WIndows 7 64bit - Minidump help?

vyrotek · Feb 10, 2010

Just recently things have started going crazy with random bsod's.
I have a few minidump file available and would appreciate if someone could take a look.

I did notice there were other people complaining about lots of crashes after the latest windows update. But, I really have no idea what is causing the problem.

Thanks

zigzag3143 · Feb 10, 2010

vyrotek said:
Just recently things have started going crazy with random bsod's.
I have a few minidump file available and would appreciate if someone could take a look.

I did notice there were other people complaining about lots of crashes after the latest windows update. But, I really have no idea what is causing the problem.

Thanks

These were caused byt your vfilter.sys which is ppart of your VPN client software. I would either uninstall it or reinstall it
Also
run a system file check
type cmd in search>right click and run as admin>sfc /scannow

If you are overclocking stop

Ken

Code:

020810-22947-01.dmp    2/8/2010 8:27:10 PM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c910b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\020810-22947-01.dmp    4    15    7600    
020910-21902-01.dmp    2/9/2010 5:49:52 PM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c8a0b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\020910-21902-01.dmp    4    15    7600    
021010-31683-01.dmp    2/10/2010 9:42:06 AM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c870b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-31683-01.dmp    4    15    7600    
021010-37799-01.dmp    2/10/2010 9:31:22 AM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c8e0b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-37799-01.dmp    4    15    7600

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\021010-31683-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e4ee50
Debug session time: Wed Feb 10 11:40:32.053 2010 (GMT-5)
System Uptime: 0 days 0:09:58.162
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c870b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c870b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb90e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02c870b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88005f1afb0 -- (.trap 0xfffff88005f1afb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009b91818 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c870b6 rsp=fffff88005f1b140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02c870b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c82469 to fffff80002c82f00

STACK_TEXT:  
fffff880`05f1ae68 fffff800`02c82469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`05f1ae70 fffff800`02c810e0 : 00000000`00000002 fffffa80`09b91810 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`05f1afb0 fffff800`02c870b6 : fffff880`05f1b1b0 fffff880`02d92b0e 00000000`00000049 fffff880`05f1b230 : nt!KiPageFault+0x260
fffff880`05f1b140 fffff880`02d929a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09b91800 : nt!KeSetEvent+0x226
fffff880`05f1b1b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09b91800 00000000`00000000 : vfilter+0x29a6
fffff880`05f1b1b8 00000000`00000000 : 00000000`00000000 fffffa80`09b91800 00000000`00000000 fffff880`02d9242b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d929a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------

vyrotek · Feb 10, 2010

Thanks for the quick response!

I could understand the ones that happened today (2/10) to be the VPN, but 2/8 and 2/9 shouldn't show the same problem. But you say it does?

I attached an even older dump from 2/6 which I don't think was the VPN either.

Edit - Also, what would make you believe I was overclocking? I'm not, but I just want to make sure you're not seeing something that typically shows up when something is overheating.

zigzag3143 · Feb 10, 2010

vyrotek said:
Thanks for the quick response!

I could understand the ones that happened today (2/10) to be the VPN, but 2/8 and 2/9 shouldn't show the same problem. But you say it does?

I attached an even older dump from 2/6 which I don't think was the VPN either.

Edit - Also, what would make you believe I was overclocking? I'm not, but I just want to make sure you're not seeing something that typically shows up when something is overheating.

Still says vfilter.sys like last time. The ref to overclock was generic, I say that every BSOD just in case.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\020610-19983-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
[B]Built by: 7600.16385.amd64fre.win7_rtm.090713-1255[/B]
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e8ee50
Debug session time: Sat Feb  6 14:19:12.281 2010 (GMT-5)
System Uptime: 0 days 2:26:50.390
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc70b6}

[B]Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter[/B]+29a6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[B]IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:[/B]
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc70b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef90e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc70b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800a397fb0 -- (.trap 0xfffff8800a397fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009a92d98 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc70b6 rsp=fffff8800a398140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!KeSetEvent+0x226:
fffff800`02cc70b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc2469 to fffff80002cc2f00

STACK_TEXT:  
fffff880`0a397e68 fffff800`02cc2469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a397e70 fffff800`02cc10e0 : 00000000`00000002 fffffa80`09a92d90 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a397fb0 fffff800`02cc70b6 : fffff880`0a3981b0 fffff880`02d21b0e 00000000`00000049 fffff880`0a398230 : nt!KiPageFault+0x260
fffff880`0a398140 fffff880`02d219a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09a92d80 : nt!KeSetEvent+0x226
fffff880`0a3981b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09a92d80 00000000`00000000 : vfilter+0x29a6
fffff880`0a3981b8 00000000`00000000 : 00000000`00000000 fffffa80`09a92d80 00000000`00000000 fffff880`02d2142b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d219a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  [B]vfilter.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------

vyrotek · Feb 23, 2010

Sorry to bump this again but I finally caught a BSOD while not running my VPN software.
Any chance someone could take a look at this dmp?

I was remoted locally in VirtualBox running Windows 2008. I'm not sure what could have caused the BSOD this time.

zigzag3143 · Feb 23, 2010

vyrotek said:
Sorry to bump this again but I finally caught a BSOD while not running my VPN software.
Any chance someone could take a look at this dmp?

I was remoted locally in VirtualBox running Windows 2008. I'm not sure what could have caused the BSOD this time.

Hate to tell you but it is still your vpn client. the file the caused this is vfilter.sys and it it loaded at start up, rvrn if you dont run the vpn client

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\022210-20935-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e90e50
Debug session time: Tue Feb 23 00:48:04.321 2010 (GMT-5)
System Uptime: 0 days 4:49:01.429
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc90b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc90b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88007958fb0 -- (.trap 0xfffff88007958fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009bbe478 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc90b6 rsp=fffff88007959140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc4469 to fffff80002cc4f00

STACK_TEXT:  
fffff880`07958e68 fffff800`02cc4469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07958e70 fffff800`02cc30e0 : 00000000`00000002 fffffa80`09bbe470 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07958fb0 fffff800`02cc90b6 : fffff880`079591b0 fffff880`02d93b0e 00000000`00000051 fffff880`07959230 : nt!KiPageFault+0x260
fffff880`07959140 fffff880`02d939a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09bbe460 : nt!KeSetEvent+0x226
fffff880`079591b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09bbe460 00000000`00000000 : vfilter+0x29a6
fffff880`079591b8 00000000`00000000 : 00000000`00000000 fffffa80`09bbe460 00000000`00000000 fffff880`02d9342b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d939a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\022210-20935-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e90e50
Debug session time: Tue Feb 23 00:48:04.321 2010 (GMT-5)
System Uptime: 0 days 4:49:01.429
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc90b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc90b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88007958fb0 -- (.trap 0xfffff88007958fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009bbe478 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc90b6 rsp=fffff88007959140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc4469 to fffff80002cc4f00

STACK_TEXT:  
fffff880`07958e68 fffff800`02cc4469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07958e70 fffff800`02cc30e0 : 00000000`00000002 fffffa80`09bbe470 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07958fb0 fffff800`02cc90b6 : fffff880`079591b0 fffff880`02d93b0e 00000000`00000051 fffff880`07959230 : nt!KiPageFault+0x260
fffff880`07959140 fffff880`02d939a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09bbe460 : nt!KeSetEvent+0x226
fffff880`079591b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09bbe460 00000000`00000000 : vfilter+0x29a6
fffff880`079591b8 00000000`00000000 : 00000000`00000000 fffffa80`09bbe460 00000000`00000000 fffff880`02d9342b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d939a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------



DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------

masterjsn · Jun 13, 2012

help: what do you make of this?

Opened log file 'c:\debuglog.txt'
1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800771e028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be200000, High order 32-bits of the MCi_STATUS value.
Arg4: 000000000005110a, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------

BUGCHECK_STR: 0x124_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: f

STACK_TEXT:
fffff880`009f4a58 fffff800`02e2ba3b : 00000000`00000124 00000000`00000000 fffffa80`0771e028 00000000`be200000 : nt!KeBugCheckEx
fffff880`009f4a60 fffff800`02feeb33 : 00000000`00000001 fffffa80`074d4830 00000000`00000000 fffffa80`074d4880 : hal!HalBugCheckSystem+0x1e3
fffff880`009f4aa0 fffff800`02e2b700 : 00000000`00000728 fffffa80`074d4830 fffff880`009f4e30 fffff880`009f4e00 : nt!WheaReportHwError+0x263
fffff880`009f4b00 fffff800`02e2b052 : fffffa80`074d4830 fffff880`009f4e30 fffffa80`074d4830 00000000`00000000 : hal!HalpMcaReportError+0x4c
fffff880`009f4c50 fffff800`02e2af0d : 00000000`00000004 00000000`00000001 fffff880`009f4eb0 00000000`00000000 : hal!HalpMceHandler+0x9e
fffff880`009f4c90 fffff800`02e1ee88 : 00000000`00000001 fffff880`009ec180 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0x55
fffff880`009f4cc0 fffff800`02edd56c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff880`009f4cf0 fffff800`02edd3d3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x6c
fffff880`009f4e30 fffff800`02ee76ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x153
fffff880`02f1bb60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PoIdle+0x3eb

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_CACHE

BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_CACHE

Followup: MachineOwner
---------

masterjsn · Jun 13, 2012

here is anotherlease help

There are many more, but they all seen ramdom. meaning it lists the program i was running when it bsod me. I dont really know how to read the info.

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800770f028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------

BUGCHECK_STR: 0x124_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: UnrealTourname

CURRENT_IRQL: f

STACK_TEXT:
fffff800`00ba8a98 fffff800`02c17a3b : 00000000`00000124 00000000`00000000 fffffa80`0770f028 00000000`be000000 : nt!KeBugCheckEx
fffff800`00ba8aa0 fffff800`02ddab33 : 00000000`00000001 fffffa80`07493c50 00000000`00000000 fffffa80`07493ca0 : hal!HalBugCheckSystem+0x1e3
fffff800`00ba8ae0 fffff800`02c17700 : 00000000`00000728 fffffa80`07493c50 fffff800`00ba8e70 fffff800`00ba8e00 : nt!WheaReportHwError+0x263
fffff800`00ba8b40 fffff800`02c17052 : fffffa80`07493c50 fffff800`00ba8e70 fffffa80`07493c50 00000000`00000000 : hal!HalpMcaReportError+0x4c
fffff800`00ba8c90 fffff800`02c16f0d : 00000000`00000004 00000000`00000001 fffff800`00ba8ef0 00000000`00000000 : hal!HalpMceHandler+0x9e
fffff800`00ba8cd0 fffff800`02c0ae88 : 00000000`00000020 00000000`03470d40 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0x55
fffff800`00ba8d00 fffff800`02cc956c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff800`00ba8d30 fffff800`02cc93d3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x6c
fffff800`00ba8e70 00000000`07bbd4ac : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x153
00000000`0018f1ec 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7bbd4ac

STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE

BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE

Followup: MachineOwner

writhziden · Jun 14, 2012

You have a 0x124 hardware bugcheck. If the system is still under warranty, I would recommend sending it in to have diagnostic tests done and any bad hardware replaced.

Warning

Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. :warn:WARNING: The steps that follow can void your warranty!!!

For your hardware stop 0x124 crash, read through http://www.sevenforums.com/crash-lockup-debug-how/35349-stop-0x124-what-means-what-try.html and use the following hardware checks to supplement that link.

If you are overclocking any hardware, please stop.
Monitor temperatures during the following tests.

Use the following programs to monitor the temperatures.
- Real Temp is a good CPU temperature monitor.
- Speccy - System Information - Free Download will monitor all hardware temperatures.
- HWiNFO, HWiNFO32 & HWiNFO64 - Hardware Information and Analysis Tools can be inaccurate for CPU temperatures, but is a good program for GPU temperature monitoring.
- Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Let it run until the GPU temperatures even out or until the GPU temperatures reach a dangerous level (you can find the max temperature for your card on either the nVidia or AMD sites; if you are not sure, ask us). The goal is to get a steady temperature, find out if the GPU is overheating, or to see if there are any artifacts present in the test itself: look for strange pixelated patterns on the screen or colors that do not look like they belong. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory. Let the memory test run for at least seven passes; the more the better.
- Run http://www.sevenforums.com/tutorials/100352-hardware-stress-test-prime95.html to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.
- Follow the steps for doing CPU stress test using IntelBurnTest
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
Once these steps have been followed, it is safe to remove and replace components within your computer.

Remember to read closely through http://www.sevenforums.com/crash-lockup-debug-how/35349-stop-0x124-what-means-what-try.html for the crash.

masterjsn · Jun 14, 2012

thanks for the reply.

AsRock Z68 Extreme3 Gen3
G.SKILL Ripjaws X Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1600 (PC3 12800)
SanDisk Extreme SDSSDX-120G-G25 2.5" 120GB SATA III Internal Solid State Drive (SSD)

This is a custom built computer with a core i5 2500k. So i cant return it. I am not overclocking. Im only using the cpu graphics, and onboard everything else. So is there a better program to bugcheck my system? I just used a program from ms (Microsoft Windows SDK for Windows 7 and .NET Framework 4). There were many im not sure if im using the right one. I have done memtest+ and no errors. What else can i do? Thanks in advance.

writhziden · Jun 15, 2012

Go through the steps I outlined above, including the link: http://www.sevenforums.com/crash-lockup-debug-how/35349-stop-0x124-what-means-what-try.html

If you still need help, please start your own thread (I just noticed you hijacked this one...) and follow the http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

WinDbg is what the BSOD Team uses to analyze .dmps. There is a how to section for reading them and analyzing them: Crash and lockup debug 'How To' - Windows 7 Forums

masterjsn · Jun 15, 2012

Solved minidump. I was reading the minidump report trying to find out what kept crashing my pc. It seemed to crash at any time what ever i was running, whether it was internet or music or games. Seemed very random. Well yesterday i updated my mobo bios and i have been running all day with no crash. I didnt think it was bios related because it was working fine before, and i have not updated any software. Well if you are wanting to read minidump files then this info may help you find the problem even if the minidump report does not help like it didnt help me, due to the randomness of the report.

writhziden · Jun 15, 2012

Sometimes when Windows is provided updates through Windows Updates, the BIOS needs to be updated to keep up so the hardware can still work with Windows. That may be what happened in your case. I am a little surprised to see that, but computers are a whole other animal sometimes. Glad one of the BIOS updates provided more stability.

Thanks for posting back.

When you are sure the problem is solved, let us know.

masterjsn · Jun 15, 2012

still going

Well before the bios update, my pc was crashing sometimes bsod and sometimes just locked up. It was doing it every 20-60 minutes. Sometimes 2 or 3 times an hour. Now i have been on it probably 18 hours, and not one crash. I was wondering if it was hardware, maybe even cpu. Cuz minidump report said hardware, but it didn't say the same thing over and over, So at least the minidump info did help eliminate some things. I really am surprised that a bios update worked for me. Wouldn't it be cool if windows actually made a file you could just read that tells the story instead of all this complicated crap?

writhziden · Jun 15, 2012

It would be cool, but it would be next to impossible. There are so many different hardware configurations available for users that Microsoft cannot predict what people will install in the system. Take into account that people throw some old hardware in from the XP era, too. Then there is the software that people install. No one system is ever the same.

Glad to see your system is a lot more stable.

WIndows 7 64bit - Minidump help?

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Closed by request.

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer