Problem Devices:
Code:
Cisco Systems VPN Adapter for 64-bit Windows ROOT\NET\0000 This device is disabled.
Security Software:
Code:
vipappservice.exe c:\program files (x86)\symantec\vip access client\vipappservice.exe 8356 8 200 1380 3/23/2012 9:40 PM 2.0.2.140 80.61 KB (82,544 bytes) 6/30/2011 1:07 AM
vipuimanager.exe c:\program files (x86)\symantec\vip access client\vipuimanager.exe 6196 8 200 1380 3/23/2012 9:46 PM 2.0.2.140 2.08 MB (2,185,832 bytes) 6/30/2011 1:07 AM
avastsvc.exe c:\program files\avast software\avast\avastsvc.exe 2096 8 200 1380 3/23/2012 9:38 PM 7.0.1426.0 43.72 KB (44,768 bytes) 3/23/2012 7:13 PM
avastui.exe c:\program files\avast software\avast\avastui.exe 1744 8 200 1380 3/23/2012 9:38 PM 7.0.1426.0 4.05 MB (4,241,512 bytes) 3/23/2012 7:13 PM
Possible out of date drivers:
Code:
dne64x fffff880`04c60000 fffff880`04c8c000 Mon Nov 10 18:01:24 2008 (4918d964) 000359da dne64x.sys
LenovoRd fffff880`027cb000 fffff880`027e7d00 Mon May 11 03:33:56 2009 (4a07f104) 000271d2 LenovoRd.sys
dne64x.sys
LenovoRd.sys
Code:
Loading Dump File [D:\Kingston\BSODDmpFiles\AfraidOfDecaf\Windows_NT6_BSOD_jcgriff2\032312-13166-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`02e5a000 PsLoadedModuleList = 0xfffff800`0309e650
Debug session time: Fri Mar 23 19:35:25.355 2012 (UTC - 6:00)
System Uptime: 0 days 0:28:46.214
Loading Kernel Symbols
...............................................................
................................................................
..............................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff88007e661c0, fffff880247456c0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceHandler+7c )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88007e661c0, Address of the instruction which caused the bugcheck
Arg3: fffff880247456c0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
+0
fffff880`07e661c0 0000 add byte ptr [rax],al
CONTEXT: fffff880247456c0 -- (.cxr 0xfffff880247456c0)
rax=0000000000000000 rbx=0000000000000000 rcx=0000f88003e841ba
rdx=fffffa8014b664a1 rsi=0000000000000008 rdi=0000000000000000
rip=fffff88007e661c0 rsp=fffff880247460a8 rbp=fffff88024746b60
r8=fffffa8014b664a0 r9=0000000000000010 r10=fffffa800cd6c980
r11=fffff880247460a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
fffff880`07e661c0 0000 add byte ptr [rax],al ds:002b:00000000`00000000=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88007e661c0
STACK_TEXT:
fffff880`24744df8 fffff800`02ed62e9 : 00000000`0000003b 00000000`c0000005 fffff880`07e661c0 fffff880`247456c0 : nt!KeBugCheckEx
fffff880`24744e00 fffff800`02ed5c3c : fffff880`24745e68 fffff880`247456c0 00000000`00000000 fffff800`02f01f60 : nt!KiBugCheckDispatch+0x69
fffff880`24744f40 fffff800`02f01a6d : fffff800`030f4764 fffff800`030197a8 fffff800`02e5a000 fffff880`24745e68 : nt!KiSystemServiceHandler+0x7c
fffff880`24744f80 fffff800`02f00845 : fffff800`03020638 fffff880`24744ff8 fffff880`24745e68 fffff800`02e5a000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`24744fb0 fffff800`02f117c1 : fffff880`24745e68 fffff880`247456c0 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
fffff880`24745690 fffff800`02ed63c2 : fffff880`24745e68 00000000`00000000 fffff880`24745f10 00000000`00000008 : nt!KiDispatchException+0x135
fffff880`24745d30 fffff800`02ed4f3a : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`24745f10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceHandler+7c
fffff800`02ed5c3c b801000000 mov eax,1
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceHandler+7c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0x3B_nt!KiSystemServiceHandler+7c
BUCKET_ID: X64_0x3B_nt!KiSystemServiceHandler+7c
Followup: MachineOwner
---------
It is easier to find patterns with multiple dmp files, so we may have to wait for you to crash a few more times to determine the cause. Possible causes of the above crash are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
Start with the following steps:- Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
If you swap any memory components, follow these steps for ESD safety:
- Shut down and turn off your computer.
- Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
- Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
- Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
Once these steps have been followed, it is safe to remove and replace components within your computer.
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
a.
Backup your system and user files
b.
Create a system restore point
c. If you do not have a Windows 7 DVD,
Create a system repair disc
d. In Windows 7:
- Click the Start Menu
- Type verifier in Search programs and files (do not hit enter)
- Right click verifier and click Run as administrator
- Put a tick in Create custom settings (for code developers) and click next
- Put a tick in Select individual settings from a full list and click next
- Set up the individual settings as in the image and click next
Attachment 204113 - Put a tick in Select driver names from a list
- Put a tick next to all non-Microsoft drivers.
- Click Finish.
- Restart your computer.
If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using
System Restore OPTION TWO.
Thanks to zigzag3143 for contributing to the Verifier steps.
If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.