BSOD Need Help

dcallaghan · 09 Apr 2014

Continually crashes windows 7 64 bit not sure why

koolkat77 · 10 Apr 2014

From the error codes.. I'd suggest you start off with memtest.

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\Daniel Pc Zip\SFdebugFiles\040914-30981-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`0325b000 PsLoadedModuleList = 0xfffff800`0349e6d0
Debug session time: Wed Apr  9 16:19:28.716 2014 (UTC + 6:00)
System Uptime: 0 days 0:30:42.731
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8800bd6ef90, 0, fffff800032fbfe5, 0}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MmCopyToCachedPage+215 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800bd6ef90, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800032fbfe5, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003508100
GetUlongFromAddress: unable to read from fffff800035081c0
 fffff8800bd6ef90 Nonpaged pool

FAULTING_IP: 
nt!MmCopyToCachedPage+215
fffff800`032fbfe5 488b07          mov     rax,qword ptr [rdi]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a697130 -- (.trap 0xfffff8800a697130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000fffffffff
rdx=fffff8000325b000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800032fbfe5 rsp=fffff8800a6972c0 rbp=fffff8800a697300
 r8=0000098000000000  r9=00000000091d8040 r10=0000058000000000
r11=0000007ffffffff8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!MmCopyToCachedPage+0x215:
fffff800`032fbfe5 488b07          mov     rax,qword ptr [rdi] ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000334ebf0 to fffff800032d0bc0

STACK_TEXT:  
fffff880`0a696fc8 fffff800`0334ebf0 : 00000000`00000050 fffff880`0bd6ef90 00000000`00000000 fffff880`0a697130 : nt!KeBugCheckEx
fffff880`0a696fd0 fffff800`032cecee : 00000000`00000000 fffff880`0bd6ef90 f8a013ba`be400400 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`0a697130 fffff800`032fbfe5 : 00000000`00000002 ffffffff`ffffffff fffffa80`0a53cb50 ffffffff`ffffffff : nt!KiPageFault+0x16e
fffff880`0a6972c0 fffff800`032f908e : fffff980`01168000 00000000`091d8040 fffff880`00000000 00000000`00001000 : nt!MmCopyToCachedPage+0x215
fffff880`0a6974b0 fffff800`032f9644 : fffffa80`0745ee00 00000000`091d8040 fffff880`0a6975f0 fffff880`00000000 : nt!CcMapAndCopyInToCache+0x20e
fffff880`0a6975a0 fffff880`018c5a59 : 00000000`35830000 fffffa80`0737de00 fffff880`0a697690 fffffa80`00010000 : nt!CcCopyWrite+0x194
fffff880`0a697630 fffff880`0158e102 : fffffa80`0737de60 fffff880`015914f2 00000000`00010000 00000000`00010001 : Ntfs!NtfsCopyWriteA+0x1e9
fffff880`0a697830 fffff880`015918ba : fffff880`0a697900 fffffa80`074b6888 00000000`091d0000 00000000`00010000 : fltmgr!FltpPerformFastIoCall+0xf2
fffff880`0a697890 fffff880`015af83e : 00000000`00010000 00000000`00000000 fffffa80`0737de60 fffff880`0a697a00 : fltmgr!FltpPassThroughFastIo+0xda
fffff880`0a6978d0 fffff800`035e494e : fffffa80`0737ded4 fffffa80`00000002 fffffa80`06737570 fffffa80`0737ded4 : fltmgr!FltpFastIoWrite+0x1ce
fffff880`0a697970 fffff800`032cfe53 : 00000000`00008001 00000000`000012f4 00000000`00000000 00000000`05cacb68 : nt!NtWriteFile+0x5ad
fffff880`0a697a70 00000000`773f133a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`08bed078 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x773f133a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MmCopyToCachedPage+215
fffff800`032fbfe5 488b07          mov     rax,qword ptr [rdi]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MmCopyToCachedPage+215

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MmCopyToCachedPage+215

BUCKET_ID:  X64_0x50_nt!MmCopyToCachedPage+215

Followup: MachineOwner
---------

Code:

Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Yusra\Downloads\Daniel Pc Zip\SFdebugFiles\040914-20607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`0320e000 PsLoadedModuleList = 0xfffff800`034516d0
Debug session time: Wed Apr  9 16:33:54.260 2014 (UTC + 6:00)
System Uptime: 0 days 0:13:19.275
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8000d877d0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+35084 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa8000d877d0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  SearchFilterHo

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800032f4d50 to fffff80003283bc0

STACK_TEXT:  
fffff880`0822c5d8 fffff800`032f4d50 : 00000000`0000001a 00000000`00041790 fffffa80`00d877d0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0822c5e0 fffff800`03254e75 : ffffffff`00000000 00000000`039d3fff fffffa80`00000000 fffffa80`070b5b50 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`0822c7a0 fffff800`0355815a : fffff8a0`020c2060 fffff880`0822cae0 00000000`00000000 fffffa80`070b5b50 : nt!MmCleanProcessAddressSpace+0x679
fffff880`0822c7f0 fffff800`0353e2ed : 00000000`c0000005 00000000`00000001 000007ff`fffd4000 fffffa80`06e66b50 : nt!PspExitThread+0x56a
fffff880`0822c8f0 fffff800`032766fa : fffffa80`070b5b50 fffff800`03276631 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`0822c920 fffff800`03276a40 : 00000000`00000000 fffff880`0822c9a0 fffff800`0353e260 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`0822c9a0 fffff800`03282ef7 : 00000000`0000008c 00000000`00000000 ffffffff`dc3cba00 00000000`00000a7c : nt!KiInitiateUserApc+0x70
fffff880`0822cae0 00000000`777615fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0118fbf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777615fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+35084
fffff800`032f4d50 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+35084

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+35084

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

RAM - Test with Memtest86+

The goal is to test all the RAM sticks and all the motherboard slots.

Check your motherboard manual to ensure the RAM sticks are in the recommended motherboard slots. Some motherboards have very specific slots required for the number of RAM sticks installed.

If you get errors, stop the test and continue with the next step.

1. Remove all but one stick of RAM from your computer (this will be RAM stick #1), and run Memtest86 again, for 7 passes.

*Be sure to note the RAM stick, use a piece of tape with a number, and note the motherboard slot.

If this stick passes the test then go to step #3.

2. If RAM stick #1 has errors, repeat the test with RAM stick #2 in the same motherboard slot.

*If RAM stick #2 passes, this indicates that RAM stick #1 may be bad. If you want to be absolutely sure, re-test RAM stick #1 in another known good slot.

*If RAM stick #2 has errors, this indicates another possible bad RAM stick, a possible motherboard slot failure or inadequate settings.

3. Test the next stick of RAM (stick #2) in the next motherboard slot.

*If this RAM stick has errors repeat step #2 using a known good stick if possible, or another stick.

*If this RAM stick has no errors and both sticks failed in slot#1, test RAM stick #1 in this slot.

4. If you find a stick that passes the test, test it in all the other motherboard slots.

If Part 2 testing shows errors, and all tests in Part 3 show errors, you will need to test the RAM sticks in another computer and/or test other RAM in your computer to identify the problem.

In this way, you can identify whether it is a bad stick of RAM, a bad motherboard, or incompatibility between the sticks.

Information

Errors are sometimes found after 8 passes.

Tip

Do this test overnight, before going to bed.