New Comp. Crash Errors BSOD BCCode: 1e


  1. Posts : 5
    Windows 7 Home Premium 64bit
       #1

    New Comp. Crash Errors BSOD BCCode: 1e


    Have had this laptop for about 2 months now.

    Specs: OS Name Microsoft Windows 7 Home Premium
    Version 6.1.7601 Service Pack 1 Build 7601
    Other OS Description Not Available
    OS Manufacturer Microsoft Corporation
    System Name
    System Manufacturer Hewlett-Packard
    System Model HP Pavilion dv6 Notebook PC
    System Type x64-based PC
    Processor AMD A8-3510MX APU with Radeon(tm) HD Graphics, 1800 Mhz, 4 Core(s), 4 Logical Processor(s)
    BIOS Version/Date Hewlett-Packard F.12, 10/26/2011
    SMBIOS Version 2.7
    Windows Directory C:\Windows
    System Directory C:\Windows\system32
    Boot Device \Device\HarddiskVolume1
    Locale United States
    Hardware Abstraction Layer Version = "6.1.7601.17514"
    User Name Derick-HP\Bolo
    Time Zone Central Standard Time
    Installed Physical Memory (RAM) 8.00 GB
    Total Physical Memory 7.48 GB
    Available Physical Memory 5.24 GB
    Total Virtual Memory 15.0 GB
    Available Virtual Memory 12.4 GB
    Page File Space 7.48 GB
    Page File C:\pagefile.sys
    OS Name Microsoft Windows 7 Home Premium
    Version 6.1.7601 Service Pack 1 Build 7601
    Other OS Description Not Available
    OS Manufacturer Microsoft Corporation
    System Name DERICK-HP
    System Manufacturer Hewlett-Packard
    System Model HP Pavilion dv6 Notebook PC
    System Type x64-based PC
    Processor AMD A8-3510MX APU with Radeon(tm) HD Graphics, 1800 Mhz, 4 Core(s), 4 Logical Processor(s)
    BIOS Version/Date Hewlett-Packard F.12, 10/26/2011
    SMBIOS Version 2.7
    Windows Directory C:\Windows
    System Directory C:\Windows\system32
    Boot Device \Device\HarddiskVolume1
    Locale United States
    Hardware Abstraction Layer Version = "6.1.7601.17514"
    User Name Derick-HP\Bolo
    Time Zone Central Standard Time
    Installed Physical Memory (RAM) 8.00 GB
    Total Physical Memory 7.48 GB
    Available Physical Memory 5.24 GB
    Total Virtual Memory 15.0 GB
    Available Virtual Memory 12.4 GB
    Page File Space 7.48 GB
    Page File C:\pagefile.sys

    Error:
    Problem signature:
    Problem Event Name: BlueScreen
    OS Version: 6.1.7601.2.1.0.768.3
    Locale ID: 1033

    Additional information about the problem:
    BCCode: 1e
    BCP1: FFFFFFFFC0000005
    BCP2: FFFFF880087319F0
    BCP3: 0000000000000000
    BCP4: 0000000000000000
    OS Version: 6_1_7601
    Service Pack: 1_0
    Product: 768_1

    Files that help describe the problem:
    C:\Windows\Minidump\030712-22105-01.dmp
    C:\Users\Bolo\AppData\Local\Temp\WER-58032-0.sysdata.xml

    Read our privacy statement online:
    Windows 7 Privacy Statement - Microsoft Windows

    If the online privacy statement is not available, please read our privacy statement offline:
    C:\Windows\system32\en-US\erofflps.txt
      My Computer


  2. Posts : 60
    Windows 7 Ultimate x64
       #2

    Hello,

    KMODE_EXCEPTION_NOT_HANDLED Windows should also identified a driver (a *.sys file) first thing you could check is sfc /scannow (as administrator) also make sure you use the latest availible drivers because this error might be caused by a bad thirdparty driver.Also run windows memory diagnostics and check hp website for the newest stuff for your model.

    Diagnosing memory problems on your computer
      My Computer


  3. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #3

    Possible out of date drivers:
    Code:
    hamachi	fffff880`05800000	fffff880`0580b000	Thu Feb 19 03:36:41 2009 (499d3639)	0000a5d7		hamachi.sys
    GEARAspiWDM	fffff880`053e2000	fffff880`053ef000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys
    hamachi.sys
    GEARAspiWDM.sys


    Code:
    1. Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030712-22105-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e60670 Debug session time: Wed Mar 7 00:17:19.408 2012 (UTC - 7:00) System Uptime: 0 days 1:39:30.828 Loading Kernel Symbols ............................................................... ................................................................ .......................................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff880087319f0, 0, 0} Probably caused by : afd.sys ( afd!AfdCompletePollIrp+ef ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff880087319f0, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000000, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: +6666376537376366 fffff880`087319f0 1829 sbb byte ptr [rcx],ch EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eca100 0000000000000000 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AvastSvc.exe CURRENT_IRQL: 2 EXCEPTION_RECORD: fffff88008732918 -- (.exr 0xfffff88008732918) ExceptionAddress: fffff80002ca1e53 (nt!KiCancelTimer+0x00000000000000af) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff TRAP_FRAME: fffff880087329c0 -- (.trap 0xfffff880087329c0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff80002e11e88 rbx=0000000000000000 rcx=fdfff80002e11e88 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ca1e53 rsp=fffff88008732b50 rbp=0000000000000001 r8=fffff80002c1b000 r9=0000000000000000 r10=fffffa80088c3c60 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!KiCancelTimer+0xaf: fffff800`02ca1e53 488901 mov qword ptr [rcx],rax ds:fdfff800`02e11e88=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002d234fb to fffff80002c97c40 STACK_TEXT: fffff880`08731938 fffff800`02d234fb : 00000000`0000001e ffffffff`c0000005 fffff880`087319f0 00000000`00000000 : nt!KeBugCheckEx fffff880`08731940 fffff800`02cebbb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b fffff880`08731980 fffff800`02cc3a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d fffff880`087319c0 fffff800`02cc34fd : fffff800`02ddac24 fffff880`087339b0 00000000`00000000 fffff800`02c1b000 : nt!_C_specific_handler+0x8c fffff880`08731a30 fffff800`02cc22d5 : fffff800`02ddac24 fffff880`08731aa8 fffff880`08732918 fffff800`02c1b000 : nt!RtlpExecuteHandlerForException+0xd fffff880`08731a60 fffff800`02cd3361 : fffff880`08732918 fffff880`08732170 fffff880`00000000 fffff800`02e11e80 : nt!RtlDispatchException+0x415 fffff880`08732140 fffff800`02c972c2 : fffff880`08732918 fffffa80`0afde620 fffff880`087329c0 fffff800`02e10080 : nt!KiDispatchException+0x135 fffff880`087327e0 fffff800`02c95bca : 00000000`00000000 ffffd05b`2d57c0a4 00000000`00000002 fffffa80`06e1c660 : nt!KiExceptionDispatch+0xc2 fffff880`087329c0 fffff800`02ca1e53 : fffffa80`08c14dd0 fffff800`0320871f fffffa80`0834a980 00000000`0000005a : nt!KiGeneralProtectionFault+0x10a fffff880`08732b50 fffff800`02c72bde : 00000000`00000002 00000000`00000000 fffffa80`06bb60f0 fffffa80`0afde5c0 : nt!KiCancelTimer+0xaf fffff880`08732b90 fffff880`03e6189f : fffffa80`08c14dd0 fffff880`0149e7c1 fffffa80`08ea5790 fffffa80`09384a70 : nt!KeCancelTimer+0x1a fffff880`08732bc0 fffff880`03e4f448 : 00000000`00000000 00000000`00000000 fffffa80`0afde808 fffffa80`0afde808 : afd!AfdCompletePollIrp+0xef fffff880`08732c20 fffff880`03e5ab08 : fffffa80`0afde808 00000000`00000000 00000000`00000002 fffffa80`088c3b10 : afd!AfdIndicatePollEvent+0x138 fffff880`08732c70 fffff800`02c9b021 : fffffa80`07281180 00000000`00000008 00000000`00000d00 fffff880`02d64f40 : afd!AfdCommonRestartBufferReceive+0x1e8 fffff880`08732d20 fffff880`0173d687 : fffffa80`0781c350 fffff880`08732f02 fffff880`08732f00 00000000`00000000 : nt!IopfCompleteRequest+0x341 fffff880`08732e10 fffff880`01754a45 : 00000000`000005b4 fffffa80`09351010 fffffa80`09351010 00000000`00000002 : tcpip!TcpSatisfyReceiveRequests+0x4a7 fffff880`087330f0 fffff880`01753839 : 00000000`00000002 00000000`00000000 fffff880`01500110 00000000`00000002 : tcpip!TcpDeliverDataToClient+0x105 fffff880`08733270 fffff880`01750d58 : fffffa80`0849b7d0 00000000`00000000 00000000`00000000 fffff880`0174eb2a : tcpip!TcpDeliverReceive+0xa9 fffff880`08733370 fffff880`017518b5 : fffff880`08733838 fffff880`00000000 fffffa80`09351010 fffff800`02c96ed3 : tcpip!TcpTcbFastDatagram+0x208 fffff880`08733530 fffff880`0175067a : fffffa80`07009880 00000000`0904e8f0 fffffa80`06fd52e0 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5 fffff880`087336e0 fffff880`017522ab : fffffa80`09119780 fffffa80`06ee9580 00000000`00000000 00000000`00000000 : tcpip!TcpMatchReceive+0x1fa fffff880`08733830 fffff880`0172cffa : fffffa80`07009880 00000000`0000302f fffff880`0000f9c6 fffff880`0873f9c6 : tcpip!TcpPreValidatedReceive+0x36b fffff880`08733900 fffff800`02ca4618 : fffff880`018689a0 fffff880`0155b506 00000000`00000000 00000000`00000000 : tcpip!IppLoopbackTransmit+0x11a fffff880`087339b0 fffff880`0172d90f : fffff880`01779c70 fffffa80`0704f880 fffff880`08733b02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8 fffff880`08733a90 fffff880`0174a74a : fffffa80`069328a0 00000000`00000000 00000000`00000010 fffffa80`09119630 : tcpip!IppLoopbackEnqueue+0x22f fffff880`08733b40 fffff880`0174c895 : 00000000`00000000 00000000`00140001 00000000`00000000 fffff800`02f89508 : tcpip!IppDispatchSendPacketHelper+0x38a fffff880`08733c00 fffff880`0174afd3 : fffffa80`0aefaa06 00000000`0000f900 fffffa80`00000014 fffff880`00000000 : tcpip!IppPacketizeDatagrams+0x2d5 fffff880`08733d20 fffff880`0174e43e : 00000000`00000014 fffff880`01757607 00000000`00000000 00000000`00000000 : tcpip!IppSendDatagramsCommon+0x753 fffff880`08733ff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IpNlpSendDatagrams+0x3e STACK_COMMAND: kb FOLLOWUP_IP: afd!AfdCompletePollIrp+ef fffff880`03e6189f 84c0 test al,al SYMBOL_STACK_INDEX: b SYMBOL_NAME: afd!AfdCompletePollIrp+ef FOLLOWUP_NAME: MachineOwner MODULE_NAME: afd IMAGE_NAME: afd.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4efa9418 FAILURE_BUCKET_ID: X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef BUCKET_ID: X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030712-22105-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e60670 Debug session time: Wed Mar 7 00:17:19.408 2012 (UTC - 7:00) System Uptime: 0 days 1:39:30.828 Loading Kernel Symbols ............................................................... ................................................................ .......................................................... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1E, {ffffffffc0000005, fffff880087319f0, 0, 0} Probably caused by : afd.sys ( afd!AfdCompletePollIrp+ef ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff880087319f0, The address that the exception occurred at Arg3: 0000000000000000, Parameter 0 of the exception Arg4: 0000000000000000, Parameter 1 of the exception Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: +6666376537376366 fffff880`087319f0 1829 sbb byte ptr [rcx],ch EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eca100 0000000000000000 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. BUGCHECK_STR: 0x1E_c0000005 CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: AvastSvc.exe CURRENT_IRQL: 2 EXCEPTION_RECORD: fffff88008732918 -- (.exr 0xfffff88008732918) ExceptionAddress: fffff80002ca1e53 (nt!KiCancelTimer+0x00000000000000af) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff TRAP_FRAME: fffff880087329c0 -- (.trap 0xfffff880087329c0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffff80002e11e88 rbx=0000000000000000 rcx=fdfff80002e11e88 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002ca1e53 rsp=fffff88008732b50 rbp=0000000000000001 r8=fffff80002c1b000 r9=0000000000000000 r10=fffffa80088c3c60 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc nt!KiCancelTimer+0xaf: fffff800`02ca1e53 488901 mov qword ptr [rcx],rax ds:fdfff800`02e11e88=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002d234fb to fffff80002c97c40 STACK_TEXT: fffff880`08731938 fffff800`02d234fb : 00000000`0000001e ffffffff`c0000005 fffff880`087319f0 00000000`00000000 : nt!KeBugCheckEx fffff880`08731940 fffff800`02cebbb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b fffff880`08731980 fffff800`02cc3a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d fffff880`087319c0 fffff800`02cc34fd : fffff800`02ddac24 fffff880`087339b0 00000000`00000000 fffff800`02c1b000 : nt!_C_specific_handler+0x8c fffff880`08731a30 fffff800`02cc22d5 : fffff800`02ddac24 fffff880`08731aa8 fffff880`08732918 fffff800`02c1b000 : nt!RtlpExecuteHandlerForException+0xd fffff880`08731a60 fffff800`02cd3361 : fffff880`08732918 fffff880`08732170 fffff880`00000000 fffff800`02e11e80 : nt!RtlDispatchException+0x415 fffff880`08732140 fffff800`02c972c2 : fffff880`08732918 fffffa80`0afde620 fffff880`087329c0 fffff800`02e10080 : nt!KiDispatchException+0x135 fffff880`087327e0 fffff800`02c95bca : 00000000`00000000 ffffd05b`2d57c0a4 00000000`00000002 fffffa80`06e1c660 : nt!KiExceptionDispatch+0xc2 fffff880`087329c0 fffff800`02ca1e53 : fffffa80`08c14dd0 fffff800`0320871f fffffa80`0834a980 00000000`0000005a : nt!KiGeneralProtectionFault+0x10a fffff880`08732b50 fffff800`02c72bde : 00000000`00000002 00000000`00000000 fffffa80`06bb60f0 fffffa80`0afde5c0 : nt!KiCancelTimer+0xaf fffff880`08732b90 fffff880`03e6189f : fffffa80`08c14dd0 fffff880`0149e7c1 fffffa80`08ea5790 fffffa80`09384a70 : nt!KeCancelTimer+0x1a fffff880`08732bc0 fffff880`03e4f448 : 00000000`00000000 00000000`00000000 fffffa80`0afde808 fffffa80`0afde808 : afd!AfdCompletePollIrp+0xef fffff880`08732c20 fffff880`03e5ab08 : fffffa80`0afde808 00000000`00000000 00000000`00000002 fffffa80`088c3b10 : afd!AfdIndicatePollEvent+0x138 fffff880`08732c70 fffff800`02c9b021 : fffffa80`07281180 00000000`00000008 00000000`00000d00 fffff880`02d64f40 : afd!AfdCommonRestartBufferReceive+0x1e8 fffff880`08732d20 fffff880`0173d687 : fffffa80`0781c350 fffff880`08732f02 fffff880`08732f00 00000000`00000000 : nt!IopfCompleteRequest+0x341 fffff880`08732e10 fffff880`01754a45 : 00000000`000005b4 fffffa80`09351010 fffffa80`09351010 00000000`00000002 : tcpip!TcpSatisfyReceiveRequests+0x4a7 fffff880`087330f0 fffff880`01753839 : 00000000`00000002 00000000`00000000 fffff880`01500110 00000000`00000002 : tcpip!TcpDeliverDataToClient+0x105 fffff880`08733270 fffff880`01750d58 : fffffa80`0849b7d0 00000000`00000000 00000000`00000000 fffff880`0174eb2a : tcpip!TcpDeliverReceive+0xa9 fffff880`08733370 fffff880`017518b5 : fffff880`08733838 fffff880`00000000 fffffa80`09351010 fffff800`02c96ed3 : tcpip!TcpTcbFastDatagram+0x208 fffff880`08733530 fffff880`0175067a : fffffa80`07009880 00000000`0904e8f0 fffffa80`06fd52e0 00000000`00000000 : tcpip!TcpTcbReceive+0x1f5 fffff880`087336e0 fffff880`017522ab : fffffa80`09119780 fffffa80`06ee9580 00000000`00000000 00000000`00000000 : tcpip!TcpMatchReceive+0x1fa fffff880`08733830 fffff880`0172cffa : fffffa80`07009880 00000000`0000302f fffff880`0000f9c6 fffff880`0873f9c6 : tcpip!TcpPreValidatedReceive+0x36b fffff880`08733900 fffff800`02ca4618 : fffff880`018689a0 fffff880`0155b506 00000000`00000000 00000000`00000000 : tcpip!IppLoopbackTransmit+0x11a fffff880`087339b0 fffff880`0172d90f : fffff880`01779c70 fffffa80`0704f880 fffff880`08733b02 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8 fffff880`08733a90 fffff880`0174a74a : fffffa80`069328a0 00000000`00000000 00000000`00000010 fffffa80`09119630 : tcpip!IppLoopbackEnqueue+0x22f fffff880`08733b40 fffff880`0174c895 : 00000000`00000000 00000000`00140001 00000000`00000000 fffff800`02f89508 : tcpip!IppDispatchSendPacketHelper+0x38a fffff880`08733c00 fffff880`0174afd3 : fffffa80`0aefaa06 00000000`0000f900 fffffa80`00000014 fffff880`00000000 : tcpip!IppPacketizeDatagrams+0x2d5 fffff880`08733d20 fffff880`0174e43e : 00000000`00000014 fffff880`01757607 00000000`00000000 00000000`00000000 : tcpip!IppSendDatagramsCommon+0x753 fffff880`08733ff0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!IpNlpSendDatagrams+0x3e STACK_COMMAND: kb FOLLOWUP_IP: afd!AfdCompletePollIrp+ef fffff880`03e6189f 84c0 test al,al SYMBOL_STACK_INDEX: b SYMBOL_NAME: afd!AfdCompletePollIrp+ef FOLLOWUP_NAME: MachineOwner MODULE_NAME: afd IMAGE_NAME: afd.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4efa9418 FAILURE_BUCKET_ID: X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef BUCKET_ID: X64_0x1E_c0000005_afd!AfdCompletePollIrp+ef Followup: MachineOwner ---------
    2. Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030612-22713-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c54000 PsLoadedModuleList = 0xfffff800`02e99670 Debug session time: Tue Mar 6 22:21:05.629 2012 (UTC - 7:00) System Uptime: 0 days 1:15:21.439 Loading Kernel Symbols ............................................................... ................................................................ ........................................................ Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff8800318c758, fffff8800318bfb0, fffff880012e8be8} Probably caused by : Ntfs.sys ( Ntfs!NtfsFullDeleteLcb+ac ) Followup: MachineOwner --------- 1: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800318c758 Arg3: fffff8800318bfb0 Arg4: fffff880012e8be8 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800318c758 -- (.exr 0xfffff8800318c758) ExceptionAddress: fffff880012e8be8 (Ntfs!NtfsFullDeleteLcb+0x00000000000000ac) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff8800318bfb0 -- (.cxr 0xfffff8800318bfb0) rax=fffff8a00f293db8 rbx=fffff8800318ca08 rcx=fdfff8a00f293db8 rdx=0000000000000001 rsi=0000000000000000 rdi=fffff8a0123ee6d0 rip=fffff880012e8be8 rsp=fffff8800318c990 rbp=0000000000000000 r8=fffffa800b504338 r9=0000000000000000 r10=fffff880009ea6c0 r11=0000000000000001 r12=fffff8a00dc2d010 r13=fffff8a00f293bc0 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 Ntfs!NtfsFullDeleteLcb+0xac: fffff880`012e8be8 48894108 mov qword ptr [rcx+8],rax ds:002b:fdfff8a0`0f293dc0=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 1 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f03100 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsFullDeleteLcb+ac fffff880`012e8be8 48894108 mov qword ptr [rcx+8],rax FAULTING_IP: Ntfs!NtfsFullDeleteLcb+ac fffff880`012e8be8 48894108 mov qword ptr [rcx+8],rax BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff880012648b9 to fffff880012e8be8 STACK_TEXT: fffff880`0318c990 fffff880`012648b9 : fffff8a0`0dc2d010 fffff800`02e71260 fffff880`0318cb01 fffff880`012eccc1 : Ntfs!NtfsFullDeleteLcb+0xac fffff880`0318c9c0 fffff880`012ea770 : fffffa80`0a9b0480 fffffa80`07228180 fffff8a0`0dc2d010 fffff8a0`123ee640 : Ntfs!NtfsTeardownFromLcb+0x129 fffff880`0318ca50 fffff880`0126c0e2 : fffffa80`0a9b0480 fffffa80`0a9b0480 fffff8a0`0dc2d010 00000000`00000000 : Ntfs!NtfsTeardownStructures+0x200 fffff880`0318cad0 fffff880`012fa193 : fffffa80`0a9b0480 fffff800`02e71260 fffff8a0`0dc2d010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2 fffff880`0318cb10 fffff880`012e9357 : fffffa80`0a9b0480 fffff8a0`0dc2d140 fffff8a0`0dc2d010 fffffa80`07228180 : Ntfs!NtfsCommonClose+0x353 fffff880`0318cbe0 fffff800`02cdb001 : 00000000`00000000 fffff800`02e71200 fffffa80`060f2b01 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f fffff880`0318ccb0 fffff800`02f6bfee : 00000000`00000000 fffffa80`060f2b60 00000000`00000080 fffffa80`060ce450 : nt!ExpWorkerThread+0x111 fffff880`0318cd40 fffff800`02cc25e6 : fffff880`009e9180 fffffa80`060f2b60 fffff880`009f3fc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9e0 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsFullDeleteLcb+ac FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b STACK_COMMAND: .cxr 0xfffff8800318bfb0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFullDeleteLcb+ac BUCKET_ID: X64_0x24_Ntfs!NtfsFullDeleteLcb+ac Followup: MachineOwner ---------
    1. Caused by Avast...
    2. Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...


    Do the following steps to resolve your crashes:
      My Computer


  4. Posts : 5
    Windows 7 Home Premium 64bit
    Thread Starter
       #4

    I tried to get the info to post the logs but it says that it couldnt find any....

    And after deleting Avast and getting another antivirus it still blue screens but i believe because of another reason...now.

    Here's the new Minidumps
      My Computer


  5. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #5

    Code:
    Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030812-23665-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
    Machine Name:
    Kernel base = 0xfffff800`02c66000 PsLoadedModuleList = 0xfffff800`02eab650
    Debug session time: Thu Mar  8 21:23:04.021 2012 (UTC - 7:00)
    System Uptime: 0 days 1:45:47.816
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .......................................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 24, {1904fb, fffff88003077fe8, fffff88003077840, fffff80002cffc6f}
    
    Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2b49 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    Arguments:
    Arg1: 00000000001904fb
    Arg2: fffff88003077fe8
    Arg3: fffff88003077840
    Arg4: fffff80002cffc6f
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_RECORD:  fffff88003077fe8 -- (.exr 0xfffff88003077fe8)
    Cannot read Exception record @ fffff88003077fe8
    
    CONTEXT:  fffff88003077840 -- (.cxr 0xfffff88003077840)
    rax=0000000000000000 rbx=0000000000000001 rcx=fdfffa8006b52bf8
    rdx=0000000080000000 rsi=fffff880009e9180 rdi=0000000000000000
    rip=fffff80002cffc6f rsp=fffff88003078220 rbp=fdfffa8006b52bb0
     r8=0000000000000000  r9=fffff880009e9180 r10=0000000000000000
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=fffffa8006c42648 r15=0000000000000000
    iopl=0         nv up ei pl zr na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210246
    nt!ExTryAcquireSpinLockExclusiveAtDpcLevel+0x2f:
    fffff800`02cffc6f f00fb111        lock cmpxchg dword ptr [rcx],edx ds:002b:fdfffa80`06b52bf8=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  NULL_DEREFERENCE
    
    PROCESS_NAME:  svchost.exe
    
    CURRENT_IRQL:  2
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f15100
     0000000000000000 
    
    FOLLOWUP_IP: 
    Ntfs! ?? ::FNODOBFM::`string'+2b49
    fffff880`0164ea88 cc              int     3
    
    FAULTING_IP: 
    nt!ExTryAcquireSpinLockExclusiveAtDpcLevel+2f
    fffff800`02cffc6f f00fb111        lock cmpxchg dword ptr [rcx],edx
    
    BUGCHECK_STR:  0x24
    
    LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002cffc6f
    
    STACK_TEXT:  
    fffff880`03076fd8 fffff880`0164ea88 : 00000000`00000024 00000000`001904fb fffff880`03077fe8 fffff880`03077840 : nt!KeBugCheckEx
    fffff880`03076fe0 fffff880`01662f3d : fffff880`01694f8c fffff880`030788e0 fffff880`030788b0 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x2b49
    fffff880`03077020 fffff800`02d11adc : 00000000`00000000 fffff880`00000000 00000000`00001000 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x12c6
    fffff880`03077060 fffff880`016625c5 : fffff880`01694f94 fffff880`030788b0 fffff880`03077fe8 fffff880`030788b0 : nt!_C_specific_handler+0x8c
    fffff880`030770d0 fffff800`02d1155d : fffff880`01694f80 00000000`00000000 fffff880`01649000 00000000`00000000 : Ntfs!_GSHandlerCheck_SEH+0x75
    fffff880`03077100 fffff800`02d10335 : fffff880`01694f80 fffff880`03077178 fffff880`03077fe8 fffff880`01649000 : nt!RtlpExecuteHandlerForException+0xd
    fffff880`03077130 fffff800`02d213b1 : fffff880`03077fe8 fffff880`03077840 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
    fffff880`03077810 fffff800`02ce5382 : fffff880`03077fe8 00000000`00000001 fffff880`03078090 fffff880`009e9180 : nt!KiDispatchException+0x135
    fffff880`03077eb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
    
    
    STACK_COMMAND:  kb
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2b49
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME:  Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b
    
    FAILURE_BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2b49
    
    BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2b49
    
    Followup: MachineOwner
    ---------
    The recent crashes are pointing toward hard disk errors. Proceed through the hard disk checks.
      My Computer


  6. Posts : 5
    Windows 7 Home Premium 64bit
    Thread Starter
       #6

    I did earlier but it didn't show any errors popping up. It seems as if everytime my computer is using alot of cpu usage is when the blue screens and errors start to happen. I'm gonna run it again to make sure. and post the results.
      My Computer


  7. Posts : 5
    Windows 7 Home Premium 64bit
    Thread Starter
       #7

    Checking file system on C:
    The type of the file system is NTFS.

    A disk check has been scheduled.
    Windows will now check the disk.

    CHKDSK is verifying files (stage 1 of 5)...
    158208 file records processed. File verification completed.
    115 large file records processed. 0 bad file records processed. 0 EA records processed. 45 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
    222718 index entries processed. Index verification completed.
    0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
    158208 file SDs/SIDs processed. Cleaning up 143 unused index entries from index $SII of file 0x9.
    Cleaning up 143 unused index entries from index $SDH of file 0x9.
    Cleaning up 143 unused security descriptors.
    Security descriptor verification completed.
    32256 data files processed. CHKDSK is verifying Usn Journal...
    34546144 USN bytes processed. Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
    158192 files processed. File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
    130851261 free clusters processed. Free space verification is complete.
    Windows has checked the file system and found no problems.

    606779391 KB total disk space.
    83025088 KB in 120402 files.
    72188 KB in 32257 indexes.
    0 KB in bad sectors.
    277067 KB in use by the system.
    65536 KB occupied by the log file.
    523405048 KB available on disk.

    4096 bytes in each allocation unit.
    151694847 total allocation units on disk.
    130851262 allocation units available on disk.

    Internal Info:
    00 6a 02 00 5f 54 02 00 10 4e 04 00 00 00 00 00 .j.._T...N......
    be 02 00 00 2d 00 00 00 00 00 00 00 00 00 00 00 ....-...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

    Windows has finished checking your disk.
    Please wait while your computer restarts.
    I believe this is the logs i was supposed to post? And btw it just keeps blue screen'ing...Minidump again..
      My Computer


  8. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #8

    Code:
    1. Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030912-36176-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506 Machine Name: Kernel base = 0xfffff800`02c19000 PsLoadedModuleList = 0xfffff800`02e5e670 Debug session time: Fri Mar 9 02:03:13.214 2012 (UTC - 7:00) System Uptime: 0 days 0:00:36.009 Loading Kernel Symbols ............................................................... ................................................................ .................................... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff80002c99cd9, fffff8800338afd8, fffff8800338a830} Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+139 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff80002c99cd9, The address that the exception occurred at Arg3: fffff8800338afd8, Exception Record Address Arg4: fffff8800338a830, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!KeSetEvent+139 fffff800`02c99cd9 0fb6422b movzx eax,byte ptr [rdx+2Bh] EXCEPTION_RECORD: fffff8800338afd8 -- (.exr 0xfffff8800338afd8) Cannot read Exception record @ fffff8800338afd8 CONTEXT: fffff8800338a830 -- (.cxr 0xfffff8800338a830) rax=0000000000000003 rbx=0000000000000000 rcx=fffffa8008dd6650 rdx=fdfffa8008dd66b8 rsi=0000000000000000 rdi=fffff88002f64180 rip=fffff80002c99cd9 rsp=fffff8800338b210 rbp=0000000000000000 r8=fdfffa8008dd66b8 r9=0000000000000000 r10=d860000000060000 r11=0000000000c00000 r12=fffffa80061378c0 r13=fffffa80061378c0 r14=0000000000000001 r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 nt!KeSetEvent+0x139: fffff800`02c99cd9 0fb6422b movzx eax,byte ptr [rdx+2Bh] ds:002b:fdfffa80`08dd66e3=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: NULL_DEREFERENCE PROCESS_NAME: svchost.exe CURRENT_IRQL: 2 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: 0000000000000000 READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec8100 0000000000000000 FOLLOWUP_IP: nt!KeSetEvent+139 fffff800`02c99cd9 0fb6422b movzx eax,byte ptr [rdx+2Bh] BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff80002fb1f79 to fffff80002c99cd9 STACK_TEXT: fffff880`0338b210 fffff800`02fb1f79 : fffff8a0`00000000 fffffa80`00000000 00000000`00001000 fdfffa80`08dd66b8 : nt!KeSetEvent+0x139 fffff880`0338b280 fffff800`02fb203f : 00000000`00000000 fffffa80`07a12070 fffff8a0`001af000 00000000`00c00000 : nt!EtwpRealtimeInjectEtwBuffer+0x17d fffff880`0338b310 fffff800`02fb32e9 : fffffa80`06137700 00000000`00000000 fffff8a0`001af000 00000000`c0000000 : nt!EtwpRealtimeDeliverBuffer+0x73 fffff880`0338b360 fffff800`02fb33ba : fffffa80`06137780 fffff8a0`001af000 00000000`c0000001 00000000`00010000 : nt!EtwpFlushBufferToRealtime+0x39 fffff880`0338b390 fffff800`02cd6f99 : 00000000`00000000 00000000`00000001 fffffa80`06137780 fffffa80`06137780 : nt!EtwpFlushBuffer+0x7a fffff880`0338b3d0 fffff800`02fb1d46 : fffffa80`06130000 00000000`00000001 00000000`00000000 fffff8a0`001af020 : nt!EtwpFlushActiveBuffers+0x2bd fffff880`0338bcc0 fffff800`02f30fee : 00000000`00000000 fffffa80`06144040 00000000`00000080 fffffa80`060d7400 : nt!EtwpLogger+0x1e2 fffff880`0338bd40 fffff800`02c875e6 : fffff880`02f64180 fffffa80`06144040 fffffa80`060fe680 00000000`00000000 : nt!PspSystemThreadStartup+0x5a fffff880`0338bd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!KeSetEvent+139 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3 STACK_COMMAND: .cxr 0xfffff8800338a830 ; kb FAILURE_BUCKET_ID: X64_0x7E_nt!KeSetEvent+139 BUCKET_ID: X64_0x7E_nt!KeSetEvent+139 Followup: MachineOwner ---------
    2. Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\030912-26847-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631 Machine Name: Kernel base = 0xfffff800`02c55000 PsLoadedModuleList = 0xfffff800`02e9a650 Debug session time: Thu Mar 8 23:27:35.808 2012 (UTC - 7:00) System Uptime: 0 days 1:04:40.603 Loading Kernel Symbols ............................................................... ................................................................ .................................... Loading User Symbols Loading unloaded module list ....... Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for atikmdag.sys *** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000007E, {ffffffffc0000005, fffff88004c148f5, fffff88003cd13c8, fffff88003cd0c20} Probably caused by : atikmdag.sys ( atikmdag+3c28f5 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: fffff88004c148f5, The address that the exception occurred at Arg3: fffff88003cd13c8, Exception Record Address Arg4: fffff88003cd0c20, Context Record Address Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: atikmdag+3c28f5 fffff880`04c148f5 8179083000bebe cmp dword ptr [rcx+8],0BEBE0030h EXCEPTION_RECORD: fffff88003cd13c8 -- (.exr 0xfffff88003cd13c8) ExceptionAddress: fffff88004c148f5 (atikmdag+0x00000000003c28f5) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88003cd0c20 -- (.cxr 0xfffff88003cd0c20) rax=fffff88004d42ed0 rbx=0000000000000001 rcx=fdfff8a00a8c7d00 rdx=fdfff8a00a8c7d00 rsi=00000000ffffffff rdi=0000000000000002 rip=fffff88004c148f5 rsp=fffff88003cd1608 rbp=fffffa80088e2c20 r8=0000000000000002 r9=0000000f10055000 r10=fffff8a00a1f0410 r11=fffff88003cd17d0 r12=fffff88004852000 r13=fffffa8008837a40 r14=fffffa80088eccd0 r15=fffffa8008837a40 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 atikmdag+0x3c28f5: fffff880`04c148f5 8179083000bebe cmp dword ptr [rcx+8],0BEBE0030h ds:002b:fdfff8a0`0a8c7d08=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f04100 ffffffffffffffff FOLLOWUP_IP: atikmdag+3c28f5 fffff880`04c148f5 8179083000bebe cmp dword ptr [rcx+8],0BEBE0030h BUGCHECK_STR: 0x7E LAST_CONTROL_TRANSFER: from fffff88004c5227f to fffff88004c148f5 STACK_TEXT: fffff880`03cd1608 fffff880`04c5227f : 00000000`00000000 00000000`00000001 00000000`00000003 00000000`00000001 : atikmdag+0x3c28f5 fffff880`03cd1610 00000000`00000000 : 00000000`00000001 00000000`00000003 00000000`00000001 fffff880`03cd1870 : atikmdag+0x40027f SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: atikmdag+3c28f5 FOLLOWUP_NAME: MachineOwner MODULE_NAME: atikmdag IMAGE_NAME: atikmdag.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d9689c5 STACK_COMMAND: .cxr 0xfffff88003cd0c20 ; kb FAILURE_BUCKET_ID: X64_0x7E_atikmdag+3c28f5 BUCKET_ID: X64_0x7E_atikmdag+3c28f5 Followup: MachineOwner ---------
    1. Possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
    2. Caused by your graphics card/graphics card drivers. Same other possible causes as 1.

    We seem to be past the hard disk error crashes. Just to be sure, though, have you run the hard disk manufacturer's diagnostics/tests?


    Proceed through the following hardware checks:
    • If you are overclocking any hardware, please stop.

    • Monitor temperatures during the following tests.
      Use the following programs to monitor the temperatures.


    • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

      If you swap any memory components, follow these steps for ESD safety:
      1. Shut down and turn off your computer.
      2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
      3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
      4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.

      Once these steps have been followed, it is safe to remove and replace components within your computer.



    Additionally, please follow the https://www.sevenforums.com/crashes-d...tructions.html to provide us with more details regarding your crashes. These will help us give more specific troubleshooting steps.
      My Computer


  9. Posts : 5
    Windows 7 Home Premium 64bit
    Thread Starter
       #9

    It just keeps doing the same thing and nothing's coming up with errors. but for some reason it just keeps running high in cpu usuage at random times. It also spikes up to high in cpu usuage, like unusually high when i play certain games and what not....

    Recent Dumps:
      My Computer


  10. Posts : 11,269
    Windows 7 Home Premium 64 Bit
       #10

    The most recent crashes (031212-18735-01.dmp) point to hard disk errors again. I would suggest doing the hard disk diagnostics through your hard disk manufacturer.

    Also, please fill out your system specs more: System Info - See Your System Specs



    Code:
    Loading Dump File [D:\Kingston\BSODDmpFiles\Bolo\031112-32027-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e9c670
    Debug session time: Sun Mar 11 03:38:11.745 2012 (UTC - 6:00)
    System Uptime: 0 days 4:42:52.540
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................................
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, fffff80002cdd985, fffff880031cb738, fffff880031caf90}
    
    Unable to load image \SystemRoot\System32\drivers\WRkrn.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for WRkrn.sys
    *** ERROR: Module load completed but symbols could not be loaded for WRkrn.sys
    Probably caused by : tdx.sys ( tdx!TdxDisassociateConnection+2d )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff80002cdd985, The address that the exception occurred at
    Arg3: fffff880031cb738, Exception Record Address
    Arg4: fffff880031caf90, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    nt!KeAcquireSpinLockRaiseToDpc+55
    fffff800`02cdd985 f0480fba2900    lock bts qword ptr [rcx],0
    
    EXCEPTION_RECORD:  fffff880031cb738 -- (.exr 0xfffff880031cb738)
    ExceptionAddress: fffff80002cdd985 (nt!KeAcquireSpinLockRaiseToDpc+0x0000000000000055)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    CONTEXT:  fffff880031caf90 -- (.cxr 0xfffff880031caf90)
    rax=0000000000000002 rbx=0000000000000000 rcx=fdfffa80093ce368
    rdx=fffff88004163110 rsi=fffffa8007a09e00 rdi=fffff80002e49e80
    rip=fffff80002cdd985 rsp=fffff880031cb970 rbp=fdfffa80093ce368
     r8=fffffa80093adf28  r9=0000000000000000 r10=fffffa8006126640
    r11=fffffa80093adf70 r12=fffff880031cba40 r13=00000000031cba40
    r14=0000000000000000 r15=0000000000000001
    iopl=0         nv up ei pl nz na po nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
    nt!KeAcquireSpinLockRaiseToDpc+0x55:
    fffff800`02cdd985 f0480fba2900    lock bts qword ptr [rcx],0 ds:002b:fdfffa80`093ce368=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  2
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  ffffffffffffffff
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f06100
     ffffffffffffffff 
    
    FOLLOWUP_IP: 
    tdx!TdxDisassociateConnection+2d
    fffff880`0415c0cd 488b6b58        mov     rbp,qword ptr [rbx+58h]
    
    BUGCHECK_STR:  0x7E
    
    LAST_CONTROL_TRANSFER:  from fffff8800415c0cd to fffff80002cdd985
    
    STACK_TEXT:  
    fffff880`031cb970 fffff880`0415c0cd : fffffa80`07a09e20 fffff880`031cba40 fffffa80`093ade10 fdfffa80`093ce360 : nt!KeAcquireSpinLockRaiseToDpc+0x55
    fffff880`031cb9c0 fffff880`04154b9f : fffffa80`093adf28 fdfffa80`093ce360 fffffa80`07a09e20 fffffa80`093adf70 : tdx!TdxDisassociateConnection+0x2d
    fffff880`031cba10 fffff880`011836af : fffffa80`093ade10 fffffa80`07a09e20 00000000`00000000 00000000`00000000 : tdx! ?? ::FNODOBFM::`string'+0x47e1
    fffff880`031cba90 fffffa80`093ade10 : fffffa80`07a09e20 00000000`00000000 00000000`00000000 fffffa80`093ade10 : WRkrn+0x66af
    fffff880`031cba98 fffffa80`07a09e20 : 00000000`00000000 00000000`00000000 fffffa80`093ade10 fffff880`041a1ce3 : 0xfffffa80`093ade10
    fffff880`031cbaa0 00000000`00000000 : 00000000`00000000 fffffa80`093ade10 fffff880`041a1ce3 00000000`00000000 : 0xfffffa80`07a09e20
    
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  tdx!TdxDisassociateConnection+2d
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: tdx
    
    IMAGE_NAME:  tdx.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79332
    
    STACK_COMMAND:  .cxr 0xfffff880031caf90 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_tdx!TdxDisassociateConnection+2d
    
    BUCKET_ID:  X64_0x7E_tdx!TdxDisassociateConnection+2d
    
    Followup: MachineOwner
    ---------
    Points to Webroot as the cause of this crash.

    Uninstall Webroot and replace with either or the
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:33.
Find Us