Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [G:\Kingston\BSODDmpFiles\Enclave855\Windows_NT6_BSOD_jcgriff2\020212-14820-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`05004000 PsLoadedModuleList = 0xfffff800`05249670
Debug session time: Thu Feb 2 10:37:15.745 2012 (GMT-7)
System Uptime: 0 days 2:31:20.526
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+5ce9952f038bda74
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff880009e8268 -- (.exr 0xfffff880009e8268)
ExceptionAddress: fffff8000508c41a (nt!KiProcessExpiredTimerList+0x000000000000004a)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
TRAP_FRAME: fffff880009e8310 -- (.trap 0xfffff880009e8310)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa8011eb8100
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000508c41a rsp=fffff880009e84a0 rbp=000000000008e1c1
r8=fffff880009c2301 r9=0000000000000003 r10=00000000000000c1
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!KiProcessExpiredTimerList+0x4a:
fffff800`0508c41a f00fba2b07 lock bts dword ptr [rbx],7 ds:8400:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800050785fe to fffff80005080c10
STACK_TEXT:
fffff880`009e7348 fffff800`050785fe : fffffa80`0dc93d00 00000000`00000001 fffff880`009e7ac0 fffff800`050ac830 : nt!KeBugCheck
fffff880`009e7350 fffff800`050ac4fd : fffff800`0528a71c fffff800`051c7c30 fffff800`05004000 fffff880`009e8268 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`009e7380 fffff800`050ab2d5 : fffff800`051cb0fc fffff880`009e73f8 fffff880`009e8268 fffff800`05004000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`009e73b0 fffff800`050bc361 : fffff880`009e8268 fffff880`009e7ac0 fffff880`00000000 fffff880`009e84c8 : nt!RtlDispatchException+0x415
fffff880`009e7a90 fffff800`050802c2 : fffff880`009e8268 fffffa80`107096d0 fffff880`009e8310 00000000`00000003 : nt!KiDispatchException+0x135
fffff880`009e8130 fffff800`0507e41f : fffff880`009e8310 00000000`000ddb02 00000000`00000000 fffff880`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`009e8310 fffff800`0508c41a : fffffa80`11eb8120 fffffa80`11966b68 fffffa80`11966b68 00000000`00000102 : nt!KiInvalidOpcodeFault+0x11f
fffff880`009e84a0 fffff800`0508c37e : 00000015`246a5c68 fffff880`009e8b18 00000000`0008e1c1 fffff880`009c3da8 : nt!KiProcessExpiredTimerList+0x4a
fffff880`009e8af0 fffff800`0508c167 : 00000007`053fb9c2 00000007`0008e1c1 00000007`053fb96d 00000000`000000c1 : nt!KiTimerExpiration+0x1be
fffff880`009e8b90 fffff800`0507896a : fffff880`009c0180 fffff880`009cb0c0 00000000`00000001 fffff800`00000000 : nt!KiRetireDpcList+0x277
fffff880`009e8c40 00000000`00000000 : fffff880`009e9000 fffff880`009e3000 fffff880`009e8c00 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`050785fe 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
-
Loading Dump File [G:\Kingston\BSODDmpFiles\Enclave855\Windows_NT6_BSOD_jcgriff2\011712-14430-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`05063000 PsLoadedModuleList = 0xfffff800`052a8670
Debug session time: Tue Jan 17 13:09:34.975 2012 (GMT-7)
System Uptime: 0 days 0:34:17.756
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 124, {0, fffffa8008440028, be000000, 800400}
Probably caused by : hardware
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa8008440028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
BUGCHECK_STR: 0x124_GenuineIntel
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: firefox.exe
CURRENT_IRQL: f
STACK_TEXT:
fffff800`0683da98 fffff800`0502ca3b : 00000000`00000124 00000000`00000000 fffffa80`08440028 00000000`be000000 : nt!KeBugCheckEx
fffff800`0683daa0 fffff800`051f0513 : 00000000`00000001 fffffa80`08394750 00000000`00000000 fffffa80`083947a0 : hal!HalBugCheckSystem+0x1e3
fffff800`0683dae0 fffff800`0502c700 : 00000000`00000728 fffffa80`08394750 fffff800`0683de70 fffff800`0683de00 : nt!WheaReportHwError+0x263
fffff800`0683db40 fffff800`0502c052 : fffffa80`08394750 fffff800`0683de70 fffffa80`08394750 00000000`00000000 : hal!HalpMcaReportError+0x4c
fffff800`0683dc90 fffff800`0502bf0d : 00000000`00000008 00000000`00000001 fffff800`0683def0 00000000`00000000 : hal!HalpMceHandler+0x9e
fffff800`0683dcd0 fffff800`0501fe88 : 00000000`4b44324e 00000000`09548c90 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0x55
fffff800`0683dd00 fffff800`050de52c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff800`0683dd30 fffff800`050de393 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x6c
fffff800`0683de70 00000000`6811b77d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x153
00000000`002bcc9c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6811b77d
STACK_COMMAND: kb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: hardware
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE
BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE
Followup: MachineOwner
---------
-
Loading Dump File [G:\Kingston\BSODDmpFiles\Enclave855\Windows_NT6_BSOD_jcgriff2\121311-13681-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`05003000 PsLoadedModuleList = 0xfffff800`05248670
Debug session time: Tue Dec 13 11:57:55.174 2011 (GMT-7)
System Uptime: 0 days 0:00:47.970
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {e3, fffffa800f410531, 6f9ef08, 0}
Probably caused by : ntkrnlmp.exe ( nt!VerifierBugCheckIfAppropriate+3c )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 00000000000000e3, Kernel Zw API called with user-mode address as parameter.
Arg2: fffffa800f410531, Address inside the driver making the incorrect API call.
Arg3: 0000000006f9ef08, User-mode address used as API parameter.
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_e3
FAULTING_IP:
+5cc2952f02eedf0c
fffffa80`0f410531 85c0 test eax,eax
FOLLOWUP_IP:
nt!VerifierBugCheckIfAppropriate+3c
fffff800`055093dc cc int 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: ekrn.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800055093dc to fffff8000507fc40
STACK_TEXT:
fffff880`0b0cd318 fffff800`055093dc : 00000000`000000c4 00000000`000000e3 fffffa80`0f410531 00000000`06f9ef08 : nt!KeBugCheckEx
fffff880`0b0cd320 fffff800`05509ec5 : fffffa80`0d718f00 fffff800`0551809a fffff880`0b0c8000 fffff880`0b0ce000 : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`0b0cd360 fffff800`0550b39e : 00000000`00000000 00000000`00000028 fffffa80`0f4103b9 ffffc31d`0000051e : nt!ViZwCheckAddress+0x35
fffff880`0b0cd3a0 fffff800`0550b426 : fffff880`0b0cd4e8 fffff880`0b0cd4e8 00000000`00000000 00000000`00000000 : nt!ViZwCheckUnicodeString+0x2e
fffff880`0b0cd3e0 fffff800`0550ed99 : fffffa80`0f410531 00000000`00000000 00000000`70616745 00000000`00000000 : nt!ViZwCheckObjectAttributes+0x26
fffff880`0b0cd410 fffffa80`0f410531 : 00000000`06f9ef08 00000000`00000000 00000000`06f9ef3a 00000000`06f9ef8c : nt!VfZwOpenFile+0x49
fffff880`0b0cd450 00000000`06f9ef08 : 00000000`00000000 00000000`06f9ef3a 00000000`06f9ef8c 00000000`00000007 : 0xfffffa80`0f410531
fffff880`0b0cd458 00000000`00000000 : 00000000`06f9ef3a 00000000`06f9ef8c 00000000`00000007 fffffa80`00000021 : 0x6f9ef08
STACK_COMMAND: kb
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!VerifierBugCheckIfAppropriate+3c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xc4_e3_VRF_nt!VerifierBugCheckIfAppropriate+3c
BUCKET_ID: X64_0xc4_e3_VRF_nt!VerifierBugCheckIfAppropriate+3c
Followup: MachineOwner
---------
- Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
- Hardware stop.
- Verifier enabled; possibly due to ESET NOD32.
Thanks to Dave76 for help understanding possible causes.
We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.
I realize you have already done some memory troubleshooting steps, but they still may be worth doing since you have yet to determine the cause. While it is rare that both sets would be bad, it could be they are bad or the motherboard slots are bad.
Also, for Verifier, run the non-Microsoft drivers one at a time in the set that you found causes problems and determine which driver causes the crashes that way.
- Stop 0x124 - what it means and what to try
- Download and install the appropriate version of HWINFO: HWiNFO32 for 32-bit Windows 7 or HWiNFO64 for 64-bit Windows 7 to check hardware temperatures by running in sensor-only mode. Post back your temperatures at idle and during the stress tests carried out below.
- Use FurMark: VGA Stress Test, Graphics Card and GPU Stability Test, Burn-in Test, OpenGL Benchmark and GPU Temperature | oZone3D.Net to test the graphics card GPU. Then use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
- Run Hardware - Stress Test With Prime95 to determine any hardware problems. Run all three tests for a few hours each. If you get errors, stop the test and post back here.
- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a.
Backup your system and user files
b.
Create a system restore point
c. If you do not have a Windows 7 DVD,
Create a system repair disc
d. Run
Driver Verifier
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using
System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
Oh, and what happens if you let the pagefile be managed automatically by Windows?