Windows 7: Minidump file analysis

SenojNW · 24 Apr 2010

I thought I had traced the BSODs I had been getting back to some bad RAM - see here:

http://www.sevenforums.com/crashes-d...diagnosis.html

But I'm still getting them.

Can someone take a look at the minidump files attached and let me know if they are pointing to anything in particular?

Thanks!

Edit: Oh yeah I have replaced the RAM and now get no errors with memtest86+

Crispy · 24 Apr 2010

Code:

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001b050e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeWaitForMultipleObjects+202
fffff800`018d24dc 488908          mov     qword ptr [rax],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880089e7430 -- (.trap 0xfffff880089e7430)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8005007c68
rdx=fffffa80053cc1e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800018d24dc rsp=fffff880089e75c0 rbp=fffffa8005007c80
 r8=fffff880089e78b0  r9=0000000000000001 r10=0000000000000002
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForMultipleObjects+0x202:
fffff800`018d24dc 488908          mov     qword ptr [rax],rcx ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800018ce469 to fffff800018cef00

STACK_TEXT:  
fffff880`089e72e8 fffff800`018ce469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`089e72f0 fffff800`018cd0e0 : 00000000`00000002 0000002a`e9ebf229 00000000`00000004 fffff800`01a022dd : nt!KiBugCheckDispatch+0x69
fffff880`089e7430 fffff800`018d24dc : 00000000`00000008 fffff800`0191a65c 00000000`00000001 00000000`00000009 : nt!KiPageFault+0x260
fffff880`089e75c0 fffff880`03e966c9 : 00000000`00000002 fffff880`089e78d0 0000002a`00000001 fffffa80`00000000 : nt!KeWaitForMultipleObjects+0x202
fffff880`089e7870 fffff880`03ea15bd : fffffa80`053cc000 fffffa80`053cc1d8 fffffa80`053cc000 fffffa80`0523a050 : usbhub!UsbhWaitEventWithTimeoutEx+0x279
fffff880`089e7920 fffff880`03ea0bd8 : 00000000`00000000 fffffa80`50447100 fffffa80`053cc000 00000000`00080000 : usbhub!Usbh_PCE_Disable_Action+0x4f1
fffff880`089e7980 fffff880`03ea5f7c : fffffa80`0523a050 00000000`00000001 00000000`00000001 fffffa80`0523a708 : usbhub!UsbhDispatch_PortChangeQueueEventEx+0x110
fffff880`089e79c0 fffff880`03e9e744 : fffffa80`0523a050 fffffa80`053cc000 fffffa80`053cc000 00000000`00000000 : usbhub!UsbhPCE_Disable+0xb4
fffff880`089e7a10 fffff880`03e9da3c : 00000000`00000007 00000000`00000003 fffffa80`0523a050 fffffa80`0523a708 : usbhub!UsbhBusPause_Action+0x184
fffff880`089e7a60 fffff880`03e9deb6 : fffffa80`0523a1a0 00000000`00000007 fffffa80`0523a050 00000000`00000000 : usbhub!Usbh_BS_BusRun+0x94
fffff880`089e7aa0 fffff880`03e9e92b : 00000000`00000003 fffffa80`0523a708 fffffa80`0523a050 00000000`00000000 : usbhub!UsbhDispatch_BusEvent+0x20e
fffff880`089e7af0 fffff880`03eb334a : fffffa80`04d4df70 fffffa80`05e9ef80 fffffa80`05e9ef80 fffffa80`04d4df70 : usbhub!UsbhSyncBusPause+0x4f
fffff880`089e7b30 fffff880`03eb1a7a : fffffa80`0523a050 fffffa80`0523a708 fffffa80`0523a708 00000000`00000004 : usbhub!UsbhFdoSetPowerDx_Action+0x9a
fffff880`089e7b90 fffff880`03eb070b : fffffa80`04d4df70 fffffa80`0523a1a0 fffffa80`0523a050 fffffa80`04d4de10 : usbhub!UsbhFdoDevicePowerState+0x206
fffff880`089e7be0 fffff880`03eaf9c7 : fffffa80`04d4de10 00000000`00000000 fffffa80`0523a050 fffff880`089e7d40 : usbhub!UsbhFdoPower_SetPower+0x93
fffff880`089e7c20 fffff880`03e96fdf : 00000000`00000001 fffffa80`0523a050 fffff880`089e7d40 fffffa80`04f24c10 : usbhub!UsbhFdoPower+0xaf
fffff880`089e7c60 fffff800`019e8e55 : 00000000`00000000 00000000`00000002 00000000`00000001 fffffa80`04d4deb8 : usbhub!UsbhGenDispatch+0x7f
fffff880`089e7c90 fffff800`01b72166 : ffffffff`fa0a1f00 fffffa80`05007b60 00000000`00000080 00000000`00000000 : nt!PopIrpWorker+0x3c5
fffff880`089e7d40 fffff800`018ad486 : fffff880`01e5d180 fffffa80`05007b60 fffffa80`03a32b60 00000000`00000246 : nt!PspSystemThreadStartup+0x5a
fffff880`089e7d80 00000000`00000000 : fffff880`089e8000 fffff880`089e2000 fffff880`089e79e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbhub!UsbhWaitEventWithTimeoutEx+279
fffff880`03e966c9 8be8            mov     ebp,eax

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  usbhub!UsbhWaitEventWithTimeoutEx+279

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbhub

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bcc2d

FAILURE_BUCKET_ID:  X64_0xA_usbhub!UsbhWaitEventWithTimeoutEx+279

BUCKET_ID:  X64_0xA_usbhub!UsbhWaitEventWithTimeoutEx+279

Followup: MachineOwner
---------

Unplug all the USB out of your slots and and plug them in one at a time and see if it happens again.

Code:

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x18

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80001866fac to fffff800018cf600

STACK_TEXT:  
fffff880`062eb428 fffff800`01866fac : 00000000`00000018 00000000`00000000 fffffa80`05143ef0 00000000`00000002 : nt!KeBugCheckEx
fffff880`062eb430 fffff800`01bcbf09 : fffff880`062ebca0 fffff880`062eb7c0 00000000`00000014 00000000`00000006 : nt! ?? ::FNODOBFM::`string'+0x46451
fffff880`062eb490 fffff800`01bcc7d6 : 00000000`00000001 00000000`00000000 00000000`00000001 00000000`00000001 : nt!ObpWaitForMultipleObjects+0x2d3
fffff880`062eb960 fffff800`018ce853 : fffffa80`05a03060 00000000`00c0fb58 fffff880`062ebbc8 fffff880`062ebc00 : nt!NtWaitForMultipleObjects+0xe5
fffff880`062ebbb0 00000000`7712046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00c0fb38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7712046a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+46451
fffff800`01866fac cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+46451

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_+46451

BUCKET_ID:  X64_0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_+46451

Followup: MachineOwner
---------

Do a virus scan ans see if svchost.exe is infected.

Code:

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!IofCallDriver+50
fffff800`018dc360 49ff64c070      jmp     qword ptr [r8+rax*8+70h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000070

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001b080e0
 0000000000000070 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  AnyDVDtray.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88007b98ac8 -- (.exr 0xfffff88007b98ac8)
ExceptionAddress: fffff800018dc360 (nt!IofCallDriver+0x0000000000000050)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000070
Attempt to read from address 0000000000000070

TRAP_FRAME:  fffff88007b98b70 -- (.trap 0xfffff88007b98b70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8005251050
rdx=fffffa80040c9010 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800018dc360 rsp=fffff88007b98d08 rbp=fffffa800517d610
 r8=0000000000000000  r9=0000000000000000 r10=fffffa80047f0a30
r11=fffff88007b98ce0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!IofCallDriver+0x50:
fffff800`018dc360 49ff64c070      jmp     qword ptr [r8+rax*8+70h] ds:6db0:00000000`00000070=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000190a929 to fffff800018d0600

STACK_TEXT:  
fffff880`07b982f8 fffff800`0190a929 : 00000000`0000001e ffffffff`c0000005 fffff800`018dc360 00000000`00000000 : nt!KeBugCheckEx
fffff880`07b98300 fffff800`018cfc42 : fffff880`07b98ac8 00000000`00000000 fffff880`07b98b70 fffffa80`05313180 : nt!KiDispatchException+0x1b9
fffff880`07b98990 fffff800`018ce7ba : 00000000`00000000 00000000`00000000 fffffa80`04606d00 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`07b98b70 fffff800`018dc360 : fffff880`03b1b1bb 00000000`00000002 fffff880`00eb87c0 fffffa80`0517d610 : nt!KiPageFault+0x23a
fffff880`07b98d08 fffff880`03b1b1bb : 00000000`00000002 fffff880`00eb87c0 fffffa80`0517d610 fffffa80`05313180 : nt!IofCallDriver+0x50
fffff880`07b98d10 00000000`00000002 : fffff880`00eb87c0 fffffa80`0517d610 fffffa80`05313180 fffffa80`00000020 : AnyDVD+0x11bb
fffff880`07b98d18 fffff880`00eb87c0 : fffffa80`0517d610 fffffa80`05313180 fffffa80`00000020 fffffa80`0516f490 : 0x2
fffff880`07b98d20 fffffa80`0517d610 : fffffa80`05313180 fffffa80`00000020 fffffa80`0516f490 00000000`00000020 : Wdf01000!FxDevice::m_PriorityBoosts+0x1b30
fffff880`07b98d28 fffffa80`05313180 : fffffa80`00000020 fffffa80`0516f490 00000000`00000020 fffff880`00e3f0c2 : 0xfffffa80`0517d610
fffff880`07b98d30 fffffa80`00000020 : fffffa80`0516f490 00000000`00000020 fffff880`00e3f0c2 fffff880`00eb87c0 : 0xfffffa80`05313180
fffff880`07b98d38 fffffa80`0516f490 : 00000000`00000020 fffff880`00e3f0c2 fffff880`00eb87c0 fffffa80`0517d610 : 0xfffffa80`00000020
fffff880`07b98d40 00000000`00000020 : fffff880`00e3f0c2 fffff880`00eb87c0 fffffa80`0517d610 00000000`00000025 : 0xfffffa80`0516f490
fffff880`07b98d48 fffff880`00e3f0c2 : fffff880`00eb87c0 fffffa80`0517d610 00000000`00000025 fffffa80`0516f490 : 0x20
fffff880`07b98d50 fffff880`00e5459f : fffffa80`05318810 fffff880`00000000 fffffa80`047f0a30 fffff880`014215d5 : Wdf01000!FxIoTarget::SubmitSync+0x24a
fffff880`07b98e00 fffff880`01435e95 : fffffa80`00000020 fffffa80`0516f490 fffffa80`0517d610 0000057f`face7700 : Wdf01000!imp_WdfRequestSend+0x24b
fffff880`07b98e50 fffff880`0143237d : 0000057f`face77e8 0000057f`fbf23548 fffffa80`05318b80 0000057f`fae90b68 : cdrom!DeviceSendRequestSynchronously+0xc9
fffff880`07b98eb0 fffff880`00e7a2ae : fffffa80`0516f490 0000057f`fae81848 fffffa80`047f0a30 00000000`00000000 : cdrom!CreateQueueEvtIoDefault+0xc9
fffff880`07b98ef0 fffff880`00e7999f : 00000000`00000000 fffffa80`0516f490 fffffa80`0517e7b0 fffffa80`0517e7b0 : Wdf01000!FxIoQueue::DispatchRequestToDriver+0x7d6
fffff880`07b98f70 fffff880`00e78f98 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0516f5e2 : Wdf01000!FxIoQueue::DispatchEvents+0x4df
fffff880`07b98fe0 fffff880`00e74578 : 00000000`00000000 fffffa80`0516f490 fffffa80`040c9010 00000000`00000000 : Wdf01000!FxIoQueue::QueueRequest+0x2bc
fffff880`07b99050 fffff880`00e742dc : fffffa80`000000d8 fffff880`07b99100 fffffa80`0516f490 fffffa80`040dcab0 : Wdf01000!FxPkgGeneral::OnCreate+0x274
fffff880`07b990f0 fffff880`00e68245 : 00000000`0000000c fffff800`01bd41d0 fffffa80`0403b010 fffffa80`03e702e8 : Wdf01000!FxPkgGeneral::Dispatch+0x15c
fffff880`07b99150 fffff800`01bd4777 : 00000000`0000000c fffff800`01bd41d0 fffffa80`0403b010 fffffa80`03e702e8 : Wdf01000!FxDevice::Dispatch+0xa9
fffff880`07b99180 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopParseDevice+0x5a7


STACK_COMMAND:  kb

FOLLOWUP_IP: 
AnyDVD+11bb
fffff880`03b1b1bb ??              ???

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  AnyDVD+11bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: AnyDVD

IMAGE_NAME:  AnyDVD.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bbc9685

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_AnyDVD+11bb

BUCKET_ID:  X64_0x1E_c0000005_AnyDVD+11bb

Followup: MachineOwner
---------

Uninstall AnyDVD.

Capt.Jack Sparrow · 24 Apr 2010

Quote: Originally Posted by SenojNW

I thought I had traced the BSODs I had been getting back to some bad RAM - see here:

http://www.sevenforums.com/crashes-d...diagnosis.html

But I'm still getting them.

Can someone take a look at the minidump files attached and let me know if they are pointing to anything in particular?

Thanks!

Edit: Oh yeah I have replaced the RAM and now get no errors with memtest86+

Hello !! Welcome back Mate !!

Sorry that you had the issue again. The Dump files doesn't seems like it captured the exact cause. Follow the link and enable the Driver Verifier and let it run upto 36 hours. Make sure you delete all the dump files form Minidump folders.

Using Driver Verifier to identify issues with Drivers

Hope this helps,
Captain

SenojNW · 26 Apr 2010

Hi Cap
I followed your instructions for driver verifier this morning and rebooted the system when it asekd. How do I know it's running? There doesn't seem to be any app running?

I've just left it be all day - no BSOD...

Jonathan_King · 26 Apr 2010

It will not look like Verifier is running, but it is. Just use your machine normally, and when it crashes, upload the new dmp.

Capt.Jack Sparrow · 26 Apr 2010

Quote: Originally Posted by SenojNW

Hi Cap
I followed your instructions for driver verifier this morning and rebooted the system when it asekd. How do I know it's running? There doesn't seem to be any app running?

I've just left it be all day - no BSOD...

Hello !!

As i mentioned in that thread i should be running atleast 36 hours. You might find you system sluggish other than that no difference. It will be running in background.

Hope this helps,
Captain

SenojNW · 26 Apr 2010

I shut down last night (should have left it running). Will it keep running on the next boot or do I need to go through the instructions again to restart it? I'm getting the impression it will keep running unless I go in and stop it right?

Jonathan_King · 27 Apr 2010

It will keep running until you turn it off.

Quote:

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

SenojNW · 28 Apr 2010

Well it has been running for at least 36h now and I've had no BSOD! When installing a windows update yesterday the system did crash - it didn't give me a BSOD or a dump file though - the update just failed and the system rebooted to the "do you want to start in safe mode" prompt...

Seeing this all started during a windows update I reckon that is where the problem is coming from...?

Maybe I just need to do a clean install?

Bit disappointed with Windows 7 - never had this many crashes with XP or Vista...

Windows 7: Minidump file analysis

Minidump file analysis problems?