Alright, I will analyze the two week old crashes...
Problem Devices:
Code:
MpKslf1f2acd0 ROOT\LEGACY_MPKSLF1F2ACD0\0000 This device is not present, is not working properly, or does not have all its drivers installed.
Antivirus Software:
Code:
msmpeng.exe c:\program files\microsoft security client\antimalware\msmpeng.exe 936 8 200 1380 25.2.2012 11:19 3.0.8402.0 12,48 kt (12*784 tavua) 27.4.2011 18:21
nissrv.exe c:\program files\microsoft security client\antimalware\nissrv.exe 2408 8 200 1380 25.2.2012 11:19 3.0.8402.0 281,52 kt (288*272 tavua) 27.4.2011 18:21
msseces.exe c:\program files\microsoft security client\msseces.exe 3040 8 200 1380 25.2.2012 11:19 2.1.1116.0 1,37 Mt (1*436*736 tavua) 15.6.2011 15:35
Possible out of date drivers:
Code:
WmXlCore fffff880`05956000 fffff880`05962600 Thu Jan 24 16:01:22 2008 (479918c2) 0000e492 WmXlCore.sys
WmBEnum fffff880`05952000 fffff880`05955c00 Thu Jan 24 16:01:30 2008 (479918ca) 00006b51 WmBEnum.sys
vcsvad fffff880`04855000 fffff880`0485f000 Sun Nov 16 02:51:18 2008 (491fed16) 0000affe vcsvad.sys
hamachi fffff880`0591a000 fffff880`05925000 Thu Feb 19 03:36:41 2009 (499d3639) 0000a5d7 hamachi.sys
lirsgt fffff880`0850c000 fffff880`08519000 Sun May 17 07:06:57 2009 (4a100bf1) 0000f1b4 lirsgt.sys
atksgt fffff880`084b4000 fffff880`08503000 Sun May 17 07:36:34 2009 (4a1012e2) 0004fc56 atksgt.sys
GEARAspiWDM fffff880`0569c000 fffff880`056a9000 Mon May 18 06:17:04 2009 (4a1151c0) 000159b4 GEARAspiWDM.sys
WmXlCore.sys
WmBEnum.sys
vcsvad.sys
hamachi.sys
lirsgt.sys
atksgt.sys
GEARAspiWDM.sys
Code:
-
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-23119-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`03264670
Debug session time: Mon Feb 27 07:42:54.856 2012 (UTC - 6:00)
System Uptime: 0 days 0:04:40.666
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc000001d, fffff88004f45153, fffff88002bb99e8, fffff88002bb9240}
Probably caused by : atikmdag.sys ( atikmdag+4c7153 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff88004f45153, The address that the exception occurred at
Arg3: fffff88002bb99e8, Exception Record Address
Arg4: fffff88002bb9240, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
atikmdag+4c7153
fffff880`04f45153 27 ???
EXCEPTION_RECORD: fffff88002bb99e8 -- (.exr 0xfffff88002bb99e8)
ExceptionAddress: fffff88004f45153 (atikmdag+0x00000000004c7153)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0
CONTEXT: fffff88002bb9240 -- (.cxr 0xfffff88002bb9240)
rax=0000000000000018 rbx=0000000000000018 rcx=0000000000000018
rdx=df56b045355788bc rsi=fffff880051d37b0 rdi=0000000000000001
rip=fffff88004f45153 rsp=fffff88002bb9c28 rbp=fffff88002bb9d30
r8=fffff88004f45153 r9=fffff88002bb9c78 r10=000000b8452baad9
r11=0000000000000018 r12=0000000000000038 r13=0000000000000020
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up di pl nz ac po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010016
atikmdag+0x4c7153:
fffff880`04f45153 27 ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x7E
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
LAST_CONTROL_TRANSFER: from fffff88004f0956c to fffff88004f45153
FAILED_INSTRUCTION_ADDRESS:
atikmdag+4c7153
fffff880`04f45153 27 ???
STACK_TEXT:
fffff880`02bb9c28 fffff880`04f0956c : 00000000`00000004 00000000`00000000 00000000`0000b100 fffff880`051d3700 : atikmdag+0x4c7153
fffff880`02bb9c30 00000000`00000004 : 00000000`00000000 00000000`0000b100 fffff880`051d3700 fffff800`03211e80 : atikmdag+0x48b56c
fffff880`02bb9c38 00000000`00000000 : 00000000`0000b100 fffff880`051d3700 fffff800`03211e80 74737953`0023f5ad : 0x4
FOLLOWUP_IP:
atikmdag+4c7153
fffff880`04f45153 27 ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: atikmdag+4c7153
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME: atikmdag.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4edd8367
STACK_COMMAND: .cxr 0xfffff88002bb9240 ; kb
FAILURE_BUCKET_ID: X64_0x7E_BAD_IP_atikmdag+4c7153
BUCKET_ID: X64_0x7E_BAD_IP_atikmdag+4c7153
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-23384-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03050000 PsLoadedModuleList = 0xfffff800`03295670
Debug session time: Mon Feb 27 07:37:32.899 2012 (UTC - 6:00)
System Uptime: 0 days 0:09:54.709
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.
FAULTING_IP:
+3063636333373736
00000000`00000000 ?? ???
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0
BUGCHECK_STR: 0x1E_0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
EXCEPTION_RECORD: fffff8800311b3a8 -- (.exr 0xfffff8800311b3a8)
ExceptionAddress: fffff800030d84d3 (nt!KiProcessExpiredTimerList+0x0000000000000103)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
TRAP_FRAME: fffff8800311b450 -- (.trap 0xfffff8800311b450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=fffffa800703c100
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030d84d3 rsp=fffff8800311b5e0 rbp=fffffa800703c168
r8=fffff880009eb301 r9=0000000000000002 r10=00000000000000ea
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!KiProcessExpiredTimerList+0x103:
fffff800`030d84d3 0fb6432b movzx eax,byte ptr [rbx+2Bh] ds:1a00:00000000`0000002b=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800030c45fe to fffff800030ccc10
STACK_TEXT:
fffff880`0311a488 fffff800`030c45fe : fffffa80`06e06770 00000000`00000002 fffff880`0311ac00 fffff800`030f8830 : nt!KeBugCheck
fffff880`0311a490 fffff800`030f84fd : fffff800`032d671c fffff800`03213c30 fffff800`03050000 fffff880`0311b3a8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`0311a4c0 fffff800`030f72d5 : fffff800`032170fc fffff880`0311a538 fffff880`0311b3a8 fffff800`03050000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0311a4f0 fffff800`03108361 : fffff880`0311b3a8 fffff880`0311ac00 fffff880`00000000 fffff880`0311b608 : nt!RtlDispatchException+0x415
fffff880`0311abd0 fffff800`030cc2c2 : fffff880`0311b3a8 fffbfa80`0703c168 fffff880`0311b450 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0311b270 fffff800`030cabca : fffffa80`079fe988 00000000`0000e934 00000000`00000001 fffff880`018cef60 : nt!KiExceptionDispatch+0xc2
fffff880`0311b450 fffff800`030d84d3 : fffffa80`0703c120 fffffa80`0703c168 fffffa80`0703c168 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a
fffff880`0311b5e0 fffff800`030d837e : 00000001`627982fa fffff880`0311bc58 00000000`000094ea fffff880`009ed2c8 : nt!KiProcessExpiredTimerList+0x103
fffff880`0311bc30 fffff800`030d8167 : 00000000`617a8ec1 00000000`000094ea 00000000`617a8ec0 00000000`000000ea : nt!KiTimerExpiration+0x1be
fffff880`0311bcd0 fffff800`030c496a : fffff880`009e9180 fffff880`009f4040 00000000`00000001 fffff800`00000000 : nt!KiRetireDpcList+0x277
fffff880`0311bd80 00000000`00000000 : fffff880`0311c000 fffff880`03116000 fffff880`0311bd40 00000000`00000000 : nt!KiIdleLoop+0x5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiKernelCalloutExceptionHandler+e
fffff800`030c45fe 90 nop
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KiKernelCalloutExceptionHandler+e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
BUCKET_ID: X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-22932-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03015000 PsLoadedModuleList = 0xfffff800`0325a670
Debug session time: Mon Feb 27 07:09:19.764 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:57.935
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800719f278, fffff8800719ead0, fffff880012419a9}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCleanupIrpContext+119 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800719f278
Arg3: fffff8800719ead0
Arg4: fffff880012419a9
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800719f278 -- (.exr 0xfffff8800719f278)
ExceptionAddress: fffff880012419a9 (Ntfs!NtfsCleanupIrpContext+0x0000000000000119)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800719ead0 -- (.cxr 0xfffff8800719ead0)
rax=00fff8800719f848 rbx=fffff8800719f6d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000001 rdi=fffff8800719f630
rip=fffff880012419a9 rsp=fffff8800719f4b0 rbp=fffff8800719f830
r8=0000000000000000 r9=0000000000000727 r10=0000000000000001
r11=fffff8800719f630 r12=0000000000000001 r13=0000000000000702
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei pl zr na po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010247
Ntfs!NtfsCleanupIrpContext+0x119:
fffff880`012419a9 488b4818 mov rcx,qword ptr [rax+18h] ds:002b:00fff880`0719f860=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c4100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsCleanupIrpContext+119
fffff880`012419a9 488b4818 mov rcx,qword ptr [rax+18h]
FAULTING_IP:
Ntfs!NtfsCleanupIrpContext+119
fffff880`012419a9 488b4818 mov rcx,qword ptr [rax+18h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012403a0 to fffff880012419a9
STACK_TEXT:
fffff880`0719f4b0 fffff880`012403a0 : fffff880`0719f6d0 00000000`00000001 fffff880`0719f830 fffffa80`09482410 : Ntfs!NtfsCleanupIrpContext+0x119
fffff880`0719f500 fffff880`01240a68 : fffff880`0719f6d0 fffffa80`09482410 fffff880`0719f801 fffffa80`09d9ec01 : Ntfs!NtfsCommonRead+0x1b74
fffff880`0719f6a0 fffff880`01168bcf : fffffa80`094827b0 fffffa80`09482410 fffffa80`09d9ec30 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0719f8b0 fffff880`011676df : fffffa80`07cb2530 fffffa80`0944c601 fffffa80`07cb2500 fffffa80`09482410 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0719f940 fffff800`030b9bc5 : fffffa80`09482430 fffffa80`084119d0 fffffa80`09677a50 00000000`7562fcc8 : fltmgr!FltpDispatch+0xcf
fffff880`0719f9a0 fffff800`030b9699 : 00000000`00000001 00000000`00000001 fffffa80`09677990 00000000`0000ff01 : nt!IoPageRead+0x255
fffff880`0719fa30 fffff800`030a002a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`0719fac0 fffff800`0308fd6e : 00000000`00000000 00000000`7562fcc8 00000000`00000b01 00000000`0002e174 : nt!MmAccessFault+0x146a
fffff880`0719fc20 00000000`77959c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`024ad0b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77959c12
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsCleanupIrpContext+119
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff8800719ead0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCleanupIrpContext+119
BUCKET_ID: X64_0x24_Ntfs!NtfsCleanupIrpContext+119
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022612-23368-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a3670
Debug session time: Sun Feb 26 02:25:35.543 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:50.714
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c000001d, fffff800030e274d, fffff8800ae2c130, 0}
Probably caused by : hardware ( nt!KeWaitForSingleObject+19d )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff800030e274d, Address of the instruction which caused the bugcheck
Arg3: fffff8800ae2c130, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff ???
CONTEXT: fffff8800ae2c130 -- (.cxr 0xfffff8800ae2c130)
rax=0000000000000102 rbx=00000001ef25007a rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa8009473b30 rdi=fffffa8006b21b60
rip=fffff800030e274d rsp=fffff8800ae2cb10 rbp=0000000000000000
r8=fffffa8009d790e8 r9=0000000000000000 r10=fffffffffffffffb
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=fffff8800ae2cbf8 r15=fffffa8006b21c68
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!KeWaitForSingleObject+0x19d:
fffff800`030e274d ff ???
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: Skype.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff ???
LAST_CONTROL_TRANSFER: from fffff800033d144e to fffff800030e274d
STACK_TEXT:
fffff880`0ae2cb10 fffff800`033d144e : fffff880`0ae2cc00 fffffa80`00000006 00000000`00000001 fffff880`0ae2cc00 : nt!KeWaitForSingleObject+0x19d
fffff880`0ae2cbb0 fffff800`030d9ed3 : fffffa80`06b21b60 00000000`00001028 fffff880`0ae2cbf8 fffffa80`09473b30 : nt!NtWaitForSingleObject+0xde
fffff880`0ae2cc20 00000000`73b22e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1887f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73b22e09
FOLLOWUP_IP:
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeWaitForSingleObject+19d
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff8800ae2c130 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\022512-25552-01\022512-25552-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324d670
Debug session time: Sat Feb 25 14:51:37.245 2012 (UTC - 6:00)
System Uptime: 0 days 0:08:47.416
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 815f001, 3848, fffff70001080000}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )
Followup: MachineOwner
---------
5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000000815f001
Arg3: 0000000000003848
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800030dc5a7 to fffff80003084c40
STACK_TEXT:
fffff880`08095498 fffff800`030dc5a7 : 00000000`0000001a 00000000`00041284 00000000`0815f001 00000000`00003848 : nt!KeBugCheckEx
fffff880`080954a0 fffff800`030f3e6c : fffffa80`02287380 84800000`b8268867 00000000`0815e000 84700000`b4267867 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`080954e0 fffff800`030b8569 : 00000000`00000000 00000000`08243fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35d20
fffff880`080956a0 fffff800`0339c221 : fffffa80`09c9a6c0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`080957c0 fffff800`0339c623 : 00000000`00000000 00000000`08100000 fffffa80`00000001 00000000`00000000 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08095880 fffff800`03083ed3 : 00000000`00010001 00000000`00000001 fffffa80`06d88b30 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`080958d0 fffff800`03080470 : fffff960`001964ea 00000000`00000001 fffff900`c00be010 fffff900`c06f4880 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08095a68 fffff960`001964ea : 00000000`00000001 fffff900`c00be010 fffff900`c06f4880 00000000`00000000 : nt!KiServiceLinkage
fffff880`08095a70 fffff960`0019686c : ffffffff`00000000 fffff880`00000000 fffff900`c06f4880 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`08095bc0 fffff960`001574c9 : ffffffff`99050db2 fffff900`c06f4880 00000000`00000db2 fffff800`030d0993 : win32k!bDeleteSurface+0x34
fffff880`08095bf0 fffff800`03083ed3 : fffffa80`06d88630 fffff900`c00be010 00000000`00000018 00000000`7efdb000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`08095c20 00000000`75612e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000de478 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75612e09
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+3a2
fffff960`001964ea e9d6010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`001966c5)
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3a2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f10ff24
FAILURE_BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2
BUCKET_ID: X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2
Followup: MachineOwner
---------
- Caused by your graphics card/graphics card driver(s). Other possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
- Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
Thanks to JMH for helping with my understanding of this crash. - Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...
- Indicates hardware... Other possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
- Possible causes are Memory problems... Drivers...
Thanks to Dave76 for help understanding possible causes.
You have a plethora of different types of crashes; this usually means a hardware issue, but it could also be Windows file corruption. Let's start with file corruption first.
- If you are overclocking any hardware, please stop.
- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
- Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.