Is the laptop under warranty? If yes, you should take it for servicing.
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, b9eb001, 1bcc, fffff70001080000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ad3 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000000b9eb001
Arg3: 0000000000001bcc
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cd4717 to fffff80002c7dc00
STACK_TEXT:
fffff880`069a3918 fffff800`02cd4717 : 00000000`0000001a 00000000`00041284 00000000`0b9eb001 00000000`00001bcc : nt!KeBugCheckEx
fffff880`069a3920 fffff800`02caeef0 : fffff700`01080000 bcc00001`c0ef3867 00000000`00000000 dfe00001`24b0a025 : nt! ?? ::FNODOBFM::`string'+0x4ad3
fffff880`069a3960 fffff800`02c6a3ff : fffffa80`00000000 00000000`0bb9dfff 00000000`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`069a3b20 fffff800`02c7ce93 : ffffffff`ffffffff 00000000`0b28e7e0 00000000`0b28e7a8 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`069a3c20 00000000`773014fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0b28e718 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773014fa
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4ad3
fffff800`02cd4717 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4ad3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5147d9c6
FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ad3
BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ad3
Followup: MachineOwner
---------
You should test your ram again and remove acronis software from your system.
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8a0853f1f98, 1, fffff80002e01147, 5}
*** WARNING: Unable to verify timestamp for tdrpman.sys
*** ERROR: Module load completed but symbols could not be loaded for tdrpman.sys
Could not read faulting driver name
Probably caused by : tdrpman.sys ( tdrpman+b3a60 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a0853f1f98, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e01147, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f04100
GetUlongFromAddress: unable to read from fffff80002f041c0
fffff8a0853f1f98 Paged pool
FAULTING_IP:
nt!ExAllocatePoolWithTag+537
fffff800`02e01147 48895808 mov qword ptr [rax+8],rbx
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: mbamservice.ex
CURRENT_IRQL: 0
TRAP_FRAME: fffff88007182fb0 -- (.trap 0xfffff88007182fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0853f1f90 rbx=0000000000000000 rcx=fffff8a0053b4280
rdx=0000000000000070 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e01147 rsp=fffff88007183140 rbp=0000000000001000
r8=0000000000000001 r9=fffffa8006b172f0 r10=fffffa8006b17148
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ExAllocatePoolWithTag+0x537:
fffff800`02e01147 48895808 mov qword ptr [rax+8],rbx ds:fffff8a0`853f1f98=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d495a3 to fffff80002cccc00
STACK_TEXT:
fffff880`07182e48 fffff800`02d495a3 : 00000000`00000050 fffff8a0`853f1f98 00000000`00000001 fffff880`07182fb0 : nt!KeBugCheckEx
fffff880`07182e50 fffff800`02ccad2e : 00000000`00000001 fffff8a0`853f1f98 fffff880`00000000 fffffa80`06b172f0 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`07182fb0 fffff800`02e01147 : fffffa80`06c238a0 fffffa80`0fe44ad0 0061005c`000e000e fffff980`02180752 : nt!KiPageFault+0x16e
fffff880`07183140 fffff880`014ae1c1 : fffff8a0`00000001 fffff980`02180700 fffff8a0`049a5850 fffff8a0`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`07183230 fffff880`014ac89e : fffffa80`0fc919d0 fffff8a0`052f9a40 fffff8a0`003b9bc0 fffffa80`0fc919d0 : Ntfs!NtfsRestartIndexEnumeration+0x271
fffff880`07183450 fffff880`014adec1 : fffff880`07183950 00000000`00000000 fffffa80`07c2d8f0 fffffa80`0f7c7b80 : Ntfs!NtfsQueryDirectory+0x94e
fffff880`071837f0 fffff880`014b07bf : fffffa80`0fc919d0 00000000`00000000 fffff880`071838e0 00000000`00000000 : Ntfs!NtfsCommonDirectoryControl+0xa1
fffff880`07183830 fffff880`012d1bcf : fffffa80`0f7c7fb0 fffffa80`0f7c7b80 fffffa80`0fc919d0 fffff880`07183858 : Ntfs!NtfsFsdDirectoryControl+0x10f
fffff880`071838a0 fffff880`012d06df : fffffa80`07c2d8f0 00000000`00000000 fffffa80`07c2d800 fffffa80`0f7c7b80 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07183930 fffff880`01d16a60 : 00000000`60000001 fffffa80`0f7c7b80 fffffa80`080d2960 fffffa80`07d19820 : fltmgr!FltpDispatch+0xcf
fffff880`07183990 00000000`60000001 : fffffa80`0f7c7b80 fffffa80`080d2960 fffffa80`07d19820 00000000`0491e701 : tdrpman+0xb3a60
fffff880`07183998 fffffa80`0f7c7b80 : fffffa80`080d2960 fffffa80`07d19820 00000000`0491e701 fffff880`01d15248 : 0x60000001
fffff880`071839a0 fffffa80`080d2960 : fffffa80`07d19820 00000000`0491e701 fffff880`01d15248 fffffa80`07d19820 : 0xfffffa80`0f7c7b80
fffff880`071839a8 fffffa80`07d19820 : 00000000`0491e701 fffff880`01d15248 fffffa80`07d19820 fffffa80`080d2960 : 0xfffffa80`080d2960
fffff880`071839b0 00000000`0491e701 : fffff880`01d15248 fffffa80`07d19820 fffffa80`080d2960 00000000`60000001 : 0xfffffa80`07d19820
fffff880`071839b8 fffff880`01d15248 : fffffa80`07d19820 fffffa80`080d2960 00000000`60000001 fffffa80`0f7c7b80 : 0x491e701
fffff880`071839c0 fffffa80`07d19820 : fffffa80`080d2960 00000000`60000001 fffffa80`0f7c7b80 00000000`0491e710 : tdrpman+0xb2248
fffff880`071839c8 fffffa80`080d2960 : 00000000`60000001 fffffa80`0f7c7b80 00000000`0491e710 fffff880`01d159f6 : 0xfffffa80`07d19820
fffff880`071839d0 00000000`60000001 : fffffa80`0f7c7b80 00000000`0491e710 fffff880`01d159f6 fffffa80`0f707de0 : 0xfffffa80`080d2960
fffff880`071839d8 fffffa80`0f7c7b80 : 00000000`0491e710 fffff880`01d159f6 fffffa80`0f707de0 fffffa80`0f7c7b80 : 0x60000001
fffff880`071839e0 00000000`0491e710 : fffff880`01d159f6 fffffa80`0f707de0 fffffa80`0f7c7b80 fffffa80`07d19820 : 0xfffffa80`0f7c7b80
fffff880`071839e8 fffff880`01d159f6 : fffffa80`0f707de0 fffffa80`0f7c7b80 fffffa80`07d19820 fffffa80`080d2960 : 0x491e710
fffff880`071839f0 fffffa80`0f707de0 : fffffa80`0f7c7b80 fffffa80`07d19820 fffffa80`080d2960 fffffa80`080b0c58 : tdrpman+0xb29f6
fffff880`071839f8 fffffa80`0f7c7b80 : fffffa80`07d19820 fffffa80`080d2960 fffffa80`080b0c58 00000000`00000000 : 0xfffffa80`0f707de0
fffff880`07183a00 fffffa80`07d19820 : fffffa80`080d2960 fffffa80`080b0c58 00000000`00000000 00000000`0491e710 : 0xfffffa80`0f7c7b80
fffff880`07183a08 fffffa80`080d2960 : fffffa80`080b0c58 00000000`00000000 00000000`0491e710 fffff880`01d0fad5 : 0xfffffa80`07d19820
fffff880`07183a10 fffffa80`080b0c58 : 00000000`00000000 00000000`0491e710 fffff880`01d0fad5 fffffa80`0f707de0 : 0xfffffa80`080d2960
fffff880`07183a18 00000000`00000000 : 00000000`0491e710 fffff880`01d0fad5 fffffa80`0f707de0 00000000`00000001 : 0xfffffa80`080b0c58
STACK_COMMAND: kb
FOLLOWUP_IP:
tdrpman+b3a60
fffff880`01d16a60 ?? ???
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: tdrpman+b3a60
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tdrpman
IMAGE_NAME: tdrpman.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5033c542
FAILURE_BUCKET_ID: X64_0x50_tdrpman+b3a60
BUCKET_ID: X64_0x50_tdrpman+b3a60
Followup: MachineOwner
---------
4: kd> lmvm tdrpman
start end module name
fffff880`01c63000 fffff880`01dad000 tdrpman T (no symbols)
Loaded symbol image file: tdrpman.sys
Image path: \SystemRoot\system32\DRIVERS\tdrpman.sys
Image name: tdrpman.sys
Timestamp: Tue Aug 21 23:28:34 2012 (5033C542)
CheckSum: 00154928
ImageSize: 0014A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4