New
#11
can I anyone help me please
Code:BugCheck D5, {fffff98033636fe0, 0, fffffa800952f606, 0} Could not read faulting driver name Probably caused by : em018_64.dat ( em018_64+3d606 )This bugcheck was caused by the faulting driver (listed above), referencing freed special pool and then causing a page fault.Code:0: kd> lmvm em018_64 start end module name fffffa80`094f2000 fffffa80`09564000 em018_64 T (no symbols) Loaded symbol image file: em018_64.dat Image path: C:\Program Files\ESET\ESET NOD32 Antivirus\em018_64.dat Image name: em018_64.dat Timestamp: Thu Oct 24 11:34:08 2013 (5268F7A0) CheckSum: 00000000 ImageSize: 00072000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
The problem was clearly caused by ESET, which you have now removed. Disable Driver Verifier if you haven't already. Instructions on how to do so, are provided with the Driver Verifier links in my previous post.
hi
i was holding on for 12 days and today it was back
i removed nod32 as it seems it was the problem now i don't what is the new problem
please can anyone help
Code:BugCheck 1000007E, {ffffffffc0000005, fffff80002f667f2, fffff8800b2be858, fffff8800b2be0b0} Probably caused by : ntkrnlmp.exe ( nt!RtlInterlockedClearBitRunEx+b2 )Code:fffff8800b2be858 -- (.exr 0xfffff8800b2be858) ExceptionAddress: fffff80002f667f2 (nt!RtlInterlockedClearBitRunEx+0x00000000000000b2) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffffOkay, there is clearly a problem, when the computer is set to sleep and the contents of memory are written to a possible hibernation file. This seems to be more of a driver issue, or possibly a hardware issue with the flipped bit within the r10 register.Code:0: kd> k # Child-SP RetAddr Call Site 00 fffff880`0b2bea98 fffff800`031163db nt!RtlInterlockedClearBitRunEx+0xb2 01 fffff880`0b2beaa0 fffff800`0311abb5 nt!MmDuplicateMemory+0x8bb <-- Hibernation File Write? 02 fffff880`0b2beb90 fffff800`031692ea nt!PopTransitionToSleep+0xd5 03 fffff880`0b2bec00 fffff800`02ebd8e6 nt!PspSystemThreadStartup+0x5a 04 fffff880`0b2bec40 00000000`00000000 nt!KxStartSystemThread+0x16
Run Driver Verifier to scan for any corrupted drivers which may be causing problems, this program works by running various stress tests on drivers, in order to produce a BSOD which will locate the driver; run for least 24 hours:
InformationAdditional Help - Using Driver Verifier to identify issues with Drivers
Run the Small FFT's, Large FFT's and Blend Test for a few hours each. Do not let the temperature exceed 80*C.Code:fffff8800b2be0b0 -- (.cxr 0xfffff8800b2be0b0) rax=00000000fffffffe rbx=ffffffffffffffff rcx=0000000000000000 rdx=fffff80003056180 rsi=fffff80003056180 rdi=0000058000000000 rip=fffff80002f667f2 rsp=fffff8800b2bea98 rbp=fffe7a8091024800 r8=0000000000000000 r9=0000000000000001 r10=1ffff9800b282c40 r11=fffff80003056180 r12=0000000000000000 r13=0000000000000001 r14=fffff8800b2bebc0 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!RtlInterlockedClearBitRunEx+0xb2: fffff800`02f667f2 f0412102 lock and dword ptr [r10],eax ds:002b:1ffff980`0b282c40=????????
Enable "Round off checking" before the test (see first post below tutorial).
do u say if i stop using sleep and hibernate i will not see this bsod or it is beeter to do drive verifer with a lot of sleep and hibernate to know what driver is the problem or hardware?
When running Driver Verifier, just use your computer as you normally would. Disabling sleep or hibernate would be more of a work around, rather than a solution in my opinion, but you could try and see if it helps.
well
here it is a new hot dump
crashed now after a restart and didn't want to get into windows keept showinf this bsod
so i got into safe mode and disabled verifier
well we know what driver is causing the problems this time
and will new clean windows help?!
maybe this new chipset and haswell cpu need windows 8
It's not produced by Driver Verifier, and have you tried disabling Sleep or Hibernate? Personally, I don't use them at all, since Windows booting fast enough for me.
Code:BugCheck 50, {fffff901c066f94c, 0, fffff960000bcc73, 5} Could not read faulting driver name Probably caused by : win32k.sys ( win32k!bLoadFontFile+1f3 )The page fault wasn't a result of a bad IRQL level, it leads me to believe it may be more of a miscalled instruction.Code:1: kd> !irql Debugger saved IRQL for processor 0x1 -- 0 (LOW_LEVEL)
Code:1: kd> k Child-SP RetAddr Call Site fffff880`025990f8 fffff800`02f0f5b3 nt!KeBugCheckEx fffff880`02599100 fffff800`02e90cee nt! ?? ::FNODOBFM::`string'+0x43801 fffff880`02599260 fffff960`000bcc73 nt!KiPageFault+0x16e fffff880`025993f0 fffff960`000bca37 win32k!bLoadFontFile+0x1f3 fffff880`025994e0 fffff960`000bb69e win32k!ttfdSemLoadFontFile+0x6b fffff880`02599540 fffff960`000bb58c win32k!PDEVOBJ::LoadFontFile+0x7e fffff880`025995d0 fffff960`000bbc67 win32k!vLoadFontFileView+0x4bc fffff880`02599660 fffff960`000be92c win32k!PUBLIC_PFTOBJ::bLoadFonts+0x587 fffff880`02599790 fffff960`000be7d1 win32k!GreAddFontResourceWInternal+0x114 fffff880`02599820 fffff800`02e91e53 win32k!NtGdiAddFontResourceW+0x151 fffff880`025999d0 000007fe`fd5aa86a nt!KiSystemServiceCopyEnd+0x13 00000000`00d5f868 00000000`00000000 0x000007fe`fd5aa86aSo, it will jump to a certain function when the condition is true, hence the reason for the cmp instruction between the ecx and ebx register.Code:1: kd> uf win32k!bLoadFontFile+0x1f3 win32k!bLoadFontFile: fffff960`000bca80 6644894c2420 mov word ptr [rsp+20h],r9w fffff960`000bca86 4489442418 mov dword ptr [rsp+18h],r8d fffff960`000bca8b 48894c2408 mov qword ptr [rsp+8],rcx fffff960`000bca90 53 push rbx fffff960`000bca91 56 push rsi fffff960`000bca92 57 push rdi fffff960`000bca93 4154 push r12 fffff960`000bca95 4155 push r13 fffff960`000bca97 4156 push r14 fffff960`000bca99 4157 push r15 fffff960`000bca9b 4881ecb0000000 sub rsp,0B0h fffff960`000bcaa2 418bf8 mov edi,r8d fffff960`000bcaa5 4c8bf2 mov r14,rdx fffff960`000bcaa8 33db xor ebx,ebx fffff960`000bcaaa 895c244c mov dword ptr [rsp+4Ch],ebx fffff960`000bcaae 4c8bac2418010000 mov r13,qword ptr [rsp+118h] fffff960`000bcab6 49895d00 mov qword ptr [r13],rbx fffff960`000bcaba 4c8bfb mov r15,rbx fffff960`000bcabd 8bc3 mov eax,ebx fffff960`000bcabf 895c2440 mov dword ptr [rsp+40h],ebx fffff960`000bcac3 8b8c2410010000 mov ecx,dword ptr [rsp+110h] fffff960`000bcaca 3bcb cmp ecx,ebx fffff960`000bcacc 7427 je win32k!bLoadFontFile+0x75 (fffff960`000bcaf5)
This function mostly moves data between registers.Code:win32k!bLoadFontFile+0x75: fffff960`000bcaf5 be01000000 mov esi,1 fffff960`000bcafa 448ba42410010000 mov r12d,dword ptr [rsp+110h] fffff960`000bcb02 4489642450 mov dword ptr [rsp+50h],r12d
It again, seems like drivers referencing bad addresses to me. Turn off hibernation and sleep for now.
so u are saying u can't find the drive that is making the problem
u know this is not a good solutions to turn off sleep and hibernate
also i don't use hibernate at all only automatic sleep when i am away from computer
can u suggest what to do other than verifier?
how we can solve this problem
well here is new dump with diffrent error
this is shown after installing BlueStacks (android emulator for pc)
i feel that the video card the onboard need a relief by installing new vga card with it's own memory
what u say about that?