Windows 7 - Dump Analysis please

severedsolo · 03-12-2010

2 BSOD's 2 different screens, and some random hangs and crashes, can someone take a look and give me a clue please?

Jonathan_King · 03-12-2010

I wonder if this is caused by bad RAM.

Quote:

Cause This bug check results from a serious error in a driver or other system file. The file header checksum does not match the expected checksum.
This can also be caused by faulty hardware in the I/O path to the file (a disk error, faulty RAM, or a corrupted page file).

Source: BSOD Index

I suggest downloading a copy of Memtest86 and burning the ISO to a CD using ImgBurn. Boot from the CD, and run at least 5 passes.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Jonathan\Desktop\031210-68843-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02804000 PsLoadedModuleList = 0xfffff800`02a41e50
Debug session time: Fri Mar 12 14:34:53.374 2010 (GMT-5)
System Uptime: 0 days 0:00:11.481
Loading Kernel Symbols
...................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C0000221, {fffff8a0001efd00, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: fffff8a0001efd00
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc0000221

ERROR_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_PARAMETER1:  fffff8a0001efd00

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_PARAMETER3:  0000000000000000

EXCEPTION_PARAMETER4: 0

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ac209f to fffff80002875f00

STACK_TEXT:  
fffff880`009a91e8 fffff800`02ac209f : 00000000`0000004c 00000000`c0000221 fffff880`009a9288 fffffa80`034f3c10 : nt!KeBugCheckEx
fffff880`009a91f0 fffff800`028c2544 : 7ff00000`00000000 00000000`00000000 00000000`00000000 fffff700`01080000 : nt!ExpSystemErrorHandler2+0x5ff
fffff880`009a9420 fffff800`02ca54b1 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`00320000 : nt!ExpSystemErrorHandler+0xd4
fffff880`009a9460 fffff800`02ca58b6 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`00320000 : nt!ExpRaiseHardError+0xe1
fffff880`009a9790 fffff800`02ca6d66 : 00000000`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9988 : nt!ExRaiseHardError+0x1d6
fffff880`009a9890 fffff800`02cb9f6f : 00000000`c0000221 00000000`08000000 fffff800`02d40828 ffffffff`8000008c : nt!NtRaiseHardError+0x1e4
fffff880`009a9930 fffff800`02cba2c9 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`02d709f0 : nt!PspLocateSystemDll+0xbf
fffff880`009a9a00 fffff800`02da397d : fffff800`008127a0 00000000`00000002 00000000`00000000 fffff800`029eee80 : nt!PsLocateSystemDlls+0x69
fffff880`009a9a40 fffff800`02da6b20 : 00000000`00000000 00000000`00000010 ffffffff`80000028 fffff800`008127a0 : nt!IoInitSystem+0x85d
fffff880`009a9b40 fffff800`02cf7419 : 00081711`00000000 fffffa80`021f5260 00000000`00000080 fffffa80`021f5740 : nt!Phase1InitializationDiscard+0x1290
fffff880`009a9d10 fffff800`02b19166 : 000a340a`00040a01 00000000`00000080 000c1c01`30021206 fffff800`02854479 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`02854486 : fffff800`029eee80 fffffa80`021f5260 fffff800`029fcc40 00081a11`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExpSystemErrorHandler2+5ff
fffff800`02ac209f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExpSystemErrorHandler2+5ff

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

Followup: MachineOwner
---------

severedsolo · 03-12-2010

thanks i will do that, iv been suspecting my ram has been dodgy for a while,

question, will using mismatched RAM (not the same brand but timings are the same) cause this?

Jonathan_King · 03-12-2010

If you have a dual-channel motherboard, yes.

severedsolo · 03-12-2010

hmm.. nope its single channel, maybe the ram i bought was dodgy, ill run memtest overnight see what happens, cheers

severedsolo · 03-13-2010

Memtest came back as clean, i guess that just leaves a dying hard drive?

bearing in mind at least one BSOD came up with a corrupted nfts.sys and after reboot it checked for consistancy on 2 of my partitions and fixed a couple of errors does this seem a logical conclusion?

Jonathan_King · 03-13-2010

It could be a hard drive issue; download the appropriate software from here and run a scan.

severedsolo · 04-17-2010

sorry for resurrecting this... but i have finally got to the bottom of it, it was Zone Alarm F***ing with the file system, since ZA has been gone, not one BSOD

Jonathan_King · 04-17-2010

ZoneAlarm...Why am I not surprised?

Glad you got it figured out.

Windows 7 - Dump Analysis please

Dump Analysis please problems?