Code:
Loading Dump File [D:\Kingston\BSODDmpFiles\XplicitMind\Windows_NT6_BSOD_jcgriff2\040312-22854-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`03263650
Debug session time: Tue Apr 3 17:35:20.945 2012 (UTC - 6:00)
System Uptime: 0 days 0:01:05.147
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {fffff80003073dee, 3073121, fffff88003ddb0d0, b}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4521e )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff80003073dee, Virtual address for the attempted write.
Arg2: 0000000003073121, PTE contents.
Arg3: fffff88003ddb0d0, (reserved)
Arg4: 000000000000000b, (reserved)
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xBE
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003ddb0d0 -- (.trap 0xfffff88003ddb0d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff80003073dea
rdx=00000000000007ff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030a77c0 rsp=fffff88003ddb268 rbp=fffff88003ddb310
r8=0000000000000000 r9=0000000000000000 r10=0000000000000001
r11=fffffa8006994392 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!FsRtlResetBaseMcb:
fffff800`030a77c0 83610400 and dword ptr [rcx+4],0 ds:fffff800`03073dee=45d23345
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003047e32 to fffff8000309bd40
STACK_TEXT:
fffff880`03ddaf68 fffff800`03047e32 : 00000000`000000be fffff800`03073dee 00000000`03073121 fffff880`03ddb0d0 : nt!KeBugCheckEx
fffff880`03ddaf70 fffff800`03099e6e : 00000000`00000001 fffff800`03073dee 00000000`00000000 fffffa80`087f5d80 : nt! ?? ::FNODOBFM::`string'+0x4521e
fffff880`03ddb0d0 fffff800`030a77c0 : fffff880`0121d40d fffffa80`087f5d00 00000000`00000000 fffff8a0`040f5600 : nt!KiPageFault+0x16e
fffff880`03ddb268 fffff880`0121d40d : fffffa80`087f5d00 00000000`00000000 fffff8a0`040f5600 0000007f`ffffff00 : nt!FsRtlResetBaseMcb
fffff880`03ddb270 fffff880`01215fc6 : fffff880`03ddb610 fffff980`1524cc10 fffff8a0`040f5650 00000000`00000000 : Ntfs!NtfsNonCachedIo+0x24d
fffff880`03ddb440 fffff880`01217a68 : fffff880`03ddb610 fffff980`1524cc10 fffff880`03ddb701 fffffa80`08acc001 : Ntfs!NtfsCommonRead+0x7a6
fffff880`03ddb5e0 fffff800`03540c16 : fffff980`1524cc10 fffff980`1524cc10 fffffa80`08acc030 fffffa80`0a79c690 : Ntfs!NtfsFsdRead+0x1b8
fffff880`03ddb7f0 fffff880`0116fbcf : fffff980`1524cfb0 fffff880`03ddb8a0 fffffa80`0a7cf010 fffffa80`0a79c690 : nt!IovCallDriver+0x566
fffff880`03ddb850 fffff880`0116e6df : fffffa80`087f4de0 fffffa80`087f4de0 fffffa80`087f4d00 fffff980`1524cc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`03ddb8e0 fffff800`03540c16 : fffff980`1524cc10 00000000`00000002 fffffa80`08e9e5d0 fffffa80`06bf1218 : fltmgr!FltpDispatch+0xcf
fffff880`03ddb940 fffff800`030c3125 : fffff980`1524cc30 fffffa80`0882cad0 fffffa80`09c8a601 fffffa80`08e926a0 : nt!IovCallDriver+0x566
fffff880`03ddb9a0 fffff800`030c2bf9 : 00000000`00000001 00000000`00000001 fffffa80`0882ca10 00000000`000008f0 : nt!IoPageRead+0x255
fffff880`03ddba30 fffff800`030a949a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff800`00000000 : nt!MiIssueHardFault+0x255
fffff880`03ddbac0 fffff800`03099e6e : 00000000`00000000 00000000`00b20ff8 00000000`00000a01 00000000`74a42828 : nt!MmAccessFault+0x146a
fffff880`03ddbc20 000007fe`fd6d11fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`01d5e3f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fd6d11fd
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4521e
fffff800`03047e32 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4521e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0xBE_VRF_nt!_??_::FNODOBFM::_string_+4521e
BUCKET_ID: X64_0xBE_VRF_nt!_??_::FNODOBFM::_string_+4521e
Followup: MachineOwner
---------
The crashes are pointing to hard disk problems; either corrupted data or worse...- Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log.
For any drives that do not give the message:
Windows has checked the file system and found no problems
run disk check again as above. In other words, if it says:
Windows has made corrections to the file system
after running the disk check, run the disk check again.
- Run Data Lifeguard Diagnostic for Western Digital to check for a faulty hard disk.