pretty new machine BSOD


  1. reggiet
    Posts : 1
    Windows 7 64-bit Professional
       New #1

    pretty new machine BSOD


    Hey all,

    First post here -- getting a BSOD on a newly imaged Win 7 64-bit box. .dmp file is HUGE (>500MB)...I tried to analyze it, but still a newbie and confused.

    kd log posted below:

    ===
    C:\dbg>kd -y SRV*c:\symbols*http://msdl.microsoft
    com/downloads/symbols -z C:\windows\MEMORY.DMP

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\windows\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbo
    s
    Executable search path is:
    Page bc40000 too large to be in the dump file.
    Windows 7 Kernel Version 7600 MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
    Debug session time: Thu Aug 12 10:56:59.809 2010 (UTC - 5:00)
    System Uptime: 0 days 19:57:52.038
    Page bc40000 too large to be in the dump file.
    Loading Kernel Symbols
    Page bc40000 too large to be in the dump file.
    Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40000 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc40001 too large to be in the dump file.
    .Page bc4029d too large to be in the dump file.
    .Missing image name, possible paged-out or corrupt data.
    .Unable to read KLDR_DATA_TABLE_ENTRY at 2ea9d85a`bb65a3d4 - NTSTATUS 0xC000014


    Image path too long, possible corrupt data.
    Loading unloaded module list
    .Image path too long, possible corrupt data.
    ..Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    ..Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    ..Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .Image path too long, possible corrupt data.
    .
    WARNING: .reload failed, module list may be incomplete
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck A, {0, 2, 0, fffff80002c8a8b6}

    Probably caused by : Unknown_Image ( nt!KeSetEvent+226 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    ===

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only
    on chips which support this level of status)
    Arg4: fffff80002c8a8b6, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 0000000000000000

    CURRENT_IRQL: 0

    FAULTING_IP:
    nt!KeSetEvent+226
    fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 0000000000000000 to 000007fefcdd10f4

    STACK_TEXT:
    00000000`017cebe0 00000000`00000000 : 00000000`00000000 00000000`00000000 000000
    00`00000000 00000000`00000000 : 0x7fe`fcdd10f4


    STACK_COMMAND: .bugcheck ; kb

    FOLLOWUP_IP:
    nt!KeSetEvent+226
    fffff800`02c8a8b6 488b09 mov rcx,qword ptr [rcx]

    SYMBOL_NAME: nt!KeSetEvent+226

    FOLLOWUP_NAME: MachineOwner

    IMAGE_NAME: Unknown_Image

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    BUCKET_ID: INVALID_KERNEL_CONTEXT

    MODULE_NAME: Unknown_Module

    Followup: MachineOwner

    ===

    Memory/CPU maybe? Or maybe my dump is bad?

    Thanks for any ideas!
      My Computer
    Quote Quote

  3. zigzag3143
    Posts : 28,845
    Win 8 Release candidate 8400
       New #2

    reggiet said:
    Hey all,

    First post here -- getting a BSOD on a newly imaged Win 7 64-bit box. .dmp file is HUGE (>500MB)...I tried to analyze it, but still a newbie and confused.

    kd log posted below:


    Code:
    ===
C:\dbg>kd -y SRV*c:\symbols*http://msdl.microsoft
com/downloads/symbols -z C:\windows\MEMORY.DMP

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/downloads/symbo
s
Executable search path is:
Page bc40000 too large to be in the dump file.
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50
Debug session time: Thu Aug 12 10:56:59.809 2010 (UTC - 5:00)
System Uptime: 0 days 19:57:52.038
Page bc40000 too large to be in the dump file.
Loading Kernel Symbols
Page bc40000 too large to be in the dump file.
Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40000 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc40001 too large to be in the dump file.
.Page bc4029d too large to be in the dump file.
.Missing image name, possible paged-out or corrupt data.
.Unable to read KLDR_DATA_TABLE_ENTRY at 2ea9d85a`bb65a3d4 - NTSTATUS 0xC000014


Image path too long, possible corrupt data.
Loading unloaded module list
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
..Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.Image path too long, possible corrupt data.
.
WARNING: .reload failed, module list may be incomplete
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c8a8b6}

Probably caused by : Unknown_Image ( nt!KeSetEvent+226 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

===

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
        bit 0 : value 0 = read operation, 1 = write operation
        bit 3 : value 0 = not an execute operation, 1 = execute operation (only
on chips which support this level of status)
Arg4: fffff80002c8a8b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000000000000

CURRENT_IRQL:  0

FAULTING_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09          mov     rcx,qword ptr [rcx]

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 000007fefcdd10f4

STACK_TEXT:
00000000`017cebe0 00000000`00000000 : 00000000`00000000 00000000`00000000 000000
00`00000000 00000000`00000000 : 0x7fe`fcdd10f4


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
nt!KeSetEvent+226
fffff800`02c8a8b6 488b09          mov     rcx,qword ptr [rcx]

SYMBOL_NAME:  nt!KeSetEvent+226

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  INVALID_KERNEL_CONTEXT

MODULE_NAME: Unknown_Module

Followup: MachineOwner

===
    Memory/CPU maybe? Or maybe my dump is bad?

    Thanks for any ideas!
    First you should look for the "minidump" in c:\windows\minidump.

    You can also search for *.DMP

    You shoul also check the system control panel to insure it is configured for "kernel dump" (see attache screenshot)

    Let us know if you need more help

    Ken
    Last edited by zigzag3143; 26 Jan 2011 at 03:54.
      My Computer
    Quote Quote

  4. CarlTR6
    Posts : 11,990
    Windows 7 Ultimate 32 bit
       New #3

    Stop error C2 - Usual causes: Device driver, ?Memory

    Your latest dump shows Symantec/Norton still installed and the drivers are obsolete. If you have not unistalled it completely, do so using this tool>Info > Tool

    The dump file does not point to a specific cause. Try updating these drivers:
    AtiPcie.sys Tue May 05 11:00:22 2009
    ccHPx64.sys Fri Jun 19 19:28:39 2009
    gdrv.sys Thu Mar 12 23:22:29 2009
    mcdbus.sys Tue Feb 24 05:34:07 2009
    PxHlpa64.sys Tue Jun 23 19:16:35 2009
    SRTSPX64.SYS Mon Jun 22 22:47:54 2009
    SYMEFA64.SYS Tue Jun 23 17:52:39 2009
    SYMEVENT64x86.SYS Wed Jun 24 16:19:12 2009
    SYMFW.SYS Mon Jul 06 20:29:22 2009
    SymIMv.sys Mon Jun 22 19:11:56 2009
    SYMNDISV.SYS Mon Jul 06 20:33:26 2009
    SYMTDI.SYS Mon Jul 06 20:28:48 2009
    Outdated drivers can and do cause crashes. If you need help updating these drivers, please post.
    - search Google for the name of the driver
    - compare the Google results with what's installed on your system to figure out which device/program it belongs to
    - visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
    - if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
    - - The most common drivers are listed on this page: Driver Reference
    - - Driver manufacturer links are on this page: Drivers and Downloads

    Once you have updated these drivers, run your system and let's see what happens. If you get another BSOD, please upload it.
      My Computer
    Quote Quote

 

  Related Discussions
BSOD from pretty much anything
in BSOD Help and Support

Hello people of the internet. I've been having some major trouble with my PC and I'm really at a loss now. Please note that I'm using a Swedish OS so if I'm using some unfamiliar terms it's probably because of trouble with the translation. The bluescreens started started about a month ago...
Hello all, first time builder here. been getting random Crashes during anything from casual gaming, web browsing and even just idle.. About 2 a day, i also went a day without. i thought i had licked it , nope :mad: .. all the driver's (to my knowledge) and mb Bios are/is up to date, I've attached...
BSOD pretty random
in BSOD Help and Support

Figured id just attach the .zip that the program makes that gives all the information needed
BSOD pretty sure due to driver
in BSOD Help and Support

I have run a driver verifier on Win 7 and the startup repair failed to repair it but has found bad driver/s. The dump file is attached. Can anyone read this for me to tell me which driver is bad? Thanks
BSOD'ing pretty randomly
in BSOD Help and Support

This has been going on for a few weeks. I'm sure it's a driver issue but the problem is that I'm not really sure which driver it is. If anybody could help it'd be really appreciated. Running Windows 7 Home Premium 64bit, retail version. I've had this computer for only about two months. My...
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

 © Designer Media Ltd
All times are GMT -5. The time now is 15:43.
Find Us