Analyze Crash Please

spacelord · 29 Mar 2010

I have been getting CTD and the occasional BSOD while playing Empire: Total War. I have some trouble with games in general with my computer. Dump file attached.

Thanks for any help.

zigzag3143 · 29 Mar 2010

spacelord said:

I have been getting CTD and the occasional BSOD while playing Empire: Total War. I have some trouble with games in general with my computer. Dump file attached.

Thanks for any help.

this crash was probably caused by both a win 7 OS file (ntkrnl) and IObit (part of avira av)

I would uninstall Avira just to test,
and run a system file check to verify your win 7 system files.

to run an SFC type cmd in search>right click and run as admin>sfc /scannow ( note the space between sfc and "/")

Let us know if you need help

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\032910-17362-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e58e50
Debug session time: Mon Mar 29 01:12:11.756 2010 (GMT-4)
System Uptime: 0 days 8:48:50.158
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa00036af2b0, 1, fffff80002cabadf, 7}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CcGetVirtualAddress+21f )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa00036af2b0, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002cabadf, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec30e0
 fffffa00036af2b0 

FAULTING_IP: 
nt!CcGetVirtualAddress+21f
fffff800`02cabadf f00fc17710      lock xadd dword ptr [rdi+10h],esi

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  IObit SmartDef

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007584280 -- (.trap 0xfffff88007584280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800391e4f8 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cabadf rsp=fffff88007584410 rbp=fffffa800391e4c0
 r8=fffff88007584568  r9=fffff88007584560 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!CcGetVirtualAddress+0x21f:
fffff800`02cabadf f00fc17710      lock xadd dword ptr [rdi+10h],esi ds:00000000`00000010=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d0ab19 to fffff80002c8cf00

STACK_TEXT:  
fffff880`07584118 fffff800`02d0ab19 : 00000000`00000050 fffffa00`036af2b0 00000000`00000001 fffff880`07584280 : nt!KeBugCheckEx
fffff880`07584120 fffff800`02c8afee : 00000000`00000001 00000000`0000000e fffff880`0127ea00 fffff880`000000a0 : nt! ?? ::FNODOBFM::`string'+0x40edb
fffff880`07584280 fffff800`02cabadf : fffff980`20fff800 fffff880`012f4960 fffffa80`04657180 00000000`00002218 : nt!KiPageFault+0x16e
fffff880`07584410 fffff800`02f905b2 : 00000000`00000000 00000000`00000000 fffff880`07584568 fffff880`07584560 : nt!CcGetVirtualAddress+0x21f
fffff880`075844a0 fffff880`012f3025 : fffffa80`06509310 fffff8a0`006c4bc0 fffff8a0`006c4bc0 fffff8a0`0000000e : nt!CcMapData+0xd2
fffff880`07584560 fffff880`012f6d71 : fffff8a0`006c4bc0 00000000`00000000 fffff8a0`0af2cdf0 fffffa80`06509310 : Ntfs!FindFirstIndexEntry+0x1fa
fffff880`075845f0 fffff880`012df677 : fffffa80`06509310 fffffa80`06509310 fffff8a0`0b002601 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`07584660 fffff880`01248c0d : fffffa80`06509310 fffffa80`05c52540 fffff880`07584a10 fffff800`02caba00 : Ntfs!NtfsCommonCreate+0x7c7
fffff880`07584840 fffff800`02c9c64a : fffff880`07584980 fffffa80`039d4b30 00000000`00000000 fffff800`02c92410 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`07584870 fffff880`01248b2f : fffff880`01248bf0 fffff880`07584980 00000000`00000000 fffff880`012ea32d : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`07584950 fffff880`012e59c0 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`05c52540 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`075849b0 fffff880`0105d3a2 : fffffa80`04657030 fffffa80`05c52540 fffffa80`047b5300 fffff880`6d4e6f49 : Ntfs!NtfsFsdCreate+0x1b0
fffff880`07584b60 fffff800`02f8d477 : 00000000`00000060 fffff800`02f8ced0 fffffa80`048e55c8 fffff8a0`001c23c0 : fltmgr!FltpCreate+0x392
fffff880`07584c10 fffff800`02f83764 : fffffa80`045f9cd0 00000000`00000000 fffffa80`069a3010 fffff880`07584e00 : nt!IopParseDevice+0x5a7
fffff880`07584da0 fffff800`02f88876 : fffffa80`069a3010 fffff880`07584f20 00000000`00000240 fffffa80`036da080 : nt!ObpLookupObjectName+0x585
fffff880`07584ea0 fffff800`02f8f587 : fffff880`07584f68 00000000`00000001 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByName+0x306
fffff880`07584f70 fffff800`02f3458b : fffffa80`03abe408 fffffa80`00100001 00000000`00000000 fffff880`07585130 : nt!IopCreateFile+0x2b7
fffff880`07585010 fffff880`01060dca : fffffa80`03abe330 00000000`00000017 00000000`00000000 fffffa80`048e55c8 : nt!IoCreateFileEx+0xfb
fffff880`075850b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fltmgr!FltpNormalizeNameComponent+0x16a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CcGetVirtualAddress+21f
fffff800`02cabadf f00fc17710      lock xadd dword ptr [rdi+10h],esi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CcGetVirtualAddress+21f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x50_nt!CcGetVirtualAddress+21f

BUCKET_ID:  X64_0x50_nt!CcGetVirtualAddress+21f

Followup: MachineOwner
---------