Well see for yourself the output of your dumps one = 0x50 (again) and the other = 0x100007e
Original issue still blames ctoss driver and new dump blames fvevol.sys this is quite strange as it is a windows provided driver and relates to bitlocker drive encryption which is quite unusual
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffff954ba000, 0, fffff80002eda898, 5}
*** WARNING: Unable to verify timestamp for ctoss2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ctoss2k.sys
Could not read faulting driver name
Probably caused by : ctoss2k.sys ( ctoss2k+5d36 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffff954ba000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002eda898, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f7100
GetUlongFromAddress: unable to read from fffff800030f71c0
ffffffff954ba000
FAULTING_IP:
nt!MmProbeAndLockPages+118
fffff800`02eda898 410fb601 movzx eax,byte ptr [r9]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: lotroclient.ex
CURRENT_IRQL: 0
TRAP_FRAME: fffff880078e4530 -- (.trap 0xfffff880078e4530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000034 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000034 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eda898 rsp=fffff880078e46c0 rbp=fffff880078e4850
r8=fffffa8014ab57e0 r9=ffffffff954ba000 r10=0000000000000034
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe nc
nt!MmProbeAndLockPages+0x118:
fffff800`02eda898 410fb601 movzx eax,byte ptr [r9] ds:ffffffff`954ba000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f3b673 to fffff80002ebec40
STACK_TEXT:
fffff880`078e43c8 fffff800`02f3b673 : 00000000`00000050 ffffffff`954ba000 00000000`00000000 fffff880`078e4530 : nt!KeBugCheckEx
fffff880`078e43d0 fffff800`02ebcd6e : 00000000`00000000 ffffffff`954ba000 fffffa80`10d47400 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`078e4530 fffff800`02eda898 : fffffa80`10cefa00 00000000`00000001 00000000`00000000 00000000`00000801 : nt!KiPageFault+0x16e
fffff880`078e46c0 fffff880`05683d36 : fffffa80`14ab57b0 fffffa80`0f04bb00 00000000`00000002 ffffffff`954ba000 : nt!MmProbeAndLockPages+0x118
fffff880`078e47d0 fffffa80`14ab57b0 : fffffa80`0f04bb00 00000000`00000002 ffffffff`954ba000 00000000`00000000 : ctoss2k+0x5d36
fffff880`078e47d8 fffffa80`0f04bb00 : 00000000`00000002 ffffffff`954ba000 00000000`00000000 00000000`a000000c : 0xfffffa80`14ab57b0
fffff880`078e47e0 00000000`00000002 : ffffffff`954ba000 00000000`00000000 00000000`a000000c 00000000`00000000 : 0xfffffa80`0f04bb00
fffff880`078e47e8 ffffffff`954ba000 : 00000000`00000000 00000000`a000000c 00000000`00000000 fffff880`04833fc8 : 0x2
fffff880`078e47f0 00000000`00000000 : 00000000`a000000c 00000000`00000000 fffff880`04833fc8 00000000`00000000 : 0xffffffff`954ba000
STACK_COMMAND: kb
FOLLOWUP_IP:
ctoss2k+5d36
fffff880`05683d36 ?? ???
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: ctoss2k+5d36
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ctoss2k
IMAGE_NAME: ctoss2k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c348350
FAILURE_BUCKET_ID: X64_0x50_ctoss2k+5d36
BUCKET_ID: X64_0x50_ctoss2k+5d36
Followup: MachineOwner
---------
0: kd> lmvm ctoss2k
start end module name
fffff880`0567e000 fffff880`056af000 ctoss2k T (no symbols)
Loaded symbol image file: ctoss2k.sys
Image path: \SystemRoot\system32\drivers\ctoss2k.sys
Image name: ctoss2k.sys
Timestamp: Wed Jul 07 14:38:24 2010 (4C348350)
CheckSum: 000303C8
ImageSize: 00031000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff80002e81ea0, fffff8800336ff08, fffff8800336f760}
Probably caused by : fvevol.sys ( fvevol!FveFilterDeviceControl+1d0 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e81ea0, The address that the exception occurred at
Arg3: fffff8800336ff08, Exception Record Address
Arg4: fffff8800336f760, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!IofCallDriver+50
fffff800`02e81ea0 49ff64c070 jmp qword ptr [r8+rax*8+70h]
EXCEPTION_RECORD: fffff8800336ff08 -- (.exr 0xfffff8800336ff08)
ExceptionAddress: fffff80002e81ea0 (nt!IofCallDriver+0x0000000000000050)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000000000e0
Attempt to read from address 00000000000000e0
CONTEXT: fffff8800336f760 -- (.cxr 0xfffff8800336f760)
rax=000000000000000e rbx=fffff880016da3b0 rcx=fffffa8012a8dcd0
rdx=fffffa8015001c60 rsi=fffffa8015001c60 rdi=fffffa8012c18590
rip=fffff80002e81ea0 rsp=fffff88003370148 rbp=0000000000000001
r8=0000000000000000 r9=000000000000000e r10=fffff80003009588
r11=fffffa800e5cd660 r12=fffffa8012c18440 r13=fffffa8010db6190
r14=0000000000000002 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!IofCallDriver+0x50:
fffff800`02e81ea0 49ff64c070 jmp qword ptr [r8+rax*8+70h] ds:002b:00000000`000000e0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000000000e0
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b1100
GetUlongFromAddress: unable to read from fffff800030b11c0
00000000000000e0 Nonpaged pool
FOLLOWUP_IP:
fvevol!FveFilterDeviceControl+1d0
fffff880`016ab808 8bd8 mov ebx,eax
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff880016ab808 to fffff80002e81ea0
STACK_TEXT:
fffff880`03370148 fffff880`016ab808 : 00000000`00000000 fffff800`02e89c81 fffffa80`0f7a4030 fffffa80`0f428ad0 : nt!IofCallDriver+0x50
fffff880`03370150 fffff880`01610082 : fffffa80`15001c60 00000000`00000000 fffffa80`15001fb8 fffffa80`12be7190 : fvevol!FveFilterDeviceControl+0x1d0
fffff880`033701c0 fffff800`03138cca : fffffa80`12be7040 fffffa80`12be7040 00000000`00000000 fffff880`03370b30 : volsnap!VolSnapDeviceControl+0x72
fffff880`03370230 fffff880`016062c5 : fffffa80`13f83dd0 fffff880`01605cf0 fffffa80`11cea420 fffffa80`12be7190 : nt!IoVolumeDeviceToDosName+0x92
fffff880`03370b00 fffff880`01605d1c : 00000000`00000001 fffff880`01605cf0 fffffa80`0f6ddb38 fffffa80`0e5cd660 : volsnap!VspLogErrorWorker+0x85
fffff880`03370c80 fffff800`02e81ca9 : fffff880`01605cf0 fffff800`0301f2d8 fffffa80`0e5cd660 fffff800`0301f2d8 : volsnap!VspMediumPriorityWorkItem+0x2c
fffff880`03370cb0 fffff800`0311934a : 00000000`00000000 fffffa80`0e5cd660 00000000`00000080 fffffa80`0e596ae0 : nt!ExpWorkerThread+0x111
fffff880`03370d40 fffff800`02e69946 : fffff880`03186180 fffffa80`0e5cd660 fffff880`031910c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03370d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: fvevol!FveFilterDeviceControl+1d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fvevol
IMAGE_NAME: fvevol.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce793b6
STACK_COMMAND: .cxr 0xfffff8800336f760 ; kb
FAILURE_BUCKET_ID: X64_0x7E_fvevol!FveFilterDeviceControl+1d0
BUCKET_ID: X64_0x7E_fvevol!FveFilterDeviceControl+1d0
Followup: MachineOwner
---------
4: kd> lmvm fvevol
start end module name
fffff880`016a9000 fffff880`016e3000 fvevol (pdb symbols) c:\symbols\fvevol.pdb\C7C2E5CC175B47C4934398FDBD9C3AAF1\fvevol.pdb
Loaded symbol image file: fvevol.sys
Mapped memory image file: c:\symbols\fvevol.sys\4CE793B63a000\fvevol.sys
Image path: \SystemRoot\System32\DRIVERS\fvevol.sys
Image name: fvevol.sys
Timestamp: Sat Nov 20 09:24:06 2010 (4CE793B6) < Windows SP1 date
CheckSum: 000389BC
ImageSize: 0003A000
File version: 6.1.7601.17514
Product version: 6.1.7601.17514
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: FVEVOL.SYS
OriginalFilename: FVEVOL.SYS
ProductVersion: 6.1.7601.17514
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
FileDescription: BitLocker Drive Encryption Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
Unfortunately i am unable to extract a finite cause for your issue from your dumps files as is often the case so i recommend you go the long route and start by proving all your hardware/software upto you which order you do it in
First off if your OCing in anyway stop, return everything to stock settings for the purposes of testing
If you havent already, fill in your system specs so we know what we are dealing with
System Info - See Your System Specs
Make sure you have read the guide on asking for help with BSOD so you know what we need
https://www.sevenforums.com/crashes-d...tructions.html
And if necessary set your machine to create minidumps (Method 2 Step 2 is easiest IMO)
Dump Files - Configure Windows to Create on BSOD
Run some scans to check against virus or infection
http://support.kaspersky.com/5350
Windows Defender Offline
Run some basic hardware tests
RAM - Test with Memtest86+ (memtest)
Disk Check (windows based check)
Hard Drive Diagnostic Procedure (bootable disk check)
make sure you have temperature monitoring software installed then while monitoring run
Hardware - Stress Test With Prime95
Video Card - Stress Test with Furmark
this leaves software side and for this you can enable driver verifier to try to flush out any faulting drivers
Using Driver Verifier to identify issues with Drivers
before enabling driver verifier make sure you read all of the info as sometimes when enabling the system will become unbootable and requires safemode to turn off