Windows 7: Could Someone Analyze My .dmp?

Euclase · 04 Jan 2013

So I got a BSOD and I'm not really knowledgeable enough to interpret the contents of a .dmp; could someone take a look and let me know what happened? Thanks!

I suspect that it was some Canon printer drivers that I downloaded/installed shortly before the crash occurred but I want to be sure.

Euclase · 04 Jan 2013

Darn, looks like it probably isn't the drivers...I just triggered another BSoD: the only other thing I was doing during the first BSoD was copying files between two secondary drives. Didn't think of it as the problem but I tried to copy the same files again between the drives while waiting for a response in this thread and 3/4th of the way to finishing, the BSoD triggered which was approx. when the first BSoD happened.

**koolkat77** · 04 Jan 2013

Welcome to SevenForums.

Is this a Corporate Comp/Lappy or a Personal Computer?

Because from the one dump file it looks like - as usual: Symantec Real Time Storage Protection is causing the BSOD. Description here: Driver Reference Table - SRTSP64.SYS

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {21, fffff8a00d0b1000, 2270, 40002270}

*** WARNING: Unable to verify timestamp for SRTSP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS
Probably caused by : SRTSP64.SYS ( SRTSP64+3e521 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000021, the data following the pool block being freed is corrupt.  Typically this means the consumer (call stack ) has overrun the block.
Arg2: fffff8a00d0b1000, The pool pointer being freed.
Arg3: 0000000000002270, The number of bytes allocated for the pool block.
Arg4: 0000000040002270, The corrupted value found following the pool block.

Debugging Details:
------------------


BUGCHECK_STR:  0x19_21

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eae100
GetUlongFromAddress: unable to read from fffff80002eae1c0
 fffff8a00d0b1000 Paged pool

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002da99b2 to fffff80002c7efc0

STACK_TEXT:  
fffff880`06622838 fffff800`02da99b2 : 00000000`00000019 00000000`00000021 fffff8a0`0d0b1000 00000000`00002270 : nt!KeBugCheckEx
fffff880`06622840 fffff880`06b6b521 : fffff880`06be7028 fffff880`06be7028 fffff8a0`61456153 fffff880`00000000 : nt!ExDeferredFreePool+0xfaa
fffff880`066228f0 fffff880`06be7028 : fffff880`06be7028 fffff8a0`61456153 fffff880`00000000 fffff8a0`0bbf0210 : SRTSP64+0x3e521
fffff880`066228f8 fffff880`06be7028 : fffff8a0`61456153 fffff880`00000000 fffff8a0`0bbf0210 fffff880`06b7877b : SRTSP64+0xba028
fffff880`06622900 fffff8a0`61456153 : fffff880`00000000 fffff8a0`0bbf0210 fffff880`06b7877b fffff8a0`00000002 : SRTSP64+0xba028
fffff880`06622908 fffff880`00000000 : fffff8a0`0bbf0210 fffff880`06b7877b fffff8a0`00000002 fffff8a0`2e8219f0 : 0xfffff8a0`61456153
fffff880`06622910 fffff8a0`0bbf0210 : fffff880`06b7877b fffff8a0`00000002 fffff8a0`2e8219f0 00000000`00000000 : 0xfffff880`00000000
fffff880`06622918 fffff880`06b7877b : fffff8a0`00000002 fffff8a0`2e8219f0 00000000`00000000 fffff8a0`2e8219f0 : 0xfffff8a0`0bbf0210
fffff880`06622920 fffff8a0`00000002 : fffff8a0`2e8219f0 00000000`00000000 fffff8a0`2e8219f0 fffff8a0`0bbf0210 : SRTSP64+0x4b77b
fffff880`06622928 fffff8a0`2e8219f0 : 00000000`00000000 fffff8a0`2e8219f0 fffff8a0`0bbf0210 fffff880`06bdc36f : 0xfffff8a0`00000002
fffff880`06622930 00000000`00000000 : fffff8a0`2e8219f0 fffff8a0`0bbf0210 fffff880`06bdc36f fffff8a0`29fe9010 : 0xfffff8a0`2e8219f0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SRTSP64+3e521
fffff880`06b6b521 ??              ???

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  SRTSP64+3e521

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SRTSP64

IMAGE_NAME:  SRTSP64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  506b70fa

FAILURE_BUCKET_ID:  X64_0x19_21_SRTSP64+3e521

BUCKET_ID:  X64_0x19_21_SRTSP64+3e521

Followup: MachineOwner
---------

Norton is often responsible for stuff like this:

Code:

SRTSP64+0x7fdfc
fffff880`066228a0  fffff8a0`02fe0000
fffff880`066228a8  fffff800`02ca9e20 nt!RtlpGetStackLimits+0x14
fffff880`066228b0  fffff8a0`275c4900
fffff880`066228b8  00000000`00000000
fffff880`066228c0  fffff880`06be7028 SRTSP64+0xba028
fffff880`066228c8  fffff880`06be7630 SRTSP64+0xba630
fffff880`066228d0  00000000`00000000
fffff880`066228d8  fffff8a0`2f077900
fffff880`066228e0  fffff8a0`0d0b1000
fffff880`066228e8  fffff880`06b6b521 SRTSP64+0x3e521
fffff880`066228f0  fffff880`06be7028 SRTSP64+0xba028
fffff880`066228f8  fffff880`06be7028 SRTSP64+0xba028
fffff880`06622900  fffff8a0`61456153
fffff880`06622908  fffff880`00000000
fffff880`06622910  fffff8a0`0bbf0210
fffff880`06622918  fffff880`06b7877b SRTSP64+0x4b77b
fffff880`06622920  fffff8a0`00000002
fffff880`06622928  fffff8a0`2e8219f0
fffff880`06622930  00000000`00000000
fffff880`06622938  fffff8a0`2e8219f0
fffff880`06622940  fffff8a0`0bbf0210
fffff880`06622948  fffff880`06bdc36f SRTSP64+0xaf36f
fffff880`06622970  fffff8a0`0bbf0210
fffff880`06622978  fffff880`06b9c458 SRTSP64+0x6f458
fffff880`06622980  00000000`00000000
fffff880`06622988  fffff8a0`2e8219f0
fffff880`06622990  fffff880`06be7028 SRTSP64+0xba028
fffff880`06622998  00000000`000007ff
fffff880`066229a0  00000000`00000000
fffff880`066229a8  fffff880`06b9c6fb SRTSP64+0x6f6fb
fffff880`066229e8  fffff880`06bd09d1 SRTSP64+0xa39d1
fffff880`06622a10  00000000`00000007
fffff880`06622a18  00000000`00210040
fffff880`06622a20  fffff8a0`00000800
fffff880`06622a28  fffff880`00000000
fffff880`06622a30  0000002f`d573fc00
fffff880`06622a38  fffff800`02c85d8f nt!KeWaitForSingleObject+0x19f
fffff880`06622a40  00000000`00000000
fffff880`06622a48  fffff880`06be7028 SRTSP64+0xba028
fffff880`06622a78  00000000`00000000
fffff880`06622a80  fffff8a0`275c4940
fffff880`06622a88  fffff880`011510cf fltmgr!FltAcquirePushLockExclusive+0xf
fffff880`06622a90  fffffa80`0e7c9420
fffff880`06622a98  fffff8a0`275c48f0
fffff880`06622aa0  fffffa80`0e7a7690
fffff880`06622aa8  00000000`00000000
fffff880`06622ab0  fffff880`06be7028 SRTSP64+0xba028
fffff880`06622ab8  fffffa80`0e7a76b8
fffff880`06622ac0  00000000`00000000
fffff880`06622ac8  fffff880`06ba8d87 SRTSP64+0x7bd87
fffff880`06622b18  fffff880`06ba79b5 SRTSP64+0x7a9b5
fffff880`06622b20  00000000`00000000
fffff880`06622b28  fffff8a0`275c48f0
fffff880`06622b30  fffff8a0`275c48f0
fffff880`06622b38  fffff8a0`00000000
fffff880`06622b40  00000000`00000000
fffff880`06622b48  fffff800`02c52800 nt!KeSetBasePriorityThread+0x124
fffff880`06622b98  fffff880`06ba76e0 SRTSP64+0x7a6e0
fffff880`06622ba0  fffff800`00b96080
fffff880`06622ba8  00000000`00000000
fffff880`06622bb0  fffff880`06ba76e0 SRTSP64+0x7a6e0
fffff880`06622bb8  fffffa80`0e7a7690
fffff880`06622bc0  00000000`00000080
fffff880`06622bc8  fffff880`06ba7709 SRTSP64+0x7a709
fffff880`06622bd0  fffffa80`0e7a7690
fffff880`06622bd8  00000000`00000000
fffff880`06622be0  fffffa80`0c70e9e0
fffff880`06622be8  00000000`00000001
fffff880`06622bf0  fffffa80`0e7a71d0
fffff880`06622bf8  fffff800`02f15e5a nt!PspSystemThreadStartup+0x5a
fffff880`06622c00  fffff8a0`0144cbc0
fffff880`06622c38  fffff800`02c6fd26 nt!KiStartSystemThread+0x16
fffff880`06622c40  fffff800`02df1e80 nt!KiInitialPCR+0x180
fffff880`06622c48  fffffa80`0e7a71d0
fffff880`06622c50  fffff800`02dffcc0 nt!KiInitialThread
fffff880`06622c58  fffff880`0169b868 Ntfs!NtfsLarge0

Recommendations

Norton is known and contributing to your BSOD crashes, consider uninstalling it with the Norton Removal Tool and replace with Microsoft Security Essentials TO TEST. You may however, reinstall Norton if we know it wasn't the cause of the crashes.
Norton Removal Tool

Microsoft Security Essentials.
Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-

Microsoft Security Essentials - Free Antivirus for Windows
Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
Good and Free system security combination.

Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

Perform a System File Check:
Click on the start

Type CMD on Search

Left click and Run as Administrator

Type SFC /scannow

Full tutorial here:
SFC /SCANNOW Command - System File Checker

Disk Check on your hard drive for file system errors and bad sectors on it:
Disk Check

Also:

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here.

Please post your results and new .dmp files for analysis.

Gobby · 05 Jan 2013

Hey there.

I apologize for posting unrelated info. in this thread but I can't seem to to figure out how to message individual users. =/

Koolkat77, I was just wondering if you are able to analyze any/some of my .DMP files in my thread.
http://www.sevenforums.com/crashes-d...-7-gaming.html

Thanks and sorry again,
Gobby.

Euclase · 05 Jan 2013

Thanks for the response Koolkat! Oops, my bad; I forgot to attach the 2nd BSoD to that last post. I'll post the other requested things now too.

As for your other questions and advice: It's a personal computer. Check Disk didn't find any errors but I decided to reformat the two drives in question anyway (one drive was from an old XP rig whereas the other was formatted in Win 7 Pro when I assembled this PC). I definitely didn't expect Norton to be a possible cause but I'll test using MSE and run System File Checker after the two drives are done reformatting. I'll rerun Check Disk too.

I really hope it isn't Norton; haven't had any problems up until these two BSoDs.

**koolkat77** · 05 Jan 2013

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a0e40b8900, 0, fffff88009756020, 5}

*** WARNING: Unable to verify timestamp for SRTSP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for SRTSP64.SYS

Could not read faulting driver name
Probably caused by : SRTSP64.SYS ( SRTSP64+8e020 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a0e40b8900, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88009756020, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f05100
GetUlongFromAddress: unable to read from fffff80002f051c0
 fffff8a0e40b8900 Paged pool

FAULTING_IP: 
SRTSP64+8e020
fffff880`09756020 ??              ???

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a71e020 -- (.trap 0xfffff8800a71e020)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff8a009be3060
rdx=0554518c2edda8be rsi=0000000000000000 rdi=0000000000000000
rip=fffff88009756020 rsp=fffff8800a71e1b0 rbp=fffff8800a71e250
 r8=fffff8a0044bc7d0  r9=0000000000000100 r10=0000000000000000
r11=0000000000000011 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
SRTSP64+0x8e020:
fffff880`09756020 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c7c8af to fffff80002cd5fc0

STACK_TEXT:  
fffff880`0a71deb8 fffff800`02c7c8af : 00000000`00000050 fffff8a0`e40b8900 00000000`00000000 fffff880`0a71e020 : nt!KeBugCheckEx
fffff880`0a71dec0 fffff800`02cd40ee : 00000000`00000000 fffff8a0`e40b8900 00000000`00000000 fffff8a0`e40b88f0 : nt! ?? ::FNODOBFM::`string'+0x437c1
fffff880`0a71e020 fffff880`09756020 : fffffa80`1648dc10 00000000`00000000 00000000`00000002 fffff8a0`287af5b0 : nt!KiPageFault+0x16e
fffff880`0a71e1b0 fffffa80`1648dc10 : 00000000`00000000 00000000`00000002 fffff8a0`287af5b0 fffff8a0`02c340e0 : SRTSP64+0x8e020
fffff880`0a71e1b8 00000000`00000000 : 00000000`00000002 fffff8a0`287af5b0 fffff8a0`02c340e0 fffff880`0973a063 : 0xfffffa80`1648dc10


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SRTSP64+8e020
fffff880`09756020 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  SRTSP64+8e020

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SRTSP64

IMAGE_NAME:  SRTSP64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  506b70fa

FAILURE_BUCKET_ID:  X64_0x50_SRTSP64+8e020

BUCKET_ID:  X64_0x50_SRTSP64+8e020

Followup: MachineOwner
---------

Hmm. It seems Norton is there again. But we'll have to rule out one more thing:

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

Quote:

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.

If RAM test comes out clean and doubts remain at Norton, you can get in touch with the Norton Community - Norton Community. Probably their new version will not be having these issues.

Anyway, good luck and let us know how it goes.

Euclase · 05 Jan 2013

Yikes, I actually just finished running Memtest 3 days ago with a perfect result. I'll do it again anyway though. *crosses fingers that RAM isn't going faulty*

Unfortunately, my Norton product is the most up-to-date. I'm hoping this was just some weird freaky accident that was related to the hard drives and whatever I was copying.

**koolkat77** · 05 Jan 2013

I see.

You can still contact Norton and see what they have to say about it.

**koolkat77** · 17 Jan 2013

Any updates?

**koolkat77** · 16 Mar 2013

Were the problems fixed?

Norton? RAM?

Windows 7: Could Someone Analyze My .dmp?

Could Someone Analyze My .dmp? problems?