Antivirus Software:
Code:
avastsvc.exe c:\program files\avast software\avast\avastsvc.exe 1128 8 200 1380 23/02/2012 7:07 PM 6.0.1367.0 43.72 KB (44,768 bytes) 14/02/2012 9:47 PM
avastui.exe c:\program files\avast software\avast\avastui.exe 2640 8 200 1380 23/02/2012 7:08 PM 6.0.1367.0 3.57 MB (3,744,552 bytes) 14/02/2012 9:47 PM
Code:
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Kingston\BSODDmpFiles\Joaks\Windows_NT6_BSOD_jcgriff2\022312-35381-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0a000 PsLoadedModuleList = 0xfffff800`0304f670
Debug session time: Thu Feb 23 18:47:29.882 2012 (UTC - 7:00)
System Uptime: 0 days 0:07:29.318
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff880088b81e8, fffff880088b7a40, fffff880012d7c04}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefix+114 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880088b81e8
Arg3: fffff880088b7a40
Arg4: fffff880012d7c04
Debugging Details:
------------------
EXCEPTION_RECORD: fffff880088b81e8 -- (.exr 0xfffff880088b81e8)
ExceptionAddress: fffff880012d7c04 (Ntfs!NtfsFindPrefix+0x0000000000000114)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff880088b7a40 -- (.cxr 0xfffff880088b7a40)
rax=fffff8a0045b3d36 rbx=0100000000000000 rcx=0000000000000160
rdx=fffff8a008cf0a54 rsi=fffff8a007b65140 rdi=fffff8a008cf0990
rip=fffff880012d7c04 rsp=fffff880088b8420 rbp=fffff880088b86a0
r8=0000000000000002 r9=fffff8a008cf0a54 r10=fffff880088b8480
r11=fffff880088b8460 r12=000000000000000c r13=0000000000000000
r14=0000000000000000 r15=fffff880088b89d8
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
Ntfs!NtfsFindPrefix+0x114:
fffff880`012d7c04 4c8b4bf8 mov r9,qword ptr [rbx-8] ds:002b:00ffffff`fffffff8=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: where.exe
CURRENT_IRQL: 1
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b9100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFindPrefix+114
fffff880`012d7c04 4c8b4bf8 mov r9,qword ptr [rbx-8]
FAULTING_IP:
Ntfs!NtfsFindPrefix+114
fffff880`012d7c04 4c8b4bf8 mov r9,qword ptr [rbx-8]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012cf264 to fffff880012d7c04
STACK_TEXT:
fffff880`088b8420 fffff880`012cf264 : fffffa80`047f0a30 fffff8a0`07b65140 fffff880`088b89b8 fffff880`088b8668 : Ntfs!NtfsFindPrefix+0x114
fffff880`088b84d0 fffff880`012cc911 : fffffa80`047f0a30 fffff980`1faeac10 fffff880`088b86a0 fffff880`088b86f0 : Ntfs!NtfsFindStartingNode+0x6e4
fffff880`088b85a0 fffff880`01235a3d : fffffa80`047f0a30 fffff980`1faeac10 fffff880`088b8950 fffff8a0`0216e500 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`088b8780 fffff800`02e93618 : fffff880`088b88c0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`088b87b0 fffff880`012361bf : fffff880`01235a20 fffff880`01235020 00000000`00000000 fffff880`012d6f00 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`088b8890 fffff880`012cf99c : 00000000`00000000 00000000`00000000 00000000`00000002 fffff980`1faeac10 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`088b88f0 fffff800`0332cc16 : fffffa80`053f4030 fffff980`1faeac10 fffffa80`07625800 fffff800`03132207 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`088b8aa0 fffff880`010b43a2 : fffff980`1faeac10 00000000`00000000 fffffa80`05572010 fffffa80`066f7b70 : nt!IovCallDriver+0x566
fffff880`088b8b00 fffff800`0332cc16 : fffff980`00000060 00000000`00000002 fffffa80`07565a98 fffff8a0`03e6d610 : fltmgr!FltpCreate+0x392
fffff880`088b8bb0 fffff800`03184f95 : 00000000`00000006 fffffa80`036abcc8 fffffa80`0721bb10 fffffa80`075398e0 : nt!IovCallDriver+0x566
fffff880`088b8c10 fffff800`03181838 : fffffa80`0544c940 fffff800`00000000 fffffa80`036abb10 fffff980`00000000 : nt!IopParseDevice+0x5a5
fffff880`088b8da0 fffff800`03182a56 : 00000000`00000000 fffffa80`036abb10 fffff880`00000000 fffffa80`037309f0 : nt!ObpLookupObjectName+0x588
fffff880`088b8e90 fffff800`0318435c : 00000000`000003a0 00000000`00000000 ffffe01f`d86c4d00 fffff800`02f23122 : nt!ObOpenObjectByName+0x306
fffff880`088b8f60 fffff800`0312b88b : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopCreateFile+0x2bc
fffff880`088b9000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IoCreateFileEx+0xfb
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFindPrefix+114
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4d79997b
STACK_COMMAND: .cxr 0xfffff880088b7a40 ; kb
FAILURE_BUCKET_ID: X64_0x24_VRF_Ntfs!NtfsFindPrefix+114
BUCKET_ID: X64_0x24_VRF_Ntfs!NtfsFindPrefix+114
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\Joaks\Windows_NT6_BSOD_jcgriff2\022312-36660-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e10000 PsLoadedModuleList = 0xfffff800`03055670
Debug session time: Thu Feb 23 18:38:45.184 2012 (UTC - 7:00)
System Uptime: 0 days 0:06:47.573
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff9801d908c10, fffff9801d908272, d03e8, 23}
Probably caused by : CLASSPNP.SYS ( CLASSPNP!TransferPktComplete+1ce )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff9801d908c10, address trying to free
Arg2: fffff9801d908272, address where bits are corrupted
Arg3: 00000000000d03e8, (reserved)
Arg4: 0000000000000023, caller is freeing an address where nearby bytes within the same page have been corrupted
Debugging Details:
------------------
BUGCHECK_STR: 0xC1_23
SPECIAL_POOL_CORRUPTION_TYPE: 23
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: AvastSvc.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff80002f15ffa to fffff80002e8cc40
STACK_TEXT:
fffff880`02f93478 fffff800`02f15ffa : 00000000`000000c1 fffff980`1d908c10 fffff980`1d908272 00000000`000d03e8 : nt!KeBugCheckEx
fffff880`02f93480 fffff800`02f8e9b3 : fffff880`02f93620 fffff800`02e10000 fffffa80`00000001 fffffa80`06a86c68 : nt!MiCheckSpecialPoolSlop+0x9a
fffff880`02f934c0 fffff800`02fba93b : fffff800`02e10000 00000000`2b707249 ffffffff`ffd75448 00000000`00000001 : nt!MmFreeSpecialPool+0x1d3
fffff880`02f93600 fffff800`03331026 : fffffa80`0765a302 fffffa80`0765a340 00000000`00000000 fffff980`1d908c10 : nt!ExDeferredFreePool+0xf33
fffff880`02f936b0 fffff800`033315ec : fffff800`02e90134 fffff980`1d908c10 fffff880`02f64180 00000000`00000000 : nt!VfIoFreeIrp+0xe6
fffff880`02f936e0 fffff800`02e90134 : 00000000`00000002 00000000`00000002 fffff880`02f64180 00000000`00000000 : nt!IovFreeIrpPrivate+0x5c
fffff880`02f93720 fffff800`0332c19f : fffff980`ffffff01 00000000`ffffff01 fffffa80`06a86c68 00000000`00000000 : nt!IopfCompleteRequest+0x454
fffff880`02f93810 fffff880`01651bce : 00000000`00007000 fffff980`1c9e0e02 00000000`00000008 fffffa80`051d2010 : nt!IovCompleteRequest+0x19f
fffff880`02f938e0 fffff800`033345d6 : fffffa80`07614230 fffffa80`07614230 fffff880`02f93b00 fffff980`1c9e0e50 : CLASSPNP!TransferPktComplete+0x1ce
fffff880`02f93960 fffff800`02e90021 : fffff980`1c9e0fb3 00000000`00000001 00000000`00000000 fffff800`02f49803 : nt!IovpLocalCompletionRoutine+0x166
fffff880`02f939c0 fffff800`0332c19f : fffff980`1c9e0e50 fffffa80`04fb0701 fffffa80`04fb0701 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`02f93ab0 fffff880`0101041a : 00000000`00008000 00000000`00000000 00000000`00000000 fffffa80`04fb07d0 : nt!IovCompleteRequest+0x19f
fffff880`02f93b80 fffff880`01010242 : fffffa80`071c4b80 fffff880`01012b53 fffffa80`06dd66f0 fffffa80`04fb07d0 : ataport!IdeCompleteScsiIrp+0x62
fffff880`02f93bb0 fffff880`0100ae32 : 00000000`00000000 00000000`00000000 fffffa80`04f5a500 fffffa80`04fb07d0 : ataport!IdeCommonCrbCompletion+0x5a
fffff880`02f93be0 fffff880`01013805 : fffffa80`04f591a0 fffffa80`071c4b80 00000000`00000000 fffffa80`071c4b80 : ataport!IdeTranslateCompletedRequest+0x236
fffff880`02f93d10 fffff880`01013104 : fffffa80`04f591a0 00000000`00000000 fffffa80`04f591a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff880`02f93e40 fffff800`02e980ac : fffff880`02f64180 fffffa80`0000660b fffffa80`04f59050 fffffa80`04f59118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`02f93f00 fffff800`02e8f765 : c2addfbd`5a7e0cac fffffa80`075eeb60 00000000`00000000 fffff880`01012f5c : nt!KiRetireDpcList+0x1bc
fffff880`02f93fb0 fffff800`02e8f57c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`087fcbe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
CLASSPNP!TransferPktComplete+1ce
fffff880`01651bce 837c243002 cmp dword ptr [rsp+30h],2
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: CLASSPNP!TransferPktComplete+1ce
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CLASSPNP
IMAGE_NAME: CLASSPNP.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7929b
FAILURE_BUCKET_ID: X64_0xC1_23_VRF_CLASSPNP!TransferPktComplete+1ce
BUCKET_ID: X64_0xC1_23_VRF_CLASSPNP!TransferPktComplete+1ce
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\Joaks\Windows_NT6_BSOD_jcgriff2\022212-36176-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e12000 PsLoadedModuleList = 0xfffff800`03057670
Debug session time: Wed Feb 22 22:45:17.098 2012 (UTC - 7:00)
System Uptime: 0 days 0:07:37.144
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff98020300ee0, fffff98020300072, 710118, 23}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+9a )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98020300ee0, address trying to free
Arg2: fffff98020300072, address where bits are corrupted
Arg3: 0000000000710118, (reserved)
Arg4: 0000000000000023, caller is freeing an address where nearby bytes within the same page have been corrupted
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'WudfPf' and 'WinUsb.sys' overlap
BUGCHECK_STR: 0xC1_23
SPECIAL_POOL_CORRUPTION_TYPE: 23
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
IRP_ADDRESS: fffffa80063e0308
LAST_CONTROL_TRANSFER: from fffff80002f17ffa to fffff80002e8ec40
STACK_TEXT:
fffff880`069e5678 fffff800`02f17ffa : 00000000`000000c1 fffff980`20300ee0 fffff980`20300072 00000000`00710118 : nt!KeBugCheckEx
fffff880`069e5680 fffff800`02f909b3 : 00000000`00000000 00000000`00040001 00000000`00000003 fffffa80`063ddb60 : nt!MiCheckSpecialPoolSlop+0x9a
fffff880`069e56c0 fffff800`02fbc93b : fffff800`02e12000 00000000`2b707249 ffffffff`ffba0438 00000000`00000001 : nt!MmFreeSpecialPool+0x1d3
fffff880`069e5800 fffff800`03333026 : fffffa80`07484602 fffffa80`074846c0 00000000`00000000 fffff980`20300ee0 : nt!ExDeferredFreePool+0xf33
fffff880`069e58b0 fffff800`033335ec : fffff800`02ea3ed2 fffff980`20300ee0 fffff880`069e5ca0 00000000`00000000 : nt!VfIoFreeIrp+0xe6
fffff880`069e58e0 fffff800`02ea3ed2 : fffff880`069e5ca0 fffff980`20300ee0 00000000`00000000 00000000`00000000 : nt!IovFreeIrpPrivate+0x5c
fffff880`069e5920 fffff800`02e5e96d : fffffa80`063e0380 fffff800`03333026 fffffa80`0753c400 fffffa80`0753c410 : nt!IopCompleteRequest+0x402
fffff880`069e59f0 fffff800`031776e7 : 00000000`00000000 fffffa80`039bb201 fffffa80`06197600 00000000`00000000 : nt!IopPostProcessIrp+0x4d
fffff880`069e5a70 fffff800`03149ae5 : fffff880`00000000 fffff880`069e5b68 fffff880`069e5b60 00000000`00000001 : nt!IoRemoveIoCompletion+0xe7
fffff880`069e5b00 fffff800`02e8ded3 : fffffa80`063ddb60 00000000`02b7eee8 fffff880`069e5bc8 00000000`02772320 : nt!NtRemoveIoCompletion+0x145
fffff880`069e5bb0 00000000`750d2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02b7eec8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x750d2e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiCheckSpecialPoolSlop+9a
fffff800`02f17ffa cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiCheckSpecialPoolSlop+9a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a
BUCKET_ID: X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\Joaks\Windows_NT6_BSOD_jcgriff2\022212-36785-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4b000 PsLoadedModuleList = 0xfffff800`03090670
Debug session time: Wed Feb 22 22:36:31.002 2012 (UTC - 7:00)
System Uptime: 0 days 0:18:02.438
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff98019deef30, fffff98019dee937, c940d8, 32}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+1f82a1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98019deef30, address trying to free
Arg2: fffff98019dee937, address where one bit is corrupted
Arg3: 0000000000c940d8, (reserved)
Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error
Debugging Details:
------------------
BUGCHECK_STR: 0xC1_32
SPECIAL_POOL_CORRUPTION_TYPE: 32
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002f50fe3 to fffff80002ec7c40
STACK_TEXT:
fffff880`053cedb8 fffff800`02f50fe3 : 00000000`000000c1 fffff980`19deef30 fffff980`19dee937 00000000`00c940d8 : nt!KeBugCheckEx
fffff880`053cedc0 fffff800`02fc99b3 : 00000000`00000050 00000000`00000001 00000000`00000003 fffffa80`06728298 : nt!MiCheckSpecialPoolSlop+0x83
fffff880`053cee00 fffff800`02ff593b : fffff800`02e4b000 00000000`4d52564e 00000000`00002b68 fffff980`19deef30 : nt!MmFreeSpecialPool+0x1d3
fffff880`053cef40 fffff880`0f2692a1 : 00000000`ffffffff 00000000`ffffffff fffff980`2698cfc8 00000000`00000030 : nt!ExDeferredFreePool+0xf33
fffff880`053ceff0 00000000`ffffffff : 00000000`ffffffff fffff980`2698cfc8 00000000`00000030 fffff980`19deef30 : nvlddmkm+0x1f82a1
fffff880`053ceff8 00000000`ffffffff : fffff980`2698cfc8 00000000`00000030 fffff980`19deef30 fffff880`0f297298 : 0xffffffff
fffff880`053cf000 fffff980`2698cfc8 : 00000000`00000030 fffff980`19deef30 fffff880`0f297298 00000000`ffffffff : 0xffffffff
fffff880`053cf008 00000000`00000030 : fffff980`19deef30 fffff880`0f297298 00000000`ffffffff 00000000`00000030 : 0xfffff980`2698cfc8
fffff880`053cf010 fffff980`19deef30 : fffff880`0f297298 00000000`ffffffff 00000000`00000030 fffffa80`00000000 : 0x30
fffff880`053cf018 fffff880`0f297298 : 00000000`ffffffff 00000000`00000030 fffffa80`00000000 fffffa80`05d66000 : 0xfffff980`19deef30
fffff880`053cf020 00000000`ffffffff : 00000000`00000030 fffffa80`00000000 fffffa80`05d66000 fffff800`02e4b000 : nvlddmkm+0x226298
fffff880`053cf028 00000000`00000030 : fffffa80`00000000 fffffa80`05d66000 fffff800`02e4b000 00000000`4d52564e : 0xffffffff
fffff880`053cf030 fffffa80`00000000 : fffffa80`05d66000 fffff800`02e4b000 00000000`4d52564e 00000000`00002c8c : 0x30
fffff880`053cf038 fffffa80`05d66000 : fffff800`02e4b000 00000000`4d52564e 00000000`00002c8c fffff980`26bcaf60 : 0xfffffa80`00000000
fffff880`053cf040 fffff800`02e4b000 : 00000000`4d52564e 00000000`00002c8c fffff980`26bcaf60 fffff980`26bcaf60 : 0xfffffa80`05d66000
fffff880`053cf048 00000000`4d52564e : 00000000`00002c8c fffff980`26bcaf60 fffff980`26bcaf60 00000000`00000000 : nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`053cf050 00000000`00002c8c : fffff980`26bcaf60 fffff980`26bcaf60 00000000`00000000 fffffa80`0370a000 : 0x4d52564e
fffff880`053cf058 fffff980`26bcaf60 : fffff980`26bcaf60 00000000`00000000 fffffa80`0370a000 fffffa80`06728298 : 0x2c8c
fffff880`053cf060 fffff980`26bcaf60 : 00000000`00000000 fffffa80`0370a000 fffffa80`06728298 fffff980`2698cfb0 : 0xfffff980`26bcaf60
fffff880`053cf068 00000000`00000000 : fffffa80`0370a000 fffffa80`06728298 fffff980`2698cfb0 00000000`00000000 : 0xfffff980`26bcaf60
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+1f82a1
fffff880`0f2692a1 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nvlddmkm+1f82a1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e99233b
FAILURE_BUCKET_ID: X64_0xC1_32_VRF_nvlddmkm+1f82a1
BUCKET_ID: X64_0xC1_32_VRF_nvlddmkm+1f82a1
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\Joaks\Windows_NT6_BSOD_jcgriff2\022212-53352-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e14000 PsLoadedModuleList = 0xfffff800`03059670
Debug session time: Wed Feb 22 22:16:54.857 2012 (UTC - 7:00)
System Uptime: 0 days 0:36:08.277
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C1, {fffff9801e6e4e10, fffff9801e6e4032, ed01f0, 23}
Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+9a )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption. Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff9801e6e4e10, address trying to free
Arg2: fffff9801e6e4032, address where bits are corrupted
Arg3: 0000000000ed01f0, (reserved)
Arg4: 0000000000000023, caller is freeing an address where nearby bytes within the same page have been corrupted
Debugging Details:
------------------
BUGCHECK_STR: 0xC1_23
SPECIAL_POOL_CORRUPTION_TYPE: 23
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 1
IRP_ADDRESS: fffffa80075b7f88
LAST_CONTROL_TRANSFER: from fffff80002f19ffa to fffff80002e90c40
STACK_TEXT:
fffff880`0949d528 fffff800`02f19ffa : 00000000`000000c1 fffff980`1e6e4e10 fffff980`1e6e4032 00000000`00ed01f0 : nt!KeBugCheckEx
fffff880`0949d530 fffff800`02f929b3 : 00000000`00000000 fffff8a0`03fe6a80 fffffa80`00000003 fffffa80`075b8060 : nt!MiCheckSpecialPoolSlop+0x9a
fffff880`0949d570 fffff800`02fbe93b : fffff800`02e14000 00000000`2b707249 00000000`00098330 00000000`00000001 : nt!MmFreeSpecialPool+0x1d3
fffff880`0949d6b0 fffff800`03335026 : fffffa80`0751c302 fffffa80`0751c3c0 00000000`00000000 fffff980`1e6e4e10 : nt!ExDeferredFreePool+0xf33
fffff880`0949d760 fffff800`033355ec : fffff800`02ea601c fffff980`1e6e4e10 00000000`00000000 00000000`00000000 : nt!VfIoFreeIrp+0xe6
fffff880`0949d790 fffff800`02ea601c : 00000000`00000000 fffff980`1e6e4e10 00000000`00000000 fffffa80`07638eb0 : nt!IovFreeIrpPrivate+0x5c
fffff880`0949d7d0 fffff800`02e842f7 : fffffa80`075b8000 00000000`00000000 0a900000`0314b800 fffff8a0`00000000 : nt!IopCompleteRequest+0x54c
fffff880`0949d8a0 fffff800`02e9613d : fffff880`009ec3e0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1c7
fffff880`0949d920 fffff800`02e98f93 : 00000000`00000000 00000000`00000001 00000000`000000f3 00000000`0000000f : nt!KiCommitThreadWait+0x3dd
fffff880`0949d9b0 fffff800`03179647 : fffff900`c3069400 fffff960`0014c601 fffff800`00000000 00000000`00000002 : nt!KeRemoveQueueEx+0x323
fffff880`0949da70 fffff800`0314bae5 : fffff880`0949dc00 fffff880`0949db68 fffff880`0949db60 00000000`02c74a01 : nt!IoRemoveIoCompletion+0x47
fffff880`0949db00 fffff800`02e8fed3 : fffffa80`075b8060 00000000`0400ec68 fffff880`0949dbc8 00000000`00000000 : nt!NtRemoveIoCompletion+0x145
fffff880`0949dbb0 00000000`757c2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0400ec48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x757c2e09
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiCheckSpecialPoolSlop+9a
fffff800`02f19ffa cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiCheckSpecialPoolSlop+9a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a
BUCKET_ID: X64_0xC1_23_VRF_nt!MiCheckSpecialPoolSlop+9a
Followup: MachineOwner
---------
- Caused by Verifier (as expected). Points to your hard disk having errors. Other possible causes are Memory problems... Drivers... corrupted SCSI or IDE Drivers...
- Caused by Verifier (as expected). Points to corrupted ATAPI driver or memory problems.
- Caused by Verifier (as expected). Points to memory corruption.
- Caused by Verifier (as expected). Points to graphics card driver.
- Caused by Verifier (as expected). Points to memory corruption.
Thanks to Dave76 for help understanding possible causes.
Disable Verifier. You can do so by running an Elevated Command Prompt and typing verifier /reset
We will start with the common problems first (see bold possible causes). Do the following steps and test after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.
- If you have not done so, run memtest86+ a second time as outlined in my previous post.
- We should check that your RAM settings are correct. Sometimes, they need to be tweaked for the system to function.
Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.
Also, go into your BIOS and post all Voltages (CPU, RAM, NB, IMC, etc.) and all RAM settings (timings, frequency, etc.)
Thanks to Dave76 for help learning RAM Stability
- Monitor system temperatures: Speccy - System Information - Free Download
- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
- Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
- Run an HD Diagnostic following the guide in that link to find the manufacturer of your drive and that manufacturer's diagnostics for the drive.
- Re-install or install the latest drivers for your display card. Your current drivers may be corrupt and/or outdated. Use the following method to re-install the drivers.
- Download the latest drivers for your display card(s)
- Click Start Menu
- Right Click My Computer/Computer
- Click Manage
- Click Device Manager from the list on the left
- Expand Display adapters
- Do the following for each adapter (in case you have multiple display cards)
- Right click the adapter
- Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
- Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
- Restart your computer after uninstalling drivers for all display cards
- Install the latest driver for the display cards once Windows starts
Alternatively:
- Login as an adminstrative user
- Download the latest drivers for your display card(s)
- Click Start Menu
- Click Control Panel
- Click Hardware and Sound
- Click Device Manager (the last link under Devices and Printers)
- Expand Display adapters
- Do the following for each adapter (in case you have multiple display cards)
- Right click the adapter
- Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
- Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
- Restart your computer after uninstalling drivers for all display cards
- Install the latest driver for the display cards once Windows starts