Random BSOD, error 0x0000003b and 24


  1. Posts : 22
    Windows 7 Home Premuum 64bit
       #1

    Random BSOD, error 0x0000003b and 24


    I have been having random BSOD for the last week. Haven't been anything too taxing on the system. The BSOD has happened from just surfing to working on a Word document to being idle.
    It started mainly as being a service system exception BSOD. I got rid of Symantec Endpoint Protection as thinking that might have something to do with it and replaced with Microsoft Security Essentials and it still happened. I ran the Memory Diagnostic tool that comes with WIN7 and it said as it was running the passes Hardware issues detected but I don't know where to find the report. It looked like it had passed the Mem test though.

    I have included the files from the BSOD tool I was unable to include the Perfmon report as I kept getting the following error;
    An error occured while attempting to generate the report.

    The wait for the report generation tool to finish has timed out.


    My system specs;
    Windows 7 Home Premium 64bit
    Intel E6800 3.3Ghz 2MB cache
    XFX Nforce 750i Sli Motherboard
    Corsair XMS2 PC2-6400 8GB Ram (4 x 2GB)
    PNY NVDIA GeForce 9800GT 1GB

    I hope you guys can tell me what is wrong with my system. I have only been using WIN7 Home Premium 64bit for about 3 weeks and it is very frustrating. Also the last couple of BSOD happened when I was running the BSOD report tool.

    Thanks
    Les
    Random BSOD, error 0x0000003b and 24 Attached Files
      My Computer


  2. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #2

    See Memory Diagnostics Tool - Read Event Viewer Log for getting the memory diagnostics log. Also, run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial in case the Windows Memory Diagnostic tool missed anything. You may want to run Memtest86+ overnight as it takes a while to run (start about an hour before going to sleep and check just before going to sleep to make sure it has not stopped running due to bad RAM).

    Code:
    1. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-58562-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a11000 PsLoadedModuleList = 0xfffff800`02c56670 Debug session time: Tue Jan 10 16:23:24.110 2012 (UTC - 7:00) System Uptime: 0 days 0:03:33.532 Loading Kernel Symbols ............................................................... ................................................................ .................................. Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff8800139eb0f, fffff88006c47520, 0} Probably caused by : msrpc.sys ( msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff8800139eb0f, Address of the instruction which caused the bugcheck Arg3: fffff88006c47520, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx CONTEXT: fffff88006c47520 -- (.cxr 0xfffff88006c47520) rax=fffffa80075c2850 rbx=fffff8a00ddb1740 rcx=0000000000000012 rdx=0000000000000000 rsi=fffff880016428b6 rdi=0000000000000000 rip=fffff8800139eb0f rsp=fffff88006c47f00 rbp=ffbffa80076004c8 r8=0000000000000000 r9=0000000000000001 r10=fffffa8007763870 r11=fffff8800137f000 r12=0000000000000000 r13=fffffa80074c70cc r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+0xff: fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx ss:0018:ffbffa80`076004c8=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff8800139a92c to fffff8800139eb0f STACK_TEXT: fffff880`06c47f00 fffff880`0139a92c : fffff880`06c40009 fffff880`0f200000 fffffa80`00000001 00000000`00000000 : msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+0xff fffff880`06c47f90 fffff880`013a063e : fffff8a0`0ddb1740 00000000`00000000 fffff880`06c48190 00000000`00000000 : msrpc!NDR_POINTER_QUEUE::Dispatch+0x4c fffff880`06c47fc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : msrpc!NdrpEnquePointerUnmarshall+0x12e FOLLOWUP_IP: msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff fffff880`0139eb0f 48895500 mov qword ptr [rbp],rdx SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff FOLLOWUP_NAME: MachineOwner MODULE_NAME: msrpc IMAGE_NAME: msrpc.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ce79334 STACK_COMMAND: .cxr 0xfffff88006c47520 ; kb FAILURE_BUCKET_ID: X64_0x3B_msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff BUCKET_ID: X64_0x3B_msrpc!NDR_UNMRSHL_POINTER_QUEUE_ELEMENT::Dispatch+ff Followup: MachineOwner ---------
    2. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-30859-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c54670 Debug session time: Tue Jan 10 16:36:13.046 2012 (UTC - 7:00) System Uptime: 0 days 0:10:52.468 Loading Kernel Symbols ............................................................... ................................................................ .................................. Loading User Symbols Loading unloaded module list ....... Unable to load image \SystemRoot\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMEFA64.SYS, Win32 error 0n2 *** WARNING: Unable to verify timestamp for SYMEFA64.SYS *** ERROR: Module load completed but symbols could not be loaded for SYMEFA64.SYS ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff880013bbc6d, fffff880031f6838, fffff880031f6090} Unable to load image \SystemRoot\system32\Drivers\SEP\0C0103E8\009D.105\x64\SYMDS64.SYS, Win32 error 0n2 *** WARNING: Unable to verify timestamp for SYMDS64.SYS *** ERROR: Module load completed but symbols could not be loaded for SYMDS64.SYS Probably caused by : SYMEFA64.SYS ( SYMEFA64+c4c6d ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff880013bbc6d, The address that the exception occurred at Arg3: fffff880031f6838, Exception Record Address Arg4: fffff880031f6090, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: SYMEFA64+c4c6d fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h] EXCEPTION_RECORD: fffff880031f6838 -- (.exr 0xfffff880031f6838) ExceptionAddress: fffff880013bbc6d (SYMEFA64+0x00000000000c4c6d) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880031f6090 -- (.cxr 0xfffff880031f6090) rax=fffff8a000bb9bd0 rbx=0000000000000003 rcx=fffdf8a0103efc00 rdx=fffffa8008ac9bd0 rsi=fffff8a00f71f888 rdi=fffffa8008ac9b80 rip=fffff880013bbc6d rsp=fffff880031f6a70 rbp=0000000000000020 r8=0000000000000020 r9=0000000000000000 r10=0000000000000000 r11=fffff8a0075ea958 r12=0000000000000001 r13=fffffa800b7d1700 r14=0000000000000000 r15=0000000000000020 iopl=0 nv up ei ng nz na po cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010287 SYMEFA64+0xc4c6d: fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:fffdf8a0`103efc10=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbe100 ffffffffffffffff FOLLOWUP_IP: SYMEFA64+c4c6d fffff880`013bbc6d 488b4110 mov rax,qword ptr [rcx+10h] BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from 0000000000000021 to fffff880013bbc6d STACK_TEXT: fffff880`031f6a70 00000000`00000021 : fffffa80`073af400 00000000`00000021 fffff880`011a8645 00010000`0001ab7e : SYMEFA64+0xc4c6d fffff880`031f6a78 fffffa80`073af400 : 00000000`00000021 fffff880`011a8645 00010000`0001ab7e fffff880`011a1738 : 0x21 fffff880`031f6a80 00000000`00000021 : fffff880`011a8645 00010000`0001ab7e fffff880`011a1738 fffff8a0`0f71f888 : 0xfffffa80`073af400 fffff880`031f6a88 fffff880`011a8645 : 00010000`0001ab7e fffff880`011a1738 fffff8a0`0f71f888 fffff8a0`1108cbc8 : 0x21 fffff880`031f6a90 00010000`0001ab7e : fffff880`011a1738 fffff8a0`0f71f888 fffff8a0`1108cbc8 fffffa80`0b7d1602 : SYMDS64+0x62645 fffff880`031f6a98 fffff880`011a1738 : fffff8a0`0f71f888 fffff8a0`1108cbc8 fffffa80`0b7d1602 fffffa80`08ac9b80 : 0x10000`0001ab7e fffff880`031f6aa0 fffff8a0`0f71f888 : fffff8a0`1108cbc8 fffffa80`0b7d1602 fffffa80`08ac9b80 fffffa80`0819d0b0 : SYMDS64+0x5b738 fffff880`031f6aa8 fffff8a0`1108cbc8 : fffffa80`0b7d1602 fffffa80`08ac9b80 fffffa80`0819d0b0 fffff880`013bc123 : 0xfffff8a0`0f71f888 fffff880`031f6ab0 fffffa80`0b7d1602 : fffffa80`08ac9b80 fffffa80`0819d0b0 fffff880`013bc123 fffff880`013a40f8 : 0xfffff8a0`1108cbc8 fffff880`031f6ab8 fffffa80`08ac9b80 : fffffa80`0819d0b0 fffff880`013bc123 fffff880`013a40f8 fffff8a0`0f71f888 : 0xfffffa80`0b7d1602 fffff880`031f6ac0 fffffa80`0819d0b0 : fffff880`013bc123 fffff880`013a40f8 fffff8a0`0f71f888 fffffa80`0819d0b0 : 0xfffffa80`08ac9b80 fffff880`031f6ac8 fffff880`013bc123 : fffff880`013a40f8 fffff8a0`0f71f888 fffffa80`0819d0b0 00000000`00000000 : 0xfffffa80`0819d0b0 fffff880`031f6ad0 fffff880`013a40f8 : fffff8a0`0f71f888 fffffa80`0819d0b0 00000000`00000000 fffff880`00000002 : SYMEFA64+0xc5123 fffff880`031f6ad8 fffff8a0`0f71f888 : fffffa80`0819d0b0 00000000`00000000 fffff880`00000002 fffff880`012f8e30 : SYMEFA64+0xad0f8 fffff880`031f6ae0 fffffa80`0819d0b0 : 00000000`00000000 fffff880`00000002 fffff880`012f8e30 00000000`00000000 : 0xfffff8a0`0f71f888 fffff880`031f6ae8 00000000`00000000 : fffff880`00000002 fffff880`012f8e30 00000000`00000000 00000000`00000000 : 0xfffffa80`0819d0b0 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: SYMEFA64+c4c6d FOLLOWUP_NAME: MachineOwner MODULE_NAME: SYMEFA64 IMAGE_NAME: SYMEFA64.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4e545217 STACK_COMMAND: .cxr 0xfffff880031f6090 ; kb FAILURE_BUCKET_ID: X64_0x7E_SYMEFA64+c4c6d BUCKET_ID: X64_0x7E_SYMEFA64+c4c6d Followup: MachineOwner ---------
    3. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-41312-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a0f000 PsLoadedModuleList = 0xfffff800`02c54670 Debug session time: Tue Jan 10 17:06:29.199 2012 (UTC - 7:00) System Uptime: 0 days 0:28:47.636 Loading Kernel Symbols ............................................................... ................................................................ .................................. Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002d58e6e, fffff88006de66e0, 0} Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1de ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002d58e6e, Address of the instruction which caused the bugcheck Arg3: fffff88006de66e0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!CmpKcbCacheLookup+1de fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch] CONTEXT: fffff88006de66e0 -- (.cxr 0xfffff88006de66e0) rax=000000000000000a rbx=0000000000000000 rcx=00000000000004b9 rdx=0000000002012f4a rsi=fffff88006de72e8 rdi=00000000cb127fd7 rip=fffff80002d58e6e rsp=fffff88006de70c0 rbp=fffff8a004114010 r8=0000000000000009 r9=0000000000000000 r10=000000000000000b r11=fffff88006de7270 r12=fffff8a013833de8 r13=ffeff8a013707390 r14=0000000000000005 r15=0000000000000005 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!CmpKcbCacheLookup+0x1de: fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch] ds:002b:ffeff8a0`13707384=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: TrustedInstall CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002d58e6e STACK_TEXT: fffff880`06de70c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmpKcbCacheLookup+0x1de FOLLOWUP_IP: nt!CmpKcbCacheLookup+1de fffff800`02d58e6e 418b45f4 mov eax,dword ptr [r13-0Ch] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!CmpKcbCacheLookup+1de FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 STACK_COMMAND: .cxr 0xfffff88006de66e0 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!CmpKcbCacheLookup+1de BUCKET_ID: X64_0x3B_nt!CmpKcbCacheLookup+1de Followup: MachineOwner ---------
    4. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011012-24500-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02caa670 Debug session time: Tue Jan 10 17:24:36.820 2012 (UTC - 7:00) System Uptime: 0 days 0:15:58.242 Loading Kernel Symbols ............................................................... ................................................................ ................................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff880088b8598, fffff880088b7df0, fffff88001501c73} Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff880088b8598 Arg3: fffff880088b7df0 Arg4: fffff88001501c73 Debugging Details: ------------------ EXCEPTION_RECORD: fffff880088b8598 -- (.exr 0xfffff880088b8598) ExceptionAddress: fffff88001501c73 (Ntfs!NtfsFcbTableCompare+0x0000000000000003) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880088b7df0 -- (.cxr 0xfffff880088b7df0) rax=000100000001b0c7 rbx=ffeff8a00ea0f300 rcx=fffffa80081ae640 rdx=fffff880088b88d0 rsi=fffff880088b88d0 rdi=fffffa80081ae640 rip=fffff88001501c73 rsp=fffff880088b87d8 rbp=fffff880088b88a0 r8=ffeff8a00ea0f320 r9=0000ffffffffffff r10=fffff880014ab180 r11=fffff880088b8918 r12=fffff880088b8974 r13=0000000000000000 r14=fffffa80081ae180 r15=fffffa80081ae180 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 Ntfs!NtfsFcbTableCompare+0x3: fffff880`01501c73 498b08 mov rcx,qword ptr [r8] ds:002b:ffeff8a0`0ea0f320=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d14100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsFcbTableCompare+3 fffff880`01501c73 498b08 mov rcx,qword ptr [r8] FAULTING_IP: Ntfs!NtfsFcbTableCompare+3 fffff880`01501c73 498b08 mov rcx,qword ptr [r8] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff80002b0bb7d to fffff88001501c73 STACK_TEXT: fffff880`088b87d8 fffff800`02b0bb7d : 00000000`00000000 fffff800`02dde687 00000000`00000010 00000000`00010297 : Ntfs!NtfsFcbTableCompare+0x3 fffff880`088b87e0 fffff800`02b0bbf5 : fffff880`088b8950 fffffa80`071f9c10 fffffa80`077f6e11 fffff880`088b88d0 : nt!FindNodeOrParent+0x3d fffff880`088b8810 fffff880`015001a9 : 00010000`0001b0c7 fffff980`01129800 00000000`00000000 fffff880`014fce55 : nt!RtlLookupElementGenericTableFullAvl+0x15 fffff880`088b8840 fffff880`014d1d8b : fffffa80`077f6e40 fffffa80`081ae180 fffffa80`077f6e40 00010000`0001b0c7 : Ntfs!NtfsCreateFcb+0x79 fffff880`088b8920 fffff880`014f6179 : fffff880`061e0460 fffffa80`071f9c10 fffffa80`077f6e40 00000000`00000000 : Ntfs!NtfsOpenFile+0x1cb fffff880`088b8b10 fffff880`0145ea3d : fffffa80`077f6e40 fffffa80`071f9c10 fffff880`061e0460 fffffa80`0b34e600 : Ntfs!NtfsCommonCreate+0xc49 fffff880`088b8cf0 fffff800`02ad9757 : fffff880`061e03d0 00310031`00300032 0043000a`000d0031 00530055`005c003a : Ntfs!NtfsCommonCreateCallout+0x1d fffff880`088b8d20 fffff800`02ad9711 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27 fffff880`061e02a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff880088b7df0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3 BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3 Followup: MachineOwner ---------
    5. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-25375-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a19000 PsLoadedModuleList = 0xfffff800`02c5e670 Debug session time: Wed Jan 11 02:52:32.084 2012 (UTC - 7:00) System Uptime: 0 days 7:19:51.506 Loading Kernel Symbols ............................................................... ................................................................ .................................. Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff960000cdada, fffff8800640ec80, 0} Probably caused by : win32k.sys ( win32k!RFONTOBJ::bGetGlyphMetrics+18a ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff960000cdada, Address of the instruction which caused the bugcheck Arg3: fffff8800640ec80, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!RFONTOBJ::bGetGlyphMetrics+18a fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8] CONTEXT: fffff8800640ec80 -- (.cxr 0xfffff8800640ec80) rax=fffff900c1d91af8 rbx=fffff8800640f8e8 rcx=fffff900c1d91af8 rdx=fffdf900c1d97408 rsi=fffff900c1d91020 rdi=fffff8800640f710 rip=fffff960000cdada rsp=fffff8800640f660 rbp=0000000000000020 r8=fffff900c1d91010 r9=fffff900c1d917f0 r10=00000000000000a0 r11=0000000000000000 r12=fffff8800640fa72 r13=0000000000000088 r14=00000000000000b1 r15=fffff8800640fa50 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00210282 win32k!RFONTOBJ::bGetGlyphMetrics+0x18a: fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8] ds:002b:fffdf900`c1d97410=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: OUTLOOK.EXE CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff960000cdada STACK_TEXT: fffff880`0640f660 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!RFONTOBJ::bGetGlyphMetrics+0x18a FOLLOWUP_IP: win32k!RFONTOBJ::bGetGlyphMetrics+18a fffff960`000cdada 8b4208 mov eax,dword ptr [rdx+8] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!RFONTOBJ::bGetGlyphMetrics+18a FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4ecdcd5a STACK_COMMAND: .cxr 0xfffff8800640ec80 ; kb FAILURE_BUCKET_ID: X64_0x3B_win32k!RFONTOBJ::bGetGlyphMetrics+18a BUCKET_ID: X64_0x3B_win32k!RFONTOBJ::bGetGlyphMetrics+18a Followup: MachineOwner ---------
    6. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-25828-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c52670 Debug session time: Wed Jan 11 08:09:45.326 2012 (UTC - 7:00) System Uptime: 0 days 5:16:04.748 Loading Kernel Symbols ............................................................... ................................................................ ................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002a91fa6, fffff880083defb0, 0} Probably caused by : ntkrnlmp.exe ( nt!KeRemoveQueueEx+336 ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002a91fa6, Address of the instruction which caused the bugcheck Arg3: fffff880083defb0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!KeRemoveQueueEx+336 fffff800`02a91fa6 49890424 mov qword ptr [r12],rax CONTEXT: fffff880083defb0 -- (.cxr 0xfffff880083defb0) rax=0000000000000102 rbx=0000002c27dee694 rcx=0000000000000000 rdx=00000000000007ff rsi=fffffa800b573b60 rdi=fffffa800a979840 rip=fffff80002a91fa6 rsp=fffff880083df990 rbp=0000000000000000 r8=fffffa800a979bb8 r9=0000000000000000 r10=fffffffffffffffd r11=fffff880009e6100 r12=fffdf880083dfb88 r13=fffff880083dfba0 r14=0000000000000001 r15=fffffa800b573c68 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!KeRemoveQueueEx+0x336: fffff800`02a91fa6 49890424 mov qword ptr [r12],rax ds:002b:fffdf880`083dfb88=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002a91fa6 STACK_TEXT: fffff880`083df990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeRemoveQueueEx+0x336 FOLLOWUP_IP: nt!KeRemoveQueueEx+336 fffff800`02a91fa6 49890424 mov qword ptr [r12],rax SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!KeRemoveQueueEx+336 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 STACK_COMMAND: .cxr 0xfffff880083defb0 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!KeRemoveQueueEx+336 BUCKET_ID: X64_0x3B_nt!KeRemoveQueueEx+336 Followup: MachineOwner ---------
    7. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011112-81890-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c1f000 PsLoadedModuleList = 0xfffff800`02e64670 Debug session time: Wed Jan 11 15:43:54.886 2012 (UTC - 7:00) System Uptime: 0 days 0:56:51.308 Loading Kernel Symbols ............................................................... ................................................................ ..................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff80002f278cd, fffff880096e19d0, 0} Probably caused by : ntkrnlmp.exe ( nt!CmListGetNextElement+1d ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff80002f278cd, Address of the instruction which caused the bugcheck Arg3: fffff880096e19d0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!CmListGetNextElement+1d fffff800`02f278cd 498b09 mov rcx,qword ptr [r9] CONTEXT: fffff880096e19d0 -- (.cxr 0xfffff880096e19d0) rax=fffdf8a011f24360 rbx=0000000000000000 rcx=0000000000000000 rdx=fffff880096e2428 rsi=0000000000000001 rdi=fffff8a000024010 rip=fffff80002f278cd rsp=fffff880096e23b8 rbp=fffff8a00d4fae00 r8=0000000000000000 r9=fffdf8a011f24360 r10=fffff8a006129010 r11=fffff8a004832c40 r12=0000000000000000 r13=fffff8a00d4fae00 r14=fffff8a00d4fae10 r15=fffff880096e2460 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!CmListGetNextElement+0x1d: fffff800`02f278cd 498b09 mov rcx,qword ptr [r9] ds:002b:fffdf8a0`11f24360=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: poqexec.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002f278cd STACK_TEXT: fffff880`096e23b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CmListGetNextElement+0x1d FOLLOWUP_IP: nt!CmListGetNextElement+1d fffff800`02f278cd 498b09 mov rcx,qword ptr [r9] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!CmListGetNextElement+1d FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 STACK_COMMAND: .cxr 0xfffff880096e19d0 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!CmListGetNextElement+1d BUCKET_ID: X64_0x3B_nt!CmListGetNextElement+1d Followup: MachineOwner ---------
    8. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011212-33656-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c4d000 PsLoadedModuleList = 0xfffff800`02e92670 Debug session time: Wed Jan 11 23:16:29.371 2012 (UTC - 7:00) System Uptime: 0 days 7:31:03.792 Loading Kernel Symbols ............................................................... ................................................................ ..................................... Loading User Symbols Loading unloaded module list ............. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff880095ff348, fffff880095feba0, fffff8800144ff14} Probably caused by : Ntfs.sys ( Ntfs!NtfsUninitializeNtfsMcb+8c ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff880095ff348 Arg3: fffff880095feba0 Arg4: fffff8800144ff14 Debugging Details: ------------------ EXCEPTION_RECORD: fffff880095ff348 -- (.exr 0xfffff880095ff348) ExceptionAddress: fffff8800144ff14 (Ntfs!NtfsUninitializeNtfsMcb+0x000000000000008c) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880095feba0 -- (.cxr 0xfffff880095feba0) rax=0000000000000000 rbx=fffff8a000dc2270 rcx=fffff880014a3980 rdx=0000000000000001 rsi=0000000000000000 rdi=0008000000000000 rip=fffff8800144ff14 rsp=fffff880095ff580 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=fffff880014a3980 r11=0000000000000000 r12=0000000000000703 r13=0000000000000000 r14=0000000000000001 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 Ntfs!NtfsUninitializeNtfsMcb+0x8c: fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8] ds:002b:00080000`00000008=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: ccSvcHst.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efc100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsUninitializeNtfsMcb+8c fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8] FAULTING_IP: Ntfs!NtfsUninitializeNtfsMcb+8c fffff880`0144ff14 488b4f08 mov rcx,qword ptr [rdi+8] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff880014d2b2f to fffff8800144ff14 STACK_TEXT: fffff880`095ff580 fffff880`014d2b2f : fffff880`095ff638 00000000`00000130 fffff8a0`00dc2010 00000000`00000000 : Ntfs!NtfsUninitializeNtfsMcb+0x8c fffff880`095ff5b0 fffff880`014d7cc1 : 00000000`00000000 00000000`00000000 fffff880`095ffa00 00000000`00000001 : Ntfs!NtfsDeleteScb+0x8b fffff880`095ff5f0 fffff880`0145085c : fffff8a0`00dc2040 fffff8a0`00dc2140 fffff880`095ffa00 fffff8a0`00dc2140 : Ntfs!NtfsRemoveScb+0x61 fffff880`095ff630 fffff880`0144fa3f : fffff8a0`00dc2010 fffff880`095ffa40 fffff880`095ff701 fffffa80`0b664b30 : Ntfs!NtfsPrepareFcbForRemoval+0x50 fffff880`095ff660 fffff880`014d5770 : fffffa80`0b664b30 fffffa80`08193180 fffff8a0`13f29670 fffff8a0`15665f10 : Ntfs!NtfsTeardownFromLcb+0x2af fffff880`095ff6f0 fffff880`014c374c : fffffa80`0b664b30 00000000`00000000 00000000`00000001 fffffa80`0b664b00 : Ntfs!NtfsTeardownStructures+0x200 fffff880`095ff770 fffff880`014cbfad : fffffa80`0b664b30 fffffa80`08193180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x530 fffff880`095ff8a0 fffff880`014cc6b4 : fffffa80`0b664b30 fffffa80`0be91010 fffffa80`0b0de910 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459 fffff880`095ff980 fffff880`01110bcf : fffffa80`0be913b0 fffffa80`0be91010 fffffa80`0b664b30 fffff880`095ff9a8 : Ntfs!NtfsFsdFlushBuffers+0x104 fffff880`095ff9f0 fffff880`0110f6df : fffffa80`0853bb60 00000000`00000001 fffffa80`0853bb00 fffffa80`0be91010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`095ffa80 fffff800`02fd221b : 00000000`00000002 fffffa80`0b0de910 00000000`00000001 fffffa80`0be91010 : fltmgr!FltpDispatch+0xcf fffff880`095ffae0 fffff800`02f66b85 : fffffa80`0be91010 fffffa80`0b23bb60 fffffa80`0b0de910 fffff800`02e3fe80 : nt!IopSynchronousServiceTail+0xfb fffff880`095ffb50 fffff800`02cc8ed3 : fffffa80`0b23bb60 00000000`7efa4000 fffffa80`0853bb60 fffffa80`0b0de910 : nt!NtFlushBuffersFile+0x171 fffff880`095ffbe0 00000000`77b617ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`059ee158 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b617ca SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsUninitializeNtfsMcb+8c FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff880095feba0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsUninitializeNtfsMcb+8c BUCKET_ID: X64_0x24_Ntfs!NtfsUninitializeNtfsMcb+8c Followup: MachineOwner ---------
    9. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011212-24750-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670 Debug session time: Thu Jan 12 07:03:18.600 2012 (UTC - 7:00) System Uptime: 0 days 4:32:13.022 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1, {77ad138a, 0, ffff, fffff88005cd3c60} Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* APC_INDEX_MISMATCH (1) This is a kernel internal error. The most common reason to see this bugcheck is when a filesystem or a driver has a mismatched number of calls to disable and re-enable APCs. The key data item is the Thread->KernelApcDisable field. A negative value indicates that a driver has disabled APC calls without re-enabling them. A positive value indicates that the reverse is true. This check is made on exit from a system call. Arguments: Arg1: 0000000077ad138a, address of system function (system call) Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex Arg3: 000000000000ffff, Thread->KernelApcDisable Arg4: fffff88005cd3c60, Previous KernelApcDisable Debugging Details: ------------------ FAULTING_IP: +6233303734383535 00000000`77ad138a ?? ??? CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x1 PROCESS_NAME: svchost.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002cc51e9 to fffff80002cc5c40 STACK_TEXT: fffff880`05cd3a28 fffff800`02cc51e9 : 00000000`00000001 00000000`77ad138a 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx fffff880`05cd3a30 fffff800`02cc5120 : fffffa80`0a2afb30 00000000`00000001 fffffa80`0a2ab060 fffff800`02fbd4f4 : nt!KiBugCheckDispatch+0x69 fffff880`05cd3b70 00000000`77ad138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245 00000000`00cab3d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ad138a STACK_COMMAND: kb FOLLOWUP_IP: nt!KiSystemServiceExit+245 fffff800`02cc5120 4883ec50 sub rsp,50h SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: nt!KiSystemServiceExit+245 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 FAILURE_BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245 BUCKET_ID: X64_0x1_SysCallNum_4_nt!KiSystemServiceExit+245 Followup: MachineOwner ---------
    10. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011412-22546-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c01000 PsLoadedModuleList = 0xfffff800`02e46670 Debug session time: Fri Jan 13 22:00:36.686 2012 (UTC - 7:00) System Uptime: 1 days 7:25:17.124 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ............... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff8800126c0fe, fffff880031cc898, fffff880031cc0f0} Probably caused by : Ntfs.sys ( Ntfs!NtfsMcbCleanupLruQueue+7e ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff8800126c0fe, The address that the exception occurred at Arg3: fffff880031cc898, Exception Record Address Arg4: fffff880031cc0f0, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: Ntfs!NtfsMcbCleanupLruQueue+7e fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi] EXCEPTION_RECORD: fffff880031cc898 -- (.exr 0xfffff880031cc898) ExceptionAddress: fffff8800126c0fe (Ntfs!NtfsMcbCleanupLruQueue+0x000000000000007e) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff880031cc0f0 -- (.cxr 0xfffff880031cc0f0) rax=fffff88001296ed0 rbx=fffff8800126c080 rcx=0000000000000000 rdx=0000000000003e57 rsi=fffdf8a012984990 rdi=fffff8a012984950 rip=fffff8800126c0fe rsp=fffff880031ccad0 rbp=fffff80002e1e260 r8=0000000000001f40 r9=0000000000000000 r10=fffff80002dfd300 r11=fffff8a012b5b9d0 r12=fffff8a012984950 r13=0000000000000001 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei pl nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206 Ntfs!NtfsMcbCleanupLruQueue+0x7e: fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi] ds:002b:fffdf8a0`12984990=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb0100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsMcbCleanupLruQueue+7e fffff880`0126c0fe 488b06 mov rax,qword ptr [rsi] BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff80002c88001 to fffff8800126c0fe STACK_TEXT: fffff880`031ccad0 fffff800`02c88001 : fffffa80`06d29040 fffff880`031ccb00 00000000`00000000 00000000`00000000 : Ntfs!NtfsMcbCleanupLruQueue+0x7e fffff880`031ccc70 fffff800`02f18fee : 00000000`00000000 fffffa80`06d29040 00000000`00000080 fffffa80`06d16040 : nt!ExpWorkerThread+0x111 fffff880`031ccd00 fffff800`02c6f5e6 : fffff880`009e6180 fffffa80`06d29040 fffff880`009f0f40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`031ccd40 00000000`00000000 : fffff880`031cd000 fffff880`031c7000 fffff880`031cc9a0 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsMcbCleanupLruQueue+7e FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff880031cc0f0 ; kb FAILURE_BUCKET_ID: X64_0x7E_Ntfs!NtfsMcbCleanupLruQueue+7e BUCKET_ID: X64_0x7E_Ntfs!NtfsMcbCleanupLruQueue+7e Followup: MachineOwner ---------
    11. Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\maddog65\011412-22906-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c02000 PsLoadedModuleList = 0xfffff800`02e47670 Debug session time: Sat Jan 14 06:18:33.955 2012 (UTC - 7:00) System Uptime: 0 days 0:04:40.376 Loading Kernel Symbols ............................................................... ................................................................ ....................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1A, {5002, fffff780c0000000, d94d, 40d94efffffffe} Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+2aa81 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000005002, The subtype of the bugcheck. Arg2: fffff780c0000000 Arg3: 000000000000d94d Arg4: 0040d94efffffffe Debugging Details: ------------------ BUGCHECK_STR: 0x1a_5002 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: SearchProtocol CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80002cea347 to fffff80002c7ec40 STACK_TEXT: fffff880`0992c228 fffff800`02cea347 : 00000000`0000001a 00000000`00005002 fffff780`c0000000 00000000`0000d94d : nt!KeBugCheckEx fffff880`0992c230 fffff800`02c94fa0 : fffff6fc`c00fc500 00000000`00000001 fffff880`00000010 fffffa80`0460b630 : nt! ?? ::FNODOBFM::`string'+0x2aa81 fffff880`0992c3a0 fffff800`02c6dc1e : fffff980`1f880000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCheckCachedPageStates+0x3c0 fffff880`0992c550 fffff800`02f68e10 : 00000000`00000000 00000000`00000000 fffffa80`07910f20 00000000`01225960 : nt!CcFetchDataForRead+0x10e fffff880`0992c5b0 fffff880`0124e730 : fffff8a0`00000001 00000000`00000001 fffffa80`00040000 fffff880`012a1001 : nt!CcCopyRead+0x180 fffff880`0992c670 fffff880`0124eda3 : 00000000`00000000 fffff8a0`0bcf96f0 fffff880`0992c8a0 fffff880`0992c798 : Ntfs!NtfsCachedRead+0x180 fffff880`0992c6d0 fffff880`01250a68 : fffffa80`070f4c70 fffffa80`079d4a50 fffff880`0992c801 fffffa80`07d5e200 : Ntfs!NtfsCommonRead+0x583 fffff880`0992c870 fffff880`01165bcf : fffffa80`079d4df0 fffffa80`079d4a50 fffffa80`07d5e280 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8 fffff880`0992c920 fffff880`011646df : fffffa80`0854e7a0 00000000`00000001 fffffa80`0854e700 fffffa80`079d4a50 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f fffff880`0992c9b0 fffff800`02f8721b : 00000000`00000000 fffffa80`07910f20 00000000`00000001 fffffa80`079d4a50 : fltmgr!FltpDispatch+0xcf fffff880`0992ca10 fffff800`02f68b63 : fffffa80`07910f20 fffffa80`07910f20 fffffa80`07910f20 00000000`00000001 : nt!IopSynchronousServiceTail+0xfb fffff880`0992ca80 fffff800`02c7ded3 : fffffa80`0a190820 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631 fffff880`0992cb70 00000000`7742137a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`011ae1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7742137a STACK_COMMAND: kb FOLLOWUP_IP: nt! ?? ::FNODOBFM::`string'+2aa81 fffff800`02cea347 cc int 3 SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+2aa81 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 FAILURE_BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2aa81 BUCKET_ID: X64_0x1a_5002_nt!_??_::FNODOBFM::_string_+2aa81 Followup: MachineOwner ---------
    Update the following drivers using Installing and updating drivers in 7,
    Driver Reference Table - sysnative.com - MVP,
    and Drivers and Downloads
    as references.
    Code:
    wdcsam64	fffff880`0501b000	fffff880`0501e880	Wed Apr 16 02:39:08 2008 (4805bb2c)	0000d887		wdcsam64.sys
    agrsm64	fffff880`048a6000	fffff880`049c8000	Mon Nov 10 08:01:35 2008 (49184ccf)	00119433		agrsm64.sys
    You had a number of crashes related to your hard disk file system. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs after finding them by following the Check Disk (chkdsk) - Read Event Viewer Log tutorial.
      My Computer


  3. Posts : 22
    Windows 7 Home Premuum 64bit
    Thread Starter
       #3

    I re ran MS Memory test and it never left a report file in event viewer as per the tutorial. I ran CHKDSK and the result is attached.
    I updated the modem driver but the other driver (wdcsam64.sys) WIN 7 says it is up to date. when I look at it thru device manager it has a date of 1/19/2011. which doesn't jive with the report from earlier.

    I am going to now run memtest86+ will post later
    Random BSOD, error 0x0000003b and 24 Attached Files
      My Computer


  4. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #4

    maddog65 said:
    I re ran MS Memory test and it never left a report file in event viewer as per the tutorial. I ran CHKDSK and the result is attached.
    I updated the modem driver but the other driver (wdcsam64.sys) WIN 7 says it is up to date. when I look at it thru device manager it has a date of 1/19/2011. which doesn't jive with the report from earlier.

    I am going to now run memtest86+ will post later
    The Windows debugger is not always able to verify the timestamp for drivers as parts of the dmp file can be corrupt or mismatched for the machine the debugger is on. I would say it is 95% accurate for timestamps, and your driver probably fell in the 5% of inaccuracies. I wouldn't worry about that driver if the timestamp through Device Manager gives a date of 1/19/2011. That is pretty up to date.

    As for the disk check, you will want to run it again since "Windows has made corrections to the file system." Keep running the disk check until Windows does not find any errors.
      My Computer


  5. Posts : 22
    Windows 7 Home Premuum 64bit
    Thread Starter
       #5

    Well bugger, my new RAM is toast. Been running off my old 4GB stick (4 x 1GB) and been running strong as ever. I had two stick s that were bad, sadly they were two different sets so I will have to RMA both back to NEWEGG. No more errors with CHKDSK so that is good.
    Thanks for all the help!!

    Les
      My Computer


  6. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #6

    maddog65 said:
    Well bugger, my new RAM is toast. Been running off my old 4GB stick (4 x 1GB) and been running strong as ever. I had two stick s that were bad, sadly they were two different sets so I will have to RMA both back to NEWEGG. No more errors with CHKDSK so that is good.
    Thanks for all the help!!

    Les
    No problem. Sorry to hear about your RAM, though. Hope you get a good set next time. You may have gotten RAM that is incompatible with your motherboard, as well. Might be worth looking into before RMAing it.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 05:32.
Find Us