BSOD on user PC after 3-5 minutes, no applications running


  1. Posts : 2
    8.1pro64
       #1

    BSOD on user PC after 3-5 minutes, no applications running


    I have already debugged the dump file will paste info:

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
    Arguments:
    Arg1: 00000000000c08a5
    Arg2: 0000000000000000
    Arg3: 0000000000000000
    Arg4: 0000000000000000
    Debugging Details:
    ------------------

    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    BUGCHECK_STR: 0x24
    PROCESS_NAME: WerFault.exe
    CURRENT_IRQL: 0
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    LAST_CONTROL_TRANSFER: from fffff8800144ebd5 to fffff80002a89bc0
    STACK_TEXT:
    fffff880`03cd95b8 fffff880`0144ebd5 : 00000000`00000024 00000000`000c08a5 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
    fffff880`03cd95c0 fffff880`01473008 : 00000001`00000000 00000000`00000000 00000000`00000000 00000a80`00000000 : Ntfs!NtfsPagingFileIo+0x155
    fffff880`03cd96c0 fffff880`01045bcf : fffffa80`03914b28 fffffa80`039147d0 fffffa80`0383abb0 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x71b9
    fffff880`03cd9770 fffff880`010446df : fffffa80`04618950 fffffa80`07713001 fffffa80`04618900 fffffa80`039147d0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
    fffff880`03cd9800 fffff800`02ab0e15 : fffffa80`039147f0 fffffa80`04c40070 fffffa80`0378ea60 fffff880`02f65180 : fltmgr!FltpDispatch+0xcf
    fffff880`03cd9860 fffff800`02ab08e9 : fffff880`03cd9901 fffff880`03cd9901 fffffa80`0378e9a0 00000000`00000000 : nt!IoPageRead+0x255
    fffff880`03cd98f0 fffff800`02a9728a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`000e0000 : nt!MiIssueHardFault+0x255
    fffff880`03cd9980 fffff800`02a87cee : 00000000`00000001 00000000`002b0008 00000000`000cee01 00000000`002b2000 : nt!MmAccessFault+0x146a
    fffff880`03cd9ae0 00000000`7710d8ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
    00000000`000cedc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7710d8ae

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    Ntfs!NtfsPagingFileIo+155
    fffff880`0144ebd5 cc int 3
    SYMBOL_STACK_INDEX: 1
    SYMBOL_NAME: Ntfs!NtfsPagingFileIo+155
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: Ntfs
    IMAGE_NAME: Ntfs.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 52e1be8a
    IMAGE_VERSION: 6.1.7601.18378
    FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsPagingFileIo+155
    BUCKET_ID: X64_0x24_Ntfs!NtfsPagingFileIo+155
    ANALYSIS_SOURCE: KM
    FAILURE_ID_HASH_STRING: km:x64_0x24_ntfs!ntfspagingfileio+155
    FAILURE_ID_HASH: {8018ac65-4151-0b56-5f0b-cec86356850c}
    Followup: MachineOwner
      My Computer


  2. Posts : 2
    8.1pro64
    Thread Starter
       #2

    another BSOD from same PC


    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 0000000000000040, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002ad393c, address which referenced memory
    Debugging Details:
    ------------------

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d04100
    GetUlongFromAddress: unable to read from fffff80002d041c0
    0000000000000040 Nonpaged pool
    CURRENT_IRQL: 2
    FAULTING_IP:
    nt!KeWaitForSingleObject+13c
    fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: WerFault.exe
    ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
    TRAP_FRAME: fffff880086c7fc0 -- (.trap 0xfffff880086c7fc0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000000305e rbx=0000000000000000 rcx=0000000000000002
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002ad393c rsp=fffff880086c8150 rbp=0000000000000000
    r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
    r11=fffff88002f65180 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!KeWaitForSingleObject+0x13c:
    fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7 ds:00000000`00000000=????????
    Resetting default scope
    LAST_CONTROL_TRANSFER: from fffff80002acc169 to fffff80002accbc0
    STACK_TEXT:
    fffff880`086c7e78 fffff800`02acc169 : 00000000`0000000a 00000000`00000040 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`086c7e80 fffff800`02acade0 : 00000000`00000000 fffff960`0023cf13 00000958`086c8070 00000000`00000000 : nt!KiBugCheckDispatch+0x69
    fffff880`086c7fc0 fffff800`02ad393c : 00000000`00000000 fffff960`00139cee fffff900`c21b6710 00000000`00000001 : nt!KiPageFault+0x260
    fffff880`086c8150 fffff960`00166159 : 00000000`00000000 fffff960`00000006 00000000`00000000 00000ca0`00000000 : nt!KeWaitForSingleObject+0x13c
    fffff880`086c81f0 fffff960`0029a47e : 00000000`00000000 fffff880`086c84c8 fffff880`086c8350 00000000`00000001 : win32k!SURFACE::Map+0xa1
    fffff880`086c8240 fffff960`00176d98 : fffff900`c00be010 fffff880`086c8350 00000000`00000001 0000000f`0000014a : win32k!DEVLOCKOBJ::bMapTrgSurfaceView+0x3e
    fffff880`086c8270 fffff960`00138a7f : fffff900`c22d3010 fffff880`086c8350 00000000`00000001 fffff880`086c84c8 : win32k!DEVLOCKOBJ::bPrepareTrgDco+0x98
    fffff880`086c82a0 fffff960`0012e7a9 : fffff900`c00be010 00000000`00000000 fffff880`086c85c0 fffff960`00128d88 : win32k!DEVLOCKOBJ::bLock+0x423
    fffff880`086c82e0 fffff800`02acbd5c : fffffa80`03f20940 00000000`00000000 00000000`00000005 00000000`00000020 : win32k!NtGdiFlushUserBatch+0xf9
    fffff880`086c8540 000007fe`fd00119a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceGdiTebAccess+0x25
    00000000`02d3ecb8 fffff800`02ac4210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fd00119a
    fffff880`086c8720 fffff880`086b7000 : 00000000`00000000 fffff900`c22e58a0 fffff960`001769d6 00000000`00000010 : nt!KiCallUserMode
    fffff880`086c8728 00000000`00000000 : fffff900`c22e58a0 fffff960`001769d6 00000000`00000010 fffff880`086c8c70 : 0xfffff880`086b7000

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    win32k!SURFACE::Map+a1
    fffff960`00166159 4439ad00010000 cmp dword ptr [rbp+100h],r13d
    SYMBOL_STACK_INDEX: 4
    SYMBOL_NAME: win32k!SURFACE::Map+a1
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: win32k
    IMAGE_NAME: win32k.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 53f7e73f
    IMAGE_VERSION: 6.1.7601.18577
    FAILURE_BUCKET_ID: X64_0xA_win32k!SURFACE::Map+a1
    BUCKET_ID: X64_0xA_win32k!SURFACE::Map+a1
    ANALYSIS_SOURCE: KM
    FAILURE_ID_HASH_STRING: km:x64_0xa_win32k!surface::map+a1
    FAILURE_ID_HASH: {01320864-bf16-8609-44eb-8dfab62a041a}
    Followup: MachineOwner
    ---------
    2: kd> .trap 0xfffff880086c7fc0
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=000000000000305e rbx=0000000000000000 rcx=0000000000000002
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002ad393c rsp=fffff880086c8150 rbp=0000000000000000
    r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
    r11=fffff88002f65180 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0 nv up ei pl zr na po nc
    nt!KeWaitForSingleObject+0x13c:
    fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7 ds:00000000`00000000=????????
    2: kd> lmvm win32k
    start end module name
    fffff960`000b0000 fffff960`003c9000 win32k (pdb symbols) c:\symbols\win32k.pdb\8550A726213B49C6AB862EFC270F9E212\win32k.pdb
    Loaded symbol image file: win32k.sys
    Mapped memory image file: c:\symbols\win32k.sys\53F7E73F319000\win32k.sys
    Image path: win32k.sys
    Image name: win32k.sys
    Timestamp: Fri Aug 22 19:58:39 2014 (53F7E73F)
    CheckSum: 00313AB8
    ImageSize: 00319000
    File version: 6.1.7601.18577
    Product version: 6.1.7601.18577
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 3.7 Driver
    File date: 00000000.00000000
    Translations: 0409.04b0
    CompanyName: Microsoft Corporation
    ProductName: Microsoft® Windows® Operating System
    InternalName: win32k.sys
    OriginalFilename: win32k.sys
    ProductVersion: 6.1.7601.18577
    FileVersion: 6.1.7601.18577 (win7sp1_gdr.140822-1508)
    FileDescription: Multi-User Win32 Driver
    LegalCopyright: © Microsoft Corporation. All rights reserved.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:16.
Find Us