BSOD ntoskrnl

ruchijain · 11 Aug 2010

Hi Jonathan/Carl,

Please can you help me in updating the RAID controllers. I have uploaded the msinfo above. I have disabled the verifiers and updated the Realtek drivers from the link you provided.

It is still crashing. I am uploading the recent dump.
Thanks,

ruchijain · 11 Aug 2010

latest dump

CarlTR6 · 11 Aug 2010

There are two dumps:

BugCheck 50 - Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

BugCheck 1E - Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_latest dump.zip\081110-21278-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c1c000 PsLoadedModuleList = 0xfffff800`02e59e50
Debug session time: Wed Aug 11 16:58:48.726 2010 (GMT-4)
System Uptime: 0 days 0:03:37.894
Loading Kernel Symbols
...............................................................
................................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffe80002e08624, 0, fffff80002c4b95b, 7}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ExQueryPoolUsage+e0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffe80002e08624, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002c4b95b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

OVERLAPPED_MODULE: Address regions for 'WudfPf' and 'WUDFRd.sys' overlap

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec40e0
 ffffe80002e08624 

FAULTING_IP: 
nt!ExQueryPoolUsage+e0
fffff800`02c4b95b 8379e400        cmp     dword ptr [rcx-1Ch],0

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880080126a0 -- (.trap 0xfffff880080126a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000236b rbx=0000000000000000 rcx=ffffe80002e08640
rdx=fffff8800801297c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c4b95b rsp=fffff88008012830 rbp=fffff88008012ca0
 r8=fffff88008012978  r9=fffff80002e31720 r10=0000000000000005
r11=fffff8800801295c r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!ExQueryPoolUsage+0xe0:
fffff800`02c4b95b 8379e400        cmp     dword ptr [rcx-1Ch],0 ds:ffffe800`02e08624=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d0b849 to fffff80002c8c740

STACK_TEXT:  
fffff880`08012538 fffff800`02d0b849 : 00000000`00000050 ffffe800`02e08624 00000000`00000000 fffff880`080126a0 : nt!KeBugCheckEx
fffff880`08012540 fffff800`02c8a82e : 00000000`00000000 00000000`00000000 ffffffff`ffffff00 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x40e0b
fffff880`080126a0 fffff800`02c4b95b : 00000000`0139f590 fffff800`02f897ab 00000000`00000000 00000000`00025216 : nt!KiPageFault+0x16e
fffff880`08012830 fffff800`02f897ab : 00000000`00000000 00000000`00025216 00000000`00025216 00000000`00000000 : nt!ExQueryPoolUsage+0xe0
fffff880`08012840 fffff800`02f8b1e5 : 00000000`0139f590 fffffa80`0641d410 00000000`0139f9b8 00000000`0000ffff : nt!ExpQuerySystemInformation+0x5a9
fffff880`08012be0 fffff800`02c8b993 : fffffa80`0660db60 fffffa80`06535740 fffff880`08012ca0 00000000`03f75410 : nt!NtQuerySystemInformation+0x4d
fffff880`08012c20 00000000`777e00ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0139f538 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777e00ba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExQueryPoolUsage+e0
fffff800`02c4b95b 8379e400        cmp     dword ptr [rcx-1Ch],0

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ExQueryPoolUsage+e0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x50_nt!ExQueryPoolUsage+e0

BUCKET_ID:  X64_0x50_nt!ExQueryPoolUsage+e0

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_latest dump.zip\081110-24507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Wed Aug 11 16:54:25.776 2010 (GMT-4)
System Uptime: 0 days 16:12:36.943
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+58ee952f00d1d928
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800371b3a8 -- (.exr 0xfffff8800371b3a8)
ExceptionAddress: fffff80002cd8d82 (nt!KiProcessExpiredTimerList+0x0000000000000072)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800371b450 -- (.trap 0xfffff8800371b450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0400000000000000 rbx=0000000000000000 rcx=fffffa8007b245f0
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cd8d82 rsp=fffff8800371b5e0 rbp=0000000000391485
 r8=fffff880009ea301  r9=0000000000000002 r10=0000000000000085
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KiProcessExpiredTimerList+0x72:
fffff800`02cd8d82 803818          cmp     byte ptr [rax],18h ds:04000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc546e to fffff80002ccd710

STACK_TEXT:  
fffff880`0371a498 fffff800`02cc546e : 00000000`00000001 fffffa80`06358020 fffff880`0371ac10 fffff800`02cfa668 : nt!KeBugCheck
fffff880`0371a4a0 fffff800`02cf340d : fffff800`02edbb7c fffff800`02e15e84 fffff800`02c5d000 fffff880`0371b3a8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`0371a4d0 fffff800`02cfaa90 : fffff800`02e1cb14 fffff880`0371a548 fffff880`0371b3a8 fffff800`02c5d000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0371a500 fffff800`02d079ef : fffff880`0371b3a8 fffff880`0371ac10 fffff880`00000000 fffff880`0371b608 : nt!RtlDispatchException+0x410
fffff880`0371abe0 fffff800`02cccd82 : fffff880`0371b3a8 fffffa80`07b24610 fffff880`0371b450 00000000`00000002 : nt!KiDispatchException+0x16f
fffff880`0371b270 fffff800`02ccb68a : 00000000`00391462 00000000`00000000 00000000`c1c00000 fffffa80`061be1b0 : nt!KiExceptionDispatch+0xc2
fffff880`0371b450 fffff800`02cd8d82 : fffffa80`07b24610 fffffa80`041573e0 fffffa80`041573e0 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a
fffff880`0371b5e0 fffff800`02cd94be : 00000087`df72f5eb fffff880`0371bc58 00000000`00391485 fffff880`009eb628 : nt!KiProcessExpiredTimerList+0x72
fffff880`0371bc30 fffff800`02cd8cb7 : 000000c4`0c0691c1 000000c4`00391485 000000c4`0c0691f3 00000000`00000085 : nt!KiTimerExpiration+0x1be
fffff880`0371bcd0 fffff800`02cd5eea : fffff880`009e8180 fffff880`009f2f40 00000000`00000000 fffff880`01d08c50 : nt!KiRetireDpcList+0x277
fffff880`0371bd80 00000000`00000000 : fffff880`0371c000 fffff880`03716000 fffff880`0371bd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02cc546e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------

The first dump doesn't tell us much and points to a Microsoft core system driver which in all probability is not the cause.

The second dump implies a memory problem: 0000005 (Access violation).

I think, at least. part of the problem is obsolete drivers. I see that some drivers have been updated; but you have more to do.

Code:

adfs.SYS      Thu Jun 26 16:52:37 2008
adp94xx.sys   Fri Dec 05 18:54:42 2008
adpahci.sys   Tue May 01 13:30:09 2007
adpu320.sys   Tue Feb 27 19:04:15 2007
arc.sys       Thu May 24 17:27:55 2007
arcsas.sys    Wed Jan 14 14:27:37 2009
AtiPcie.sys   Tue May 05 11:00:22 2009
ATSwpWDF.sys  Wed May 13 16:48:02 2009
elxstor.sys   Tue Feb 03 17:52:11 2009
enecir.sys    Wed May 20 02:08:57 2009
HpqKbFiltr.sys  Wed Apr 29 09:48:30 2009
HpSAMD.sys    Mon May 18 19:43:49 2009
iirsp.sys    Tue Dec 13 16:47:54 2005
lsi_fc.sys   Tue Dec 09 17:46:09 2008
lsi_sas.sys    Mon May 18 20:20:23 2009
lsi_sas.sys    Mon May 18 20:20:23 2009
lsi_sas2.sys   Mon May 18 20:31:48 2009
lsi_scsi.sys   Thu Apr 16 18:13:50 2009
mcdbus.sys   Tue Feb 24 05:34:07 2009
megasas.sys    Mon May 18 21:09:46 2009
MegaSR.sys     Mon May 18 21:25:54 2009
nfrd960.sys   Tue Jun 06 17:11:48 2006
nvraid.sys    Wed May 20 02:39:40 2009
nvstor.sys    Wed May 20 02:45:37 2009
ql2300.sys   Thu Jan 22 18:05:06 2009
ql40xx.sys   Mon May 18 21:18:11 2009
RTKVHD64.sys Fri May 22 14:04:20 2009
SiSRaid2.sys Wed Sep 24 14:28:20 2008 
sisraid4.sys Wed Oct 01 17:56:04 2008
 smserial.sys Tue May 05 08:20:31 2009
stexstor.sys Tue Feb 17 18:03:36 2009
usbfilter.sys Mon Mar 09 07:49:01 2009
vsmraid.sys  Fri Jan 30 20:18:57 2009

I will try to help you with some of these drivers.

adfs.SYS - Adobe Drive File System Driver is a driver file from company Adobe Systems, Inc. belonging to product Adobe Drive.

adp94xx.sys - Adaptec Windows SAS/SATA Storport Driver.

adpahci.sys - Adaptec Windows SATA Storport Driver

adpu320.sys - Adaptec .NET Ultra320 Driver, Adaptec, Inc

arc.sys - Adaptec RAID Storport Driver

iirsp.sys - Intel Raid StorPort Driver, Intel Corporation

lsi_fc.sys - LSI Logic Fusion-MPT FC Driver (StorPort) Support and Downloads

nfrd960.sys - IBM ServeRAID Controller Driver IBM Support & downloads - United States

nvraid.sys - NVIDIA® nForce(TM) RAID Driver belongs to the software NVIDIA nForce(tm) RAID Class Driver or NVIDIA NForce(tm) ATA RAID Class Driver by NVIDIA Corporation (www.nvidia.com).

nvstor.sys - apparently a SATA controller driver, Drivers - Download NVIDIA Drivers

Sisraid2.sys - SiS RAID Stor Miniport Driver is a driver file from company Silicon Integrated Systems Corp.

Sisraid4.sys with description SiS AHCI Stor-Miniport Driver is a driver file from company Silicon Integrated Systems

vsmraid.sys - VIA RAID DRIVER FOR AMD-X86-64, VIA Technologies, Inc.

I am going to ask for some help with this. If you are not running a RAID array, we can simply eliminate a lot of these drivers.

ruchijain · 11 Aug 2010

Hi carl ,

Thanks a lot , the crash has decreased a lot after yesterday once I upgraded Realtek drivers. previously it was 4 - 5 times now it was once .

Thanks a lot Carls , yesterday you told that there was some obsolete drivers and problems with Raid. Do you know how I can update the same.

Thanks, a lot for stepping in.

CarlTR6 · 11 Aug 2010

You are very welcome; but I didn't really step in. We work as a team here and help each other out - which, of course, helps the poster. And that is our objective - to help the poster resolve his/her problem.

I have asked for help with the RAID as I am not sure and I don't want to steer you wrong. I edited my post above and listed some of the drivers and their sources. You may have to refresh the page to see what I added. It may be tomorrow before my request for help is answered as it is late here in the Eastern time zone of the US. So be patient and we will get the information you need. :)

I am glad your crashes have decreased. The Realtek driver is a key driver. Good job on updating it. We are slowly getting there.

Jonathan_King · 12 Aug 2010

Try installing the latest nForce drivers here: Drivers - Download NVIDIA Drivers

CarlTR6 · 12 Aug 2010

Thank you, Jonathan.

ruchijain, using the links I posted above, try to update your RAID drivers. If you need help with this, please post.

ruchijain · 12 Aug 2010

Hi Jonathan ,

Could you help me out in identifying what kind of nVidia RAID driver that I have installed . I have uploaded the msinfo on a previous post.

Thanks,
Ruchi

Jonathan_King · 12 Aug 2010

Well I must say since the time I posted that (in part because of that), I have discovered that those nVidia drivers do not need an update. You can disregard that advice now.

CarlTR6 · 12 Aug 2010

Jonathan_King said:

Well I must say since the time I posted that (in part because of that), I have discovered that those nVidia drivers do not need an update. You can disregard that advice now.

Thank you for posting this, Jonathan. I learned, too.

BSOD ntoskrnl

Latest Dumps