BSOD While Idle or playing, ntoskrnl.exe+7cd40


  1. Posts : 5
    Windows 7 Ultimate 64bit
       #1

    BSOD While Idle or playing, ntoskrnl.exe+7cd40


    Hello guys,

    im having some crashes with my computer.

    -windows7 x64
    -retail
    -os age is 1 0r 2 months
    -hardware age is 1 or 2 months

    OS Windows 7 Ultimate 64bit
    CPU Intel(R) Core(TM) i7-2600K CPU @3.4GHZ
    Motherboard Asus Sabertooth p67
    Memory GeIL 16 GB DDR3-1333 Quad-Kit
    Graphics Card(s) ASUS ENGTX580
    Sound Card onboard
    Monitor(s) Displays asus
    Screen Resolution N/A
    Hard Drives Intel SSD 120gb,wd 750gb
    PSU Cooler Master GX650



    ive already ran memtest86 for 4 hours which gave no errors so dont think its a hardware problem.
    And also ran the driver verifier with caused the last 3-4 BSOD but i cant seem to understand what is causing it to blue screen.

    Also i am running Eset smart security 5 dont know if thats a problem or not.

    and will attach the Dump files below.

    i hope you guys can help me.


    Oh and i also forgot to mention that i ran a sfc/scannow on my pc and all files are OK
    My pc is in dutch sorry for that
    Last edited by Woopiej; 04 Apr 2012 at 15:18. Reason: forgot to mention some things
      My Computer


  2. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #2

    Problem Devices:
    Code:
    WD SES Device USB Device USBSTOR \ OTHER & VEN_WD & PROD_SES_DEVICE & REV_2018 \ 574341563537373538373839 & 2 The drivers for this device are not installed.

    Security Software (just to check that you have it and it is working properly; nothing needs to be done at this time):
    Code:
    egui.exe	c:\program files\eset\eset smart security\egui.exe	1840	8	200	1380	4-4-2012 20:18	5.0.94.0	3,85 MB (4.035.152 bytes)	22-9-2011 13:03
    ekrn.exe	c:\program files\eset\eset smart security\x86\ekrn.exe	1936	8	200	1380	4-4-2012 20:18	5.0.94.0	952,09 kB (974.944 bytes)	22-9-2011 13:03

    Code:
    1. Loading Dump File [D:\Kingston\BSODDmpFiles\Woopiej\Windows_NT6_BSOD_jcgriff2\040412-13696-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`0300c000 PsLoadedModuleList = 0xfffff800`03250650 Debug session time: Wed Apr 4 11:48:12.335 2012 (UTC - 6:00) System Uptime: 0 days 0:00:16.288 Loading Kernel Symbols ............................................................... ................................................................ .......................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {0, 2, 0, fffff8000309dc35} Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000000, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff8000309dc35, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ba100 0000000000000000 CURRENT_IRQL: 2 FAULTING_IP: nt!IopCompleteRequest+ae5 fffff800`0309dc35 488b09 mov rcx,qword ptr [rcx] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0xA PROCESS_NAME: AppleMobileDev IRP_ADDRESS: ffffffffffffff89 TRAP_FRAME: fffff880067ab070 -- (.trap 0xfffff880067ab070) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000001 rbx=0000000000000000 rcx=fffffa800dc15008 rdx=ffffff000226cff8 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8000307f8e0 rsp=fffff880067ab208 rbp=fffffa800dc26590 r8=0000000000001000 r9=0000000000000080 r10=fffffa80082c4370 r11=fffffa800dc14008 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe cy nt!memcpy+0x250: fffff800`0307f8e0 488b440af8 mov rax,qword ptr [rdx+rcx-8] ds:b1b0:fffff980`0fe81ff8=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800030882e9 to fffff80003088d40 STACK_TEXT: fffff880`067aa728 fffff800`030882e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`067aa730 fffff800`03086f60 : 00000000`80000000 fffff880`00000000 00000000`00000003 fffff980`0fdb6ee0 : nt!KiBugCheckDispatch+0x69 fffff880`067aa870 fffff800`0309dc35 : fffffa80`0dbb8060 fffff800`0308bc8a 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260 fffff880`067aaa00 fffff800`0307b6d7 : 00000000`00000001 00000000`00000000 00000000`00000300 fffff980`00000000 : nt!IopCompleteRequest+0xae5 fffff880`067aaad0 fffff800`0307e8cd : fffffa80`0dbb8060 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7 fffff880`067aab50 fffff800`0308fbaf : fffff880`03165180 00000000`00000001 fffff980`00000000 fffff800`03097bd6 : nt!KiCommitThreadWait+0x3dd fffff880`067aabe0 fffff800`03025fec : fffffa80`0dbb8000 fffffa80`00000009 00000000`00000000 fffff800`0323a200 : nt!KeWaitForSingleObject+0x19f fffff880`067aac80 fffff800`030b9754 : 00000000`0138a8c0 fffff8a0`019ffe08 fffffa80`0003a9e0 00000000`00000001 : nt!MiWaitForCollidedFaultComplete+0x110 fffff880`067aace0 fffff800`030a6d25 : 00000000`00000000 00000000`0138a8c0 fffff980`0f434ca0 fffff800`032bdb00 : nt!MiResolveTransitionFault+0x544 fffff880`067aad70 fffff800`030a56e3 : f8a0019f`fe080400 fffff980`0fe81ff8 fffff6fc`c007f408 fffff800`032bdb00 : nt!MiResolveProtoPteFault+0x325 fffff880`067aae00 fffff800`03095e4b : fffff980`0f434f00 fffff800`0351927e fffff980`0f434ca0 fffff800`0309d69c : nt!MiDispatchFault+0x1c3 fffff880`067aaf10 fffff800`03086e6e : 00000000`00000000 fffff980`0fe81ff8 00000000`0db80100 00000000`00001000 : nt!MmAccessFault+0xe1b fffff880`067ab070 fffff800`0307f8e0 : fffff800`03371cc1 fffffa80`0dc14008 00000000`00001000 fffffa80`0db80d60 : nt!KiPageFault+0x16e fffff880`067ab208 fffff800`03371cc1 : fffffa80`0dc14008 00000000`00001000 fffffa80`0db80d60 00000000`00001000 : nt!memcpy+0x250 fffff880`067ab210 fffff800`03371b2a : 00000000`00040000 fffffa80`0dc14008 00000000`00001000 00000000`00000000 : nt!CcCopyBytesToUserBuffer+0x41 fffff880`067ab250 fffff880`014eaf08 : fffff880`00000000 00000000`00000005 fffffa80`00001000 fffffa80`00001001 : nt!CcCopyRead+0x1ba fffff880`067ab310 fffff880`012e7098 : fffffa80`0dc26590 fffffa80`0db80cf8 fffffa80`0dc118d8 fffffa80`0dc26501 : Ntfs!NtfsCopyReadA+0x1a8 fffff880`067ab4f0 fffff880`012ea8ba : fffff880`067ab5c0 fffffa80`0dc14003 fffffa80`0dc14000 fffffa80`0dc26500 : fltmgr!FltpPerformFastIoCall+0x88 fffff880`067ab550 fffff880`01308630 : fffffa80`0dc26590 00000000`00000000 fffff880`067ab6b0 00000000`00001000 : fltmgr!FltpPassThroughFastIo+0xda fffff880`067ab590 fffff800`03371629 : fffffa80`0dc26590 fffff800`00000001 fffffa80`09788f30 fffffa80`0dc26590 : fltmgr!FltpFastIoRead+0x1d0 fffff880`067ab630 fffff800`03087fd3 : 00000000`00001000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x417 fffff880`067ab720 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 STACK_COMMAND: kb FOLLOWUP_IP: nt!KiPageFault+260 fffff800`03086f60 440f20c0 mov rax,cr8 SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nt!KiPageFault+260 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2 FAILURE_BUCKET_ID: X64_0xA_VRF_nt!KiPageFault+260 BUCKET_ID: X64_0xA_VRF_nt!KiPageFault+260 Followup: MachineOwner ---------
    2. Loading Dump File [D:\Kingston\BSODDmpFiles\Woopiej\Windows_NT6_BSOD_jcgriff2\040412-7363-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`0305c000 PsLoadedModuleList = 0xfffff800`032a0650 Debug session time: Wed Apr 4 11:41:16.592 2012 (UTC - 6:00) System Uptime: 0 days 0:08:08.544 Loading Kernel Symbols ............................................................... ................................................................ ................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff800035755ef, 0, a} Unable to load image \SystemRoot\system32\DRIVERS\ehdrv.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ehdrv.sys *** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys Probably caused by : ehdrv.sys ( ehdrv+18304 ) Followup: MachineOwner --------- 4: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff800035755ef, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 000000000000000a, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!VerifierMmUnlockPages+2f fffff800`035755ef 0fb75f0a movzx ebx,word ptr [rdi+0Ah] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 000000000000000a READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330a100 000000000000000a ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: ekrn.exe CURRENT_IRQL: 0 TRAP_FRAME: fffff88005cd61d0 -- (.trap 0xfffff88005cd61d0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000004 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800035755ef rsp=fffff88005cd6360 rbp=fffffa80096e19e0 r8=0000000000000006 r9=0000000000000000 r10=00000000133428d3 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz ac pe cy nt!VerifierMmUnlockPages+0x2f: fffff800`035755ef 0fb75f0a movzx ebx,word ptr [rdi+0Ah] ds:bc80:00000000`0000000a=???? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80003123a08 to fffff800030d8d40 STACK_TEXT: fffff880`05cd5948 fffff800`03123a08 : 00000000`0000001e ffffffff`c0000005 fffff800`035755ef 00000000`00000000 : nt!KeBugCheckEx fffff880`05cd5950 fffff800`030d83c2 : fffff880`05cd6128 fffff880`05cd6501 fffff880`05cd61d0 fffffa80`096e19e0 : nt! ?? ::FNODOBFM::`string'+0x48d2d fffff880`05cd5ff0 fffff800`030d6f3a : 00000000`00000000 00000000`0000000a 00000000`00000000 fffff880`05cd6501 : nt!KiExceptionDispatch+0xc2 fffff880`05cd61d0 fffff800`035755ef : fffff880`04390243 00720063`002e0030 00000000`0743ec28 00000000`00000014 : nt!KiPageFault+0x23a fffff880`05cd6360 fffff880`04390304 : fffff880`05cd6501 fffffa80`096e19e0 fffffa80`096e19e0 00000000`00000000 : nt!VerifierMmUnlockPages+0x2f fffff880`05cd63a0 fffff880`05cd6501 : fffffa80`096e19e0 fffffa80`096e19e0 00000000`00000000 00000000`00000000 : ehdrv+0x18304 fffff880`05cd63a8 fffffa80`096e19e0 : fffffa80`096e19e0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`05cd6501 fffff880`05cd63b0 fffffa80`096e19e0 : 00000000`00000000 00000000`00000000 00000000`00000000 133428d3`00760001 : 0xfffffa80`096e19e0 fffff880`05cd63b8 00000000`00000000 : 00000000`00000000 00000000`00000000 133428d3`00760001 00000000`00000006 : 0xfffffa80`096e19e0 STACK_COMMAND: kb FOLLOWUP_IP: ehdrv+18304 fffff880`04390304 ?? ??? SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: ehdrv+18304 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ehdrv IMAGE_NAME: ehdrv.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4e09840e FAILURE_BUCKET_ID: X64_0x1E_c0000005_VRF_ehdrv+18304 BUCKET_ID: X64_0x1E_c0000005_VRF_ehdrv+18304 Followup: MachineOwner ---------
    3. Loading Dump File [D:\Kingston\BSODDmpFiles\Woopiej\Windows_NT6_BSOD_jcgriff2\040412-14648-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`0301a000 PsLoadedModuleList = 0xfffff800`0325e650 Debug session time: Wed Apr 4 11:31:47.515 2012 (UTC - 6:00) System Uptime: 0 days 0:00:11.467 Loading Kernel Symbols ............................................................... ............................................................. Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C9, {6, 103, fffff9800533ae10, 0} Unable to load image \SystemRoot\system32\DRIVERS\nvoclk64.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvoclk64.sys *** ERROR: Module load completed but symbols could not be loaded for nvoclk64.sys Probably caused by : nvoclk64.sys ( nvoclk64+b264 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9) The IO manager has caught a misbehaving driver. Arguments: Arg1: 0000000000000006, IRP passed to IoCompleteRequest contains invalid status Arg2: 0000000000000103, the status Arg3: fffff9800533ae10, the IRP Arg4: 0000000000000000 Debugging Details: ------------------ BUGCHECK_STR: 0xc9_6 DRIVER_VERIFIER_IO_VIOLATION_TYPE: 6 IRP_ADDRESS: fffff9800533ae10 DEVICE_OBJECT: fffffa800adfe5f0 DRIVER_OBJECT: fffffa800adffe70 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: System CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff800035350c2 to fffff80003096d40 STACK_TEXT: fffff880`037623e8 fffff800`035350c2 : 00000000`000000c9 00000000`00000006 00000000`00000103 fffff980`0533ae10 : nt!KeBugCheckEx fffff880`037623f0 fffff880`05684264 : fffff880`03762500 00000000`00000000 00000000`00000103 fffff980`0533ae10 : nt!IovCompleteRequest+0xc2 fffff880`037624c0 fffff880`03762500 : 00000000`00000000 00000000`00000103 fffff980`0533ae10 00000000`00000000 : nvoclk64+0xb264 fffff880`037624c8 00000000`00000000 : 00000000`00000103 fffff980`0533ae10 00000000`00000000 00000000`00000002 : 0xfffff880`03762500 STACK_COMMAND: kb FOLLOWUP_IP: nvoclk64+b264 fffff880`05684264 ?? ??? SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nvoclk64+b264 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nvoclk64 IMAGE_NAME: nvoclk64.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ab00e3d FAILURE_BUCKET_ID: X64_0xc9_6_VRF_nvoclk64+b264 BUCKET_ID: X64_0xc9_6_VRF_nvoclk64+b264 Followup: MachineOwner ---------
    4. Loading Dump File [D:\Kingston\BSODDmpFiles\Woopiej\Windows_NT6_BSOD_jcgriff2\040312-9843-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03060000 PsLoadedModuleList = 0xfffff800`032a4650 Debug session time: Tue Apr 3 13:02:04.820 2012 (UTC - 6:00) System Uptime: 0 days 3:10:31.757 Loading Kernel Symbols ............................................................... ................................................................ ...................................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffff680000e0c78, 0, 0, fffff800030ac687} Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+11b ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffff680000e0c78, memory referenced Arg2: 0000000000000000, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff800030ac687, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330e100 fffff680000e0c78 CURRENT_IRQL: 0 FAULTING_IP: nt!MiDeleteAddressesInWorkingSet+11b fffff800`030ac687 488b1e mov rbx,qword ptr [rsi] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: bf3.exe TRAP_FRAME: fffff88009bd5320 -- (.trap 0xfffff88009bd5320) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000098000000000 rbx=0000000000000000 rcx=000000000003c864 rdx=0000000000000015 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800030ac687 rsp=fffff88009bd54b0 rbp=fffff700010fe388 r8=fffffa80103125d8 r9=0000000000000000 r10=0000000000009fee r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po cy nt!MiDeleteAddressesInWorkingSet+0x11b: fffff800`030ac687 488b1e mov rbx,qword ptr [rsi] ds:00000000`00000000=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff800030dc2e9 to fffff800030dcd40 STACK_TEXT: fffff880`09bd51d8 fffff800`030dc2e9 : 00000000`0000000a fffff680`000e0c78 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx fffff880`09bd51e0 fffff800`030daf60 : 00000000`00000000 fffff680`000e0c78 00000000`c56a3000 0000000f`ffffffff : nt!KiBugCheckDispatch+0x69 fffff880`09bd5320 fffff800`030ac687 : 00000000`00000000 fffffa80`0eeb8df0 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x260 fffff880`09bd54b0 fffff800`030ad942 : fffffa80`10312240 fffffa80`00000015 fffff880`00009fee fffff800`0000000e : nt!MiDeleteAddressesInWorkingSet+0x11b fffff880`09bd5d60 fffff800`033b181a : fffff8a0`0dc3e060 fffff880`09bd60a0 00000000`00000000 fffffa80`0f5bfb60 : nt!MmCleanProcessAddressSpace+0x96 fffff880`09bd5db0 fffff800`03394cfd : 00000000`c0000005 00000000`00000001 00000000`fffdb000 fffffa80`0f9e3b60 : nt!PspExitThread+0x56a fffff880`09bd5eb0 fffff800`030cf7da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d fffff880`09bd5ee0 fffff800`030cfb20 : 00000000`0008e800 fffff880`09bd5f60 fffff800`03394c68 00000000`00000001 : nt!KiDeliverApc+0x2ca fffff880`09bd5f60 fffff800`030dc077 : fffffa80`0f5bfb60 00000000`fffdb000 00000000`00000020 00000000`fffdb000 : nt!KiInitiateUserApc+0x70 fffff880`09bd60a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c STACK_COMMAND: kb FOLLOWUP_IP: nt!MiDeleteAddressesInWorkingSet+11b fffff800`030ac687 488b1e mov rbx,qword ptr [rsi] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!MiDeleteAddressesInWorkingSet+11b FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2 IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b BUCKET_ID: X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b Followup: MachineOwner ---------
    5. Loading Dump File [D:\Kingston\BSODDmpFiles\Woopiej\Windows_NT6_BSOD_jcgriff2\032912-11091-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330 Machine Name: Kernel base = 0xfffff800`03058000 PsLoadedModuleList = 0xfffff800`0329c650 Debug session time: Thu Mar 29 12:28:59.576 2012 (UTC - 6:00) System Uptime: 0 days 1:50:53.513 Loading Kernel Symbols ............................................................... ................................................................ ..................................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff800032039bc, fffff8800733ec10, 0} Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 ) Followup: Pool_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff800032039bc, Address of the instruction which caused the bugcheck Arg3: fffff8800733ec10, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!ExDeferredFreePool+100 fffff800`032039bc 4c8b02 mov r8,qword ptr [rdx] CONTEXT: fffff8800733ec10 -- (.cxr 0xfffff8800733ec10) rax=fffff8a00a4f4d30 rbx=0000000000000000 rcx=fffffa80096b7660 rdx=7168ae0000001505 rsi=fffff8a00b26e000 rdi=fffff8a002f26480 rip=fffff800032039bc rsp=fffff8800733f5f0 rbp=0000000000000001 r8=7168ae0000001505 r9=fffff8a00b29d733 r10=0000000000000000 r11=0000000000000000 r12=fffffa80096b7500 r13=0000000000000000 r14=000000000000000c r15=0000000000000001 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 nt!ExDeferredFreePool+0x100: fffff800`032039bc 4c8b02 mov r8,qword ptr [rdx] ds:002b:7168ae00`00001505=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: dwm.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff800032039bc STACK_TEXT: fffff880`0733f5f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100 FOLLOWUP_IP: nt!ExDeferredFreePool+100 fffff800`032039bc 4c8b02 mov r8,qword ptr [rdx] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!ExDeferredFreePool+100 FOLLOWUP_NAME: Pool_corruption IMAGE_NAME: Pool_Corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: Pool_Corruption STACK_COMMAND: .cxr 0xfffff8800733ec10 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100 BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+100 Followup: Pool_corruption ---------
    1. Driver Verified: Indicates possible hard disk errors or corruption. Other possible causes are Memory problems... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
    2. Driver Verified: The crash report gives a probable cause of ESET. Other possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
    3. Driver Verified: The crash report gives a probable cause of an NVIDIA system utility driver.
    4. The crash report indicates memory corruption. Other possible causes are Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...
    5. The crash report indicates either memory problems or a driver. Other possible causes are Corrupted hard disk file system... Corrupted System Files... Graphics Driver...

    Start with these steps first:
    • If you are overclocking any hardware, please stop.

    • Disable Verifier for the time being: Start Menu -> All Programs -> Accessories -> Right click Command Prompt -> Run as administrator -> Enter the following commands followed by the Enter key:
      verifier /reset
      -> Restart your computer

    • Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
      For any drives that do not give the message:
      Windows has checked the file system and found no problems
      run disk check again as above. In other words, if it says:
      Windows has made corrections to the file system
      after running the disk check, run the disk check again.
      My Computer


  3. Posts : 5
    Windows 7 Ultimate 64bit
    Thread Starter
       #3

    Hello,

    first of all thank you very much for helping me.

    i have unplugged my Wd external hd from my pc the one that was a problem device (driver not installed )

    ps : i did put my Pc language to english for a while so u guys can understand it better.

    So i did run the checkdisk thingy on my ssd with windows installed on it (local disk C)
    And also on my second disk with games and other programms (local disk D)





    The file system on C: is checked ...
    The filesystem type is NTFS.

    There is an earlier stage in a disk check has been scheduled.
    Windows will now check the disk.

    Checking files (step 1 of 5) ...
    156928 file records processed. The control file is complete.
    415 records with large files. 0 records with corrupted files. 2 EA records processed. 81 reparserecords processed. Indices checked (step 2 of 5) ...
    219612 index entries processed. The index control is completed.
    0 non-indexed files checked. 0 non-indexed files as well. CHKDSK checks the security descriptors (stage 3 of 5) ...
    156928 file SDs / SIDs processed. 407 unused index entries from index $ SII
    Remove from file 0x9.
    407 unused index entries from index $ SDH
    Remove from file 0x9.
    407 unused security descriptors.
    The Security descriptor verification completed.
    31343 processed data. The USN check ...
    35547336 USN bytes processed. Checking USN journal is complete.
    CHKDSK checks the data file (step 4 of 5) ...
    156912 files processed. The control of data file is completed.
    Free space (stage 5 of 5) ...
    16245177 free clusters processed. The Free space verification is complete.
    CHKDSK discovered free space in the MFT bitmap found as
    assigned is highlighted.
    CHKDSK discovered free space in the volume as
    assigned is highlighted.
    The file is restored.

    117115903 KB total disk space.
    51815376 KB in 87145 files.
    57612 KB in 31344 indexes.
    0 KB in bad sectors.
    262203 KB in use by the system.
    The log file does 65536 KB occupied.
    64980712 KB available on disk.

    4096 bytes per cluster
    29278975 total clusters on disk
    16245178 units available on disk

    Internal Info:
    00 65 February 00 January 00 1a e4 ce 79 03 00 00 00 00 00. Y e ....... ......
    60 01 00 00 51 00 00 00 00 00 00 00 00 00 00 00 `... Q. ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

    The disk check is complete.
    Please wait. The computer restarts.
    -------------------------------------------------------------------------------------------------------
    End of first disk check local drive C
    -------------------------------------------------------------------------------------------------------
    Chkdsk was executed in read / write mode.

    The file system on D: is checked ...
    Volume is disconnected. All opened handles to this volume
    are invalid.
    Volume label is Local Disk.

    Checking files (step 1 of 5) ...
    105728 file records processed. The control file is complete.
    28 records with large files. 0 records with corrupted files. 0 EA records processed. 0 reparserecords processed. Indices checked (step 2 of 5) ...
    119294 index entries processed. The index control is completed.


    CHKDSK checks the security descriptors (stage 3 of 5) ...
    105728 file SDs / SIDs processed. 44 unused index entries from index $ SII
    Remove from file 0x9.
    44 unused index entries from index $ SDH
    Remove from file 0x9.
    44 unused security descriptors.
    The Security descriptor verification completed.
    6783 data processed. CHKDSK checks the data file (step 4 of 5) ...
    105712 files processed. The control of data file is completed.
    Free space (stage 5 of 5) ...
    143487869 free clusters processed. The Free space verification is complete.
    The file is checked. No problems were identified.

    732571647 KB total disk space.
    158389088 KB in 85567 files.
    37012 KB in 6785 indexes.
    194067 KB in use by the system.
    The log file does 65536 KB occupied.
    573951480 KB available on disk.

    4096 bytes per cluster
    183142911 total clusters on disk
    143487870 units available on disk
    -------------------------------------------------------------------------------
    End of disk check local drive D
      My Computer


  4. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #4

    You're welcome. Suggest running the check on C: again and providing the report. You can run with just the "Automatically fix file system errors" checked this time. It appears you do not have any bad sectors.
      My Computer


  5. Posts : 5
    Windows 7 Ultimate 64bit
    Thread Starter
       #5

    Okey so as requested i did the scan again and here are my files.



    The file system on C: is checked ...
    The filesystem type is NTFS.


    There is an earlier stage in a disk check has been scheduled.
    Windows will now check the disk.

    Checking files (step 1 of 3) ...
    156928 file records processed. The control file is complete.
    419 records with large files. 0 records with corrupted files. 2 EA records processed. 81 reparserecords processed. Indices checked (step 2 of 3) ...
    227964 index entries processed. The index control is completed.
    0 non-indexed files checked. 0 non-indexed files as well. CHKDSK checks the security descriptors (stage 3 of 3) ...
    156928 file SDs / SIDs processed. 78 unused index entries from index $ SII
    Remove from file 0x9.
    78 unused index entries from index $ SDH
    Remove from file 0x9.
    78 unused security descriptors.
    The Security descriptor verification completed.
    35519 processed data. The USN check ...
    35594960 USN bytes processed. Checking USN journal is complete.
    The file is checked. No problems were identified.

    117115903 KB total disk space.
    52498316 KB in 95109 files.
    64416 KB in 35520 indexes.
    0 KB in bad sectors.
    262587 KB in use by the system.
    The log file does 65536 KB occupied.
    64290584 KB available on disk.

    4096 bytes per cluster
    29278975 total clusters on disk
    16072646 units available on disk

    Internal Info:
    00 65 02 00 50 January 00 fe 1f e1 03 00 00 00 00 00. E .. P. ..........
    64 01 00 00 51 00 00 00 00 00 00 00 00 00 00 00 d ... Q. ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

    The disk check is complete.
    Please wait. The computer restarts.


    -------------------------------------------------------------
    End of Checkdisk local disk c
    -------------------------------------------------------------


    Hope this helps.
    greetings woopiej
      My Computer


  6. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #6

    Alright, go about your normal routine for a while and post back in a few days how the system is responding. Best of luck!
      My Computer


  7. Posts : 5
    Windows 7 Ultimate 64bit
    Thread Starter
       #7

    Hello little update for now.

    So im running Stable for a few days now and still no BSOD so thats good .
    Dont know if the system is actually stable but so far so good.
    will be back in a few days for another update.

    greetings woopiej
      My Computer


  8. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #8

    Great news! Thanks for keeping us updated.
      My Computer


  9. Posts : 5
    Windows 7 Ultimate 64bit
    Thread Starter
       #9

    hello hello,

    Right so its been another week and stil no BSOD so this thread can be closed

    goodluck to you all and thanks for the help

    Greetings Woopiej
      My Computer


  10. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #10

    You're welcome. Thank you for posting back. Glad to see the problem was solved.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 05:07.
Find Us