New
#1
Random BSOD getting more frequent
Hello and greetings all
I have stumbled across this site in the hope that I can find some assistance with a BSOD my colleague is getting on his Dell laptop. It was working fine with Windows XP, but after installing Windows 7 Ultimate 32bit it has randomly BSOD'd.
We have used 'MemTest x86' and found no errors, I have run a CHKDSK with no errors, as well as a 'SFC /SCANNOW' which didn't find anything.
It BSOD'd again this morning, and I've captured the full MEMORY.DMP from the Windows directory. Opening this in WinDbg and doing an analyze, I see that it is an attempt to write to read only memory which caused the error. It points to a VISTA_DRIVER_FAULT on Process 'System'. Here is the WinDbg text :-
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\dthornycroft\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x82837000 PsLoadedModuleList = 0x8297f810
Debug session time: Thu Feb 17 11:20:46.283 2011 (UTC + 0:00)
System Uptime: 0 days 2:03:26.187
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 9689b978, Virtual address for the attempted write.
Arg2: 518a5101, PTE contents.
Arg3: 8cd3fb84, (reserved)
Arg4: 0000000a, (reserved)
Debugging Details:
------------------
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: System
CURRENT_IRQL: 2
TRAP_FRAME: 8cd3fb84 -- (.trap 0xffffffff8cd3fb84)
ErrCode = 00000003
eax=9689b978 ebx=00000100 ecx=00000000 edx=fffffffe esi=85f87e10 edi=85e6d000
eip=828e9508 esp=8cd3fbf8 ebp=8cd3fc28 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiReleaseConfirmedPageFileSpace+0x88:
828e9508 2110 and dword ptr [eax],edx ds:0023:9689b978=2e003000
Resetting default scope
LAST_CONTROL_TRANSFER: from 8287d628 to 828bc9eb
STACK_TEXT:
8cd3fb6c 8287d628 00000001 9689b978 00000000 nt!MmAccessFault+0x106
8cd3fb6c 828e9508 00000001 9689b978 00000000 nt!KiTrap0E+0xdc
8cd3fc28 8289dc32 00000000 85174b80 85234708 nt!MiReleaseConfirmedPageFileSpace+0x88
8cd3fc9c 82a68e1e 85174b10 85174b10 85174b38 nt!MiDeleteSegmentPages+0x2d3
8cd3fccc 82862f29 85174b10 00000000 00000000 nt!MiSegmentDelete+0xec
8cd3fd28 82862e41 84fe3570 00000000 00000000 nt!MiProcessDereferenceList+0xdb
8cd3fd50 82a459df 00000000 aa9be7cb 00000000 nt!MiDereferenceSegmentThread+0xc5
8cd3fd90 828f71d9 82862d7a 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+dc
8287d628 85c0 test eax,eax
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiTrap0E+dc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc78ed4
FAILURE_BUCKET_ID: 0xBE_nt!KiTrap0E+dc
BUCKET_ID: 0xBE_nt!KiTrap0E+dc
Followup: MachineOwner
---------
I would appreciate any, and all suggestions.
Thanks for your time.
Quote