New
#1
Crashing
Evenin All I was wondering if you could help a struggling noob on the problems I am having with crashes attached a few files after studying Jonathan Kings very good tuition thanks Jonathan.
Evenin All I was wondering if you could help a struggling noob on the problems I am having with crashes attached a few files after studying Jonathan Kings very good tuition thanks Jonathan.
Looks like possible hardware issues.
STOP 0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility
STOP 0x00000024: NTFS_FILE_SYSTEM
Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failureI found the driver, sptd.sys, at the time of the crash. Please remove any CD virtualization programs such as Daemon Tools and Alcohol 120%. They use the driver, found in your dmp, sptd.sys, that is notorious for causing BSODs. Use this SPTD uninstaller when you're done: DuplexSecure - DownloadsCode:Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062410-19422-01.zip\062410-19422-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`0309ee50 Debug session time: Thu Jun 24 09:23:42.012 2010 (GMT-4) System Uptime: 0 days 0:24:02.463 ............................................................... Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BugCheck A, {fffffa8013244010, 2, 1, fffff80002f8f9f7} Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 ) Followup: MachineOwner --------- ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: fffffa8013244010, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000001, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff80002f8f9f7, address which referenced memory Debugging Details: ------------------ WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800031090e0 fffffa8013244010 CURRENT_IRQL: 2 FAULTING_IP: nt!MiReleaseConfirmedPageFileSpace+87 fffff800`02f8f9f7 480fb328 btr qword ptr [rax],rbp CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0xA PROCESS_NAME: iexplore.exe TRAP_FRAME: fffff88009ee3440 -- (.trap 0xfffff88009ee3440) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=fffffa8003244010 rbx=0000000000000000 rcx=0000000000000000 rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000 rip=fffff80002f8f9f7 rsp=fffff88009ee35d0 rbp=0000000080000000 r8=fffff88009ee3600 r9=fffffa8001f6a060 r10=0000000fffffffff r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl zr na po nc nt!MiReleaseConfirmedPageFileSpace+0x87: fffff800`02f8f9f7 480fb328 btr qword ptr [rax],rbp ds:836b:fffffa80`03244010=???????????????? Resetting default scope LAST_CONTROL_TRANSFER: from fffff80002ed0b69 to fffff80002ed1600 STACK_TEXT: fffff880`09ee32f8 fffff800`02ed0b69 : 00000000`0000000a fffffa80`13244010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx fffff880`09ee3300 fffff800`02ecf7e0 : fffffa80`01feb600 fffffa80`01df5b60 fffffa80`01feb600 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff880`09ee3440 fffff800`02f8f9f7 : fffffa80`02075000 fffffa80`01df5b60 fffffa80`042f0890 00000000`00000702 : nt!KiPageFault+0x260 fffff880`09ee35d0 fffff800`02f44d78 : 80000000`00000000 fffff880`012567b5 00000000`000001a0 00000000`068a2000 : nt!MiReleaseConfirmedPageFileSpace+0x87 fffff880`09ee3650 fffff800`02f12fca : 00000000`00000000 00000000`068dffff fffffa80`00000000 fffffa80`01f6a060 : nt! ?? ::FNODOBFM::`string'+0x337d8 fffff880`09ee3810 fffff800`02ed0853 : ffffffff`ffffffff fffff880`09ee3ad0 fffff880`09ee3ad8 fffff800`00008000 : nt!NtFreeVirtualMemory+0x5ca fffff880`09ee3900 fffff800`02eccdf0 : fffff800`031628c7 fffffa80`01f6a060 fffffa80`01df5b60 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 fffff880`09ee3a98 fffff800`031628c7 : fffffa80`01f6a060 fffffa80`01df5b60 00000000`00000000 00000000`00000000 : nt!KiServiceLinkage fffff880`09ee3aa0 fffff800`031b7ace : 00000000`068a0000 00000000`00000000 fffff8a0`0a39ae30 fffffa80`0509ce60 : nt!RtlFreeUserStack+0x27 fffff880`09ee3ad0 fffff800`031bb5c1 : 00000000`00000000 fffff800`031e8500 00000000`7ef6e000 00000000`00000000 : nt!PspExitThread+0x7ae fffff880`09ee3b90 fffff800`031bb805 : fffffa80`01df5b60 00000000`00000000 fffffa80`01df5b60 00000000`7ef6e000 : nt!PspTerminateThreadByPointer+0x4d fffff880`09ee3be0 fffff800`02ed0853 : fffffa80`01df5b60 fffff880`09ee3ca0 00000000`7ef6e000 00000000`7ef6e000 : nt!NtTerminateThread+0x45 fffff880`09ee3c20 00000000`7741028a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`068de2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7741028a STACK_COMMAND: kb FOLLOWUP_IP: nt!MiReleaseConfirmedPageFileSpace+87 fffff800`02f8f9f7 480fb328 btr qword ptr [rax],rbp SYMBOL_STACK_INDEX: 3 SYMBOL_NAME: nt!MiReleaseConfirmedPageFileSpace+87 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt DEBUG_FLR_IMAGE_TIMESTAMP: 4b88cfeb IMAGE_NAME: memory_corruption FAILURE_BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87 BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87 Followup: MachineOwner Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062310-19437-01.zip\062310-19437-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`0d615000 PsLoadedModuleList = 0xfffff800`0d852e50 Debug session time: Wed Jun 23 15:08:12.855 2010 (GMT-4) System Uptime: 0 days 3:47:26.322 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BugCheck 24, {1904fb, fffff8800add2478, fffff8800add1ce0, fffff880012f35a9} Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckExistingFile+f9 ) Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.11.0001.404 X86 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_062310-19437-01.zip\062310-19437-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\symbols*Symbol information Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`0d615000 PsLoadedModuleList = 0xfffff800`0d852e50 Debug session time: Wed Jun 23 15:08:12.855 2010 (GMT-4) System Uptime: 0 days 3:47:26.322 Loading Kernel Symbols ............................................................... ................................................................ .................... Loading User Symbols Loading unloaded module list ..... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* BugCheck 24, {1904fb, fffff8800add2478, fffff8800add1ce0, fffff880012f35a9} Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckExistingFile+f9 ) Followup: MachineOwner --------- NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff8800add2478 Arg3: fffff8800add1ce0 Arg4: fffff880012f35a9 Debugging Details: ------------------ EXCEPTION_RECORD: fffff8800add2478 -- (.exr 0xfffff8800add2478) ExceptionAddress: fffff880012f35a9 (Ntfs!NtfsCheckExistingFile+0x00000000000000f9) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff8800add1ce0 -- (.cxr 0xfffff8800add1ce0) rax=fffff8a01143d040 rbx=7ffff8a01143cfe0 rcx=0000000000000080 rdx=fffffa8006c0f060 rsi=0000000000000000 rdi=fffff8a01143d010 rip=fffff880012f35a9 rsp=fffff8800add26b0 rbp=0000000000000000 r8=0000000000000000 r9=0000000000000000 r10=fffff8a0114a2060 r11=fffffa8006c0f060 r12=fffffa8006c25010 r13=fffffa8002001610 r14=fffff8800acf2390 r15=fffffa8006f7bad8 iopl=0 nv up ei pl nz na pe cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010203 Ntfs!NtfsCheckExistingFile+0xf9: fffff880`012f35a9 8b8bac000000 mov ecx,dword ptr [rbx+0ACh] ds:002b:7ffff8a0`1143d08c=???????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: services.exe CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000d8bd0e0 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsCheckExistingFile+f9 fffff880`012f35a9 8b8bac000000 mov ecx,dword ptr [rbx+0ACh] FAULTING_IP: Ntfs!NtfsCheckExistingFile+f9 fffff880`012f35a9 8b8bac000000 mov ecx,dword ptr [rbx+0ACh] BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff880012f3f0f to fffff880012f35a9 STACK_TEXT: fffff880`0add26b0 fffff880`012f3f0f : 00000000`00000000 fffff8a0`1143d010 00000000`00000002 fffff8a0`1142de00 : Ntfs!NtfsCheckExistingFile+0xf9 fffff880`0add2740 fffff880`012f078b : fffff880`0acf2390 fffffa80`06c25010 fffff8a0`1143d3a8 fffff8a0`00000024 : Ntfs!NtfsOpenExistingAttr+0x20f fffff880`0add2800 fffff880`012f0eff : fffffa80`06c25010 fffffa80`06f7b780 fffff8a0`1143d3a8 fffff880`00000024 : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab fffff880`0add2990 fffff880`01301e76 : fffffa80`06c25010 fffffa80`06f7b780 fffff8a0`1143d3a8 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef fffff880`0add2a80 fffff880`012fc28d : fffffa80`06c25010 fffffa80`06f7b780 fffff880`0add2c60 fffff880`0add2ca8 : Ntfs!NtfsFindStartingNode+0x5e6 fffff880`0add2b50 fffff880`01265c0d : fffffa80`06c25010 fffffa80`06f7b780 fffff880`0acf2390 fffffa80`06c0f000 : Ntfs!NtfsCommonCreate+0x3dd fffff880`0add2d30 fffff800`0d67d487 : fffff880`0acf2300 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d fffff880`0add2d60 fffff800`0d67d441 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27 fffff880`0acf21d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsCheckExistingFile+f9 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f STACK_COMMAND: .cxr 0xfffff8800add1ce0 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCheckExistingFile+f9 BUCKET_ID: X64_0x24_Ntfs!NtfsCheckExistingFile+f9 Followup: MachineOwner ---------
After you have uninstalled the program associated with this driver, reboot and let's see what happens. Please post back after you have uninstalled it. We will go from there.
Last edited by CarlTR6; 24 Jun 2010 at 14:11.
Thank Carl
Carl Thanks for the speedy reply I had deamon lite installed so I have removed that nothing else of that elk on my comp I think lol I have downloaded the file you suggested so I will see what crops up in the next few days. Thanks again for your help.
You are very welcome. I hope your problem is solved that easily! SPTD.sys definitely causes BSOD's with Windows 7. We see it almost daily.
Had a few more crashes which always seemed to happened when I was on Internet Exp.8 so I have switched to Google Chrome not had a crash since fingers crossed yet again.
That is interesting, a definitely conflict somewhere. Keep us updated. I'm glad you are running smoothly.
If you want to upload those latest dumps, we will take a look at them.
Spoke to soon Back to crashing again attached a few files to see if its same problem thanks in anticipation,
Welcome
Since, Carl was off line, I just wanted to take a look at a few files and see if I agreed. I was not able to open any files. Your files are uploaded as a short cut, not like your first files, which I could open.