a468900 : Ntfs!NtfsCommonSetInformation+0xef3
fffff880`0a468920 fffff880`00c02bcf : fffffa80`0f0ed5c8 fffffa80`0f0ed270 fffffa80`071164a0 fffff880`0a468948 : Ntfs!NtfsFsdSetInformation+0x11c
fffff880`0a4689a0 fffff880`00c016df : fffffa80`079c6de0 fffffa80`0f0ed270 fffffa80`079c6d00 fffffa80`0f0ed270 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0a468a30 fffff800`03564063 : 00000000`000000ba fffff880`0a468ca0 00000000`00000000 fffffa80`0a02adc0 : fltmgr!FltpDispatch+0xcf
fffff880`0a468a90 fffff800`03283ed3 : 00000000`00000e20 fffffa80`0e6f8b60 00000000`0328dfd8 fffff800`000000ba : nt!NtSetInformationFile+0x91f
fffff880`0a468bb0 00000000`76f8158a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0328dfb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f8158a


SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  Ntfs!NtfsExtendedCompleteRequestInternal+114

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800a467b80 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsExtendedCompleteRequestInternal+114

BUCKET_ID:  X64_0x24_Ntfs!NtfsExtendedCompleteRequestInternal+114

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\020612-19640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0320b000 PsLoadedModuleList = 0xfffff800`03450670
Debug session time: Mon Feb  6 07:09:29.143 2012 (GMT-7)
System Uptime: 0 days 17:27:52.969
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800032595f7, fffff8800b03ee90, 0}

Probably caused by : memory_corruption ( nt!MmCleanProcessAddressSpace+f7 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800032595f7, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800b03ee90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MmCleanProcessAddressSpace+f7
fffff800`032595f7 498b442420      mov     rax,qword ptr [r12+20h]

CONTEXT:  fffff8800b03ee90 -- (.cxr 0xfffff8800b03ee90)
rax=0000000000000000 rbx=ffffffffffffffff rcx=fffff8800b03f760
rdx=8000000000000000 rsi=fffffa800c862b30 rdi=fffffa800cea71d0
rip=fffff800032595f7 rsp=fffff8800b03f870 rbp=fffff8800b03fc20
 r8=0007ffffffffffff  r9=fffffa800cdccbb0 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000026fff r15=fffffa800c862c01
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MmCleanProcessAddressSpace+0xf7:
fffff800`032595f7 498b442420      mov     rax,qword ptr [r12+20h] ds:002b:00000000`00000020=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800032595f7

STACK_TEXT:  
fffff880`0b03f870 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0xf7


FOLLOWUP_IP: 
nt!MmCleanProcessAddressSpace+f7
fffff800`032595f7 498b442420      mov     rax,qword ptr [r12+20h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmCleanProcessAddressSpace+f7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800b03ee90 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MmCleanProcessAddressSpace+f7

BUCKET_ID:  X64_0x3B_nt!MmCleanProcessAddressSpace+f7

Followup: MachineOwner
---------

Loading Dump File [D:\Kingston\BSODDmpFiles\symetric\020512-27206-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0321e000 PsLoadedModuleList = 0xfffff800`03463670
Debug session time: Sun Feb  5 12:59:52.285 2012 (GMT-7)
System Uptime: 0 days 5:30:09.111
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88010382f12, fffff8800c795220, 0}

Probably caused by : dxgmms1.sys ( dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88010382f12, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800c795220, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a
fffff880`10382f12 488b4010        mov     rax,qword ptr [rax+10h]

CONTEXT:  fffff8800c795220 -- (.cxr 0xfffff8800c795220)
rax=002e007300630076 rbx=fffff8a00c0ad000 rcx=fffff8a00bfe7b80
rdx=fffff8a003295660 rsi=0000000000000000 rdi=fffff8a00c038670
rip=fffff88010382f12 rsp=fffff8800c795c08 rbp=fffff8a00c038670
 r8=fffffa800a081320  r9=fffff8a00c038670 r10=fffff8a00bc9a401
r11=fffff8a00c0a9000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=ffffffffc000000d
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
dxgmms1!VidMmQueryAllocationSizeInSystemMemory+0xa:
fffff880`10382f12 488b4010        mov     rax,qword ptr [rax+10h] ds:002b:002e0073`00630086=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  wmplayer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff880102c48c0 to fffff88010382f12

STACK_TEXT:  
fffff880`0c795c08 fffff880`102c48c0 : fffff8a0`0c0ad000 fffff8a0`0c0ad000 00000000`00000001 fffff880`102c3fbb : dxgmms1!VidMmQueryAllocationSizeInSystemMemory+0xa
fffff880`0c795c10 fffff880`102c879c : fffff8a0`0c038600 fffff880`0c796060 fffffa80`0c262000 fffff880`1028f3af : dxgkrnl!DXGDEVICE::TerminateAllocations+0x98
fffff880`0c795c60 fffff880`102cae57 : fffff8a0`0c0ad000 fffff880`0c795d70 00000000`7efdb001 00000000`00000001 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x448
fffff880`0c795cf0 fffff960`0021f51a : 00000000`00000020 fffffa80`0ca7bb60 00000000`00000020 00000000`74916168 : dxgkrnl!DxgkDestroyAllocation+0x9bf
fffff880`0c795fb0 fffff800`03299ed3 : 00000000`00000008 00000000`6a3f2510 00000000`0013c201 00000000`093a6fc0 : win32k!NtGdiDdDDIDestroyAllocation+0x12
fffff880`0c795fe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


FOLLOWUP_IP: 
dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a
fffff880`10382f12 488b4010        mov     rax,qword ptr [rax+10h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce799c1

STACK_COMMAND:  .cxr 0xfffff8800c795220 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a

BUCKET_ID:  X64_0x3B_dxgmms1!VidMmQueryAllocationSizeInSystemMemory+a

Followup: MachineOwner
---------

Points to file system manager; could be hard disk file system corruption. Other possible causes are Memory problems... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
Possible cause is Drivers...
Possible causes are Memory problems... Drivers...
Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...
Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
DirectX/graphics card/graphics card driver related. Other possible causes can be found in 5.

Thanks to Dave76 for help understanding possible causes.

Update the following driver.

Code:

ctac32k	fffff880`052ea000	fffff880`05398000	Wed Jul 02 02:38:22 2008 (486b3e7e)	00095082		ctac32k.sys

ctac32k.sys

We will start with the common problems first (see bold possible causes). Do the following steps and test after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you are overclocking any hardware, please stop.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.
1. Download the latest drivers for your display card(s)
2. Click Start Menu
3. Right Click My Computer/Computer
4. Click Manage
5. Click Device Manager from the list on the left
6. Expand Display adapters
7. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
8. Restart your computer after uninstalling drivers for all display cards
9. Install the latest driver for the display cards once Windows starts
Alternatively:
1. Login as an adminstrative user
2. Download the latest drivers for your display card(s)
3. Click Start Menu
4. Click Control Panel
5. Click Hardware and Sound
6. Click Device Manager (the last link under Devices and Printers)
7. Expand Display adapters
8. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer after uninstalling drivers for all display cards
10. Install the latest driver for the display cards once Windows starts
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.

Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

Also, go into your BIOS and post all Voltages (CPU, RAM, NB, IMC, etc.) and all RAM settings (timings, frequency, etc.)

Thanks to Dave76 for help learning RAM Stability

symetric · 23 Feb 2012

Hello, thank for awsome report...I have one question, before I start what you ask, I have another problem with my "windows update" in another thread here and I probably need to do a clean install of my Win 7... should I do this before doing all your test ??

writhziden · 23 Feb 2012

Do the clean install, then see if you still have crashes. If you do, upload the new crash reports and we will analyze them and give new instructions or refer to the old instructions. Since you are doing a clean install, the crashes may stop, or they may not be related anymore.

symetric · 23 Feb 2012

writhziden said:

Do the clean install, then see if you still have crashes. If you do, upload the new crash reports and we will analyze them and give new instructions or refer to the old instructions. Since you are doing a clean install, the crashes may stop, or they may not be related anymore.

One question... If I do a clean install, I will have no problem "register" my copy of win 7 Pro...even if I installed it since 1 year ??? I have a RETAIL version

symetric · 23 Feb 2012

Just to tell you guys, that I run MemTest for 14 hrs... 7 PASS...with no error and I check all my HDD with no error.

writhziden · 23 Feb 2012

symetric said:

writhziden said:

Do the clean install, then see if you still have crashes. If you do, upload the new crash reports and we will analyze them and give new instructions or refer to the old instructions. Since you are doing a clean install, the crashes may stop, or they may not be related anymore.

One question... If I do a clean install, I will have no problem "register" my copy of win 7 Pro...even if I installed it since 1 year ??? I have a RETAIL version

You will not have a problem re-installing as long as you have a valid key for a clean install. Did you do a clean install initially on the computer? Or did you do an upgrade install?

symetric said:

Just to tell you guys, that I run MemTest for 14 hrs... 7 PASS...with no error and I check all my HDD with no error.

That is good news. :)

symetric · 24 Feb 2012

writhziden said:

symetric said:

writhziden said:

Do the clean install, then see if you still have crashes. If you do, upload the new crash reports and we will analyze them and give new instructions or refer to the old instructions. Since you are doing a clean install, the crashes may stop, or they may not be related anymore.

One question... If I do a clean install, I will have no problem "register" my copy of win 7 Pro...even if I installed it since 1 year ??? I have a RETAIL version

You will not have a problem re-installing as long as you have a valid key for a clean install. Did you do a clean install initially on the computer? Or did you do an upgrade install?

symetric said:

Just to tell you guys, that I run MemTest for 14 hrs... 7 PASS...with no error and I check all my HDD with no error.

That is good news. :)

Inititaly I think I do a clean install....I'm pretty sure because before I was using VISTA and I wanted to get rid of that OS !!

I think I will do this in the week-end, but we have many thing to think... all my program installed, doc , my DRIVERS...etc etc...that;s scare me a little bit

writhziden · 24 Feb 2012

Yeah, re-installing is a lot of work to get things back up and running and the way you like them. Let us know if you need help during the process. You can start a thread in Installation & Setup - Windows 7 Forums if you want expert help with the installation process.

symetric · 26 Feb 2012

Hello guys, I'm back with a my FORMATED HD with a Clean Install !

I installed Google Chrome, made some windows update , installed Office 2010, Virtual Clone Drive, new NVIDIA Driver, some utility and later I open Internet Eplorer and one error come like "Internet Explorer stop working etc etc, please close" I close and BANG! a BSOD so I post the result :

Thank you very much

Please note, I have a soundblaster Audigy ZS Platinum that I have to install with Driver for a Model SB0460 (I don't know if it matter)