This is starting to happen more and more recently usually preceded by applications crashing (Google Chrome or Football Manager), but on occasion just out of nowhere.
I ordered this computer new about a month ago from Overclockers UK with Windows 7 Home Premium 64-bit preloaded, and have not had to do any system restores or re-installations.
Thanks for your help.
Memory corruption caused by an as yet un-named driver (probably your Sftredirlh.sys)
I would run memtest and driver verifier
Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program.
Memtest86.com - Memory Diagnostic
Boot from the CD, and leave it running for at least 5 or 6 passes.
Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.
Test the sticks individually, and if you find a good one, test it in all slots.
Beyond that, please run Verifier with these settings:
Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.
So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).
Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
NOTE: You can use Low Resource Simulation if you'd like. From my limited experimentation it makes the BSOD's come faster.
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.
Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).
Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.
If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line:
Code:
Delete these registry keys (works in XP, Vista, Win7):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDrivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\VerifyDriverLevel
Using Driver Verifier to identify issues with Windows drivers for advanced users
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\050611-17191-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`0329be50
Debug session time: Fri May 6 16:21:26.394 2011 (GMT-4)
System Uptime: 0 days 0:02:21.017
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff68004032408, 0, fffff800031d4f07, 2}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiCaptureAndResetWorkingSetAccessBits+97 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff68004032408, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800031d4f07, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800033060e0
fffff68004032408
FAULTING_IP:
nt!MiCaptureAndResetWorkingSetAccessBits+97
fffff800`031d4f07 488b5d00 mov rbx,qword ptr [rbp]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88003139850 -- (.trap 0xfffff88003139850)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=0000000004032408
rdx=fffff6fb40000190 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031d4f07 rsp=fffff880031399e0 rbp=fffff68004032408
r8=0000000000000001 r9=0000000000000014 r10=0000000000000000
r11=00000000000000f4 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!MiCaptureAndResetWorkingSetAccessBits+0x97:
fffff800`031d4f07 488b5d00 mov rbx,qword ptr [rbp] ss:0018:fffff680`04032408=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000314d8f2 to fffff800030ce740
STACK_TEXT:
fffff880`031396e8 fffff800`0314d8f2 : 00000000`00000050 fffff680`04032408 00000000`00000000 fffff880`03139850 : nt!KeBugCheckEx
fffff880`031396f0 fffff800`030cc82e : 00000000`00000000 84600000`2c93d847 00000000`00001000 fffff800`03202bfe : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`03139850 fffff800`031d4f07 : 00000003`00000000 7c400000`2c9fb867 fffff6fb`40000190 fffff700`010942a8 : nt!KiPageFault+0x16e
fffff880`031399e0 fffff800`03150a70 : 00000000`00000000 00000000`0000000a fffff880`03139ba0 fffff880`03139bb0 : nt!MiCaptureAndResetWorkingSetAccessBits+0x97
fffff880`03139ae0 fffff800`030e2ee2 : 00000000`0000008d 00000000`00000000 fffffa80`00000000 00000000`00000005 : nt! ?? ::FNODOBFM::`string'+0x496e8
fffff880`03139b80 fffff800`030e30e8 : 00000000`00000008 fffff880`03139c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03139bd0 fffff800`033717c6 : fffffa80`03a03680 00000000`00000080 fffffa80`03967b30 00000000`00000001 : nt!KeBalanceSetManager+0x138
fffff880`03139d40 fffff800`030acc26 : fffff800`03248e80 fffffa80`03a03680 fffff800`03256c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03139d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiCaptureAndResetWorkingSetAccessBits+97
fffff800`031d4f07 488b5d00 mov rbx,qword ptr [rbp]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiCaptureAndResetWorkingSetAccessBits+97
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiCaptureAndResetWorkingSetAccessBits+97
BUCKET_ID: X64_0x50_nt!MiCaptureAndResetWorkingSetAccessBits+97
Followup: MachineOwner
---------
