another crash, this time no bsod.
removed eset
installed essentials
according to Intel, using their update utility,drivers are up to date Intel® Driver Update Utility
scannow found no errors
I have run memtest86 a few time, no errors found there
anything else I can do to , Ill try anything, these are getting annoying & I'm getting worried about them harming the hardware
again thanks for your help
Hi,
Your dmp bugcheck SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e), usual caused by driver.
Enable driver verifier and wait until your windows get BSOD, then attach new file here.
Driver Verifier - Enable and Disable
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff80002fc191c, fffff880031cb988, fffff880031cb1f0} Probably caused by : ntkrnlmp.exe ( nt!CmpRemoveKeyHash+4c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80002fc191c, The address that the exception occurred at Arg3: fffff880031cb988, Exception Record Address Arg4: fffff880031cb1f0, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: nt!CmpRemoveKeyHash+4c fffff800`02fc191c 488b01 mov rax,qword ptr [rcx] EXCEPTION_RECORD: fffff880031cb988 -- (.exr 0xfffff880031cb988) ExceptionAddress: fffff80002fc191c (nt!CmpRemoveKeyHash+0x000000000000004c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880031cb1f0 -- (.cxr 0xfffff880031cb1f0) rax=ffff00a00ed78708 rbx=fffff8a00e3deb98 rcx=ffff00a00ed78710 rdx=00000000000003a2 rsi=0000000000000004 rdi=fffff880031cbc00 rip=fffff80002fc191c rsp=fffff880031cbbc8 rbp=fffff880031cbc8c r8=000000007735940e r9=000000003b94c536 r10=fffff8a00ea08008 r11=fffff8a00e3deba8 r12=0000000000000003 r13=0000000000000003 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 nt!CmpRemoveKeyHash+0x4c: fffff800`02fc191c 488b01 mov rax,qword ptr [rcx] ds:002b:ffff00a0`0ed78710=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0 ffffffffffffffff FOLLOWUP_IP: nt!CmpRemoveKeyHash+4c fffff800`02fc191c 488b01 mov rax,qword ptr [rcx] BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff80002fc1ae6 to fffff80002fc191c STACK_TEXT: fffff880`031cbbc8 fffff800`02fc1ae6 : fffff8a0`0e3deb98 fffff880`031cbc8c 00000000`00000004 00000000`00000246 : nt!CmpRemoveKeyHash+0x4c fffff880`031cbbd0 fffff800`02f25aee : fffff8a0`0e3deb98 fffff880`031cbc74 00000000`00000004 00000000`00000002 : nt!CmpCleanUpKcbCacheWithLock+0x52 fffff880`031cbc00 fffff800`02cda961 : fffff800`02f257b4 fffff800`02e725f8 fffffa80`0551ab60 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a fffff880`031cbcb0 fffff800`02f71c06 : 00000000`00000000 fffffa80`0551ab60 00000000`00000080 fffffa80`0548b840 : nt!ExpWorkerThread+0x111 fffff880`031cbd40 fffff800`02cabc26 : fffff880`02fd3180 fffffa80`0551ab60 fffff880`02fddfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`031cbd80 00000000`00000000 : fffff880`031cc000 fffff880`031c6000 fffff880`031cadc0 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!CmpRemoveKeyHash+4c FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9 STACK_COMMAND: .cxr 0xfffff880031cb1f0 ; kb FAILURE_BUCKET_ID: X64_0x7E_nt!CmpRemoveKeyHash+4c BUCKET_ID: X64_0x7E_nt!CmpRemoveKeyHash+4c Followup: MachineOwner ---------
Hi,
thanks for your help.
I've enabled the Enable driver verifier as you asked but with dzs of crashes I've only seen the bsod once.
Not too sure this will work :/
And of course we just had a bsod (2nd one)
Last edited by thetruenorth; 12 Dec 2010 at 10:42.
Hi,
Driver verifier find violation on KernExplorer64.sys.
It is part of Lavasoft Ad-Aware Antivirus so you must uninstall it completely.
Are you by chance use Avira antivirus? If that true then you must uninstall it and use MSE, because MSE can running better in kernel Windows.
After we finish and the problem gone, then you may go back to your AV.
Just continue the verifier to reveal more driver issue.
Code:******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C4, {3c, 14c, 0, 0} Unable to load image KernExplorer64.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for KernExplorer64.sys *** ERROR: Module load completed but symbols could not be loaded for KernExplorer64.sys Probably caused by : KernExplorer64.sys ( KernExplorer64+1277 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_VERIFIER_DETECTED_VIOLATION (c4) A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes. Arguments: Arg1: 000000000000003c, ObReferenceObjectByHandle is being called with a bad handle. Arg2: 000000000000014c, bad handle passed in, Arg3: 0000000000000000, object type, Arg4: 0000000000000000, 0. Debugging Details: ------------------ BUGCHECK_STR: 0xc4_3c CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff800031603dc to fffff80002cd6740 STACK_TEXT: fffff880`082ed858 fffff800`031603dc : 00000000`000000c4 00000000`0000003c 00000000`0000014c 00000000`00000000 : nt!KeBugCheckEx fffff880`082ed860 fffff800`0317590f : 00000000`000002d4 fffffa80`06849960 fffff880`082ed930 fffff880`06f9db7a : nt!VerifierBugCheckIfAppropriate+0x3c fffff880`082ed8a0 fffff880`06f9d277 : 00000000`00000000 fffffa80`06eee000 fffffa80`06849960 00000000`00000000 : nt!VerifierObReferenceObjectByHandle+0xdf fffff880`082ed8f0 00000000`00000000 : fffffa80`06eee000 fffffa80`06849960 00000000`00000000 fffff880`082ed9b0 : KernExplorer64+0x1277 STACK_COMMAND: kb FOLLOWUP_IP: KernExplorer64+1277 fffff880`06f9d277 ?? ??? SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: KernExplorer64+1277 FOLLOWUP_NAME: MachineOwner MODULE_NAME: KernExplorer64 IMAGE_NAME: KernExplorer64.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4cc52d94 FAILURE_BUCKET_ID: X64_0xc4_3c_KernExplorer64+1277 BUCKET_ID: X64_0xc4_3c_KernExplorer64+1277 Followup: MachineOwner ---------
thanks wish.
uninstalled ad aware & reinstalled essentials ( just seemed a little slow)
do I reset the verifier after i get a blue screen or does it stay setup?
I'll reset it just incase
Thanks wish.
uninstalled ad aware & Avira antivirus, reinstalled essentials ( just seemed a little slow)
do I reset the verifier after a blue screen? I did just in case.
I've been crash free since the last one, over a day now:)
again tkx wish, feels like I'm getting somewhere with this
Another crash with no blue screen..........
do I reset verifier?
thanks wish, I'll report back here in a few days
Quote
