Random and unknown cause for BSODs

Page 1 of 2 12 LastLast

  1. Posts : 35
    Windows 7 Professional 64-bit SP1
       #1

    Random and unknown cause for BSODs


    Fresh installation from a format and now BSODs. Files attached.

    Is Windows 7 . . .
    - x86 (32-bit) or x64 ? --x64
    - the original installed OS on the system? -- Fresh format install
    - an OEM or full retail version? -- Professional retail upgrade disc
    -
    - What is the age of system (hardware)? 2 years
    - What is the age of OS installation 3-5 days
      My Computer

  2.   My Computer


  3. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #3

    Code:
    1. BugCheck 50, {fffff8a00c641810, 1, fffff880012b899c, 2} Could not read faulting driver name Probably caused by : Ntfs.sys ( Ntfs!NtfsFullDeleteLcb+ac ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffff8a00c641810, memory referenced. Arg2: 0000000000000001, value 0 = read operation, 1 = write operation. Arg3: fffff880012b899c, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000002, (reserved) Debugging Details: ------------------ Could not read faulting driver name WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002af30e0 fffff8a00c641810 FAULTING_IP: Ntfs!NtfsFullDeleteLcb+ac fffff880`012b899c 48894108 mov qword ptr [rcx+8],rax MM_INTERNAL_CODE: 2 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 1 TRAP_FRAME: fffff8800318c800 -- (.trap 0xfffff8800318c800) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff8a00ae18db8 rbx=0000000000000000 rcx=fffff8a00c641808 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff880012b899c rsp=fffff8800318c990 rbp=0000000000000000 r8=fffffa800756e018 r9=fffff8a00c3e7b30 r10=fffff8000284b000 r11=0000000000000001 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc Ntfs!NtfsFullDeleteLcb+0xac: fffff880`012b899c 48894108 mov qword ptr [rcx+8],rax ds:4d46:fffff8a0`0c641810=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff8000293abc2 to fffff800028bcf00 STACK_TEXT: fffff880`0318c698 fffff800`0293abc2 : 00000000`00000050 fffff8a0`0c641810 00000000`00000001 fffff880`0318c800 : nt!KeBugCheckEx fffff880`0318c6a0 fffff800`028bafee : 00000000`00000001 fffff880`0318ca08 00000000`00000700 00000000`00000170 : nt! ?? ::FNODOBFM::`string'+0x40f90 fffff880`0318c800 fffff880`012b899c : fffff880`0318ca08 fffff880`012b7c14 fffff8a0`0c3e7820 fffffa80`06a2d680 : nt!KiPageFault+0x16e fffff880`0318c990 fffff880`0122aea9 : fffff8a0`0c3e76f0 fffff800`02a605a0 fffff880`0318cb01 fffff880`012b78d5 : Ntfs!NtfsFullDeleteLcb+0xac fffff880`0318c9c0 fffff880`012b52cc : fffffa80`075cf9f0 fffffa80`07b92180 fffff8a0`0c3e76f0 fffff8a0`0c3e7b30 : Ntfs!NtfsTeardownFromLcb+0x129 fffff880`0318ca50 fffff880`01233882 : fffffa80`075cf9f0 fffffa80`075cf9f0 fffff8a0`0c3e76f0 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xcc fffff880`0318cad0 fffff880`012cc813 : fffffa80`075cf9f0 fffff800`02a605a0 fffff8a0`0c3e76f0 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`0318cb10 fffff880`012a638f : fffffa80`075cf9f0 fffff8a0`0c3e7820 fffff8a0`0c3e76f0 fffffa80`07b92180 : Ntfs!NtfsCommonClose+0x353 fffff880`0318cbe0 fffff800`028ca161 : 00000000`00000000 fffff880`00e30e00 fffffa80`06a2d601 00000500`00000003 : Ntfs!NtfsFspClose+0x15f fffff880`0318ccb0 fffff800`02b60166 : 00000500`00000000 fffffa80`06a2d680 00000000`00000080 fffffa80`06a0a040 : nt!ExpWorkerThread+0x111 fffff880`0318cd40 fffff800`0289b486 : fffff880`02f64180 fffffa80`06a2d680 fffff880`02f6efc0 00000500`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0318cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: Ntfs!NtfsFullDeleteLcb+ac fffff880`012b899c 48894108 mov qword ptr [rcx+8],rax SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: Ntfs!NtfsFullDeleteLcb+ac FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f FAILURE_BUCKET_ID: X64_0x50_Ntfs!NtfsFullDeleteLcb+ac BUCKET_ID: X64_0x50_Ntfs!NtfsFullDeleteLcb+ac Followup: MachineOwner ---------
    2. BugCheck 24, {1904fb, fffff88003559148, fffff880035589b0, fffff88001312539} Probably caused by : Ntfs.sys ( Ntfs!NtfsCleanupLinkForRemoval+29 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88003559148 Arg3: fffff880035589b0 Arg4: fffff88001312539 Debugging Details: ------------------ EXCEPTION_RECORD: fffff88003559148 -- (.exr 0xfffff88003559148) ExceptionAddress: fffff88001312539 (Ntfs!NtfsCleanupLinkForRemoval+0x0000000000000029) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880035589b0 -- (.cxr 0xfffff880035589b0) rax=000000000000fffb rbx=fa800cb73d8004c0 rcx=fa800cb73d8004c0 rdx=fffffa8006f56060 rsi=fffff8a01cf22030 rdi=fffffa800e134e40 rip=fffff88001312539 rsp=fffff88003559380 rbp=fffff8a00d4b5bc0 r8=0000000000000000 r9=0000000000000000 r10=fffff88002dd66c0 r11=fffff88003559350 r12=0000000000000001 r13=0000000000000000 r14=fffff8a021e25810 r15=fffff9802383f401 iopl=0 nv up ei ng nz na po cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287 Ntfs!NtfsCleanupLinkForRemoval+0x29: fffff880`01312539 488b4be8 mov rcx,qword ptr [rbx-18h] ds:002b:fa800cb7`3d8004a8=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: TrustedInstall CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002af50e0 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsCleanupLinkForRemoval+29 fffff880`01312539 488b4be8 mov rcx,qword ptr [rbx-18h] FAULTING_IP: Ntfs!NtfsCleanupLinkForRemoval+29 fffff880`01312539 488b4be8 mov rcx,qword ptr [rbx-18h] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff88001241594 to fffff88001312539 STACK_TEXT: fffff880`03559380 fffff880`01241594 : fffff8a0`1cf223a8 fffff880`035599e0 fffff880`03559590 fffff8a0`1cf223a8 : Ntfs!NtfsCleanupLinkForRemoval+0x29 fffff880`035593b0 fffff880`0128931c : fffffa80`07afe378 00000000`00000000 fffff8a0`0d4b5bc0 00000000`000007ff : Ntfs!NtfsRemoveSupersededTarget+0x5c4 fffff880`03559450 fffff880`0129b775 : fffff8a0`21e25810 fffff880`035599e0 00000000`0000000a 00000000`00000701 : Ntfs!NtfsSetRenameInfo+0x16de fffff880`03559840 fffff880`0120dba0 : fffffa80`0e134e40 fffffa80`0dca8010 fffff880`03559901 fffff880`03559900 : Ntfs!NtfsCommonSetInformation+0x795 fffff880`03559920 fffff880`00c3823f : fffffa80`0dca83b0 fffffa80`0dca8010 fffffa80`0e134e40 fffff880`03559948 : Ntfs!NtfsFsdSetInformation+0x11c fffff880`035599a0 fffff880`00c366df : fffffa80`079358e0 fffffa80`0dca8010 fffffa80`07935800 fffffa80`0dca8010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`03559a30 fffff800`02b9d2ed : 00000000`00000184 fffff880`03559ca0 00000000`00000000 fffffa80`08195980 : fltmgr!FltpDispatch+0xcf fffff880`03559a90 fffff800`028bc813 : 00000000`00001ed8 fffffa80`06f56060 00000000`0140ea48 00000000`00000184 : nt!NtSetInformationFile+0x909 fffff880`03559bb0 00000000`770df92a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0140ea28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770df92a SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsCleanupLinkForRemoval+29 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d STACK_COMMAND: .cxr 0xfffff880035589b0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCleanupLinkForRemoval+29 BUCKET_ID: X64_0x24_Ntfs!NtfsCleanupLinkForRemoval+29 Followup: MachineOwner ---------
    3. BugCheck 24, {1904fb, fffff88009e81238, fffff88009e80aa0, fffff8000287b354} Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireExclusiveFcb+73 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88009e81238 Arg3: fffff88009e80aa0 Arg4: fffff8000287b354 Debugging Details: ------------------ EXCEPTION_RECORD: fffff88009e81238 -- (.exr 0xfffff88009e81238) ExceptionAddress: fffff8000287b354 (nt!ExAcquireResourceExclusiveLite+0x0000000000000054) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 00000000016a020a Attempt to write to address 00000000016a020a CONTEXT: fffff88009e80aa0 -- (.cxr 0xfffff88009e80aa0) rax=000000000000ff7b rbx=00000000016a01aa rcx=00000000016a01aa rdx=fffff8a012443601 rsi=0000000000000000 rdi=fffff800029ede80 rip=fffff8000287b354 rsp=fffff88009e81470 rbp=0000000000000001 r8=0000000000000000 r9=0000000000000001 r10=fffff88009e815c0 r11=0000000000000000 r12=0000000000000000 r13=00000000c00000d8 r14=fffffa800a114780 r15=0000000000010001 iopl=0 nv up di pl zr na po nc cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010046 nt!ExAcquireResourceExclusiveLite+0x54: fffff800`0287b354 f0480fba696000 lock bts qword ptr [rcx+60h],0 ds:002b:00000000`016a020a=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: MsMpEng.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 00000000016a020a WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aab0e0 00000000016a020a FOLLOWUP_IP: Ntfs!NtfsAcquireExclusiveFcb+73 fffff880`0104a353 84c0 test al,al FAULTING_IP: nt!ExAcquireResourceExclusiveLite+54 fffff800`0287b354 f0480fba696000 lock bts qword ptr [rcx+60h],0 BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff8800104a353 to fffff8000287b354 STACK_TEXT: fffff880`09e81470 fffff880`0104a353 : 00000000`c00000d8 fffff8a0`12443600 fffffa80`0cae7010 00000000`00000702 : nt!ExAcquireResourceExclusiveLite+0x54 fffff880`09e814e0 fffff880`010b41f8 : 00000000`00000000 fffff880`09e818e0 00000000`00000001 fffffa80`0cae7010 : Ntfs!NtfsAcquireExclusiveFcb+0x73 fffff880`09e81530 fffff880`01059648 : fffffa80`0cae7010 fffffa80`07c51180 fffffa80`06ee9201 fffffa80`06ee9200 : Ntfs!NtfsFlushVolume+0x188 fffff880`09e81660 fffff880`0104c96d : fffffa80`0cae7010 fffff880`00c0fd01 fffffa80`0792a9e0 fffff880`09e81700 : Ntfs!NtfsVolumeDasdIo+0x1dc fffff880`09e81710 fffff880`0104dcf8 : fffffa80`0cae7010 fffffa80`0d834410 fffff880`09e81801 fffffa80`0d7c6000 : Ntfs!NtfsCommonRead+0x1e61 fffff880`09e818b0 fffff880`00c0323f : fffffa80`0d8347b0 fffffa80`0d834410 fffffa80`0d7c6010 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8 fffff880`09e81960 fffff880`00c016df : fffffa80`079248e0 00000000`00000001 fffffa80`07924800 fffffa80`0d834410 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`09e819f0 fffff800`02b86b29 : 00000000`00000000 fffffa80`0d826ca0 00000000`00000001 fffffa80`0d834410 : fltmgr!FltpDispatch+0xcf fffff880`09e81a50 fffff800`02b8e343 : fffffa80`0d826ca0 fffffa80`0d826ca0 fffffa80`0d826ca0 fffffa80`0d826c01 : nt!IopSynchronousServiceTail+0xf9 fffff880`09e81ac0 fffff800`02872813 : 00000000`0000079c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631 fffff880`09e81bb0 00000000`770af71a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0447cfd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770af71a SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: Ntfs!NtfsAcquireExclusiveFcb+73 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79996d STACK_COMMAND: .cxr 0xfffff88009e80aa0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireExclusiveFcb+73 BUCKET_ID: X64_0x24_Ntfs!NtfsAcquireExclusiveFcb+73 Followup: MachineOwner ---------
    4. BugCheck C2, {7, 1097, 19765030, fffff8a0197653f0} GetPointerFromAddress: unable to read from fffff80002ab30e0 Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGSHAREDRESOURCE::`scalar deleting destructor'+28 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BAD_POOL_CALLER (c2) The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc. Arguments: Arg1: 0000000000000007, Attempt to free pool which was already freed Arg2: 0000000000001097, (reserved) Arg3: 0000000019765030, Memory contents of the pool block Arg4: fffff8a0197653f0, Address of the block of pool being deallocated Debugging Details: ------------------ POOL_ADDRESS: fffff8a0197653f0 FREED_POOL_TAG: Ntff BUGCHECK_STR: 0xc2_7_Ntff CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff800029ae60e to fffff8000287b5c0 STACK_TEXT: fffff880`047b5208 fffff800`029ae60e : 00000000`000000c2 00000000`00000007 00000000`00001097 00000000`19765030 : nt!KeBugCheckEx fffff880`047b5210 fffff880`1489d814 : fffff8a0`00075f30 00000000`00000000 fffff8a0`07f8f000 00000000`00000000 : nt!ExDeferredFreePool+0x11eb fffff880`047b52c0 fffff880`148d3230 : fffff8a0`287ee510 00000000`00000000 fffff8a0`07f8f000 00000000`00000799 : dxgkrnl!DXGSHAREDRESOURCE::`scalar deleting destructor'+0x28 fffff880`047b52f0 fffff880`148d33ac : fffff8a0`15033550 00000000`00000000 00000000`00000001 fffff8a0`07f8f000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x7ac fffff880`047b53e0 fffff880`148d2651 : fffff8a0`07f8f000 fffff8a0`07f8f000 fffff8a0`1c6e16d0 fffffa80`08d9b2b0 : dxgkrnl!DXGDEVICE::DestroyResource+0x84 fffff880`047b5410 fffff880`148d28e1 : fffffa80`08d95af0 fffff8a0`07f8f000 00000000`00000001 fffff8a0`1b696280 : dxgkrnl!DXGDEVICE::ProcessTerminationList+0x95 fffff880`047b5460 fffff880`148d63e7 : fffff8a0`07f8f000 00000000`c0001d40 fffff8a0`07f41d80 fffff880`1489d3af : dxgkrnl!DXGDEVICE::TerminateAllocations+0xb9 fffff880`047b54b0 fffff880`148dffc1 : fffff8a0`07f8f000 fffff880`047b55a8 00000000`00000000 fffff8a0`07f41d80 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x93 fffff880`047b5540 fffff960`00708804 : 00000000`00000000 00000000`00000000 fffff8a0`07f62300 fffff8a0`07f62300 : dxgkrnl!DxgkCddDestroyAllocation+0x241 fffff880`047b55f0 fffff960`00709a19 : 00000000`00000004 fffff900`c00c14e8 fffff900`c00c1d20 fffff900`c07d45c0 : cdd!CDDPDEV::DestroyAllocation+0x68 fffff880`047b5660 fffff960`0070b450 : 00000000`00000000 00000000`00000000 fffff900`c00c0020 ffffffff`fffe7960 : cdd!CHwCommandBuffer::FlushDestroyAllocationList+0x3d fffff880`047b5690 fffff960`007095d5 : fffffa80`08d8d1e0 fffffa80`08d8d1e0 00000000`00000000 fffff900`c00c0020 : cdd!CHwCommandBuffer::FlushGdiCommands+0x2a0 fffff880`047b5980 fffff960`00705c6e : ffffffff`fffd7460 00000000`00000010 00000000`00000001 fffff900`00000000 : cdd!CDDPDEV::FlushGdiOutput+0x81 fffff880`047b59b0 fffff800`02b1b6fa : 00000000`19c0979d fffffa80`08d90060 00000000`00000080 fffffa80`08d77880 : cdd!PresentWorkerThread+0x902 fffff880`047b5d40 fffff800`02859b46 : fffff880`02dd5180 fffffa80`08d90060 fffff880`02ddffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`047b5d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: dxgkrnl!DXGSHAREDRESOURCE::`scalar deleting destructor'+28 fffff880`1489d814 488b4b38 mov rcx,qword ptr [rbx+38h] SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: dxgkrnl!DXGSHAREDRESOURCE::`scalar deleting destructor'+28 FOLLOWUP_NAME: MachineOwner MODULE_NAME: dxgkrnl IMAGE_NAME: dxgkrnl.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d3fa1a0 FAILURE_BUCKET_ID: X64_0xc2_7_Ntff_dxgkrnl!DXGSHAREDRESOURCE::_scalar_deleting_destructor_+28 BUCKET_ID: X64_0xc2_7_Ntff_dxgkrnl!DXGSHAREDRESOURCE::_scalar_deleting_destructor_+28 Followup: MachineOwner ---------
    5. BugCheck 50, {fffffffffffffff1, 0, fffff800029f80f3, 0} Could not read faulting driver name Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+43 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* PAGE_FAULT_IN_NONPAGED_AREA (50) Invalid system memory was referenced. This cannot be protected by try-except, it must be protected by a Probe. Typically the address is just plain bad or it is pointing at freed memory. Arguments: Arg1: fffffffffffffff1, memory referenced. Arg2: 0000000000000000, value 0 = read operation, 1 = write operation. Arg3: fffff800029f80f3, If non-zero, the instruction address which referenced the bad memory address. Arg4: 0000000000000000, (reserved) Debugging Details: ------------------ Could not read faulting driver name READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002afb0e0 fffffffffffffff1 FAULTING_IP: nt!ExFreePoolWithTag+43 fffff800`029f80f3 418b45f0 mov eax,dword ptr [r13-10h] MM_INTERNAL_CODE: 0 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x50 PROCESS_NAME: System CURRENT_IRQL: 0 TRAP_FRAME: fffff88002f93700 -- (.trap 0xfffff88002f93700) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff800029f80f3 rsp=fffff88002f93890 rbp=0000000000000000 r8=0000000000000001 r9=0000000000000000 r10=fffff880012ad980 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!ExFreePoolWithTag+0x43: fffff800`029f80f3 418b45f0 mov eax,dword ptr [r13-10h] ds:4450:ffffffff`fffffff0=???????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002943df4 to fffff800028c35c0 STACK_TEXT: fffff880`02f93598 fffff800`02943df4 : 00000000`00000050 ffffffff`fffffff1 00000000`00000000 fffff880`02f93700 : nt!KeBugCheckEx fffff880`02f935a0 fffff800`028c16ae : 00000000`00000000 fffff8a0`1dca5960 00000000`00000000 fffff880`02f93748 : nt! ?? ::FNODOBFM::`string'+0x426f7 fffff880`02f93700 fffff800`029f80f3 : fffffa80`0aca5df8 00000000`00000000 00000000`00000703 fffff880`00c5ac51 : nt!KiPageFault+0x16e fffff880`02f93890 fffff800`02899ba7 : 00000000`00000703 fffffa80`0dc40e40 fffff880`02f939f0 fffff880`012e51c8 : nt!ExFreePoolWithTag+0x43 fffff880`02f93940 fffff880`0125b471 : fffff8a0`1dca5960 fffffa80`0dc40e40 00020000`000029dd fffff880`012e5b06 : nt!FsRtlUninitializeBaseMcb+0x5f fffff880`02f93970 fffff880`012e4c5b : fffff880`02f93a28 00000000`00000130 fffff8a0`1dca5700 fffff880`0125acfa : Ntfs!NtfsUninitializeNtfsMcb+0xc1 fffff880`02f939a0 fffff880`012e49d9 : 00000000`00000000 00000000`00000000 fffff800`02a68500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x8b fffff880`02f939e0 fffff880`0125aa50 : fffff8a0`1dca5730 fffff8a0`1dca5830 fffff800`02a68500 fffff880`02f93b52 : Ntfs!NtfsRemoveScb+0x61 fffff880`02f93a20 fffff880`012e23ec : fffff8a0`1dca5700 fffff800`02a685a0 fffff880`02f93b52 fffffa80`0e63ea40 : Ntfs!NtfsPrepareFcbForRemoval+0x50 fffff880`02f93a50 fffff880`01263602 : fffffa80`0e63ea40 fffffa80`0e63ea40 fffff8a0`1dca5700 fffff880`02f93c00 : Ntfs!NtfsTeardownStructures+0xdc fffff880`02f93ad0 fffff880`012f98f3 : fffffa80`0e63ea40 fffff800`02a685a0 fffff8a0`4946744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`02f93b10 fffff880`012d3c9f : fffffa80`0e63ea40 fffff8a0`1dca5830 fffff8a0`1dca5700 fffffa80`07c77180 : Ntfs!NtfsCommonClose+0x353 fffff880`02f93be0 fffff800`028d07e1 : 00000000`00000000 fffff800`02bbc900 fffffa80`06a49601 fffffa80`00000003 : Ntfs!NtfsFspClose+0x15f fffff880`02f93cb0 fffff800`02b636fa : 00000000`00000000 fffffa80`06a49680 00000000`00000080 fffffa80`069ab9e0 : nt!ExpWorkerThread+0x111 fffff880`02f93d40 fffff800`028a1b46 : fffff880`02d64180 fffffa80`06a49680 fffff880`02d6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`02f93d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16 STACK_COMMAND: kb FOLLOWUP_IP: nt!ExFreePoolWithTag+43 fffff800`029f80f3 418b45f0 mov eax,dword ptr [r13-10h] SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!ExFreePoolWithTag+43 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aa44 FAILURE_BUCKET_ID: X64_0x50_nt!ExFreePoolWithTag+43 BUCKET_ID: X64_0x50_nt!ExFreePoolWithTag+43 Followup: MachineOwner ---------
    You had a hard disk error three times: Run Disk Check with "Scan for and attempt recovery of bad sectors" checked.

    You had a DirectX error; look into: Diagnosing basic problems with DirectX and make sure you have DirectX 11

    Also, DirectX issues can be display card related; do the following steps:

    1. Download and install Driver Sweeper
    2. Download the latest driver for your display card
    3. Click Start Menu
    4. Right Click My Computer
    5. Click Manage
    6. Click Device Manager from the list on the left
    7. Click the + next to Display adapter
    8. Right click your display/graphics card device
    9. Click Uninstall
    10. Check the box to Delete driver software for the device
    11. Click OK
    12. Restart your computer in safe mode
    13. Run Driver Sweeper, select display card manufacturer's drivers, analyze, clean
    14. Restart your computer
    15. Install the latest drivers

    Your final error could be memory related. Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete.
      My Computer


  4. Posts : 35
    Windows 7 Professional 64-bit SP1
    Thread Starter
       #4

    Thanks. I will do all of the above and report back.
      My Computer


  5. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #5

    Did the DirectX steps bring more stability to your system? Please let us know whether you were able to solve your problem. :)
      My Computer


  6. Posts : 35
    Windows 7 Professional 64-bit SP1
    Thread Starter
       #6

    Sorry I have not updated the thread. I will update this today after I get back from school.

    EDIT: Sorry, I did the Windows Memory Test and no errors were found. I have not completed the Memtest86+ test(s) as of yet (but I will). I did the check disk test and it "fixed" errors. I'm unsure how to go back and check what exactly was fixed at this point because I did the test almost a month ago now .

    My system says I have direct X 11 installed. How would one go about removing direct X 11 and reinstalling? Just Add/Remove in Control Panel and then reinstall through Windows Update? The link above doesn't provide a download from MS.
      My Computer


  7. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #7

    DirectX 11 comes installed on Windows 7, so there is no way to remove it and re-install other than to re-install Windows. You can make sure DirectX 11 is working properly by running SFC /SCANNOW Command - System File Checker up to three times to fix all errors. If it comes back with no integrity violations the first time, the system is working as it should be.

    To find your disk check results, follow the steps in Check Disk (chkdsk) - Read Event Viewer Log to see the results. If it fixed errors, you may want to run the disk check again to make sure all errors are fixed and the drive does not continue to accumulate errors.
      My Computer


  8. Posts : 35
    Windows 7 Professional 64-bit SP1
    Thread Starter
       #8

    I ran the SFC /SCANNOW and it did find some corrupt system files. The prompt said it wasn't able to fix all of the errors. I'm running the test a 2nd and 3rd time to ensure errors are fixed. A log file is being created by the scan. If, by the 3rd scan, the program is unable to fix all errors, should I post the log here for further troubleshooting?
      My Computer


  9. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #9

    You should familiarize yourself with OPTION THREE of the SFC /SCANNOW tutorial. It provides instructions for when SFC /SCANNOW is unable to correct all system file corruptions. The tip in that option is also good information for manually replacing corrupted files.
      My Computer


  10. Posts : 35
    Windows 7 Professional 64-bit SP1
    Thread Starter
       #10

    Thank you. I will do step three.

    Okay, so this is basically pulling the file directly off of the Windows 7 installation disk. I have the files here which were indicated corrupt by the log:


    1. "WTVGOTHIC-RB.ttc" of Microsoft-Windows-ehome-font
    2. "MFWMAAEC.DLL" of Microsoft-Windows-MFWMAAEC
    3. "korwbrkr.lex" of Microsoft-Windows-WordbreakerStemmer-Korean
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 03:07.
Find Us