Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: WIndows 7 64bit - Minidump help?

10 Feb 2010   #1
vyrotek

Windows 7 Ultimate
 
 
WIndows 7 64bit - Minidump help?

Just recently things have started going crazy with random bsod's.
I have a few minidump file available and would appreciate if someone could take a look.

I did notice there were other people complaining about lots of crashes after the latest windows update. But, I really have no idea what is causing the problem.

Thanks


My System SpecsSystem Spec
.
10 Feb 2010   #2
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by vyrotek View Post
Just recently things have started going crazy with random bsod's.
I have a few minidump file available and would appreciate if someone could take a look.

I did notice there were other people complaining about lots of crashes after the latest windows update. But, I really have no idea what is causing the problem.

Thanks

These were caused byt your vfilter.sys which is ppart of your VPN client software. I would either uninstall it or reinstall it
Also
run a system file check
type cmd in search>right click and run as admin>sfc /scannow

If you are overclocking stop


Ken


Code:
020810-22947-01.dmp    2/8/2010 8:27:10 PM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c910b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\020810-22947-01.dmp    4    15    7600    
020910-21902-01.dmp    2/9/2010 5:49:52 PM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c8a0b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\020910-21902-01.dmp    4    15    7600    
021010-31683-01.dmp    2/10/2010 9:42:06 AM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c870b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-31683-01.dmp    4    15    7600    
021010-37799-01.dmp    2/10/2010 9:31:22 AM    IRQL_NOT_LESS_OR_EQUAL    0x0000000a    00000000`00000000    00000000`00000002    00000000`00000000    fffff800`02c8e0b6    ntoskrnl.exe    ntoskrnl.exe+71f00                    x64        C:\Users\K\Desktop\New folder\021010-37799-01.dmp    4    15    7600
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\021010-31683-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e4ee50
Debug session time: Wed Feb 10 11:40:32.053 2010 (GMT-5)
System Uptime: 0 days 0:09:58.162
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c870b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c870b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb90e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02c870b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88005f1afb0 -- (.trap 0xfffff88005f1afb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009b91818 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c870b6 rsp=fffff88005f1b140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02c870b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c82469 to fffff80002c82f00

STACK_TEXT:  
fffff880`05f1ae68 fffff800`02c82469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`05f1ae70 fffff800`02c810e0 : 00000000`00000002 fffffa80`09b91810 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`05f1afb0 fffff800`02c870b6 : fffff880`05f1b1b0 fffff880`02d92b0e 00000000`00000049 fffff880`05f1b230 : nt!KiPageFault+0x260
fffff880`05f1b140 fffff880`02d929a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09b91800 : nt!KeSetEvent+0x226
fffff880`05f1b1b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09b91800 00000000`00000000 : vfilter+0x29a6
fffff880`05f1b1b8 00000000`00000000 : 00000000`00000000 fffffa80`09b91800 00000000`00000000 fffff880`02d9242b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d929a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------
My System SpecsSystem Spec
10 Feb 2010   #3
vyrotek

Windows 7 Ultimate
 
 

Thanks for the quick response!

I could understand the ones that happened today (2/10) to be the VPN, but 2/8 and 2/9 shouldn't show the same problem. But you say it does?

I attached an even older dump from 2/6 which I don't think was the VPN either.

Edit - Also, what would make you believe I was overclocking? I'm not, but I just want to make sure you're not seeing something that typically shows up when something is overheating.
My System SpecsSystem Spec
.

10 Feb 2010   #4
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by vyrotek View Post
Thanks for the quick response!

I could understand the ones that happened today (2/10) to be the VPN, but 2/8 and 2/9 shouldn't show the same problem. But you say it does?

I attached an even older dump from 2/6 which I don't think was the VPN either.

Edit - Also, what would make you believe I was overclocking? I'm not, but I just want to make sure you're not seeing something that typically shows up when something is overheating.
Still says vfilter.sys like last time. The ref to overclock was generic, I say that every BSOD just in case.


Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\020610-19983-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e8ee50
Debug session time: Sat Feb  6 14:19:12.281 2010 (GMT-5)
System Uptime: 0 days 2:26:50.390
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc70b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc70b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef90e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc70b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800a397fb0 -- (.trap 0xfffff8800a397fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009a92d98 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc70b6 rsp=fffff8800a398140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe cy
nt!KeSetEvent+0x226:
fffff800`02cc70b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc2469 to fffff80002cc2f00

STACK_TEXT:  
fffff880`0a397e68 fffff800`02cc2469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a397e70 fffff800`02cc10e0 : 00000000`00000002 fffffa80`09a92d90 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0a397fb0 fffff800`02cc70b6 : fffff880`0a3981b0 fffff880`02d21b0e 00000000`00000049 fffff880`0a398230 : nt!KiPageFault+0x260
fffff880`0a398140 fffff880`02d219a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09a92d80 : nt!KeSetEvent+0x226
fffff880`0a3981b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09a92d80 00000000`00000000 : vfilter+0x29a6
fffff880`0a3981b8 00000000`00000000 : 00000000`00000000 fffffa80`09a92d80 00000000`00000000 fffff880`02d2142b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d219a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------
My System SpecsSystem Spec
23 Feb 2010   #5
vyrotek

Windows 7 Ultimate
 
 

Sorry to bump this again but I finally caught a BSOD while not running my VPN software.
Any chance someone could take a look at this dmp?

I was remoted locally in VirtualBox running Windows 2008. I'm not sure what could have caused the BSOD this time.
My System SpecsSystem Spec
23 Feb 2010   #6
zigzag3143

Win 8 Release candidate 8400
 
 

Quote   Quote: Originally Posted by vyrotek View Post
Sorry to bump this again but I finally caught a BSOD while not running my VPN software.
Any chance someone could take a look at this dmp?

I was remoted locally in VirtualBox running Windows 2008. I'm not sure what could have caused the BSOD this time.
Hate to tell you but it is still your vpn client. the file the caused this is vfilter.sys and it it loaded at start up, rvrn if you dont run the vpn client

Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\022210-20935-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e90e50
Debug session time: Tue Feb 23 00:48:04.321 2010 (GMT-5)
System Uptime: 0 days 4:49:01.429
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc90b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc90b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88007958fb0 -- (.trap 0xfffff88007958fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009bbe478 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc90b6 rsp=fffff88007959140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc4469 to fffff80002cc4f00

STACK_TEXT:  
fffff880`07958e68 fffff800`02cc4469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07958e70 fffff800`02cc30e0 : 00000000`00000002 fffffa80`09bbe470 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07958fb0 fffff800`02cc90b6 : fffff880`079591b0 fffff880`02d93b0e 00000000`00000051 fffff880`07959230 : nt!KiPageFault+0x260
fffff880`07959140 fffff880`02d939a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09bbe460 : nt!KeSetEvent+0x226
fffff880`079591b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09bbe460 00000000`00000000 : vfilter+0x29a6
fffff880`079591b8 00000000`00000000 : 00000000`00000000 fffffa80`09bbe460 00000000`00000000 fffff880`02d9342b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d939a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\022210-20935-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e90e50
Debug session time: Tue Feb 23 00:48:04.321 2010 (GMT-5)
System Uptime: 0 days 4:49:01.429
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002cc90b6}

Unable to load image \SystemRoot\system32\DRIVERS\vfilter.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for vfilter.sys
*** ERROR: Module load completed but symbols could not be loaded for vfilter.sys
Probably caused by : vfilter.sys ( vfilter+29a6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc90b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff88007958fb0 -- (.trap 0xfffff88007958fb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009bbe478 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc90b6 rsp=fffff88007959140 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!KeSetEvent+0x226:
fffff800`02cc90b6 488b09          mov     rcx,qword ptr [rcx] ds:0002:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cc4469 to fffff80002cc4f00

STACK_TEXT:  
fffff880`07958e68 fffff800`02cc4469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07958e70 fffff800`02cc30e0 : 00000000`00000002 fffffa80`09bbe470 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`07958fb0 fffff800`02cc90b6 : fffff880`079591b0 fffff880`02d93b0e 00000000`00000051 fffff880`07959230 : nt!KiPageFault+0x260
fffff880`07959140 fffff880`02d939a6 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`09bbe460 : nt!KeSetEvent+0x226
fffff880`079591b0 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`09bbe460 00000000`00000000 : vfilter+0x29a6
fffff880`079591b8 00000000`00000000 : 00000000`00000000 fffffa80`09bbe460 00000000`00000000 fffff880`02d9342b : 0xfffffa80`00000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vfilter+29a6
fffff880`02d939a6 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vfilter+29a6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vfilter

IMAGE_NAME:  vfilter.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------



DEBUG_FLR_IMAGE_TIMESTAMP:  4b048bff

FAILURE_BUCKET_ID:  X64_0xA_vfilter+29a6

BUCKET_ID:  X64_0xA_vfilter+29a6

Followup: MachineOwner
---------
My System SpecsSystem Spec
13 Jun 2012   #7
masterjsn

Missouri
 
 
help: what do you make of this?

Opened log file 'c:\debuglog.txt'
1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800771e028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be200000, High order 32-bits of the MCi_STATUS value.
Arg4: 000000000005110a, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------


BUGCHECK_STR: 0x124_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: f

STACK_TEXT:
fffff880`009f4a58 fffff800`02e2ba3b : 00000000`00000124 00000000`00000000 fffffa80`0771e028 00000000`be200000 : nt!KeBugCheckEx
fffff880`009f4a60 fffff800`02feeb33 : 00000000`00000001 fffffa80`074d4830 00000000`00000000 fffffa80`074d4880 : hal!HalBugCheckSystem+0x1e3
fffff880`009f4aa0 fffff800`02e2b700 : 00000000`00000728 fffffa80`074d4830 fffff880`009f4e30 fffff880`009f4e00 : nt!WheaReportHwError+0x263
fffff880`009f4b00 fffff800`02e2b052 : fffffa80`074d4830 fffff880`009f4e30 fffffa80`074d4830 00000000`00000000 : hal!HalpMcaReportError+0x4c
fffff880`009f4c50 fffff800`02e2af0d : 00000000`00000004 00000000`00000001 fffff880`009f4eb0 00000000`00000000 : hal!HalpMceHandler+0x9e
fffff880`009f4c90 fffff800`02e1ee88 : 00000000`00000001 fffff880`009ec180 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0x55
fffff880`009f4cc0 fffff800`02edd56c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff880`009f4cf0 fffff800`02edd3d3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x6c
fffff880`009f4e30 fffff800`02ee76ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x153
fffff880`02f1bb60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PoIdle+0x3eb


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_CACHE

BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_CACHE

Followup: MachineOwner
---------
My System SpecsSystem Spec
13 Jun 2012   #8
masterjsn

Missouri
 
 
here is another:please help

There are many more, but they all seen ramdom. meaning it lists the program i was running when it bsod me. I dont really know how to read the info.

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800770f028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.

Debugging Details:
------------------


BUGCHECK_STR: 0x124_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: UnrealTourname

CURRENT_IRQL: f

STACK_TEXT:
fffff800`00ba8a98 fffff800`02c17a3b : 00000000`00000124 00000000`00000000 fffffa80`0770f028 00000000`be000000 : nt!KeBugCheckEx
fffff800`00ba8aa0 fffff800`02ddab33 : 00000000`00000001 fffffa80`07493c50 00000000`00000000 fffffa80`07493ca0 : hal!HalBugCheckSystem+0x1e3
fffff800`00ba8ae0 fffff800`02c17700 : 00000000`00000728 fffffa80`07493c50 fffff800`00ba8e70 fffff800`00ba8e00 : nt!WheaReportHwError+0x263
fffff800`00ba8b40 fffff800`02c17052 : fffffa80`07493c50 fffff800`00ba8e70 fffffa80`07493c50 00000000`00000000 : hal!HalpMcaReportError+0x4c
fffff800`00ba8c90 fffff800`02c16f0d : 00000000`00000004 00000000`00000001 fffff800`00ba8ef0 00000000`00000000 : hal!HalpMceHandler+0x9e
fffff800`00ba8cd0 fffff800`02c0ae88 : 00000000`00000020 00000000`03470d40 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0x55
fffff800`00ba8d00 fffff800`02cc956c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x40
fffff800`00ba8d30 fffff800`02cc93d3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxMcheckAbort+0x6c
fffff800`00ba8e70 00000000`07bbd4ac : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x153
00000000`0018f1ec 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7bbd4ac




STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE

BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE

Followup: MachineOwner
My System SpecsSystem Spec
13 Jun 2012   #9
writhziden

Windows 7 Home Premium 64 Bit
 
 

You have a 0x124 hardware bugcheck. If the system is still under warranty, I would recommend sending it in to have diagnostic tests done and any bad hardware replaced.

warning   Warning
Before you proceed with the following, answer these two questions: Are you still under warranty? Does your warranty allow you to open up the machine to check hardware? If you are unsure of the answers to these questions, contact your system manufacturer. WARNING: The steps that follow can void your warranty!!!

For your hardware stop 0x124 crash, read through Stop 0x124 - what it means and what to try and use the following hardware checks to supplement that link.
  • If you are overclocking any hardware, please stop.

  • Monitor temperatures during the following tests.
    Use the following programs to monitor the temperatures.
  • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

    For Part 3: If You Have Errors: If you swap any memory components, follow these steps for ESD safety:
    1. Shut down and turn off your computer.
    2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
    3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
    4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working. If you do not have an anti-static workbench, desk, or pad, you can use your computer tower/case by finding a metal hold in it, such as a drive bay.
    Once these steps have been followed, it is safe to remove and replace components within your computer.

Remember to read closely through Stop 0x124 - what it means and what to try for the crash.
My System SpecsSystem Spec
14 Jun 2012   #10
masterjsn

Missouri
 
 
thanks for the reply.

AsRock Z68 Extreme3 Gen3
G.SKILL Ripjaws X Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1600 (PC3 12800)
SanDisk Extreme SDSSDX-120G-G25 2.5" 120GB SATA III Internal Solid State Drive (SSD)

This is a custom built computer with a core i5 2500k. So i cant return it. I am not overclocking. Im only using the cpu graphics, and onboard everything else. So is there a better program to bugcheck my system? I just used a program from ms (Microsoft Windows SDK for Windows 7 and .NET Framework 4). There were many im not sure if im using the right one. I have done memtest+ and no errors. What else can i do? Thanks in advance.
My System SpecsSystem Spec
Reply

 WIndows 7 64bit - Minidump help?




Thread Tools




Similar help and support threads
Thread Forum
HELP! windows minidump error
:cry:
BSOD Help and Support
Windows 8.1 64bit and windows 7 64bit dual boot
hey there! My system has a single SATA 500gb hard drive. I have clean installed windows 8.1 on it. Now I need Windows 7 on my system but I love Windows 8.1 also. I want both windows 7 and windows 8.1 Can I dual boot windows 7 with Windows 8.1?
Installation & Setup
Windows 7 keeps crashing blue screen C:\Windows\Minidump\101912-39795-
Hi please can you help me, I have a windows 7 Home premium 64 bit, and the problem is my computer keeps crashing to blue screen and restarting. I've checked my drive for errors and checked my memory and have found nothing!!! I've done a restore system to an earlier point in time and the...
BSOD Help and Support
Random Win 7 home premium 64bit restart with err and minidump attached
Problem signature: Problem Event Name: BlueScreen OS Version: 6.1.7601.2.1.0.768.3 Locale ID: 1048 Additional information about the problem: BCCode: d1 BCP1: 0000000000000008 BCP2: 0000000000000002 BCP3: 0000000000000000
BSOD Help and Support
Windows 7 minidump/BSoD
I have W7 Ultimate on my Compaq Presario CQ60 notebook laptop and it just BSoD'd on me this morning. Here's the error message as well as a screenshot Problem signature: Problem Event Name: BlueScreen OS Version: 6.1.7600.2.0.0.256.1 Locale ID: 1033 Additional information about the...
BSOD Help and Support
Adobe Photoshop 64bit freezes on 64bit windows
getting frustrated as since i got windows 7 both Adobe Photoshop cs4 and Grass Valley Edius keep freezing. Edius usually only will freeze for 10 seconds then rectify but photoshop is freezing often.. especially after the pc has idled, and nothing can rectify it, so im losing work help!
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:41.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App