New
#11
For now, please turn off Driver Verifier. All three of the Verifier enables dumps show different bugcheck codes. They blame Pool Corruption, USBPORT.SYS, and nvlddmkm.sys respectively. USBPORT.SYS is a Windows system driver and highly unlikely to be the real cause. nvlddmkm.sys is a video driver and it is up to date.
I suggest you test the RAM on your daughters machine using Memtest86. Follow the instructions in this tutorial: RAM - Test with Memtest86+. Run Memtest from a cold boot after the computer has been off for an hour or so. Let it run for a minimum of seven passes; this will take 6-8 hours. Errors, if any, will show on the screen in red. Post back with the results.
Code:Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`02c05000 PsLoadedModuleList = 0xfffff800`02e42e50 Debug session time: Wed Feb 2 10:19:02.217 2011 (GMT-5) System Uptime: 0 days 0:00:11.949 Loading Kernel Symbols ............................................................... ...................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck A, {6, 2, 0, fffff80002c952b3} Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+126d ) Followup: Pool_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000000000006, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002c952b3, address which referenced memory Debugging Details: ------------------ READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ead0e0 0000000000000006 CURRENT_IRQL: 2 FAULTING_IP: nt!IopCompleteRequest+ae3 fffff800`02c952b3 488b09 mov rcx,qword ptr [rcx] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0xA PROCESS_NAME: System IRP_ADDRESS: ffffffffffffff8e TRAP_FRAME: fffff88002fb39d0 -- (.trap 0xfffff88002fb39d0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff88002fb5f80 rbx=0000000000000000 rcx=0000000000000006 rdx=0000000000000006 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002c952b3 rsp=fffff88002fb3b60 rbp=fffff88002fb3cb0 r8=0000000000000100 r9=0000000000000000 r10=0000000000000002 r11=fffff80002c947d0 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe cy nt!IopCompleteRequest+0xae3: fffff800`02c952b3 488b09 mov rcx,qword ptr [rcx] ds:00000000`00000006=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002c74ca9 to fffff80002c75740 STACK_TEXT: fffff880`02fb3888 fffff800`02c74ca9 : 00000000`0000000a 00000000`00000006 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff880`02fb3890 fffff800`02c73920 : 00000000`00000000 fffff980`02d10ee0 fffff880`02fb3960 fffff880`02fb7000 : nt!KiBugCheckDispatch+0x69 fffff880`02fb39d0 fffff800`02c952b3 : fffff980`02d10ee0 fffff880`02fb3cb0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260 fffff880`02fb3b60 fffff800`02c520c7 : 00000000`00000006 659a7ef2`13eaabb1 00000000`582f1f00 fffff880`00000000 : nt!IopCompleteRequest+0xae3 fffff880`02fb3c30 fffff800`02c52487 : fffff880`00d13000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7 fffff880`02fb3cb0 fffff800`02c4e0af : fffff880`02fb3f50 00000000`0000d9a5 00000000`00000001 00000000`80000000 : nt!KiApcInterrupt+0xd7 fffff880`02fb3e40 fffff800`02c4de62 : fffff880`00d1ebe0 fffff880`02fb4050 fffffa80`0411ee18 fffff880`02fb4030 : nt!RtlLookupFunctionTable+0x12f fffff880`02fb3ea0 fffff800`02c15b16 : 00000000`00003a08 00000000`00000000 fffff880`02fb4030 00000000`00000000 : nt!RtlpLookupFunctionEntryForStackWalks+0x32 fffff880`02fb3f10 fffff800`02c15967 : fffffa80`0411ee18 fffff880`00000011 00000000`00000000 fffff800`00000004 : nt!RtlpWalkFrameChain+0x18e fffff880`02fb45b0 fffff800`02d38c2b : 00000000`00000003 fffffa80`0411ee18 00000000`00000000 00000000`00000000 : nt!RtlWalkFrameChain+0x73 fffff880`02fb45e0 fffff800`0310c0dc : fffffa80`0411ee00 00000000`00000a20 00000000`00000003 fffff800`02d6c1d1 : nt!RtlCaptureStackBackTrace+0x4b fffff880`02fb4610 fffff800`0310e33a : fffff880`02fb1000 fffff880`02fb7000 00000000`00000000 fffff880`02fb4e90 : nt!IovpLogStackCallout+0x1c fffff880`02fb4640 fffff800`03110c9a : fffff8a0`004cc5f0 00000000`000000a2 00000000`00000001 00000000`00000003 : nt!ViPoolLogStackTrace+0x8a fffff880`02fb4670 fffff800`02da867c : fffff8a0`004cc5e0 00000000`00000a20 00000000`00000003 00000000`00000001 : nt!VfFreePoolNotification+0x4a fffff880`02fb46a0 fffff880`00d69116 : fffff8a0`004ccbf0 fffff880`02fb4a64 00000000`00000040 fffff8a0`004cf010 : nt!ExDeferredFreePool+0x126d fffff880`02fb4750 fffff880`00d691bf : fffff880`02fb4e90 fffff880`02fb4e90 fffff8a0`004cc010 fffff880`02fb4a64 : CI!BenalohModExp64+0x606 fffff880`02fb4830 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : CI!BenalohModExp64Wrapper+0x3f STACK_COMMAND: kb FOLLOWUP_IP: nt!ExDeferredFreePool+126d fffff800`02da867c 90 nop SYMBOL_STACK_INDEX: e SYMBOL_NAME: nt!ExDeferredFreePool+126d FOLLOWUP_NAME: Pool_corruption IMAGE_NAME: Pool_Corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MODULE_NAME: Pool_Corruption FAILURE_BUCKET_ID: X64_0xA_VRF_nt!ExDeferredFreePool+126d BUCKET_ID: X64_0xA_VRF_nt!ExDeferredFreePool+126d Followup: Pool_corruption --------- Debug session time: Wed Feb 2 14:51:56.907 2011 (GMT-5) System Uptime: 0 days 2:42:25.265 Loading Kernel Symbols ............................................................... ................................................................ ........................ Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 50, {fffff80000000030, 1, fffff88003f664e3, 0} Could not read faulting driver name Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff80000000030, memory referenced. Arg2: 0000000000000001, value 0 = read operation, 1 = write operation. Arg3: fffff88003f664e3, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef60e0 fffff80000000030 FAULTING_IP: USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f fffff880`03f664e3 44897030 mov dword ptr [rax+30h],r14d MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 0 TRAP_FRAME: fffff88002ffc990 -- (.trap 0xfffff88002ffc990) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff80000000000 rbx=0000000000000000 rcx=00000000fdeb71ba rdx=fffffa80066f8740 rsi=0000000000000000 rdi=0000000000000000 rip=fffff88003f664e3 rsp=fffff88002ffcb20 rbp=0000000000000000 r8=fffffa80057671a0 r9=0000000000000000 r10=fffffa8003ba4cf0 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc USBPORT!USBPORT_Core_iCompleteDoneTransfer+0x91f: fffff880`03f664e3 44897030 mov dword ptr [rax+30h],r14d ds:8460:fffff800`00000030=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002d3ef14 to fffff80002cbe740 STACK_TEXT: fffff880`02ffc828 fffff800`02d3ef14 : 00000000`00000050 fffff800`00000030 00000000`00000001 fffff880`02ffc990 : nt!KeBugCheckEx fffff880`02ffc830 fffff800`02cbc82e : 00000000`00000001 fffffa80`057671a0 00000000`00000000 fffff800`03158ecc : nt! ?? ::FNODOBFM::`string'+0x42837 fffff880`02ffc990 fffff880`03f664e3 : fffffa80`057671a0 fffff880`080b3970 fffffa80`05767050 fffffa80`057671a0 : nt!KiPageFault+0x16e fffff880`02ffcb20 fffff880`02ff8000 : fffffa80`091a4c20 fffff800`00000000 00000001`0000000c 00000050`00000011 : USBPORT!USBPORT_Core_iCompleteDoneTransfer+0x91f fffff880`02ffcc00 fffffa80`091a4c20 : fffff800`00000000 00000001`0000000c 00000050`00000011 fffff880`02ffe000 : 0xfffff880`02ff8000 fffff880`02ffcc08 fffff800`00000000 : 00000001`0000000c 00000050`00000011 fffff880`02ffe000 fffff880`02ff8000 : 0xfffffa80`091a4c20 fffff880`02ffcc10 00000001`0000000c : 00000050`00000011 fffff880`02ffe000 fffff880`02ff8000 00000000`00000000 : 0xfffff800`00000000 fffff880`02ffcc18 00000050`00000011 : fffff880`02ffe000 fffff880`02ff8000 00000000`00000000 fffff800`00000000 : 0x1`0000000c fffff880`02ffcc20 fffff880`02ffe000 : fffff880`02ff8000 00000000`00000000 fffff800`00000000 00000000`00000000 : 0x50`00000011 fffff880`02ffcc28 fffff880`02ff8000 : 00000000`00000000 fffff800`00000000 00000000`00000000 fffff800`00000001 : 0xfffff880`02ffe000 fffff880`02ffcc30 00000000`00000000 : fffff800`00000000 00000000`00000000 fffff800`00000001 fffff880`02ffd760 : 0xfffff880`02ff8000 STACK_COMMAND: kb FOLLOWUP_IP: USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f fffff880`03f664e3 44897030 mov dword ptr [rax+30h],r14d SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f FOLLOWUP_NAME: MachineOwner MODULE_NAME: USBPORT IMAGE_NAME: USBPORT.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcc07 FAILURE_BUCKET_ID: X64_0x50_VRF_USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f BUCKET_ID: X64_0x50_VRF_USBPORT!USBPORT_Core_iCompleteDoneTransfer+91f Followup: MachineOwner --------- Debug session time: Wed Feb 2 07:36:53.608 2011 (GMT-5) System Uptime: 0 days 0:00:11.356 Loading Kernel Symbols ............................................................... ...................... Loading User Symbols ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff80002c82634, fffff88002fc38b8, fffff88002fc3120} Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for nvlddmkm.sys *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys Probably caused by : nvlddmkm.sys ( nvlddmkm+91f54 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80002c82634, The address that the exception occurred at Arg3: fffff88002fc38b8, Exception Record Address Arg4: fffff88002fc3120, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!memmove+204 fffff800`02c82634 488b040a mov rax,qword ptr [rdx+rcx] EXCEPTION_RECORD: fffff88002fc38b8 -- (.exr 0xfffff88002fc38b8) ExceptionAddress: fffff80002c82634 (nt!memmove+0x0000000000000204) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000104d68018 Attempt to read from address 0000000104d68018 CONTEXT: fffff88002fc3120 -- (.cxr 0xfffff88002fc3120) rax=fffff8a0001d1bb0 rbx=0000000000000008 rcx=fffff8a0001d1bb0 rdx=0000076104b96468 rsi=fffff8a0001d1bb0 rdi=0000000000000008 rip=fffff80002c82634 rsp=fffff88002fc3af8 rbp=fffff88002fc3ec0 r8=0000000000000008 r9=0000000000000001 r10=fffffa8003aff148 r11=fffff8a0001d1bb0 r12=000000000000000a r13=fffff88002fc3c38 r14=0000000104d68018 r15=0000000000000000 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 nt!memmove+0x204: fffff800`02c82634 488b040a mov rax,qword ptr [rdx+rcx] ds:002b:00000001`04d68018=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000104d68018 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec30e0 0000000104d68018 FOLLOWUP_IP: nvlddmkm+91f54 fffff880`046b2f54 ?? ??? BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff80002f84552 to fffff80002c82634 STACK_TEXT: fffff880`02fc3af8 fffff800`02f84552 : fffffa80`00000001 00000000`00000008 00000000`00000000 00000000`000007ff : nt!memmove+0x204 fffff880`02fc3b00 fffff800`02f8440b : fffffa80`0632ab80 fffff880`02fc3f70 00000000`00000001 fffff880`02fc3f00 : nt!ObpCaptureObjectName+0x102 fffff880`02fc3b80 fffff800`02f87555 : fffffa80`03b12de0 fffffa80`03bc7200 00000000`0000006c 00000000`00000000 : nt!ObpCaptureObjectCreateInformation+0x279 fffff880`02fc3c00 fffff800`02f22262 : fffffa80`03ba2040 fffff880`02fc3d80 fffff880`02fc3f00 00000000`00000000 : nt!ObCreateObject+0x75 fffff880`02fc3c70 fffff800`02c8a993 : fffffa80`03ba2040 fffffa80`0654ee70 00000000`00000000 00000000`00000001 : nt!NtCreateSymbolicLinkObject+0xbe fffff880`02fc3d00 fffff800`02c86f30 : fffff800`02ffedf6 00000000`000090de fffffa80`0654ee70 fffff980`0146cfa0 : nt!KiSystemServiceCopyEnd+0x13 fffff880`02fc3e98 fffff800`02ffedf6 : 00000000`000090de fffffa80`0654ee70 fffff980`0146cfa0 fffffa80`062ed000 : nt!KiServiceLinkage fffff880`02fc3ea0 fffff880`046b2f54 : 00000000`00000000 fffffa80`062ed000 fffffa80`0654ee70 00000000`000007ff : nt!IoCreateSymbolicLink+0x46 fffff880`02fc3f00 00000000`00000000 : fffffa80`062ed000 fffffa80`0654ee70 00000000`000007ff 00000000`00000100 : nvlddmkm+0x91f54 SYMBOL_STACK_INDEX: 8 SYMBOL_NAME: nvlddmkm+91f54 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nvlddmkm IMAGE_NAME: nvlddmkm.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4cb9dd0e STACK_COMMAND: .cxr 0xfffff88002fc3120 ; kb FAILURE_BUCKET_ID: X64_0x7E_VRF_nvlddmkm+91f54 BUCKET_ID: X64_0x7E_VRF_nvlddmkm+91f54 Followup: MachineOwner ---------
Quote