ntoskrnl.exe 0x0000001E BSOD

Page 1 of 11 123 ... LastLast

  1. Posts : 66
    Windows 7 Home Premuim 64bit
       #1

    ntoskrnl.exe 0x0000001E BSOD


    Specs:
    - Windows 7 Home Premium x64
    - Original and only OS ever on the system
    - Came pre-installed
    - The entire system is about 2 months old
    - The install is 2 months old.
    - No other security system besides Microsoft Security Essentials

    I'm getting a BSOD caused by the ntoskrnl.exe driver. Can't find any solutions. Could you guys help?

    STOP error code is 0x0000001E.

    Everything you need in the ZIP file.

    (Note: It's not called minidump.zip because I have more than just the minidump in the zip file. I also have a dxdiag and some html files in there. All thing in there are relevant and helpful though.)
      My Computer


  2. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #2

    Code:
    Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\122711-31044-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
    Debug session time: Tue Dec 27 08:40:25.115 2011 (UTC - 7:00)
    System Uptime: 0 days 0:02:33.644
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1E, {ffffffffc0000005, fffff8800287afb0, 0, 0}
    
    Probably caused by : CLASSPNP.SYS ( CLASSPNP!ServiceTransferRequest+a8 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff8800287afb0, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000000, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    +3665613334393163
    fffff880`0287afb0 d8be870280f8    fdivr   dword ptr [rsi-77FFD79h]
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000000
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef8100
     0000000000000000 
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    BUGCHECK_STR:  0x1E_c0000005
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  0
    
    DEVICE_OBJECT: fffffa80055b8c50
    
    EXCEPTION_RECORD:  fffff8800287bed8 -- (.exr 0xfffff8800287bed8)
    ExceptionAddress: fffff880019ae198 (CLASSPNP!ServiceTransferRequest+0x00000000000000a8)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    TRAP_FRAME:  fffff8800287bf80 -- (.trap 0xfffff8800287bf80)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffa8003cc275000 rbx=0000000000000000 rcx=0000000000000001
    rdx=fffffa80055b88b0 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff880019ae198 rsp=fffff8800287c110 rbp=fffffa80055b88b0
     r8=fffffa800433c060  r9=0000000000000200 r10=fffffa800433c1b0
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    CLASSPNP!ServiceTransferRequest+0xa8:
    fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch] ds:c0e0:fffa8003`cc27502c=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff80002d514fb to fffff80002cc5c40
    
    STACK_TEXT:  
    fffff880`0287aef8 fffff800`02d514fb : 00000000`0000001e ffffffff`c0000005 fffff880`0287afb0 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0287af00 fffff800`02d19bb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
    fffff880`0287af40 fffff800`02cf1a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d
    fffff880`0287af80 fffff800`02cf14fd : fffff800`02e08c24 fffff880`0287c3c0 00000000`00000000 fffff800`02c49000 : nt!_C_specific_handler+0x8c
    fffff880`0287aff0 fffff800`02cf02d5 : fffff800`02e08c24 fffff880`0287b068 fffff880`0287bed8 fffff800`02c49000 : nt!RtlpExecuteHandlerForException+0xd
    fffff880`0287b020 fffff800`02d01361 : fffff880`0287bed8 fffff880`0287b730 fffff880`00000000 fffffa80`055b8a58 : nt!RtlDispatchException+0x415
    fffff880`0287b700 fffff800`02cc52c2 : fffff880`0287bed8 fffffa80`0433c1b0 fffff880`0287bf80 fffffa80`0433f8e0 : nt!KiDispatchException+0x135
    fffff880`0287bda0 fffff800`02cc3bca : 00000000`00004000 fffff880`0287c0e8 fffffa80`00001000 fffffa80`03ebacfc : nt!KiExceptionDispatch+0xc2
    fffff880`0287bf80 fffff880`019ae198 : fffffa80`04cad180 fffffa80`053aa4b0 fffffa80`053424d0 fffff880`0287c128 : nt!KiGeneralProtectionFault+0x10a
    fffff880`0287c110 fffff880`019ae975 : fffffa80`0433c060 fffffa80`055b8a00 00000000`00000003 fffff880`00000001 : CLASSPNP!ServiceTransferRequest+0xa8
    fffff880`0287c1b0 fffff880`00e010af : fffffa80`055b88b0 00000002`bfe1a200 fffffa80`055b8aa0 00000000`00000000 : CLASSPNP!ClassReadWrite+0xd5
    fffff880`0287c200 fffff880`00e1618c : fffffa80`03e90e20 fffffa80`055b88b0 fffffa80`055b88b0 fffff8a0`002106b0 : partmgr!PmGlobalDispatch+0x9f
    fffff880`0287c230 fffff880`0195e2bf : 00000002`bfe1a200 fffffa80`03e98b90 fffffa80`055b88b0 00000000`00000000 : volmgr!VmReadWrite+0x11c
    fffff880`0287c270 fffff880`0195e53c : fffffa80`03e98b90 fffff880`0287c8e0 fffffa80`03c1a980 fffffa80`04347010 : fvevol!FveReadWrite+0x47
    fffff880`0287c2b0 fffff880`0195e593 : 00000000`00000000 fffffa80`055b88b0 00000000`00000000 fffffa80`0566dfc0 : fvevol!FveFilterRundownReadWrite+0x1dc
    fffff880`0287c310 fffff880`018b84a9 : fffffa80`055b8b78 fffffa80`055b88b0 fffffa80`04346190 fffffa80`055b88b0 : fvevol!FveFilterRundownWrite+0x2f
    fffff880`0287c340 fffff880`0122539a : fffff880`0287c5b0 00000000`00006000 fffff880`0287c4d8 00000000`00000200 : volsnap! ?? ::FNODOBFM::`string'+0x19f8
    fffff880`0287c390 fffff800`02cd2618 : fffff880`0287c560 fffff880`01223d06 fffffa80`053424d0 fffff8a0`0259f140 : Ntfs!NtfsStorageDriverCallout+0x16
    fffff880`0287c3c0 fffff880`01224f09 : fffff880`01225384 00000000`00000200 00000000`00000200 00000002`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
    fffff880`0287c4a0 fffff880`012243d6 : fffffa80`03eb5a70 00000000`00000000 fffff8a0`0259f140 00001000`00000000 : Ntfs!NtfsMultipleAsync+0xa9
    fffff880`0287c510 fffff880`012285f4 : fffffa80`053424d0 fffffa80`055b88b0 00000002`9d0d1826 fffff8a0`0259f010 : Ntfs!NtfsNonCachedIo+0x216
    fffff880`0287c6e0 fffff880`012291a3 : fffffa80`053424d0 fffffa80`055b88b0 fffff880`0287c800 fffff880`00000200 : Ntfs!NtfsCommonWrite+0x2d91
    fffff880`0287c890 fffff880`01098bcf : fffffa80`055b8c08 fffffa80`055b88b0 fffffa80`05a90c30 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
    fffff880`0287c950 fffff880`010976df : fffffa80`04348c40 00000000`00000001 fffffa80`04348c00 fffffa80`055b88b0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`0287c9e0 fffff800`02fce21b : 00000000`00000001 fffffa80`054f2620 00000000`00000001 fffffa80`055b88b0 : fltmgr!FltpDispatch+0xcf
    fffff880`0287ca40 fffff800`02fd8c83 : fffffa80`055b8c50 00000000`00000000 fffffa80`054f2620 fffff880`009e9180 : nt!IopSynchronousServiceTail+0xfb
    fffff880`0287cab0 fffff800`02cc4ed3 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
    fffff880`0287cbb0 00000000`76ea139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`00d7f7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea139a
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    CLASSPNP!ServiceTransferRequest+a8
    fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch]
    
    SYMBOL_STACK_INDEX:  9
    
    SYMBOL_NAME:  CLASSPNP!ServiceTransferRequest+a8
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: CLASSPNP
    
    IMAGE_NAME:  CLASSPNP.SYS
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929b
    
    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8
    
    BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8
    
    Followup: MachineOwner
    ---------
    The problems were system related. To rule out system corruption, run SFC /SCANNOW Command - System File Checker to check system files. You may have to run it up to three times to fix any errors.
      My Computer


  3. Posts : 66
    Windows 7 Home Premuim 64bit
    Thread Starter
       #3

    Windows Resource Protection did not find any integrity violations.
      My Computer


  4. JMH
    Posts : 7,952
    Win 7 Ultimate 64-bit. SP1.
       #4

    FYI.
    Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED

    * This indicates that a kernel-mode program generated an exception which the error handler did not catch.

    * The following actions might prevent an error like this from happening again:

    > Download and install updates and device drivers for your computer from Windows Update.
    > Scan your computer for computer viruses.
    > Check your hard disk for errors.

    Disk Check

    > For good measure download the free version of Malwarebytes.

    Update it immediately.
    Run a full system scan.

    Tell us the results at the end please.

    Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!
      My Computer


  5. Posts : 66
    Windows 7 Home Premuim 64bit
    Thread Starter
       #5

    Im going to run the disk check now.

    I already have the full paid for version of Malwarebytes, and I run scans all the time. But I'll scan again for good measure.
      My Computer


  6. JMH
    Posts : 7,952
    Win 7 Ultimate 64-bit. SP1.
       #6

    Good luck!
      My Computer


  7. Posts : 66
    Windows 7 Home Premuim 64bit
    Thread Starter
       #7

    Neither Malwarebytes nor Chkdsk found anything.
      My Computer


  8. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #8

    Since everything checks out, we will have to do a more thorough investigation to determine the cause of your blue screens. Run Driver verifier as follows:
    1. Backup your system and user files
    2. Create a system restore point
    3. If you do not have a Windows 7 DVD, Create a system repair disc
    4. Run Driver Verifier

    If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using System Restore OPTION TWO.

    Thanks to zigzag3143 for contributing to the above steps.

    You may need to run the driver checks in groups instead of all at once as running all at once often causes blue screens to occur without creating dmp files. Recommend running approximately 1/3 of the non-Microsoft drivers at a time and posting any blue screen dmp files that you get after each set.
      My Computer


  9. Posts : 28,845
    Win 8 Release candidate 8400
       #9

    Just a thought in passing. The first parameter in the DMP file is a memory exception and upon further examination it was called by bitlocker.

    JUST TO TEST, I would disable bitlocker.
    Last edited by zigzag3143; 29 Feb 2012 at 00:41.
      My Computer


  10. Posts : 66
    Windows 7 Home Premuim 64bit
    Thread Starter
       #10

    I don't have bitlocker on my computer.
      My Computer


 
Page 1 of 11 123 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 20:07.
Find Us