Hi,
I've been getting a few bsod's lately and can't figure out what's the cause.
they mostly happen just before the windows screen to load, but there are some cases when they happen during various windows operations (nothing specific).
I attached the dump file from the latest restart...
Thank you,
Cristi
Hi Cristi. Welcome to the forum. I will take a look.
The stop error code in this dump file is 3B, SYSTEM_SERVICE_EXCEPTION. the usual causes are System service, Device driver, graphics driver, ?memory.
I noticed the error c0000005 in the dump which indicates memory corruption. I find several drivers on your system that can cause memory corruption We will start with this one.Code:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082410-16785-01.zip\082410-16785-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*Symbol information Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50 Debug session time: Tue Aug 24 03:50:04.388 2010 (GMT-4) System Uptime: 0 days 0:53:35.980 Loading Kernel Symbols ............................................................... ................................................................ ............................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002dff0bf, fffff880072eebc0, 0} Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 ) Followup: Pool_corruption --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002dff0bf, Address of the exception record for the exception that caused the bugcheck Arg3: fffff880072eebc0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!ExDeferredFreePool+233 fffff800`02dff0bf 4c395008 cmp qword ptr [rax+8],r10 CONTEXT: fffff880072eebc0 -- (.cxr 0xfffff880072eebc0) rax=00000000000c4322 rbx=0000000000000001 rcx=fffffa800395c310 rdx=fffff8a00c0ba600 rsi=0000000000000000 rdi=fffff8a00a3edd80 rip=fffff80002dff0bf rsp=fffff880072ef590 rbp=0000000000000000 r8=fffff8a00852b9e0 r9=fffff8a00c0ba890 r10=fffff8a00c0ba8a0 r11=0000000000000001 r12=fffffa800395c140 r13=0000000000000000 r14=0000000000000006 r15=0000000000000001 iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 nt!ExDeferredFreePool+0x233: fffff800`02dff0bf 4c395008 cmp qword ptr [rax+8],r10 ds:002b:00000000`000c432a=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: SC2.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002dff0bf STACK_TEXT: fffff880`072ef590 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x233 FOLLOWUP_IP: nt!ExDeferredFreePool+233 fffff800`02dff0bf 4c395008 cmp qword ptr [rax+8],r10 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!ExDeferredFreePool+233 FOLLOWUP_NAME: Pool_corruption IMAGE_NAME: Pool_Corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: Pool_Corruption STACK_COMMAND: .cxr 0xfffff880072eebc0 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+233 BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+233 Followup: Pool_corruption ---------
ASACPI.sys Sun Mar 27 22:30:36 2005
I also find another commons BSOD cause.The 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).
Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - Downloads
You can use MagicDisc as an alternative.
Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview
I find other older drivers on your system that need updating. Win 7 does not like older drivers; they can and do cause memory corruption.
Update these drivers from the manufacturers' websites rather than using Windows Update or Device Manager.AsUpIO.sys Sun Jul 05 22:21:38 2009
RTKVHD64.sys Fri May 22 14:04:20 2009
Rtnic64.sys Mon Mar 31 01:39:38 2008
usbVM303.sys Sun Mar 25 00:26:25 2007
vvftav303.sys Sat Jun 23 01:46:10 2007
How To Find Drivers:Please let us know if you need help in finding these drivers.
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads
Last edited by CarlTR6; 25 Aug 2010 at 14:33.
I have edited my post with additional information. Please refresh your screen.
Here is some help with the drivers.
vvftav303.sys - Filter 303, Vimicro Corporation. I think this may be a VIMICRO USB PC Camera (ZC0301PLH) Driver. Try to update this driver. If you cannot update it, uninstall the the hardware and the software. It is very obsolete.
usbVM303.sys - see above.
Rtnic64.sys - Realtek Ethernet NIC driver Realtek. Update this driver
RTKVHD64.sys - Realtek High Definition Audio Function Driver Realtek. Update this driver.
AsUpIO.sys - I think this is part of Asus PCProbe Utility ASUSTeK Computer Inc.-Support- Update this driver or update the utility.
Let us know if you need help.
Last edited by CarlTR6; 25 Aug 2010 at 14:57.
thank you very much for you advices.
i will update all drivers mentioned and come back if the problem still persists.
Cristi.
ok , so i updated all except these 2 : vvftav303.sys + usbVM303.sys
i have a web camera but it is made by a4 tech (Welcome to www.A4Tech.com::Product).
how can i get rid of these 2 drivers (i guess i don't need them ?)
all went ok, no more bsods before windows screen so far.
now i was playing a sc2 game and i got another one, irq_not_less bla bla.
i attached the minidump, can you guys please take a look ?
Thank you,
Cristi
Using Windows Explore, navigate to c:\windows\system32\drivers. Find those two drivers and rename them from .sys to to .bak. Reboot. This way if anything breaks when you renmanr the drivers, you can reverse it by renaming them again.
I will take a look at the dumps.
You have a hardware problem. The first dump is error code A, IRQL_NOT_LESS_OR_EQUAL. The second dump is more telling. It is error code 124. Here is a link to read on error code 124 and what you need to do.
[2-Int] Stop 0x124 - what it means and what to try
Post back with any questions.
Code:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082910-19890-01.zip\082910-19890-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`02c5b000 PsLoadedModuleList = 0xfffff800`02e98e50 Debug session time: Sun Aug 29 06:08:16.771 2010 (GMT-4) System Uptime: 0 days 1:57:23.364 Loading Kernel Symbols ............................................................... ................................................................ .............................. Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {fffffa8007f7d728, 2, 1, fffff80002ccfe32} Probably caused by : ntkrnlmp.exe ( nt!KiTryUnwaitThread+182 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffffa8007f7d728, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002ccfe32, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f030e0 fffffa8007f7d728 CURRENT_IRQL: 2 FAULTING_IP: nt!KiTryUnwaitThread+182 fffff800`02ccfe32 48894108 mov qword ptr [rcx+8],rax CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: SC2.exe TRAP_FRAME: fffff880031225a0 -- (.trap 0xfffff880031225a0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa800410e100 rbx=0000000000000000 rcx=fffffa8007f7d720 rdx=fffffa8003a42168 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ccfe32 rsp=fffff88003122730 rbp=fffff880009e9180 r8=0000000000000000 r9=0000000000000000 r10=fffff880009e9180 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc nt!KiTryUnwaitThread+0x182: fffff800`02ccfe32 48894108 mov qword ptr [rcx+8],rax ds:3050:fffffa80`07f7d728=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002ccaca9 to fffff80002ccb740 STACK_TEXT: fffff880`03122458 fffff800`02ccaca9 : 00000000`0000000a fffffa80`07f7d728 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`03122460 fffff800`02cc9920 : 00000000`00000000 fffffa80`03a42060 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`031225a0 fffff800`02ccfe32 : fffffa80`03b192a0 fffff880`0478af79 fffffa80`04de3480 fffff800`02d7f9f4 : nt!KiPageFault+0x260 fffff880`03122730 fffff800`02cd53f1 : fffffa80`0502ec18 fffffa80`0502ec18 00000000`00000000 fffffa80`0502ec10 : nt!KiTryUnwaitThread+0x182 fffff880`03122790 fffff800`02cd6d7d : fffffa80`0502ec10 fffffa80`03fb8488 fffffa80`03fb8488 00000000`00000000 : nt!KiTimerWaitTest+0x2d1 fffff880`03122810 fffff800`02cd74be : 00000010`662c2737 fffff880`03122e88 00000000`0006e3a6 fffff880`009eca48 : nt!KiProcessExpiredTimerList+0x6d fffff880`03122e60 fffff800`02cd6cb7 : fffffa80`04f2acca fffffa80`0006e3a6 fffffa80`04f24000 00000000`000000a6 : nt!KiTimerExpiration+0x1be fffff880`03122f00 fffff800`02cd1865 : 180b111c`0d131e0d fffffa80`0445f060 00000000`00000000 fffff880`04763480 : nt!KiRetireDpcList+0x277 fffff880`03122fb0 fffff800`02cd167c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxRetireDpcList+0x5 fffff880`07ee9ba0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue STACK_COMMAND: kb FOLLOWUP_IP: nt!KiTryUnwaitThread+182 fffff800`02ccfe32 48894108 mov qword ptr [rcx+8],rax SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!KiTryUnwaitThread+182 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9 FAILURE_BUCKET_ID: X64_0xA_nt!KiTryUnwaitThread+182 BUCKET_ID: X64_0xA_nt!KiTryUnwaitThread+182 Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_082910-17768-01.zip\082910-17768-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`02c1e000 PsLoadedModuleList = 0xfffff800`02e5be50 Debug session time: Sun Aug 29 06:26:18.693 2010 (GMT-4) System Uptime: 0 days 0:00:08.144 Loading Kernel Symbols .................................................... Loading User Symbols Mini Kernel Dump does not contain unloaded driver list ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 124, {0, fffffa8004bca748, 0, 0} Probably caused by : hardware Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* WHEA_UNCORRECTABLE_ERROR (124) A fatal hardware error has occurred. Parameter 1 identifies the type of error source that reported the error. Parameter 2 holds the address of the WHEA_ERROR_RECORD structure that describes the error conditon. Arguments: Arg1: 0000000000000000, Machine Check Exception Arg2: fffffa8004bca748, Address of the WHEA_ERROR_RECORD structure. Arg3: 0000000000000000, High order 32-bits of the MCi_STATUS value. Arg4: 0000000000000000, Low order 32-bits of the MCi_STATUS value. Debugging Details: ------------------ BUGCHECK_STR: 0x124_GenuineIntel CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 STACK_TEXT: fffff880`02fe06b0 fffff800`02ed8a89 : fffffa80`04bca720 fffffa80`039feb60 00000000`0000000c 00000000`00000001 : nt!WheapCreateLiveTriageDump+0x6c fffff880`02fe0bd0 fffff800`02dba667 : fffffa80`04bca720 fffff800`02e335f8 fffffa80`039feb60 00000002`00000005 : nt!WheapCreateTriageDumpFromPreviousSession+0x49 fffff880`02fe0c00 fffff800`02d22c45 : fffff800`02e95360 fffffa80`04bb94f8 fffffa80`04bb94f0 fffffa80`039feb60 : nt!WheapProcessWorkQueueItem+0x57 fffff880`02fe0c40 fffff800`02c9b961 : fffff880`00c30e00 fffff800`02d22c20 fffffa80`039feb60 00000000`00000000 : nt!WheapWorkQueueWorkerRoutine+0x25 fffff880`02fe0c70 fffff800`02f32c06 : 00000000`00000000 fffffa80`039feb60 00000000`00000080 fffffa80`039e8b30 : nt!ExpWorkerThread+0x111 fffff880`02fe0d00 fffff800`02c6cc26 : fffff880`009e9180 fffffa80`039feb60 fffff880`009f3f40 000007fe`fbe489a0 : nt!PspSystemThreadStartup+0x5a fffff880`02fe0d40 00000000`00000000 : fffff880`02fe1000 fffff880`02fdb000 fffff880`02fe09b0 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_NAME: MachineOwner MODULE_NAME: hardware IMAGE_NAME: hardware DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_BUS_PRV BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_BUS_PRV Followup: MachineOwner ---------
Quote
(