New Comp. Crash Errors BSOD BCCode: 1e

Bolo · Mar 7, 2012

Have had this laptop for about 2 months now.

Specs: OS Name Microsoft Windows 7 Home Premium
Version 6.1.7601 Service Pack 1 Build 7601
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name
System Manufacturer Hewlett-Packard
System Model HP Pavilion dv6 Notebook PC
System Type x64-based PC
Processor AMD A8-3510MX APU with Radeon(tm) HD Graphics, 1800 Mhz, 4 Core(s), 4 Logical Processor(s)
BIOS Version/Date Hewlett-Packard F.12, 10/26/2011
SMBIOS Version 2.7
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "6.1.7601.17514"
User Name Derick-HP\Bolo
Time Zone Central Standard Time
Installed Physical Memory (RAM) 8.00 GB
Total Physical Memory 7.48 GB
Available Physical Memory 5.24 GB
Total Virtual Memory 15.0 GB
Available Virtual Memory 12.4 GB
Page File Space 7.48 GB
Page File C:\pagefile.sys
OS Name Microsoft Windows 7 Home Premium
Version 6.1.7601 Service Pack 1 Build 7601
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name DERICK-HP
System Manufacturer Hewlett-Packard
System Model HP Pavilion dv6 Notebook PC
System Type x64-based PC
Processor AMD A8-3510MX APU with Radeon(tm) HD Graphics, 1800 Mhz, 4 Core(s), 4 Logical Processor(s)
BIOS Version/Date Hewlett-Packard F.12, 10/26/2011
SMBIOS Version 2.7
Windows Directory C:\Windows
System Directory C:\Windows\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "6.1.7601.17514"
User Name Derick-HP\Bolo
Time Zone Central Standard Time
Installed Physical Memory (RAM) 8.00 GB
Total Physical Memory 7.48 GB
Available Physical Memory 5.24 GB
Total Virtual Memory 15.0 GB
Available Virtual Memory 12.4 GB
Page File Space 7.48 GB
Page File C:\pagefile.sys

Error:
Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF880087319F0
BCP3: 0000000000000000
BCP4: 0000000000000000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\030712-22105-01.dmp
C:\Users\Bolo\AppData\Local\Temp\WER-58032-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

Erikbe · Mar 7, 2012

Hello,

KMODE_EXCEPTION_NOT_HANDLED Windows should also identified a driver (a *.sys file) first thing you could check is sfc /scannow (as administrator) also make sure you use the latest availible drivers because this error might be caused by a bad thirdparty driver.Also run windows memory diagnostics and check hp website for the newest stuff for your model.

Diagnosing memory problems on your computer

writhziden · Mar 7, 2012

Possible out of date drivers:

Code:

hamachi	fffff880`05800000	fffff880`0580b000	Thu Feb 19 03:36:41 2009 (499d3639)	0000a5d7		hamachi.sys
GEARAspiWDM	fffff880`053e2000	fffff880`053ef000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys

hamachi.sys
GEARAspiWDM.sys

Code:

[list=1]
[*]
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030712-22105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e60670
Debug session time: Wed Mar  7 00:17:19.408 2012 (UTC - 7:00)
System Uptime: 0 days 1:39:30.828
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff880087319f0, 0, 0}

Probably caused by : afd.sys ( afd!AfdCompletePollIrp+ef )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880087319f0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+6666376537376366
fffff880`087319f0 1829            sbb     byte ptr [rcx],ch

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eca100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  AvastSvc.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88008732918 -- (.exr 0xfffff88008732918)
ExceptionAddress: fffff80002ca1e53 (nt!KiCancelTimer+0x00000000000000af)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880087329c0 -- (.trap 0xfffff880087329c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80002e11e88 rbx=0000000000000000 rcx=fdfff80002e11e88
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca1e53 rsp=fffff88008732b50 rbp=0000000000000001
 r8=fffff80002c1b000  r9=0000000000000000 r10=fffffa80088c3c60
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!KiCancelTimer+0xaf:
fffff800`02ca1e53 488901          mov     qword ptr [rcx],rax ds:fdfff800`02e11e88=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d234fb to fffff80002c97c40

STACK_TEXT:  
fffff880`08731938 fffff800`02d234fb : 00000000`0000001e ffffffff`c0000005 fffff880`087319f0 00000000`00000000 : nt!KeBugCheckEx
fffff880`08731940 fffff800`02cebbb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`08731980 fffff800`02cc3a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`087319c0 fffff800`02cc34fd : fffff800`02ddac24 fffff880`087339b0 00000000`00000000 fffff800`02c1b000 : nt!_C_specific_handler+0x8c
fffff880`08731a30 fffff800`02cc22d5 : fffff800`02ddac24 fffff880`08731aa8 fffff880`08732918 fffff800`02c1b000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`08731a60 fffff800`02cd3361 : fffff880`08732918 fffff880`08732170 fffff880`00000000 fffff800`02e11e80 : nt!RtlDispatchException+0x415
fffff880`08732140 fffff800`02c972c2 : fffff880`08732918 fffffa80`0afde620 fffff880`087329c0 fffff800`02e10080 : nt!KiDispatchException+0x135
fffff880`087327e0 fffff800`02c95bca : 00000000`00000000 ffffd05b`2d57c0a4 00000000`00000002 fffffa80`06e1c660 : nt!KiExceptionDispatch+0xc2
fffff880`087329c0 fffff800`02ca1e53 : fffffa80`08c14dd0 fffff800`0320871f fffffa80`0834a980 00000000`0000005a : nt!KiGeneralProtectionFault+0x10a
fffff880`08732b50 fffff800`02c72bde : 00000000`00000002 00000000`00000000 fffffa80`06bb60f0 fffffa80`0afde5c0 : nt!KiCancelTimer+0xaf
fffff880`08732b90 fffff880`03e6189f : fffffa80`08c14dd0 fffff880`0149e7c1 fffffa80`08ea5790 fffffa80`09384a70 : nt!KeCancelTimer+0x1a
fffff880`08732bc0 fffff880`03e4f448 : 00000000`00000000 00000000`00000000 fffffa80`0afde808 fffffa80`0afde808 : afd!AfdCompletePollIrp+0xef
fffff880`08732c20 fffff880`03e5ab08 : fffffa80`0afde808 00000000`00000000 00000000`00000002 fffffa80`088c3b10 : afd!AfdIndicatePollEvent+0x138
fffff880`08732c70 fffff800`02c9b021 : fffffa80`07281180 00000000`00000008 00000000`00000d00 fffff880`02d64f40 : afd!AfdCommonRestartBufferReceive+0x1e8
fffff880`08732d20 fffff880`0173d687 : fffffa80`0781c350 fffff880`08732f02 fffff880`08732f00 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`08732e10 fffff880`01754a45 : 00000000`000005b4 fffffa80`09351010 fffffa80`09351010 00000000`00000002 : tcpip!TcpSatisfyReceiveRequests+0x4a7
fffff880`087330f0 fffff880`01753839 : 00000000`00000002 00000000`00000000 fffff880`01500110 00000000`00000002 : tcpip!TcpDeliverDataToClient+0x105
fffff880`08733270 fffff880`01750d58 : fffffa80`0849b7d0 00000000`00000000 00000000`00000000 fffff880`0174eb2a : tcpip!TcpDeliverReceive+0xa9
fffff880`08733370 fffff880`017518b5 : fffff880`08733838 fffff880`00000000 fffffa80`09351010 fffff800`02c96ed3 : tcpip!TcpTcbFastDatagram+0x208
fffff880`08733530 fffff880`0175067a : fffffa80`07009880 00000000`0904e8f0 fffffa80`06fd52e0 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5
fffff880`087336e0 fffff880`017522ab : fffffa80`09119780 fffffa80`06ee9580 00000000`00000000 00000000`00000000 : tcpip!TcpMatchReceive+0x1fa
fffff880`08733830 fffff880`0172cffa : fffffa80`07009880 00000000`0000302f fffff880`0000f9c6 fffff880`0873f9c6 : tcpip!TcpPreValidatedReceive+0x36b
fffff880`08733900 fffff800`02ca4618 : fffff880`018689a0 fffff880`0155b506 00000000`00000000 00000000`00000000 : tcpip!IppLoopbackTransmit+0x11a
fffff880`087339b0 fffff880`0172d90f : fffff880`01779c70 fffffa80`0704f880 fffff880`08733b02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`08733a90 fffff880`0174a74a : fffffa80`069328a0 00000000`00000000 00000000`00000010 fffffa80`09119630 : tcpip!IppLoopbackEnqueue+0x22f
fffff880`08733b40 fffff880`0174c895 : 00000000`00000000 00000000`00140001 00000000`00000000 fffff800`02f89508 : tcpip!IppDispatchSendPacketHelper+0x38a
fffff880`08733c00 fffff880`0174afd3 : fffffa80`0aefaa06 00000000`0000f900 fffffa80`00000014 fffff880`00000000 : tcpip!IppPacketizeDatagrams+0x2d5
fffff880`08733d20 fffff880`0174e43e : 00000000`00000014 fffff880`01757607 00000000`00000000 00000000`00000000 : tcpip!IppSendDatagramsCommon+0x753
fffff880`08733ff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IpNlpSendDatagrams+0x3e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdCompletePollIrp+ef
fffff880`03e6189f 84c0            test    al,al

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  afd!AfdCompletePollIrp+ef

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4efa9418

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef

BUCKET_ID:  X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030712-22105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e60670
Debug session time: Wed Mar  7 00:17:19.408 2012 (UTC - 7:00)
System Uptime: 0 days 1:39:30.828
Loading Kernel Symbols
...............................................................
................................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff880087319f0, 0, 0}

Probably caused by : afd.sys ( afd!AfdCompletePollIrp+ef )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880087319f0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+6666376537376366
fffff880`087319f0 1829            sbb     byte ptr [rcx],ch

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eca100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  AvastSvc.exe

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88008732918 -- (.exr 0xfffff88008732918)
ExceptionAddress: fffff80002ca1e53 (nt!KiCancelTimer+0x00000000000000af)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff880087329c0 -- (.trap 0xfffff880087329c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80002e11e88 rbx=0000000000000000 rcx=fdfff80002e11e88
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca1e53 rsp=fffff88008732b50 rbp=0000000000000001
 r8=fffff80002c1b000  r9=0000000000000000 r10=fffffa80088c3c60
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!KiCancelTimer+0xaf:
fffff800`02ca1e53 488901          mov     qword ptr [rcx],rax ds:fdfff800`02e11e88=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d234fb to fffff80002c97c40

STACK_TEXT:  
fffff880`08731938 fffff800`02d234fb : 00000000`0000001e ffffffff`c0000005 fffff880`087319f0 00000000`00000000 : nt!KeBugCheckEx
fffff880`08731940 fffff800`02cebbb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`08731980 fffff800`02cc3a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`087319c0 fffff800`02cc34fd : fffff800`02ddac24 fffff880`087339b0 00000000`00000000 fffff800`02c1b000 : nt!_C_specific_handler+0x8c
fffff880`08731a30 fffff800`02cc22d5 : fffff800`02ddac24 fffff880`08731aa8 fffff880`08732918 fffff800`02c1b000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`08731a60 fffff800`02cd3361 : fffff880`08732918 fffff880`08732170 fffff880`00000000 fffff800`02e11e80 : nt!RtlDispatchException+0x415
fffff880`08732140 fffff800`02c972c2 : fffff880`08732918 fffffa80`0afde620 fffff880`087329c0 fffff800`02e10080 : nt!KiDispatchException+0x135
fffff880`087327e0 fffff800`02c95bca : 00000000`00000000 ffffd05b`2d57c0a4 00000000`00000002 fffffa80`06e1c660 : nt!KiExceptionDispatch+0xc2
fffff880`087329c0 fffff800`02ca1e53 : fffffa80`08c14dd0 fffff800`0320871f fffffa80`0834a980 00000000`0000005a : nt!KiGeneralProtectionFault+0x10a
fffff880`08732b50 fffff800`02c72bde : 00000000`00000002 00000000`00000000 fffffa80`06bb60f0 fffffa80`0afde5c0 : nt!KiCancelTimer+0xaf
fffff880`08732b90 fffff880`03e6189f : fffffa80`08c14dd0 fffff880`0149e7c1 fffffa80`08ea5790 fffffa80`09384a70 : nt!KeCancelTimer+0x1a
fffff880`08732bc0 fffff880`03e4f448 : 00000000`00000000 00000000`00000000 fffffa80`0afde808 fffffa80`0afde808 : afd!AfdCompletePollIrp+0xef
fffff880`08732c20 fffff880`03e5ab08 : fffffa80`0afde808 00000000`00000000 00000000`00000002 fffffa80`088c3b10 : afd!AfdIndicatePollEvent+0x138
fffff880`08732c70 fffff800`02c9b021 : fffffa80`07281180 00000000`00000008 00000000`00000d00 fffff880`02d64f40 : afd!AfdCommonRestartBufferReceive+0x1e8
fffff880`08732d20 fffff880`0173d687 : fffffa80`0781c350 fffff880`08732f02 fffff880`08732f00 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`08732e10 fffff880`01754a45 : 00000000`000005b4 fffffa80`09351010 fffffa80`09351010 00000000`00000002 : tcpip!TcpSatisfyReceiveRequests+0x4a7
fffff880`087330f0 fffff880`01753839 : 00000000`00000002 00000000`00000000 fffff880`01500110 00000000`00000002 : tcpip!TcpDeliverDataToClient+0x105
fffff880`08733270 fffff880`01750d58 : fffffa80`0849b7d0 00000000`00000000 00000000`00000000 fffff880`0174eb2a : tcpip!TcpDeliverReceive+0xa9
fffff880`08733370 fffff880`017518b5 : fffff880`08733838 fffff880`00000000 fffffa80`09351010 fffff800`02c96ed3 : tcpip!TcpTcbFastDatagram+0x208
fffff880`08733530 fffff880`0175067a : fffffa80`07009880 00000000`0904e8f0 fffffa80`06fd52e0 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5
fffff880`087336e0 fffff880`017522ab : fffffa80`09119780 fffffa80`06ee9580 00000000`00000000 00000000`00000000 : tcpip!TcpMatchReceive+0x1fa
fffff880`08733830 fffff880`0172cffa : fffffa80`07009880 00000000`0000302f fffff880`0000f9c6 fffff880`0873f9c6 : tcpip!TcpPreValidatedReceive+0x36b
fffff880`08733900 fffff800`02ca4618 : fffff880`018689a0 fffff880`0155b506 00000000`00000000 00000000`00000000 : tcpip!IppLoopbackTransmit+0x11a
fffff880`087339b0 fffff880`0172d90f : fffff880`01779c70 fffffa80`0704f880 fffff880`08733b02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`08733a90 fffff880`0174a74a : fffffa80`069328a0 00000000`00000000 00000000`00000010 fffffa80`09119630 : tcpip!IppLoopbackEnqueue+0x22f
fffff880`08733b40 fffff880`0174c895 : 00000000`00000000 00000000`00140001 00000000`00000000 fffff800`02f89508 : tcpip!IppDispatchSendPacketHelper+0x38a
fffff880`08733c00 fffff880`0174afd3 : fffffa80`0aefaa06 00000000`0000f900 fffffa80`00000014 fffff880`00000000 : tcpip!IppPacketizeDatagrams+0x2d5
fffff880`08733d20 fffff880`0174e43e : 00000000`00000014 fffff880`01757607 00000000`00000000 00000000`00000000 : tcpip!IppSendDatagramsCommon+0x753
fffff880`08733ff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IpNlpSendDatagrams+0x3e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdCompletePollIrp+ef
fffff880`03e6189f 84c0            test    al,al

SYMBOL_STACK_INDEX:  b

SYMBOL_NAME:  afd!AfdCompletePollIrp+ef

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4efa9418

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef

BUCKET_ID:  X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030612-22713-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c54000 PsLoadedModuleList = 0xfffff800`02e99670
Debug session time: Tue Mar  6 22:21:05.629 2012 (UTC - 7:00)
System Uptime: 0 days 1:15:21.439
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800318c758, fffff8800318bfb0, fffff880012e8be8}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFullDeleteLcb+ac )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800318c758
Arg3: fffff8800318bfb0
Arg4: fffff880012e8be8

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800318c758 -- (.exr 0xfffff8800318c758)
ExceptionAddress: fffff880012e8be8 (Ntfs!NtfsFullDeleteLcb+0x00000000000000ac)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800318bfb0 -- (.cxr 0xfffff8800318bfb0)
rax=fffff8a00f293db8 rbx=fffff8800318ca08 rcx=fdfff8a00f293db8
rdx=0000000000000001 rsi=0000000000000000 rdi=fffff8a0123ee6d0
rip=fffff880012e8be8 rsp=fffff8800318c990 rbp=0000000000000000
 r8=fffffa800b504338  r9=0000000000000000 r10=fffff880009ea6c0
r11=0000000000000001 r12=fffff8a00dc2d010 r13=fffff8a00f293bc0
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
Ntfs!NtfsFullDeleteLcb+0xac:
fffff880`012e8be8 48894108        mov     qword ptr [rcx+8],rax ds:002b:fdfff8a0`0f293dc0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f03100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFullDeleteLcb+ac
fffff880`012e8be8 48894108        mov     qword ptr [rcx+8],rax

FAULTING_IP: 
Ntfs!NtfsFullDeleteLcb+ac
fffff880`012e8be8 48894108        mov     qword ptr [rcx+8],rax

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012648b9 to fffff880012e8be8

STACK_TEXT:  
fffff880`0318c990 fffff880`012648b9 : fffff8a0`0dc2d010 fffff800`02e71260 fffff880`0318cb01 fffff880`012eccc1 : Ntfs!NtfsFullDeleteLcb+0xac
fffff880`0318c9c0 fffff880`012ea770 : fffffa80`0a9b0480 fffffa80`07228180 fffff8a0`0dc2d010 fffff8a0`123ee640 : Ntfs!NtfsTeardownFromLcb+0x129
fffff880`0318ca50 fffff880`0126c0e2 : fffffa80`0a9b0480 fffffa80`0a9b0480 fffff8a0`0dc2d010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0x200
fffff880`0318cad0 fffff880`012fa193 : fffffa80`0a9b0480 fffff800`02e71260 fffff8a0`0dc2d010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0318cb10 fffff880`012e9357 : fffffa80`0a9b0480 fffff8a0`0dc2d140 fffff8a0`0dc2d010 fffffa80`07228180 : Ntfs!NtfsCommonClose+0x353
fffff880`0318cbe0 fffff800`02cdb001 : 00000000`00000000 fffff800`02e71200 fffffa80`060f2b01 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0318ccb0 fffff800`02f6bfee : 00000000`00000000 fffffa80`060f2b60 00000000`00000080 fffffa80`060ce450 : nt!ExpWorkerThread+0x111
fffff880`0318cd40 fffff800`02cc25e6 : fffff880`009e9180 fffffa80`060f2b60 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsFullDeleteLcb+ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800318bfb0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFullDeleteLcb+ac

BUCKET_ID:  X64_0x24_Ntfs!NtfsFullDeleteLcb+ac

Followup: MachineOwner
---------


[/list]

Caused by Avast...
Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...

Do the following steps to resolve your crashes:

Uninstall Avast and replace with either
Microsoft Security Essentials - Free Antivirus for Windows
or the
http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
Use HD Diagnostic to find the manufacturer of your hard drive. Then use the same guide to find the diagnostics for that manufacturer. Test the hard drive with those diagnostics to determine whether the hard disk is faulty. Use Seagate's SeaTools if you have a Samsung drive, and run the short and long tests on the drive.

Bolo · Mar 8, 2012

I tried to get the info to post the logs but it says that it couldnt find any....

And after deleting Avast and getting another antivirus it still blue screens but i believe because of another reason...now.

Here's the new Minidumps

writhziden · Mar 8, 2012

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030812-23665-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02c66000 PsLoadedModuleList = 0xfffff800`02eab650
Debug session time: Thu Mar  8 21:23:04.021 2012 (UTC - 7:00)
System Uptime: 0 days 1:45:47.816
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88003077fe8, fffff88003077840, fffff80002cffc6f}

Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2b49 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88003077fe8
Arg3: fffff88003077840
Arg4: fffff80002cffc6f

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88003077fe8 -- (.exr 0xfffff88003077fe8)
Cannot read Exception record @ fffff88003077fe8

CONTEXT:  fffff88003077840 -- (.cxr 0xfffff88003077840)
rax=0000000000000000 rbx=0000000000000001 rcx=fdfffa8006b52bf8
rdx=0000000080000000 rsi=fffff880009e9180 rdi=0000000000000000
rip=fffff80002cffc6f rsp=fffff88003078220 rbp=fdfffa8006b52bb0
 r8=0000000000000000  r9=fffff880009e9180 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=fffffa8006c42648 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
nt!ExTryAcquireSpinLockExclusiveAtDpcLevel+0x2f:
fffff800`02cffc6f f00fb111        lock cmpxchg dword ptr [rcx],edx ds:002b:fdfffa80`06b52bf8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f15100
 0000000000000000 

FOLLOWUP_IP: 
Ntfs! ?? ::FNODOBFM::`string'+2b49
fffff880`0164ea88 cc              int     3

FAULTING_IP: 
nt!ExTryAcquireSpinLockExclusiveAtDpcLevel+2f
fffff800`02cffc6f f00fb111        lock cmpxchg dword ptr [rcx],edx

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002cffc6f

STACK_TEXT:  
fffff880`03076fd8 fffff880`0164ea88 : 00000000`00000024 00000000`001904fb fffff880`03077fe8 fffff880`03077840 : nt!KeBugCheckEx
fffff880`03076fe0 fffff880`01662f3d : fffff880`01694f8c fffff880`030788e0 fffff880`030788b0 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x2b49
fffff880`03077020 fffff800`02d11adc : 00000000`00000000 fffff880`00000000 00000000`00001000 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x12c6
fffff880`03077060 fffff880`016625c5 : fffff880`01694f94 fffff880`030788b0 fffff880`03077fe8 fffff880`030788b0 : nt!_C_specific_handler+0x8c
fffff880`030770d0 fffff800`02d1155d : fffff880`01694f80 00000000`00000000 fffff880`01649000 00000000`00000000 : Ntfs!_GSHandlerCheck_SEH+0x75
fffff880`03077100 fffff800`02d10335 : fffff880`01694f80 fffff880`03077178 fffff880`03077fe8 fffff880`01649000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`03077130 fffff800`02d213b1 : fffff880`03077fe8 fffff880`03077840 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
fffff880`03077810 fffff800`02ce5382 : fffff880`03077fe8 00000000`00000001 fffff880`03078090 fffff880`009e9180 : nt!KiDispatchException+0x135
fffff880`03077eb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2b49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2b49

BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2b49

Followup: MachineOwner
---------

The recent crashes are pointing toward hard disk errors. Proceed through the hard disk checks.

Bolo · Mar 9, 2012

I did earlier but it didn't show any errors popping up. It seems as if everytime my computer is using alot of cpu usage is when the blue screens and errors start to happen. I'm gonna run it again to make sure. and post the results.

Bolo · Mar 9, 2012

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
158208 file records processed. File verification completed.
115 large file records processed. 0 bad file records processed. 0 EA records processed. 45 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
222718 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
158208 file SDs/SIDs processed. Cleaning up 143 unused index entries from index $SII of file 0x9.
Cleaning up 143 unused index entries from index $SDH of file 0x9.
Cleaning up 143 unused security descriptors.
Security descriptor verification completed.
32256 data files processed. CHKDSK is verifying Usn Journal...
34546144 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
158192 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
130851261 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

606779391 KB total disk space.
83025088 KB in 120402 files.
72188 KB in 32257 indexes.
0 KB in bad sectors.
277067 KB in use by the system.
65536 KB occupied by the log file.
523405048 KB available on disk.

4096 bytes in each allocation unit.
151694847 total allocation units on disk.
130851262 allocation units available on disk.

Internal Info:
00 6a 02 00 5f 54 02 00 10 4e 04 00 00 00 00 00 .j.._T...N......
be 02 00 00 2d 00 00 00 00 00 00 00 00 00 00 00 ....-...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

I believe this is the logs i was supposed to post? And btw it just keeps blue screen'ing...Minidump again..

writhziden · Mar 9, 2012

Code:

[list=1]
[*]
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030912-36176-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c19000 PsLoadedModuleList = 0xfffff800`02e5e670
Debug session time: Fri Mar  9 02:03:13.214 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:36.009
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002c99cd9, fffff8800338afd8, fffff8800338a830}

Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+139 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c99cd9, The address that the exception occurred at
Arg3: fffff8800338afd8, Exception Record Address
Arg4: fffff8800338a830, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeSetEvent+139
fffff800`02c99cd9 0fb6422b        movzx   eax,byte ptr [rdx+2Bh]

EXCEPTION_RECORD:  fffff8800338afd8 -- (.exr 0xfffff8800338afd8)
Cannot read Exception record @ fffff8800338afd8

CONTEXT:  fffff8800338a830 -- (.cxr 0xfffff8800338a830)
rax=0000000000000003 rbx=0000000000000000 rcx=fffffa8008dd6650
rdx=fdfffa8008dd66b8 rsi=0000000000000000 rdi=fffff88002f64180
rip=fffff80002c99cd9 rsp=fffff8800338b210 rbp=0000000000000000
 r8=fdfffa8008dd66b8  r9=0000000000000000 r10=d860000000060000
r11=0000000000c00000 r12=fffffa80061378c0 r13=fffffa80061378c0
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeSetEvent+0x139:
fffff800`02c99cd9 0fb6422b        movzx   eax,byte ptr [rdx+2Bh] ds:002b:fdfffa80`08dd66e3=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec8100
 0000000000000000 

FOLLOWUP_IP: 
nt!KeSetEvent+139
fffff800`02c99cd9 0fb6422b        movzx   eax,byte ptr [rdx+2Bh]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002fb1f79 to fffff80002c99cd9

STACK_TEXT:  
fffff880`0338b210 fffff800`02fb1f79 : fffff8a0`00000000 fffffa80`00000000 00000000`00001000 fdfffa80`08dd66b8 : nt!KeSetEvent+0x139
fffff880`0338b280 fffff800`02fb203f : 00000000`00000000 fffffa80`07a12070 fffff8a0`001af000 00000000`00c00000 : nt!EtwpRealtimeInjectEtwBuffer+0x17d
fffff880`0338b310 fffff800`02fb32e9 : fffffa80`06137700 00000000`00000000 fffff8a0`001af000 00000000`c0000000 : nt!EtwpRealtimeDeliverBuffer+0x73
fffff880`0338b360 fffff800`02fb33ba : fffffa80`06137780 fffff8a0`001af000 00000000`c0000001 00000000`00010000 : nt!EtwpFlushBufferToRealtime+0x39
fffff880`0338b390 fffff800`02cd6f99 : 00000000`00000000 00000000`00000001 fffffa80`06137780 fffffa80`06137780 : nt!EtwpFlushBuffer+0x7a
fffff880`0338b3d0 fffff800`02fb1d46 : fffffa80`06130000 00000000`00000001 00000000`00000000 fffff8a0`001af020 : nt!EtwpFlushActiveBuffers+0x2bd
fffff880`0338bcc0 fffff800`02f30fee : 00000000`00000000 fffffa80`06144040 00000000`00000080 fffffa80`060d7400 : nt!EtwpLogger+0x1e2
fffff880`0338bd40 fffff800`02c875e6 : fffff880`02f64180 fffffa80`06144040 fffffa80`060fe680 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0338bd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeSetEvent+139

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800338a830 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!KeSetEvent+139

BUCKET_ID:  X64_0x7E_nt!KeSetEvent+139

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030912-26847-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`02c55000 PsLoadedModuleList = 0xfffff800`02e9a650
Debug session time: Thu Mar  8 23:27:35.808 2012 (UTC - 7:00)
System Uptime: 0 days 1:04:40.603
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88004c148f5, fffff88003cd13c8, fffff88003cd0c20}

Probably caused by : atikmdag.sys ( atikmdag+3c28f5 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004c148f5, The address that the exception occurred at
Arg3: fffff88003cd13c8, Exception Record Address
Arg4: fffff88003cd0c20, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
atikmdag+3c28f5
fffff880`04c148f5 8179083000bebe  cmp     dword ptr [rcx+8],0BEBE0030h

EXCEPTION_RECORD:  fffff88003cd13c8 -- (.exr 0xfffff88003cd13c8)
ExceptionAddress: fffff88004c148f5 (atikmdag+0x00000000003c28f5)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003cd0c20 -- (.cxr 0xfffff88003cd0c20)
rax=fffff88004d42ed0 rbx=0000000000000001 rcx=fdfff8a00a8c7d00
rdx=fdfff8a00a8c7d00 rsi=00000000ffffffff rdi=0000000000000002
rip=fffff88004c148f5 rsp=fffff88003cd1608 rbp=fffffa80088e2c20
 r8=0000000000000002  r9=0000000f10055000 r10=fffff8a00a1f0410
r11=fffff88003cd17d0 r12=fffff88004852000 r13=fffffa8008837a40
r14=fffffa80088eccd0 r15=fffffa8008837a40
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
atikmdag+0x3c28f5:
fffff880`04c148f5 8179083000bebe  cmp     dword ptr [rcx+8],0BEBE0030h ds:002b:fdfff8a0`0a8c7d08=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f04100
 ffffffffffffffff 

FOLLOWUP_IP: 
atikmdag+3c28f5
fffff880`04c148f5 8179083000bebe  cmp     dword ptr [rcx+8],0BEBE0030h

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88004c5227f to fffff88004c148f5

STACK_TEXT:  
fffff880`03cd1608 fffff880`04c5227f : 00000000`00000000 00000000`00000001 00000000`00000003 00000000`00000001 : atikmdag+0x3c28f5
fffff880`03cd1610 00000000`00000000 : 00000000`00000001 00000000`00000003 00000000`00000001 fffff880`03cd1870 : atikmdag+0x40027f


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+3c28f5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9689c5

STACK_COMMAND:  .cxr 0xfffff88003cd0c20 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_atikmdag+3c28f5

BUCKET_ID:  X64_0x7E_atikmdag+3c28f5

Followup: MachineOwner
---------


[/list]

Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Caused by your graphics card/graphics card drivers. Same other possible causes as 1.

We seem to be past the hard disk error crashes. Just to be sure, though, have you run the hard disk manufacturer's diagnostics/tests?

Proceed through the following hardware checks:

If you are overclocking any hardware, please stop.
Monitor temperatures during the following tests.

Use the following programs to monitor the temperatures.
- Real Temp is a good CPU temperature monitor.
- Speccy - System Information - Free Download will monitor all hardware temperatures.
- HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
- Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
- Run http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.

Additionally, please follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html to provide us with more details regarding your crashes. These will help us give more specific troubleshooting steps.

Bolo · Mar 12, 2012

It just keeps doing the same thing and nothing's coming up with errors. but for some reason it just keeps running high in cpu usuage at random times. It also spikes up to high in cpu usuage, like unusually high when i play certain games and what not....

Recent Dumps:

writhziden · Mar 12, 2012

The most recent crashes (031212-18735-01.dmp) point to hard disk errors again. I would suggest doing the hard disk diagnostics through your hard disk manufacturer.

Also, please fill out your system specs more: http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html

Code:

Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\031112-32027-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e9c670
Debug session time: Sun Mar 11 03:38:11.745 2012 (UTC - 6:00)
System Uptime: 0 days 4:42:52.540
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002cdd985, fffff880031cb738, fffff880031caf90}

Unable to load image \SystemRoot\System32\drivers\WRkrn.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for WRkrn.sys
*** ERROR: Module load completed but symbols could not be loaded for WRkrn.sys
Probably caused by : tdx.sys ( tdx!TdxDisassociateConnection+2d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002cdd985, The address that the exception occurred at
Arg3: fffff880031cb738, Exception Record Address
Arg4: fffff880031caf90, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeAcquireSpinLockRaiseToDpc+55
fffff800`02cdd985 f0480fba2900    lock bts qword ptr [rcx],0

EXCEPTION_RECORD:  fffff880031cb738 -- (.exr 0xfffff880031cb738)
ExceptionAddress: fffff80002cdd985 (nt!KeAcquireSpinLockRaiseToDpc+0x0000000000000055)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880031caf90 -- (.cxr 0xfffff880031caf90)
rax=0000000000000002 rbx=0000000000000000 rcx=fdfffa80093ce368
rdx=fffff88004163110 rsi=fffffa8007a09e00 rdi=fffff80002e49e80
rip=fffff80002cdd985 rsp=fffff880031cb970 rbp=fdfffa80093ce368
 r8=fffffa80093adf28  r9=0000000000000000 r10=fffffa8006126640
r11=fffffa80093adf70 r12=fffff880031cba40 r13=00000000031cba40
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!KeAcquireSpinLockRaiseToDpc+0x55:
fffff800`02cdd985 f0480fba2900    lock bts qword ptr [rcx],0 ds:002b:fdfffa80`093ce368=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f06100
 ffffffffffffffff 

FOLLOWUP_IP: 
tdx!TdxDisassociateConnection+2d
fffff880`0415c0cd 488b6b58        mov     rbp,qword ptr [rbx+58h]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff8800415c0cd to fffff80002cdd985

STACK_TEXT:  
fffff880`031cb970 fffff880`0415c0cd : fffffa80`07a09e20 fffff880`031cba40 fffffa80`093ade10 fdfffa80`093ce360 : nt!KeAcquireSpinLockRaiseToDpc+0x55
fffff880`031cb9c0 fffff880`04154b9f : fffffa80`093adf28 fdfffa80`093ce360 fffffa80`07a09e20 fffffa80`093adf70 : tdx!TdxDisassociateConnection+0x2d
fffff880`031cba10 fffff880`011836af : fffffa80`093ade10 fffffa80`07a09e20 00000000`00000000 00000000`00000000 : tdx! ?? ::FNODOBFM::`string'+0x47e1
fffff880`031cba90 fffffa80`093ade10 : fffffa80`07a09e20 00000000`00000000 00000000`00000000 fffffa80`093ade10 : WRkrn+0x66af
fffff880`031cba98 fffffa80`07a09e20 : 00000000`00000000 00000000`00000000 fffffa80`093ade10 fffff880`041a1ce3 : 0xfffffa80`093ade10
fffff880`031cbaa0 00000000`00000000 : 00000000`00000000 fffffa80`093ade10 fffff880`041a1ce3 00000000`00000000 : 0xfffffa80`07a09e20


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  tdx!TdxDisassociateConnection+2d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tdx

IMAGE_NAME:  tdx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332

STACK_COMMAND:  .cxr 0xfffff880031caf90 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_tdx!TdxDisassociateConnection+2d

BUCKET_ID:  X64_0x7E_tdx!TdxDisassociateConnection+2d

Followup: MachineOwner
---------

Points to Webroot as the cause of this crash.

Uninstall Webroot and replace with either

Microsoft Security Essentials - Free Antivirus for Windows

or the

http://www.sevenforums.com/system-s...-system-security-combination.html#post1732627

New Comp. Crash Errors BSOD BCCode: 1e

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer