Code:
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Kingston\BSODDmpFiles\JCL III\Windows_NT6_BSOD_jcgriff2\031312-19858-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0d000 PsLoadedModuleList = 0xfffff800`03052670
Debug session time: Tue Mar 13 03:24:15.806 2012 (UTC - 6:00)
System Uptime: 0 days 0:07:11.993
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffd6f801e64e0, 2, 1, fffff80002e77601}
Probably caused by : memory_corruption ( nt!MmCreateKernelStack+e6 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffd6f801e64e0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e77601, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bc100
fffffd6f801e64e0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MmCreateKernelStack+e6
fffff800`02e77601 49891cd2 mov qword ptr [r10+rdx*8],rbx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: firefox.exe
TRAP_FRAME: fffff88008545240 -- (.trap 0xfffff88008545240)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a21a458 rbx=0000000000000000 rcx=0000000fa800a21a
rdx=0000005df003cc9c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e77601 rsp=fffff880085453d0 rbp=0000000000000002
r8=000000144348c000 r9=0000000fffffffff r10=fffffa8000000000
r11=fffffa800a21a450 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!MmCreateKernelStack+0xe6:
fffff800`02e77601 49891cd2 mov qword ptr [r10+rdx*8],rbx ds:f500:fffffd6f`801e64e0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e891e9 to fffff80002e89c40
STACK_TEXT:
fffff880`085450f8 fffff800`02e891e9 : 00000000`0000000a fffffd6f`801e64e0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`08545100 fffff800`02e87e60 : 00000000`00000000 fffff800`03092e28 fffff800`03092e28 fffffa80`078cf061 : nt!KiBugCheckDispatch+0x69
fffff880`08545240 fffff800`02e77601 : fffff800`030bf500 fffff880`08545510 00000000`00000000 fffff880`08545480 : nt!KiPageFault+0x260
fffff880`085453d0 fffff800`02e96792 : fffffa80`078cf060 00000000`00000002 fffff880`08545990 fffffa80`0918b680 : nt!MmCreateKernelStack+0xe6
fffff880`085454c0 fffff880`0103bd42 : fffff880`0103bcb0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x252
fffff880`085455a0 fffff880`010daa04 : fffff880`08545670 fffff880`08545670 fffff880`08545670 fffff8a0`019449e8 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`08545610 fffff800`0332fc16 : fffff880`08545670 fffff980`44d50c10 fffff980`44d50c10 fffffa80`087f4030 : Ntfs!NtfsFsdCleanup+0x144
fffff880`08545880 fffff880`00c02bcf : fffff980`44d50fb0 fffff880`08545920 fffffa80`07bbaae0 fffffa80`079a3d60 : nt!IovCallDriver+0x566
fffff880`085458e0 fffff880`00c016df : fffffa80`085f28e0 fffffa80`085f28e0 fffffa80`08498c00 fffff980`44d50c10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`08545970 fffff800`0332fc16 : fffff980`44d50c10 00000000`00000002 fffffa80`085f28e0 00000000`00000000 : fltmgr!FltpDispatch+0xcf
fffff880`085459d0 fffff800`03191a0f : fffff980`44d50c10 fffffa80`08147b30 00000000`00000000 fffffa80`07bed6d0 : nt!IovCallDriver+0x566
fffff880`08545a30 fffff800`03181174 : 00000000`00000000 fffffa80`08147b30 00000000`00000001 fffffa80`079b3b80 : nt!IopCloseFile+0x11f
fffff880`08545ac0 fffff800`03180f31 : fffffa80`08147b30 fffffa80`00000001 fffff8a0`03091240 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`08545b40 fffff800`031814f4 : 00000000`00000788 fffffa80`08147b30 fffff8a0`03091240 00000000`00000788 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`08545bd0 fffff800`02e88ed3 : fffffa80`078cf060 fffff880`08545ca0 00000000`fffd5000 00000000`fffd5000 : nt!ObpCloseHandle+0x94
fffff880`08545c20 00000000`7767140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0209e4f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7767140a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MmCreateKernelStack+e6
fffff800`02e77601 49891cd2 mov qword ptr [r10+rdx*8],rbx
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MmCreateKernelStack+e6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MmCreateKernelStack+e6
BUCKET_ID: X64_0xA_nt!MmCreateKernelStack+e6
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\JCL III\Windows_NT6_BSOD_jcgriff2\031312-22011-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`03054670
Debug session time: Tue Mar 13 02:04:49.754 2012 (UTC - 6:00)
System Uptime: 0 days 5:17:15.314
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffff8003, 1, fffff80002e98348, 0}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!SleepInputIdle+79 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffff8003, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e98348, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030be100
ffffffffffff8003
FAULTING_IP:
nt!KeClearEvent+0
fffff800`02e98348 83610400 and dword ptr [rcx+4],0
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88009957950 -- (.trap 0xfffff88009957950)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c207fce0 rbx=0000000000000000 rcx=ffffffffffff7fff
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e98348 rsp=fffff88009957ae8 rbp=0000000000000000
r8=fffffa80093e39a0 r9=000000000000000a r10=0000000000000000
r11=fffff88002fd5100 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!KeClearEvent:
fffff800`02e98348 83610400 and dword ptr [rcx+4],0 ds:ffffffff`ffff8003=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002e379fc to fffff80002e8bc40
STACK_TEXT:
fffff880`099577e8 fffff800`02e379fc : 00000000`00000050 ffffffff`ffff8003 00000000`00000001 fffff880`09957950 : nt!KeBugCheckEx
fffff880`099577f0 fffff800`02e89d6e : 00000000`00000001 ffffffff`ffff8003 00000000`00000000 fffff900`c272ec20 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`09957950 fffff800`02e98348 : fffff960`0010ca31 00000000`00000000 fffffa80`093e3900 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`09957ae8 fffff960`0010ca31 : 00000000`00000000 fffffa80`093e3900 00000000`00000000 00000000`00000000 : nt!KeClearEvent
fffff880`09957af0 fffff960`0010c90d : fffff900`c272ec00 00000000`0000000d 00000000`00000401 fffff960`00096e00 : win32k!SleepInputIdle+0x79
fffff880`09957b20 fffff960`0010c989 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : win32k!xxxRealSleepThread+0x27d
fffff880`09957bc0 fffff960`0011f4f6 : fffffa80`093e3900 fffff880`09957ca0 00000000`76e505ba 00000000`00000000 : win32k!xxxSleepThread+0x59
fffff880`09957bf0 fffff800`02e8aed3 : fffffa80`093e3900 fffff880`09957bd8 00000000`00070168 00000000`fffdc033 : win32k!NtUserWaitMessage+0x46
fffff880`09957c20 00000000`74e32e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001ff048 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74e32e09
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SleepInputIdle+79
fffff960`0010ca31 4883c428 add rsp,28h
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: win32k!SleepInputIdle+79
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f10ff24
FAILURE_BUCKET_ID: X64_0x50_win32k!SleepInputIdle+79
BUCKET_ID: X64_0x50_win32k!SleepInputIdle+79
Followup: MachineOwner
---------
- Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
- Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers...
Thanks to Dave76 for help understanding possible causes.
None of the above crashes were Verified, which means this is probably a hardware problem. You also had the file system on the stack, so it could be corrupted file system data on the hard disk file system.
- Disable Verifier: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator ->
verifier /reset
-> Restart your computer.
- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
- Use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
If you swap any memory components, follow these steps for ESD safety:
- Shut down and turn off your computer.
- Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
- Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
- Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.