Hi guys, i have a machine that was working perfectly on vista, but now i get random BSOD every now and then, and almost always when im not using my machine...
I dont know how to use minidump files, so i attached the one i get. Im using this computer to work so i need to resolve the problem, thanks.-.
heres the message i get:
Firma con problemas:
Nombre del evento de problema: BlueScreen
Versión del sistema operativo: 6.1.7600.2.0.0.256.1
Id. de configuración regional: 3082
Información adicional del problema:
BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF880016C7655
BCP3: FFFFF8800D10CF78
BCP4: FFFFF8800D10C7D0
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1
Archivos que ayudan a describir el problema:
C:\Windows\Minidump\111409-26676-01.dmp
C:\Users\glen\AppData\Local\Temp\WER-45443-0.sysdata.xml
Lea nuestra declaración de privacidad en línea:
Windows 7 Privacy Highlights - Microsoft Windows
Si la declaración de privacidad en línea no está disponible, lea la declaración de privacidad sin conexión:
C:\Windows\system32\es-ES\erofflps.txt
My collegue Tews asked me to take a look at your dump
Basically it shows three distinct problems
first ancient drivers. If you are running 7600 as it shows you have drivers from as far back as 2005. those will make for instability and crashes. I auappect that you did not do a clean install and hence the old drivers.
these are the oldest
ASACPI.sys fffff880`05091000 fffff880`05099000 0x00008000 0x42476c4c 3/27/2005 9:30:36 PM
secdrv.SYS fffff880`096bd000 fffff880`096c8000 0x0000b000 0x4508052e 9/13/2006 8:18:38 AM
PxHlpa64.sys fffff880`013ce000 fffff880`013d9ae0 0x0000bae0 0x475dd06d 12/10/2007 6:49:01 PM
vncmirror.sys fffff880`0512a000 fffff880`05131000 0x00007000 0x47dab929 3/14/2008 12:43:05 PM
000.fcl fffff880`09707000 fffff880`09732000 0x0002b000 0x48dcdf7a 9/26/2008 8:11:22 AM
adfs.SYS fffff880`08fb2000 fffff880`08fca000 0x00018000 0x490f2b4e 11/3/2008 11:48:14 AM
second the file that probably caused the crash is Epfwndis.sys That is a part of your ESET AV.
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\K\Desktop\111409-26676-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*d:\symbols*
Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by:
7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e94e50
Debug session time: Sat Nov 14 04:03:09.255 2009 (GMT-5)
System Uptime: 1 days 21:40:30.549
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff880016c7655, fffff8800d10cf78, fffff8800d10c7d0}
Unable to load image \SystemRoot\system32\DRIVERS\Epfwndis.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Epfwndis.sys
*** ERROR: Module load completed but symbols could not be loaded for
Epfwndis.sys
Probably caused by : Epfwndis.sys ( Epfwndis+367b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880016c7655, The address that the exception occurred at
Arg3: fffff8800d10cf78, Exception Record Address
Arg4: fffff8800d10c7d0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
ndis!ndisXlateRecvPacketArrayToNetBufferLists+b5
fffff880`016c7655 4c895d00 mov qword ptr [rbp],r11
EXCEPTION_RECORD: fffff8800d10cf78 -- (.exr 0xfffff8800d10cf78)
ExceptionAddress: fffff880016c7655 (ndis!ndisXlateRecvPacketArrayToNetBufferLists+0x00000000000000b5)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: ffffffffffffffff
Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000
CONTEXT: fffff8800d10c7d0 -- (.cxr 0xfffff8800d10c7d0)
rax=00000000c000009a rbx=fffffa800c483810 rcx=fffff8800d10d340
rdx=fffffa800c483810 rsi=0000000000000000 rdi=fffff8800d10d270
rip=fffff880016c7655 rsp=fffff8800d10d1b0 rbp=ff7ffa800c5e2200
r8=0000000000000000 r9=0000000000000000 r10=fffffa800781a1a0
r11=0000000000000000 r12=00000000c000009a r13=fffff8800d10d340
r14=0000000000000001 r15=fffffa8006ff0201
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
ndis!ndisXlateRecvPacketArrayToNetBufferLists+0xb5:
fffff880`016c7655 4c895d00 mov qword ptr [rbp],r11 ss:0018:ff7ffa80`0c5e2200=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: NULL_DEREFERENCE
PROCESS_NAME: System
CURRENT_IRQL: 2
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: ffffffffffffffff
EXCEPTION_PARAMETER2: 0000000000000000
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eff0e0
0000000000000000
FOLLOWUP_IP:
Epfwndis+367b
fffff880`0513467b ?? ???
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffff8800177b821 to fffff880016c7655
STACK_TEXT:
fffff880`0d10d1b0 fffff880`0177b821 : 00000000`00000000 fffff800`c000009a fffffa80`0781a1a0 00000000`00000000 : ndis!ndisXlateRecvPacketArrayToNetBufferLists+0xb5
fffff880`0d10d240 fffff880`0513467b : fffffa80`079e7010 fffffa80`078c2010 fffffa80`079e7002 fffffa80`079e7010 : ndis!ndisMIndicatePacketsToNetBufferLists+0x51
fffff880`0d10d2e0 fffffa80`079e7010 : fffffa80`078c2010 fffffa80`079e7002 fffffa80`079e7010 00000000`000005ea : Epfwndis+0x367b
fffff880`0d10d2e8 fffffa80`078c2010 : fffffa80`079e7002 fffffa80`079e7010 00000000`000005ea 00000000`00000000 : 0xfffffa80`079e7010
fffff880`0d10d2f0 fffffa80`079e7002 : fffffa80`079e7010 00000000`000005ea 00000000`00000000 fffffa80`079e7010 : 0xfffffa80`078c2010
fffff880`0d10d2f8 fffffa80`079e7010 : 00000000`000005ea 00000000`00000000 fffffa80`079e7010 00000000`00000002 : 0xfffffa80`079e7002
fffff880`0d10d300 00000000`000005ea : 00000000`00000000 fffffa80`079e7010 00000000`00000002 fffffa80`078c2010 : 0xfffffa80`079e7010
fffff880`0d10d308 00000000`00000000 : fffffa80`079e7010 00000000`00000002 fffffa80`078c2010 fffff880`05135b30 : 0x5ea
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: Epfwndis+367b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Epfwndis
IMAGE_NAME: Epfwndis.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 49dded68
STACK_COMMAND: .cxr 0xfffff8800d10c7d0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_Epfwndis+367b
BUCKET_ID: X64_0x7E_Epfwndis+367b
Followup: MachineOwner
Third from the failure to read the memory at the above location you may have a memory issue, or heat issue.
I would
Update the above drivers first.
second update the ESET app
third download memtestx86 and run it for several hours (preferably overnight)
If you are overclocking STOP
I would also run a system file check to verify and fix your system files
to rin it type cmd in search>right click and run as admin> SFC /SCANNOW
let us know the results
If you still crash upload the dumps so we can refine our search
Hope this helps
Ken J
this is my workstation...
