Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD w/ viewing photos w/ Windows Live Photo Gallery error 0x0000001e


21 Mar 2012   #1

windows 7 home premium 64 bit
 
 
BSOD w/ viewing photos w/ Windows Live Photo Gallery error 0x0000001e

I have had a problem with my Gateway NV73 laptop where I would get a BSOD whenever I was viewing video on the internet, viewing pictures in my photo editing program and now after about 5 minutes of just using the internet. The BSOD would come up in a square in the center of the screen and dissappear within seconds. Then the system would still show the power light as on but a blank screen and unresponsive. I would press and hold power button until shutdown and try to restart but only the fan sound was working but nothing else. And after about 30 to 40 minutes later it would boot up just fine, but would then crash after minutes of using it. I tried to get the info needed from the dump files but I literally had to do the whole process stated above many times and I saved the minidump files to my network drive so I could post this on my desktop computer. Please help, I am pulling my hair out trying to figure this out.

Gateway Laptop Model NV73
AMD processor
3GB Ram
Windows 7 Home Premium 64 bit OEM
Laptop is about 17 months old

I attached a text file with the contents of one of the minidump files but also pasted the results below:

Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [X:\032012-25194-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03260650
Debug session time: Tue Mar 20 01:09:31.387 2012 (UTC - 4:00)
System Uptime: 0 days 0:13:01.010
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..........
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8800334f9f8, 1, fffff800033a7c8d, 1}

Could not read faulting driver name
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrnlmp.exe ( nt!AlpcpReceiveSynchronousReply+ed )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800334f9f8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800033a7c8d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000001, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ca100
GetUlongFromAddress: unable to read from fffff800032ca1c0
fffff8800334f9f8 Nonpaged pool
FAULTING_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800734f7d0 -- (.trap 0xfffff8800734f7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffdfff rbx=0000000000000000 rcx=fffff8a00322a708
rdx=fffffa8002884b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033a7c8d rsp=fffff8800734f960 rbp=fffffa8002884b60
r8=fffffa8003541bb8 r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!AlpcpReceiveSynchronousReply+0xed:
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000302ce64 to fffff80003098d40
STACK_TEXT:
fffff880`0734f668 fffff800`0302ce64 : 00000000`00000050 fffff880`0334f9f8 00000000`00000001 fffff880`0734f7d0 : nt!KeBugCheckEx
fffff880`0734f670 fffff800`03096e6e : 00000000`00000001 fffff880`0334f9f8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45792
fffff880`0734f7d0 fffff800`033a7c8d : 00000000`00000000 fffffa80`02884f20 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0734f960 fffff800`033a72e0 : 00000000`00000000 00000000`011e0340 00000000`00299dd8 00000000`00004801 : nt!AlpcpReceiveSynchronousReply+0xed
fffff880`0734f9c0 fffff800`033a50db : fffffa80`02708e60 fffffa80`00020000 00000000`011e0340 00000000`00299dd8 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0734fb00 fffff800`03097fd3 : fffffa80`02884b60 fffff880`0734fca0 00000000`0153e3a0 00000980`00000000 : nt!NtAlpcSendWaitReceivePort+0x1ab
fffff880`0734fbb0 00000000`77181b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0153e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181b6a

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!AlpcpReceiveSynchronousReply+ed
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
Followup: MachineOwner
---------

My System SpecsSystem Spec
.

21 Mar 2012   #2
JMH

Win 7 Ultimate 64-bit. SP1.
 
 



We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:
Quote:
* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:
Quote:
* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.
My System SpecsSystem Spec
21 Mar 2012   #3

windows 7 home premium 64 bit
 
 

Thanks for your help! Attached is the zip file of the dump files.
My System SpecsSystem Spec
.


21 Mar 2012   #4

Windows 7 Home Premium 64 Bit
 
 

Possible out of date drivers:
Code:
mdmxsdk	fffff880`02be9000	fffff880`02bed280	Mon Jun 19 15:27:26 2006 (449716be)	00010210		mdmxsdk.sys
CAX_CNXT	fffff880`058b8000	fffff880`05983000	Fri Feb 13 14:19:32 2009 (4995e3e4)	000b6489		CAX_CNXT.sys
CAXHWAZL	fffff880`04109000	fffff880`0415b000	Fri Feb 13 14:20:54 2009 (4995e436)	0004f091		CAXHWAZL.sys
CAX_DPV	fffff880`0545f000	fffff880`055d3000	Fri Feb 13 14:24:50 2009 (4995e522)	00176feb		CAX_DPV.sys
NTIDrvr	fffff880`045c1000	fffff880`045c9000	Tue Mar 24 21:09:39 2009 (49c9a073)	0000e15e		NTIDrvr.sys
DKbFltr	fffff880`0441e000	fffff880`0442a000	Wed Mar 25 21:15:42 2009 (49caf35e)	0000809a		DKbFltr.sys
usbfilter	fffff880`045db000	fffff880`045e7000	Fri Apr 03 05:39:51 2009 (49d5f587)	000128e6		usbfilter.sys
UBHelper	fffff880`045b9000	fffff880`045c1000	Mon Apr 27 02:48:19 2009 (49f57153)	0000589c		UBHelper.sys
XAudio64	fffff880`05f09000	fffff880`05f11000	Wed Apr 29 12:21:07 2009 (49f89a93)	00002a9e		XAudio64.sys
AtiPcie	fffff880`01830000	fffff880`01838000	Tue May 05 09:00:22 2009 (4a005486)	000134c7		AtiPcie.sys
k57nd60a	fffff880`04a00000	fffff880`04a51000	Sun Jun 07 01:36:34 2009 (4a2b6e02)	000539bb		k57nd60a.sys
RtHDMIVX	fffff880`04073000	fffff880`040a3880	Wed Jun 24 04:23:22 2009 (4a41fe9a)	00032def		RtHDMIVX.sys
mdmxsdk.sys
CAX_CNXT.sys
CAXHWAZL.sys
CAX_DPV.sys
NTIDrvr.sys
DKbFltr.sys
usbfilter.sys
UBHelper.sys
XAudio64.sys
AtiPcie.sys
k57nd60a.sys
RtHDMIVX.sys


Code:
  1. Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032112-20560-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03050000 PsLoadedModuleList = 0xfffff800`03294650 Debug session time: Tue Mar 20 23:09:58.169 2012 (UTC - 6:00) System Uptime: 0 days 11:22:46.792 Loading Kernel Symbols ............................................................... ................................................................ ......................................... Loading User Symbols Loading unloaded module list .......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {5001, fffff70001080000, 574, 57e00fffffe} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+38efb ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000005001, The subtype of the bugcheck. Arg2: fffff70001080000 Arg3: 0000000000000574 Arg4: 0000057e00fffffe Debugging Details: ------------------ BUGCHECK_STR: 0x1a_5001 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: ncwmodulelist. CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff8000313eae7 to fffff800030ccd40 STACK_TEXT: fffff880`08dd69a8 fffff800`0313eae7 : 00000000`0000001a 00000000`00005001 fffff700`01080000 00000000`00000574 : nt!KeBugCheckEx fffff880`08dd69b0 fffff800`030d9389 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x38efb fffff880`08dd6ac0 fffff800`030cae6e : 00000000`00000000 00000000`004a0008 00000000`00b19901 00000000`00000000 : nt!MmAccessFault+0x359 fffff880`08dd6c20 00000000`7789a7fc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e 00000000`0012f430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7789a7fc STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+38efb fffff800`0313eae7 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+38efb FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2 FAILURE_BUCKET_ID: X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb BUCKET_ID: X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb Followup: MachineOwner ---------
  2. Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-25194-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03260650 Debug session time: Mon Mar 19 23:09:31.387 2012 (UTC - 6:00) System Uptime: 0 days 0:13:01.010 Loading Kernel Symbols ............................................................... ................................................................ .......................................... Loading User Symbols Loading unloaded module list .......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff8800334f9f8, 1, fffff800033a7c8d, 1} Could not read faulting driver name Probably caused by : ntkrnlmp.exe ( nt!AlpcpReceiveSynchronousReply+ed ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff8800334f9f8, memory referenced. Arg2: 0000000000000001, value 0 = read operation, 1 = write operation. Arg3: fffff800033a7c8d, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000001, (reserved) Debugging Details: ------------------ Could not read faulting driver name WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ca100 fffff8800334f9f8 FAULTING_IP: nt!AlpcpReceiveSynchronousReply+ed fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi MM_INTERNAL_CODE: 1 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: services.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff8800734f7d0 -- (.trap 0xfffff8800734f7d0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=00000000ffffdfff rbx=0000000000000000 rcx=fffff8a00322a708 rdx=fffffa8002884b60 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800033a7c8d rsp=fffff8800734f960 rbp=fffffa8002884b60 r8=fffffa8003541bb8 r9=0000000000000000 r10=fffffffffffffffd r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!AlpcpReceiveSynchronousReply+0xed: fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi ds:00000000`00000000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000302ce64 to fffff80003098d40 STACK_TEXT: fffff880`0734f668 fffff800`0302ce64 : 00000000`00000050 fffff880`0334f9f8 00000000`00000001 fffff880`0734f7d0 : nt!KeBugCheckEx fffff880`0734f670 fffff800`03096e6e : 00000000`00000001 fffff880`0334f9f8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45792 fffff880`0734f7d0 fffff800`033a7c8d : 00000000`00000000 fffffa80`02884f20 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e fffff880`0734f960 fffff800`033a72e0 : 00000000`00000000 00000000`011e0340 00000000`00299dd8 00000000`00004801 : nt!AlpcpReceiveSynchronousReply+0xed fffff880`0734f9c0 fffff800`033a50db : fffffa80`02708e60 fffffa80`00020000 00000000`011e0340 00000000`00299dd8 : nt!AlpcpProcessSynchronousRequest+0x33d fffff880`0734fb00 fffff800`03097fd3 : fffffa80`02884b60 fffff880`0734fca0 00000000`0153e3a0 00000980`00000000 : nt!NtAlpcSendWaitReceivePort+0x1ab fffff880`0734fbb0 00000000`77181b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0153e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181b6a STACK_COMMAND: kb FOLLOWUP_IP: nt!AlpcpReceiveSynchronousReply+ed fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!AlpcpReceiveSynchronousReply+ed FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2 FAILURE_BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed Followup: MachineOwner ---------
  3. Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-34757-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a2650 Debug session time: Mon Mar 19 22:28:57.349 2012 (UTC - 6:00) System Uptime: 0 days 0:06:37.973 Loading Kernel Symbols ............................................................... ................................................................ .......................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff800030cbcbe, 0, ffffffffffffffff} Probably caused by : fileinfo.sys ( fileinfo!FIPfFilePfLinkDereference+2b ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800030cbcbe, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: ffffffffffffffff, Parameter 1 of the exception Debugging Details: ------------------ OVERLAPPED_MODULE: Address regions for 'WSDPrint' and 'WUDFRd.sys' overlap EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!ExfAcquirePushLockExclusive+1e fffff800`030cbcbe 488b19 mov rbx,qword ptr [rcx] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330c100 ffffffffffffffff ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80003125a08 to fffff800030dad40 STACK_TEXT: fffff880`03affb58 fffff800`03125a08 : 00000000`0000001e ffffffff`c0000005 fffff800`030cbcbe 00000000`00000000 : nt!KeBugCheckEx fffff880`03affb60 fffff800`030da3c2 : fffff880`03b00338 fffffa80`0233be00 fffff880`03b003e0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x48d2d fffff880`03b00200 fffff800`030d8cca : fffffa80`05356060 00000000`00000000 fffffa80`05621b10 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`03b003e0 fffff800`030cbcbe : fffffa80`021cfb30 fffff8a0`097e9860 fffffa80`021de660 fffffa80`05356060 : nt!KiGeneralProtectionFault+0x10a fffff880`03b00570 fffff880`010cc973 : fffff8a0`00000000 fffff8a0`00000000 fffffa80`0233be00 fffff8a0`03fe4d10 : nt!ExfAcquirePushLockExclusive+0x1e fffff880`03b005f0 fffff880`010cb8ec : fffff8a0`0ef1c4e0 fffffa80`023a4e60 fffffa80`0233be18 fffffa80`0233be18 : fileinfo!FIPfFilePfLinkDereference+0x2b fffff880`03b00620 fffff880`010ca6b4 : fffff8a0`0efe4d10 00000000`00000000 fffff880`03b006b0 00000000`000007ff : fileinfo!FIPfFileOpenRemove+0x9c fffff880`03b00660 fffff800`03448625 : fffffa80`0601a570 fffff8a0`0f000000 fffff880`03b00840 00000000`00000001 : fileinfo!FIPfInterfaceClose+0x90 fffff880`03b00690 fffff800`034f45e9 : fffff880`03b00780 fffff8a0`0f000000 fffff880`4c526650 fffff880`00000087 : nt!PfpOpenHandleClose+0x55 fffff880`03b006e0 fffff800`035372d3 : fffff8a0`0f003bc0 00000000`00000000 fffffa80`04c0b810 fffff880`03b00778 : nt!PfpReadSupportCleanup+0x49 fffff880`03b00710 fffff800`0353f27e : fffff8a0`00000000 fffff8a0`00000003 fffff8a0`0000013b fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x293 fffff880`03b00810 fffff800`0353fe17 : 00000000`00000000 fffff880`03b00ca0 fffff880`03b00a08 fffff8a0`04994060 : nt!PfpPrefetchRequestPerform+0x30e fffff880`03b00960 fffff800`0354c3ee : fffff880`03b00a08 fffff880`03b00c01 fffffa80`0552d430 00000000`00000000 : nt!PfpPrefetchRequest+0x176 fffff880`03b009d0 fffff800`03550c1a : 00000000`00000000 00000000`0000004f 00000000`00000000 ffffffff`ffffff01 : nt!PfSetSuperfetchInformation+0x1ad fffff880`03b00ab0 fffff800`030d9fd3 : fffffa80`05621b10 00000000`00000000 00000000`00000001 00000000`0000ac96 : nt!NtSetSystemInformation+0xc8d fffff880`03b00c20 00000000`76f02a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`02c7f4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f02a0a STACK_COMMAND: kb FOLLOWUP_IP: fileinfo!FIPfFilePfLinkDereference+2b fffff880`010cc973 83c9ff or ecx,0FFFFFFFFh SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: fileinfo!FIPfFilePfLinkDereference+2b FOLLOWUP_NAME: MachineOwner MODULE_NAME: fileinfo IMAGE_NAME: fileinfo.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc481 FAILURE_BUCKET_ID: X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b BUCKET_ID: X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b Followup: MachineOwner ---------
  4. Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\020812-22401-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`0304c000 PsLoadedModuleList = 0xfffff800`03291670 Debug session time: Tue Feb 7 22:59:17.902 2012 (UTC - 6:00) System Uptime: 0 days 1:30:33.525 Loading Kernel Symbols ............................................................... ................................................................ ......................................... Loading User Symbols Loading unloaded module list ................ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffffa7fffffffd0, 2, 1, fffff800030d925c} Probably caused by : memory_corruption ( nt!MiInsertPageInFreeOrZeroedList+54c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffffa7fffffffd0, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff800030d925c, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fb100 fffffa7fffffffd0 CURRENT_IRQL: 2 FAULTING_IP: nt!MiInsertPageInFreeOrZeroedList+54c fffff800`030d925c 498930 mov qword ptr [r8],rsi CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: System TRAP_FRAME: fffff880009a9970 -- (.trap 0xfffff880009a9970) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000001 rbx=0000000000000000 rcx=ffffffffffffffd0 rdx=ffffffffffffffff rsi=0000000000000000 rdi=0000000000000000 rip=fffff800030d925c rsp=fffff880009a9b00 rbp=fffff880009a9b40 r8=fffffa7fffffffd0 r9=0000000000000000 r10=fffffa80020fd048 r11=fffff800032fe4c0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc nt!MiInsertPageInFreeOrZeroedList+0x54c: fffff800`030d925c 498930 mov qword ptr [r8],rsi ds:fffffa7f`ffffffd0=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800030c81e9 to fffff800030c8c40 STACK_TEXT: fffff880`009a9828 fffff800`030c81e9 : 00000000`0000000a fffffa7f`ffffffd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`009a9830 fffff800`030c6e60 : fffff980`1aeb3000 fffff880`00e34fb0 00000000`00000000 fffffa80`01c20630 : nt!KiBugCheckDispatch+0x69 fffff880`009a9970 fffff800`030d925c : fffffa80`021b3710 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260 fffff880`009a9b00 fffff800`03090d6e : fffffa80`01c20630 00000000`00096021 00000000`00000002 00000000`00000000 : nt!MiInsertPageInFreeOrZeroedList+0x54c fffff880`009a9c10 fffff800`03363fee : fffffa80`021b3650 00000000`00000080 fffffa80`021b3b30 fffff800`030ba5d9 : nt!MmZeroPageThread+0x8f5 fffff880`009a9d40 fffff800`030ba5e6 : fffff800`0323ee80 fffffa80`021b3650 fffff800`0324ccc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!MiInsertPageInFreeOrZeroedList+54c fffff800`030d925c 498930 mov qword ptr [r8],rsi SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!MiInsertPageInFreeOrZeroedList+54c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c BUCKET_ID: X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c Followup: MachineOwner ---------
  1. Possible causes are Memory problems... Drivers...
  2. Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Antivirus Software... Drivers...
  3. Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
  4. Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...


We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.
  • If you are overclocking any hardware, please stop.

  • Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
    For any drives that do not give the message:
    Windows has checked the file system and found no problems
    run disk check again as above. In other words, if it says:
    Windows has made corrections to the file system
    after running the disk check, run the disk check again.

  • Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.


  • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

    If you swap any memory components, follow these steps for ESD safety:
    1. Shut down and turn off your computer.
    2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
    3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
    4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
    Once these steps have been followed, it is safe to remove and replace components within your computer.

  • An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
    a. Backup your system and user files
    b. Create a system restore point
    c. If you do not have a Windows 7 DVD, Create a system repair disc
    d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.

    If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

    Thanks to zigzag3143 for contributing to the Verifier steps.
    If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
    The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.
My System SpecsSystem Spec
Reply

 BSOD w/ viewing photos w/ Windows Live Photo Gallery error 0x0000001e




Thread Tools




Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:33 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33