Crash Dmp - 0x...c2 and 0x...24

beeswax · 23 Dec 2011

I just install my MB and loaded a fresh copy on win7. I have gotten a blue screen each day since. 0x24 first and then 0xc2.

There isn't a pattern to the crahed yet. One happened at boot and one when I was playing wow. I have attached the crash dump files. I have to change the DMP extension to txt in order to upload.

Thank you for any help that can be deciphered for the files.

Win7 Prem Home 64bit
Fresh Retail install 12/19

MB - GA-880GMA-USB3
CPU - Athlon II x4 630
Mem - 8g - pc3-10700
Vid - ATI HD 4250 - onboard
Sound - Realtek - on board
HDD - Seagate Barracuda - ST3750528AS
PSU - HCE hp585D atx12v

writhziden · 23 Dec 2011

Download and run the AVG Removal Tool to uninstall AVG, which can be a source of BSODs. Install Microsoft Security Essentials in its place.

writhziden · 23 Dec 2011

Code:

BugCheck 50, {fffffa8005049000, 0, fffff80002ece38a, 0}

Unable to load image \SystemRoot\system32\drivers\copperhd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for copperhd.sys
*** ERROR: Module load completed but symbols could not be loaded for copperhd.sys

Could not read faulting driver name
Probably caused by : copperhd.sys ( copperhd+16c9 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8005049000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ece38a, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310f0e0
 fffffa8005049000 

FAULTING_IP: 
nt!memmove+ca
fffff800`02ece38a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  razerhid.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88003a942e0 -- (.trap 0xfffff88003a942e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=02010008fffffa80 rbx=0000000000000000 rcx=000000000018ec60
rdx=fffffa8004eba3a4 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ece38a rsp=fffff88003a94478 rbp=00000000a000000c
 r8=000000000000018c  r9=0000000000000001 r10=046786c0ffff2aa4
r11=000000000018eadc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!memmove+0xca:
fffff800`02ece38a 4c8b540af8      mov     r10,qword ptr [rdx+rcx-8] ds:0700:fffffa80`05048ffc=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f57df4 to fffff80002ed75c0

STACK_TEXT:  
fffff880`03a94178 fffff800`02f57df4 : 00000000`00000050 fffffa80`05049000 00000000`00000000 fffff880`03a942e0 : nt!KeBugCheckEx
fffff880`03a94180 fffff800`02ed56ae : 00000000`00000000 fffffa80`046243e0 fffff880`02dddf00 fffff800`02edd982 : nt! ?? ::FNODOBFM::`string'+0x426f7
fffff880`03a942e0 fffff800`02ece38a : fffff800`02ef6bc3 fffff880`009ec560 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`03a94478 fffff800`02ef6bc3 : fffff880`009ec560 00000000`00000000 00000000`00000000 00000000`00000000 : nt!memmove+0xca
fffff880`03a94480 fffff800`02ed9f76 : 00000000`00000000 fffffa80`040f8f10 00000000`00000001 00000000`00000000 : nt!IopCompleteRequest+0x5a3
fffff880`03a94550 fffff880`059df6c9 : 00000000`00000156 00000000`00000000 fffffa80`656e6f4e 00000000`00000000 : nt!IopfCompleteRequest+0x6f6
fffff880`03a94640 00000000`00000156 : 00000000`00000000 fffffa80`656e6f4e 00000000`00000000 00000000`000007ff : copperhd+0x16c9
fffff880`03a94648 00000000`00000000 : fffffa80`656e6f4e 00000000`00000000 00000000`000007ff 00000000`00000440 : 0x156


STACK_COMMAND:  kb

FOLLOWUP_IP: 
copperhd+16c9
fffff880`059df6c9 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  copperhd+16c9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: copperhd

IMAGE_NAME:  copperhd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4af91b39

FAILURE_BUCKET_ID:  X64_0x50_copperhd+16c9

BUCKET_ID:  X64_0x50_copperhd+16c9

Followup: MachineOwner
---------


BugCheck 24, {70f89, 21, 0, 0}

Unable to load image AVGIDSFilter.Sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AVGIDSFilter.Sys
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.Sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCleanup+35ee )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 0000000000070f89
Arg2: 0000000000000021
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x24

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff880012e9d04 to fffff80002e8a5c0

STACK_TEXT:  
fffff880`05e8f108 fffff880`012e9d04 : 00000000`00000024 00000000`00070f89 00000000`00000021 00000000`00000000 : nt!KeBugCheckEx
fffff880`05e8f110 fffff880`01258829 : 00000000`00000000 00000000`00000000 fffff880`05e8f660 fffff880`05e7e000 : Ntfs!NtfsCommonCleanup+0x35ee
fffff880`05e8f520 fffff800`02e99cda : fffff880`05e8f660 00008000`00000001 00000000`00008000 00000000`000f2400 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`05e8f550 fffff880`012583e2 : fffff880`01258810 fffff880`05e8f660 fffff880`05e8f900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`05e8f630 fffff880`012f7324 : fffff880`05e8f700 fffff880`05e8f700 fffff880`05e8f700 00000000`00000000 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`05e8f6a0 fffff880`0103f23f : fffff880`05e8f700 fffffa80`095aa010 fffffa80`095aa3f8 fffffa80`09265c30 : Ntfs!NtfsFsdCleanup+0x144
fffff880`05e8f910 fffff880`0103d6df : fffffa80`0732d9e0 00000000`00000000 fffffa80`071e7c00 fffffa80`095aa010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`05e8f9a0 fffff880`0387465c : fffffa80`095aa010 00000000`00000000 fffffa80`09744060 00000000`00000000 : fltmgr!FltpDispatch+0xcf
fffff880`05e8fa00 fffffa80`095aa010 : 00000000`00000000 fffffa80`09744060 00000000`00000000 fffffa80`0801d4b0 : AVGIDSFilter+0x365c
fffff880`05e8fa08 00000000`00000000 : fffffa80`09744060 00000000`00000000 fffffa80`0801d4b0 fffff800`0319d88f : 0xfffffa80`095aa010


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonCleanup+35ee
fffff880`012e9d04 49837b4000      cmp     qword ptr [r11+40h],0

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsCommonCleanup+35ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79996d

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonCleanup+35ee

BUCKET_ID:  X64_0x24_Ntfs!NtfsCommonCleanup+35ee

Followup: MachineOwner
---------


BugCheck C2, {7, 109b, c0e7110, fffffa8006b34bb8}

GetPointerFromAddress: unable to read from fffff80003317100
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+539 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000c0e7110, Memory contents of the pool block
Arg4: fffffa8006b34bb8, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffffa8006b34bb8 

FREED_POOL_TAG:  ViMm

BUGCHECK_STR:  0xc2_7_ViMm

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003212be9 to fffff800030e4c40

STACK_TEXT:  
fffff880`0317ea58 fffff800`03212be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0c0e7110 : nt!KeBugCheckEx
fffff880`0317ea60 fffff880`012cf379 : fffffa80`074b7180 fffff800`03285260 fffff8a0`0b915b40 00000000`00000009 : nt!ExDeferredFreePool+0x1201
fffff880`0317eb10 fffff880`012be357 : fffffa80`090b2bd0 fffff8a0`0b915c70 fffff8a0`0b915b40 fffffa80`074b7180 : Ntfs!NtfsCommonClose+0x539
fffff880`0317ebe0 fffff800`030ef001 : 00000000`00000000 fffff800`033db900 fffff800`032e6801 00000000`00000020 : Ntfs!NtfsFspClose+0x15f
fffff880`0317ecb0 fffff800`0337ffee : 00000000`00000000 fffffa80`06409680 00000000`00000080 fffffa80`0639d840 : nt!ExpWorkerThread+0x111
fffff880`0317ed40 fffff800`030d65e6 : fffff880`02f64180 fffffa80`06409680 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0317ed80 00000000`00000000 : fffff880`0317f000 fffff880`03179000 fffff880`0317e9e0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+539
fffff880`012cf379 e918fdffff      jmp     Ntfs!NtfsCommonClose+0x256 (fffff880`012cf096)

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsCommonClose+539

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0xc2_7_ViMm_Ntfs!NtfsCommonClose+539

BUCKET_ID:  X64_0xc2_7_ViMm_Ntfs!NtfsCommonClose+539

Followup: MachineOwner
---------

I note that you have Gigabyte EasyTune6 driver (GVTDrv64.sys) installed on your system which has known issues with Windows 7. See Driver Reference. It would be a good idea to remove the software.

Your first blue screen was caused by copperhd.sys by Razer Diamondback. See Driver Reference for updating the driver. Note: this may have been related to EasyTune's incompatibility with Windows 7.

Your other blue screens were NTFS related, possibly due to corruption on the hard drive and possibly due to AVG. Recommend running Disk Check on all drives containing system files and program files. Run first with "automatically fix file system errors" checked, and then if the problem persists, run with "Scan for and attempt recovery of bad sectors" checked.

beeswax · 23 Dec 2011

Uninstalled AVG / Razor software / Easy tune.

Installed MS Security Essentials.

Will post back if another crash happens.

writhziden · 23 Dec 2011

beeswax said:

Uninstalled AVG / Razor software / Easy tune.

Installed MS Security Essentials.

Will post back if another crash happens.

Alright, good to hear. We're here if you need help with anything. :)

beeswax · 23 Dec 2011

If easytune is bad, what would you suggest for pcu core temp monitor. Overdrive?

writhziden · 23 Dec 2011

I use HWiNFO64 myself.

beeswax · 23 Dec 2011

just got another bsod - this time on boot up - dump file attached.

writhziden · 23 Dec 2011

The blue screen was caused by readyboost, probably due to the system files being accessed by multiple processes/applications. I wouldn't worry too much about it unless it occurs again. You can try running without ReadyBoost on your system and see if things run more stable.

beeswax · 14 Jan 2012

thank you for your previous help, everything has been good. Until this morning when i blue screened 0...x19. I have attached the dmp file.