Please help, very frequent BSOD errors recently

Takeshi · 03 Oct 2011

Hi I have a DELL Studio XPS9100 with the following specs:-

Intel(R) Core(TM)i7-930 Processor (2.8GHz, 8MB)
Integrated Intel(R) 10/100/1000 Ethernet Networking
Intel(R) Core(TM) i7 Label
6GB Tri-Channel DDR3 SDRAM at 1333MHz - 3 DIMMs(3X2GB)
1TB-7,200RPM Hard Drives
1GB ATI(R) Radeon(TM) HD 5870
Integrated high definition 7.1 channel audio with THX® TruStudio PC
Dell(TM) 2.1 Multimedia Desktop Speaker System
Dell 1525 Wireless-N PCIe Card (802.11 a/b/g/n compliant)
Genuine Windows(R) 7 Home Premium 64bit Edition (English)
Windows(R) 7 Home Premium 32/64bit COA Label (MY/D/TH)
Microsoft(R) Office(TM) Home and Student 2007(English)
McAfee(R) Security Center 11 (Multi Language) - 15 months

Recently I have been getting the BSOD quite a bit. I don’t game too much (at most 2 hours every other day) and I have tried all the other windows tools test etc and nothing seems to show up. Would really appreciate your kind assistance on this matter.

zigzag3143 · 03 Oct 2011

Takeshi said:

Hi I have a DELL Studio XPS9100 with the following specs:-

Intel(R) Core(TM)i7-930 Processor (2.8GHz, 8MB)
Integrated Intel(R) 10/100/1000 Ethernet Networking
Intel(R) Core(TM) i7 Label
6GB Tri-Channel DDR3 SDRAM at 1333MHz - 3 DIMMs(3X2GB)
1TB-7,200RPM Hard Drives
1GB ATI(R) Radeon(TM) HD 5870
Integrated high definition 7.1 channel audio with THX® TruStudio PC
Dell(TM) 2.1 Multimedia Desktop Speaker System
Dell 1525 Wireless-N PCIe Card (802.11 a/b/g/n compliant)
Genuine Windows(R) 7 Home Premium 64bit Edition (English)
Windows(R) 7 Home Premium 32/64bit COA Label (MY/D/TH)
Microsoft(R) Office(TM) Home and Student 2007(English)
McAfee(R) Security Center 11 (Multi Language) - 15 months

Recently I have been getting the BSOD quite a bit. I don’t game too much (at most 2 hours every other day) and I have tried all the other windows tools test etc and nothing seems to show up. Would really appreciate your kind assistance on this matter.

The most recent were related to pci.sys (your pinnacle software). I would remove it

Your .dmp file shows a stop error of 0x124 which is a general hardware error .

A "stop 0x124" is fundamentally different to many other types of bluescreens because it stems from a hardware complaint.

Stop 0x124 minidumps contain very little practical information, and it is therefore necessary to approach the problem as a case of hardware in an unknown state of distress.

You can read more on this error and what to try here... Stop 0x124 - what it means and what to try Stop 0x124 - what it means and what to try

Takeshi · 03 Oct 2011

Thank you zigzag3143 for your reply. Apologies for this question, what is the pci.sys and how do I remove it?

I have read the post of stop 0x124 and I shall try the steps recommended therein when I finish work. However from the previously attached files which I uploaded, I don't suppose you can tell which particular hardware is having problems? I don't have anything overclocked and it can't be overheated because a lot of times the screen just appears a couple of minutes after starting the computer. All drivers have been updated except for the motherboard BIOS which I shall attempt to later.

zigzag3143 · 03 Oct 2011

Takeshi said:

Thank you zigzag3143 for your reply. Apologies for this question, what is the pci.sys and how do I remove it?

I have read the post of stop 0x124 and I shall try the steps recommended therein when I finish work. However from the previously attached files which I uploaded, I don't suppose you can tell which particular hardware is having problems? I don't have anything overclocked and it can't be overheated because a lot of times the screen just appears a couple of minutes after starting the computer. All drivers have been updated except for the motherboard BIOS which I shall attempt to later.

PCI.sys is an OS file and you should not remove it

I would start with RAM.

Run these two test

1-Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

RAM - Test with Memtest86+

2-Driver verifier

I'd suggest that you first backup your data and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

In Windows 7 you can make a Startup Repair disk by going to Start....All Programs...Maintenance...Create a System Repair Disc - with Windows Vista you'll have to use your installation disk or the "Repair your computer" option at the top of the Safe Mode menu .

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

Driver Verifier - Enable and Disable

Takeshi · 08 Feb 2012

Hi, I have again recently encountered a lot of BSOD with various error messages.

The previous issue was resolved after I ran memtest and nothing came up and all was fine thereafter.

Now the BSOD is back ... Would truly appreciate your kind assistance in this. I have attached the necessary zip files.

I have not upgraded my computer or any components. Just the occasional software updates etc.

writhziden · 08 Feb 2012

Code:


Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\BSODDmpFiles\Takeshi\Windows_NT6_BSOD_jcgriff2\020712-25038-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03404000 PsLoadedModuleList = 0xfffff800`03649670
Debug session time: Mon Feb  6 18:56:05.036 2012 (GMT-7)
System Uptime: 0 days 0:23:06.988
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800037979bd, fffff8800bb1fc10, 0}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800037979bd, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800bb1fc10, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ObCheckObjectAccess+10d
fffff800`037979bd 4da5            movs    qword ptr [rdi],qword ptr [rsi]

CONTEXT:  fffff8800bb1fc10 -- (.cxr 0xfffff8800bb1fc10)
rax=00000000fdfffbbe rbx=fffff8800bb20a30 rcx=fffff8800bb20708
rdx=fffff8800bb20640 rsi=0000000000000001 rdi=fffff8a00ce70a60
rip=fffff800037979bd rsp=fffff8800bb205f0 rbp=0000000000000001
 r8=fffff8800bb20a50  r9=fffff8a001b311c0 r10=0000000000000001
r11=fffff8800bb20578 r12=fffffa8008e3d060 r13=fffffa800548dbc0
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ObCheckObjectAccess+0x10d:
fffff800`037979bd 4da5            movs    qword ptr [rdi],qword ptr [rsi] ds:002b:fffff8a0`0ce70a60=???????????????? ds:002b:00000000`00000001=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff800037979bd

STACK_TEXT:  
fffff880`0bb205f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObCheckObjectAccess+0x10d


CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
2 errors : !nt (fffff80003797826-fffff800037979be)
fffff80003797820  90  90  90  90  90  90 *94  90  48  89  5c  24  08  48  89  6c ........H.\$.H.l
...
fffff800037979b0  ba  e8  19  f7  d0  21  43  10  4c  8b  4c  24  58  4d *a5  c9 .....!C.L.L$XM..

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

STACK_COMMAND:  .cxr 0xfffff8800bb1fc10 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

Loading Dump File [F:\BSODDmpFiles\Takeshi\Windows_NT6_BSOD_jcgriff2\020712-21138-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03467000 PsLoadedModuleList = 0xfffff800`036ac670
Debug session time: Mon Feb  6 18:31:31.396 2012 (GMT-7)
System Uptime: 0 days 0:08:08.348
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800b6f3218, fffff8800b6f2a70, fffff800034ea8ae}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonRead+bae )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b6f3218
Arg3: fffff8800b6f2a70
Arg4: fffff800034ea8ae

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800b6f3218 -- (.exr 0xfffff8800b6f3218)
ExceptionAddress: fffff800034ea8ae (nt!ExAcquireResourceSharedLite+0x000000000000004e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800b6f2a70 -- (.cxr 0xfffff8800b6f2a70)
rax=0000000000000000 rbx=fffefa8008d49700 rcx=fffefa8008d49700
rdx=fffffa8006635101 rsi=fffff8a00154bf00 rdi=fffff880009e7180
rip=fffff800034ea8ae rsp=fffff8800b6f3450 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000078800 r10=fffffa80059d9368
r11=fffff8800b6f3698 r12=fffffa8005ea1660 r13=0000000000000001
r14=0000000000000001 r15=fffff8800b6f3690
iopl=0         nv up di pl zr na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010046
nt!ExAcquireResourceSharedLite+0x4e:
fffff800`034ea8ae f0480fba696000  lock bts qword ptr [rcx+60h],0 ds:002b:fffefa80`08d49760=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003716100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCommonRead+bae
fffff880`0123b3ce 84c0            test    al,al

FAULTING_IP: 
nt!ExAcquireResourceSharedLite+4e
fffff800`034ea8ae f0480fba696000  lock bts qword ptr [rcx+60h],0

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff8800123b3ce to fffff800034ea8ae

STACK_TEXT:  
fffff880`0b6f3450 fffff880`0123b3ce : 00000000`00000001 fffff8a0`01675b50 fffff880`0b6f37f0 00000000`00000000 : nt!ExAcquireResourceSharedLite+0x4e
fffff880`0b6f34c0 fffff880`0123ca68 : fffff880`0b6f3690 fffffa80`059d9010 fffff880`0b6f3701 fffffa80`0731e001 : Ntfs!NtfsCommonRead+0xbae
fffff880`0b6f3660 fffff880`01182bcf : fffffa80`059d9368 fffffa80`059d9010 fffffa80`0731e010 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0b6f3870 fffff880`011816df : fffffa80`064ee8e0 fffffa80`05ea1601 fffffa80`064ee800 fffffa80`059d9010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0b6f3900 fffff800`0350bbc5 : fffffa80`059d9030 fffffa80`08db29f0 fffffa80`056edf50 fffff880`009e7180 : fltmgr!FltpDispatch+0xcf
fffff880`0b6f3960 fffff800`0350b699 : fffffa80`08db2901 fffffa80`08db2901 fffffa80`056ede90 000007fe`fd29bbd4 : nt!IoPageRead+0x255
fffff880`0b6f39f0 fffff800`034f202a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`0b6f3ac0 fffff800`034e1d6e : 00000000`00000000 000007fe`fd29bbd4 00000000`00000201 00000000`00004d44 : nt!MmAccessFault+0x146a
fffff880`0b6f3c20 00000000`77b89c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`00c2d830 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b89c12


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsCommonRead+bae

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800b6f2a70 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonRead+bae

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonRead+bae

Followup: MachineOwner
---------

Loading Dump File [F:\BSODDmpFiles\Takeshi\Windows_NT6_BSOD_jcgriff2\020612-25459-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0345a000 PsLoadedModuleList = 0xfffff800`0369f670
Debug session time: Mon Feb  6 08:19:41.015 2012 (GMT-7)
System Uptime: 0 days 2:07:08.968
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

Probably caused by : ndis.sys ( ndis! ?? ::FNODOBFM::`string'+ce3c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003709100
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
+0
00000000`00000000 ??              ???

PROCESS_NAME:  uTorrent.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

TRAP_FRAME:  fffff8800b218320 -- (.trap 0xfffff8800b218320)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8008267740
rdx=fffffa800c285d50 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff8800b2184b0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffffa800c285fc6 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po cy
00000000`00000000 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800034d61e9 to fffff800034d6c40

FAILED_INSTRUCTION_ADDRESS: 
+0
00000000`00000000 ??              ???

STACK_TEXT:  
fffff880`0b2184b0 fffff880`01705429 : fffffa80`06450c38 00000000`00000000 fffffa80`0c285d50 00000000`00000000 : 0x0
fffff880`0b2184b8 00000000`0000003c : fffffa80`07d741a0 00000000`00000000 fffffa80`07ef57e0 fffffa80`0ba70b50 : ndis! ?? ::FNODOBFM::`string'+0xce3c
fffff880`0b2184f8 fffffa80`07d741a0 : 00000000`00000000 fffffa80`07ef57e0 fffffa80`0ba70b50 00000000`00000001 : 0x3c
fffff880`0b218500 00000000`00000000 : fffffa80`07ef57e0 fffffa80`0ba70b50 00000000`00000001 fffffa80`0ba70b10 : 0xfffffa80`07d741a0


STACK_COMMAND:  .trap 0xfffff8800b218320 ; kb

FOLLOWUP_IP: 
ndis! ?? ::FNODOBFM::`string'+ce3c
fffff880`01705429 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  ndis! ?? ::FNODOBFM::`string'+ce3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ndis

IMAGE_NAME:  ndis.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79392

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_ndis!_??_::FNODOBFM::_string_+ce3c

BUCKET_ID:  X64_0xD1_CODE_AV_NULL_IP_ndis!_??_::FNODOBFM::_string_+ce3c

Followup: MachineOwner
---------

Loading Dump File [F:\BSODDmpFiles\Takeshi\Windows_NT6_BSOD_jcgriff2\020612-22542-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0340d000 PsLoadedModuleList = 0xfffff800`03652670
Debug session time: Mon Feb  6 06:11:05.123 2012 (GMT-7)
System Uptime: 0 days 0:01:47.075
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff8800171d0f5, fffff88003d4d928, fffff88003d4d180}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800171d0f5, The address that the exception occurred at
Arg3: fffff88003d4d928, Exception Record Address
Arg4: fffff88003d4d180, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
ndis!ndisDereferenceMiniport+25
fffff880`0171d0f5 0fba612c13      bt      dword ptr [rcx+2Ch],13h

EXCEPTION_RECORD:  fffff88003d4d928 -- (.exr 0xfffff88003d4d928)
ExceptionAddress: fffff8800171d0f5 (ndis!ndisDereferenceMiniport+0x0000000000000025)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000000000000002c
Attempt to read from address 000000000000002c

CONTEXT:  fffff88003d4d180 -- (.cxr 0xfffff88003d4d180)
rax=0000000000000000 rbx=fffffa8007dc51a0 rcx=0000000000000000
rdx=fffff80003602c68 rsi=fffff880016f9110 rdi=fffffa8007dc51a0
rip=fffff8800171d0f5 rsp=fffff88003d4db60 rbp=fffff8000362a260
 r8=fffffa8007dc5298  r9=000000000000004f r10=fffff8000340d000
r11=0000000000000000 r12=fffffa800a2c8530 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei pl nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
ndis!ndisDereferenceMiniport+0x25:
fffff880`0171d0f5 0fba612c13      bt      dword ptr [rcx+2Ch],13h ds:002b:00000000`0000002c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000000000000002c

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036bc100
 000000000000002c 

FOLLOWUP_IP: 
ndis!ndisDereferenceMiniport+25
fffff880`0171d0f5 0fba612c13      bt      dword ptr [rcx+2Ch],13h

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

LAST_CONTROL_TRANSFER:  from fffff8800169630a to fffff8800171d0f5

STACK_TEXT:  
fffff880`03d4db60 fffff880`0169630a : fffffa80`07dc51a0 fffffa80`0a2c8520 fffffa80`0a2c8520 fffffa80`07dc51a0 : ndis!ndisDereferenceMiniport+0x25
fffff880`03d4dba0 fffff800`03494001 : fffffa80`05574300 fffff800`03780901 fffff800`0362a260 fffffa80`00000002 : ndis!ndisQueuedCheckForHang+0x19a
fffff880`03d4dcb0 fffff800`03724fee : d3f73d5c`dd977157 fffffa80`0556d9e0 00000000`00000080 fffffa80`054edb30 : nt!ExpWorkerThread+0x111
fffff880`03d4dd40 fffff800`0347b5e6 : fffff880`03b86180 fffffa80`0556d9e0 fffff880`03b910c0 dc508751`b8f78e37 : nt!PspSystemThreadStartup+0x5a
fffff880`03d4dd80 00000000`00000000 : fffff880`03d4e000 fffff880`03d48000 fffff880`03d4d9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


CHKIMG_EXTENSION: !chkimg -lo 50 -db !ndis
2 errors : !ndis (fffff8800171d0e6-fffff8800171d0fe)
fffff8800171d0e0  8b  f9  48  8b  0d  27 *c4  fd  ff  48  8d  35  20  c0  fd  ff ..H..'...H.5 ...
fffff8800171d0f0  48  3b  ce  74  0b  0f  ba  61  2c  13  0f  82  4d  3b *20  00 H;.t...a,...M; .

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

STACK_COMMAND:  .cxr 0xfffff88003d4d180 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

Loading Dump File [F:\BSODDmpFiles\Takeshi\Windows_NT6_BSOD_jcgriff2\020112-16629-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0344a000 PsLoadedModuleList = 0xfffff800`0368f670
Debug session time: Wed Feb  1 07:48:24.279 2012 (GMT-7)
System Uptime: 0 days 0:46:16.231
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960000bf1eb, fffff8800a6c1540, 0}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : win32k.sys ( win32k+8f1eb )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960000bf1eb, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a6c1540, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k+8f1eb
fffff960`000bf1eb 4088b42570010000 mov     byte ptr [rbp+170h],sil

CONTEXT:  fffff8800a6c1540 -- (.cxr 0xfffff8800a6c1540)
rax=0000000000000003 rbx=fffff900c062d2e0 rcx=fffff96000030000
rdx=0000000000000000 rsi=000000000326ce03 rdi=fffff900c23ff4a0
rip=fffff960000bf1eb rsp=fffff8800a6c1f20 rbp=0000000000000000
 r8=fffff8800a6c20e8  r9=fffff8800a6c20f0 r10=0000000000000001
r11=0000000000000003 r12=0000000000000000 r13=0000000000000003
r14=000000000326d920 r15=00000000750e2450
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
win32k+0x8f1eb:
fffff960`000bf1eb 4088b42570010000 mov     byte ptr [rbp+170h],sil ss:0018:00000000`00000170=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  avp.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff900c062d2e0 to fffff960000bf1eb

STACK_TEXT:  
fffff880`0a6c1f20 fffff900`c062d2e0 : fffff900`c062d2e0 fffff900`c062f880 00000000`00000008 fffff880`0a6c2090 : win32k+0x8f1eb
fffff880`0a6c1f28 fffff900`c062d2e0 : fffff900`c062f880 00000000`00000008 fffff880`0a6c2090 00000000`750e2450 : 0xfffff900`c062d2e0
fffff880`0a6c1f30 fffff900`c062f880 : 00000000`00000008 fffff880`0a6c2090 00000000`750e2450 00000000`0326d9a0 : 0xfffff900`c062d2e0
fffff880`0a6c1f38 00000000`00000008 : fffff880`0a6c2090 00000000`750e2450 00000000`0326d9a0 fffffa80`07e58600 : 0xfffff900`c062f880
fffff880`0a6c1f40 fffff880`0a6c2090 : 00000000`750e2450 00000000`0326d9a0 fffffa80`07e58600 00000000`00000003 : 0x8
fffff880`0a6c1f48 00000000`750e2450 : 00000000`0326d9a0 fffffa80`07e58600 00000000`00000003 00000000`00000000 : 0xfffff880`0a6c2090
fffff880`0a6c1f50 00000000`0326d9a0 : fffffa80`07e58600 00000000`00000003 00000000`00000000 fffffa80`00000000 : 0x750e2450
fffff880`0a6c1f58 fffffa80`07e58600 : 00000000`00000003 00000000`00000000 fffffa80`00000000 fffff880`0a6c2090 : 0x326d9a0
fffff880`0a6c1f60 00000000`00000003 : 00000000`00000000 fffffa80`00000000 fffff880`0a6c2090 fffffa80`07d8a1a0 : 0xfffffa80`07e58600
fffff880`0a6c1f68 00000000`00000000 : fffffa80`00000000 fffff880`0a6c2090 fffffa80`07d8a1a0 fffff880`04bca40c : 0x3


FOLLOWUP_IP: 
win32k+8f1eb
fffff960`000bf1eb 4088b42570010000 mov     byte ptr [rbp+170h],sil

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k+8f1eb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5b

STACK_COMMAND:  .cxr 0xfffff8800a6c1540 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k+8f1eb

BUCKET_ID:  X64_0x3B_win32k+8f1eb

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...
Possible causes are Drivers... Kaspersky...
Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Kaspersky...

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you are overclocking any hardware, please stop.
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Use the Kaspersky Removal Tool to remove Kaspersky, and then replace it with Microsoft Security Essentials - Free Antivirus for Windows to run alongside the Windows firewall.
Update your intel storage drivers using the Intel Driver Update Utility.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

If you swap any memory components, follow these steps for ESD safety:
1. Shut down and turn off your computer.
2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:

a. Backup your system and user files
b. Create a system restore point
c. If you do not have a Windows 7 DVD, Create a system repair disc
d. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.

Takeshi · 10 Feb 2012

Thank you very much for your prompt response :)

Please find enclosed the chkdsk log.

I have uninstalled kaspersky.

Updated some components from the intel link.

Will run memtest right after this.

writhziden · 10 Feb 2012

Run the disk check again since it came up with Windows has made corrections to the file system. You want to get the message Windows has checked the file system and found no problems.

Takeshi · 13 Feb 2012

Memtest revealed that I have errors on one of the ram chips. I will probably just upgrade all the ram to 12 gb with new 3 x 4gb.

In the mean time, I have managed to operate windows 7 with the remaining 4gb ram without any BSOD thus far but just a little slow. I have run chkdsk again and got a ".. found no problems" message.

writhziden · 13 Feb 2012

Takeshi said:

Memtest revealed that I have errors on one of the ram chips. I will probably just upgrade all the ram to 12 gb with new 3 x 4gb.

In the mean time, I have managed to operate windows 7 with the remaining 4gb ram without any BSOD thus far but just a little slow. I have run chkdsk again and got a ".. found no problems" message.

Glad to hear the disk came up clean. Sorry about the RAM, though. At least you were able to narrow down the problem. Best of luck with the new RAM. Post back when you get it how things run.

Please help, very frequent BSOD errors recently

Please help, very frequent BSOD errors recently

BSOD again ...