New
#1
BSOD, please help
I'm getting a BSOD. Help is very much appreciated. Thanks in advance.
- x64
- originally XP on system
- Full retail
- Age of system 3-4 years old
- Age of OS installation around 3 months
I'm getting a BSOD. Help is very much appreciated. Thanks in advance.
- x64
- originally XP on system
- Full retail
- Age of system 3-4 years old
- Age of OS installation around 3 months
All of these either directly or indirectly point to memory corruption. I suspect it was caused by these two drivers
ASACPI.sys Sun Mar 27 22:30:36 2005
Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use a driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - DownloadsThe 2005 version of this driver is a known BSOD cause.
Please visit this link: ASUSTeK Computer Inc.-Support- download_item_mkt
Scroll down to the Utilities category, then scroll down to the "ATK0110 driver for WindowsXP/Vista/Windows 7 32&64-bit " (it's about the 8th item down).
Download and install it.
Go to C:\Windows\System32\drivers to check and make sure that the ASACPI.sys file is date stamped from 2009 or 2010 (NOT 2005).
[/quote]
You can use MagicDisc as an alternative.
Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview
Suspect drivers
AnalysisCode:ACPI.sys fffff880`0102f000 fffff880`01086000 0x00057000 0x4a5bc106 7/13/2009 19:19:34 sptd.sys fffff880`010b6000 fffff880`011dc000 0x00126000 0x4ad24632 10/11/2009 16:55:14
Code:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\072910-18673-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available WARNING: Whitespace at end of path element Symbol search path is: SRV*C:\symbols;*http://msdl.microsoft.com/download/symbols ;srv*e:\symbols *http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`02c4f000 PsLoadedModuleList = 0xfffff800`02e8ce50 Debug session time: Thu Jul 29 19:15:58.196 2010 (GMT-4) System Uptime: 0 days 3:35:54.038 Loading Kernel Symbols ............................................................... ................................................................ ............................... Loading User Symbols Loading unloaded module list .......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff80002fbb463, 0, 11} Probably caused by : memory_corruption ( nt!MmCreateSection+3b7 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80002fbb463, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000011, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!MmCreateSection+3b7 fffff800`02fbb463 488b4010 mov rax,qword ptr [rax+10h] EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000011 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef70e0 0000000000000011 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x1E PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 EXCEPTION_RECORD: fffff88007d2d158 -- (.exr 0xfffff88007d2d158) ExceptionAddress: fffff80002fbb463 (nt!MmCreateSection+0x00000000000003b7) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000011 Attempt to read from address 0000000000000011 TRAP_FRAME: fffff88007d2d200 -- (.trap 0xfffff88007d2d200) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000038 rdx=0000000000000088 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002fbb463 rsp=fffff88007d2d390 rbp=0000000001000000 r8=0000000000000208 r9=fffff88007d2d178 r10=fffffa8003320700 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!MmCreateSection+0x3b7: fffff800`02fbb463 488b4010 mov rax,qword ptr [rax+10h] ds:00000000`00000011=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002cf9929 to fffff80002cbf600 STACK_TEXT: fffff880`07d2c988 fffff800`02cf9929 : 00000000`0000001e ffffffff`c0000005 fffff800`02fbb463 00000000`00000000 : nt!KeBugCheckEx fffff880`07d2c990 fffff800`02cbec42 : fffff880`07d2d158 00000000`0000000c fffff880`07d2d200 00000000`00000000 : nt!KiDispatchException+0x1b9 fffff880`07d2d020 fffff800`02cbd7ba : 00000000`00000000 00000000`0000000c 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2 fffff880`07d2d200 fffff800`02fbb463 : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a fffff880`07d2d390 fffff800`02fb0b83 : fffff880`07d2d5f0 00000000`00000000 fffff880`07d2d698 fffffa80`03c65628 : nt!MmCreateSection+0x3b7 fffff880`07d2d5a0 fffff800`0311d0e3 : 00000000`00000000 fffff8a0`036029f0 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x162 fffff880`07d2d620 fffff800`0311d671 : 00000000`00000000 fffff8a0`036029f0 fffffa80`056f78c0 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163 fffff880`07d2d710 fffff800`0312578e : fffff8a0`00000000 fffff8a0`0000002e fffff8a0`000000dc 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x121 fffff880`07d2d810 fffff800`03126327 : 00000000`00000000 fffff880`07d2dca0 fffff880`07d2da08 fffff8a0`00f21060 : nt!PfpPrefetchRequestPerform+0x30e fffff880`07d2d960 fffff800`031328fe : fffff880`07d2da08 fffff880`07d2da01 fffffa80`0550afe0 00000000`00000000 : nt!PfpPrefetchRequest+0x176 fffff880`07d2d9d0 fffff800`0313702e : 00000000`00000000 00000000`02d7f890 00000000`0000004f 00000000`0a858001 : nt!PfSetSuperfetchInformation+0x1ad fffff880`07d2dab0 fffff800`02cbe853 : fffffa80`05696060 00000000`00000000 fffffa80`03650c01 00000000`0a13bbf0 : nt!NtSetSystemInformation+0xb91 fffff880`07d2dc20 00000000`776d15aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`02d7f868 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776d15aa STACK_COMMAND: kb FOLLOWUP_IP: nt!MmCreateSection+3b7 fffff800`02fbb463 488b4010 mov rax,qword ptr [rax+10h] SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: nt!MmCreateSection+3b7 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0x1E_nt!MmCreateSection+3b7 BUCKET_ID: X64_0x1E_nt!MmCreateSection+3b7 Followup: MachineOwner ---------