Sudden onslaught of BSODs

bellandbottle · 06 Jan 2010

I have had 6 BSODs in the last couple of hours, after weeks of almost trouble free usage. I have attached a zip file, and would appreciate someone taking a look for me.

zigzag3143 · 06 Jan 2010

bellandbottle said:

I have had 6 BSODs in the last couple of hours, after weeks of almost trouble free usage. I have attached a zip file, and would appreciate someone taking a look for me.

Hi and welcome

this one was probably caused by memory corruption. I would download memtestx86 and run it for 5 passes

run a system file checker
type cmd in search>right click and run as adim>sfc /scannow

Ken J+

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\010610-21340-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82e44000 PsLoadedModuleList = 0x82f8c810
Debug session time: Wed Jan  6 12:12:46.908 2010 (GMT-5)
System Uptime: 0 days 0:02:45.375
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fff6ca56, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 82ee3888, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82fac718
Unable to read MiSystemVaType memory at 82f8c160
 fff6ca56 

FAULTING_IP: 
nt!MiGetNextNode+20
82ee3888 8b4804          mov     ecx,dword ptr [eax+4]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  8e71fa10 -- (.trap 0xffffffff8e71fa10)
ErrCode = 00000000
eax=fff6ca52 ebx=85dc0df8 ecx=fff6ca52 edx=879732ed esi=85b948e0 edi=beaaa014
eip=82ee3888 esp=8e71fa84 ebp=8e71fabc iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
nt!MiGetNextNode+0x20:
82ee3888 8b4804          mov     ecx,dword ptr [eax+4] ds:0023:fff6ca56=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82e8a5f8 to 82ec98e3

STACK_TEXT:  
8e71f9f8 82e8a5f8 00000000 fff6ca56 00000000 nt!MmAccessFault+0x106
8e71f9f8 82ee3888 00000000 fff6ca56 00000000 nt!KiTrap0E+0xdc
8e71fa80 830c222c 00002000 8e71fb50 00000002 nt!MiGetNextNode+0x20
8e71fabc 83005720 beaaa000 87979668 8e71fb50 nt!MmEnumerateAndReferenceImages+0x11c
8e71fae4 8300607a 87979668 00000000 87979668 nt!EtwpEnumerateImages+0x41
8e71fb28 83005531 87979668 8e71fb50 00000000 nt!EtwpProcessEnumCallback+0x1c1
8e71fb40 83005eac 83005eb7 8e71fb50 8e71fbb4 nt!PsEnumProcesses+0x12
8e71fb64 83005dbd 8e71fbb4 00000000 82f7db18 nt!EtwpProcessThreadImageRundown+0x43
8e71fb78 83005d3d 00000002 00000001 82f83320 nt!EtwpKernelTraceRundown+0x28
8e71fc34 8302d5c1 00000000 00000000 00000002 nt!EtwpUpdateLoggerGroupMasks+0x1a4
8e71fc48 8302d322 000000b4 00000000 000000b4 nt!EtwpStopLoggerInstance+0x39
8e71fc78 83096462 b77d3d80 00000000 a3bbd1fd nt!EtwpStopTrace+0xf8
8e71fcd0 83005a6d 00000002 82f83ac0 000000b4 nt!NtTraceControl+0x219
8e71fd00 82eb1f2b 85de4400 00000000 85b948e0 nt!PerfDiagpProxyWorker+0x15a
8e71fd50 8305266d 00000001 a3bbd0bd 00000000 nt!ExpWorkerThread+0x10d
8e71fd90 82f040d9 82eb1e1e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiGetNextNode+20
82ee3888 8b4804          mov     ecx,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiGetNextNode+20

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc007

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x50_nt!MiGetNextNode+20

BUCKET_ID:  0x50_nt!MiGetNextNode+20

Followup: MachineOwner
---------

bellandbottle · 06 Jan 2010

Many thanks for the welcome and the very quick reply - I will do as you suggest straight away.

bellandbottle · 06 Jan 2010

I burned memtest86 to DVD and did 5 passes. I was a little confused about what it was doing as it went straight to reboot after each test, but I take it that it would have halted on an error?

I then did a system scan, with no integrity problems.

Is there anything else I should do?

bellandbottle · 07 Jan 2010

No problems seen today.

It could all be down to power supply issues in this area, with us having white-out conditions and neighbouring villages cut off completely.

I am still not entirely sure that I am using memtest86 properly.

usasma · 07 Jan 2010

Memtest will run until you turn it off. If you don't see errors at the bottom of the screen (in bright red), it's usually OK. Here's an image w/errors:

Please try running Driver Verifier according to these directions:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users