2 BSOD Reports ... telling different things

[TruthOrDare]

Hi all,

I've recently installed Windows 7 Ultimate 32-bit ... and I think it was only until today that I've encountered BSOD. I was playing Burnout, and there's this part where they will take your photo for your license (or something similar). At that point, dang - BSOD. At first, I thought it might just be some temperature hi-cups, so I didn't really went to look at the dump, not did I report to Action Centre.

However, the problem persist no matter what. So, I was quite fed-up (and I forgotten about the dump files) and went to format my PC, reinstall Windows 7 (and it was during installing Windows 7 that I remembered about the dump files).

However, it didn't turn out better. I've experience BSOD when i was installing Windows 7 ... 2 times to be precise - one during expanding files and the other during completion. When I've finally installed Windows 7 cleanly, I thought the problem was gone ... and I was wrong -.-"

Right at the Windows Update point (after downloading and begining to install), I got BSOD AGAIN. This time, I've taken note of the dump file (once bitten twice shy you could say), and here it is:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 8c62b9d4
Arg3: 8c62b5b0
Arg4: 88a959fd
Debugging Details:
------------------

EXCEPTION_RECORD: 8c62b9d4 -- (.exr 0xffffffff8c62b9d4)
ExceptionAddress: 88a959fd (Ntfs!NtfsFlushVolume+0x00000552)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 28c7dbf4
Attempt to write to address 28c7dbf4
CONTEXT: 8c62b5b0 -- (.cxr 0xffffffff8c62b5b0)
eax=28c7dbf4 ebx=00000000 ecx=00000001 edx=84b3f3a8 esi=00000000 edi=85673240
eip=88a959fd esp=8c62ba9c ebp=8c62bb20 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsFlushVolume+0x552:
88a959fd f00fc108 lock xadd dword ptr [eax],ecx ds:0023:28c7dbf4=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: VSSVC.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 28c7dbf4
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b7c718
Unable to read MiSystemVaType memory at 82b5c160
28c7dbf4
FOLLOWUP_IP:
Ntfs!NtfsFlushVolume+552
88a959fd f00fc108 lock xadd dword ptr [eax],ecx
FAULTING_IP:
Ntfs!NtfsFlushVolume+552
88a959fd f00fc108 lock xadd dword ptr [eax],ecx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 88aa3fab to 88a959fd
STACK_TEXT:
8c62bb20 88aa3fab 84b3f2e0 856730d8 00000001 Ntfs!NtfsFlushVolume+0x552
8c62bba4 88aa476b 84b3f2e0 84f2f3a8 04c49747 Ntfs!NtfsCommonFlushBuffers+0x1a9
8c62bc0c 82a504bc 85673020 84f2f3a8 84f2f3a8 Ntfs!NtfsFsdFlushBuffers+0xf7
8c62bc24 889bc20c 8567ac50 84f2f3a8 00000000 nt!IofCallDriver+0x63
8c62bc48 889bc3cb 8c62bc68 8567ac50 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
8c62bc80 82a504bc 8567ac50 84f2f3a8 84f2f3a8 fltmgr!FltpDispatch+0xc5
8c62bc98 82c51eee 84f2f3a8 869b49e0 00000000 nt!IofCallDriver+0x63
8c62bcb8 82c32e5a 8567ac50 869b49e0 00000000 nt!IopSynchronousServiceTail+0x1f8
8c62bd24 82a5742a 848b8c80 01d7fa60 01d7fa68 nt!NtFlushBuffersFile+0x1d7
8c62bd24 77af64f4 848b8c80 01d7fa60 01d7fa68 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d7fa68 00000000 00000000 00000000 00000000 0x77af64f4

SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFlushVolume+552
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf45
STACK_COMMAND: .cxr 0xffffffff8c62b5b0 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsFlushVolume+552
BUCKET_ID: 0x24_Ntfs!NtfsFlushVolume+552
Followup: MachineOwner
---------

After I've restarted, and gone over the Windows Update paranoid, I've another BSOD when I wanted to rate my computer at the Performance Information and Tool. Just at the point where it says "Finalizing Assessment" ... it went BSOD. And the worst thing is, no matter how many time I click "Rate This Computer" at the Performace Information and Tool, nothing happen ... that button seemed to become a dummy. Oh, and here's a dump file:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 823560cc, 917fd938, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 823560cc, The address that the exception occurred at
Arg3: 917fd938, Trap Frame
Arg4: 00000000
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!psoSpCreateSurface+42
823560cc 89481c mov dword ptr [eax+1Ch],ecx
TRAP_FRAME: 917fd938 -- (.trap 0xffffffff917fd938)
ErrCode = 00000002
eax=00000018 ebx=00000000 ecx=ffb8f748 edx=00000001 esi=ffb8f790 edi=00000006
eip=823560cc esp=917fd9ac ebp=917fd9b4 iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
win32k!psoSpCreateSurface+0x42:
823560cc 89481c mov dword ptr [eax+1Ch],ecx ds:0023:00000034=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82435e25 to 823560cc
STACK_TEXT:
917fd9b4 82435e25 ffb8f790 00000000 00000036 win32k!psoSpCreateSurface+0x42
917fd9e8 8243762d 00000036 00000870 917fda7c win32k!psoSpGetComposite+0xe3
917fda90 8243472c fe440ba0 00000001 ffb8f790 win32k!vSpRedrawUncoveredArea+0x58
917fdb70 82431b29 ffb8f790 00000000 00000000 win32k!bSpUpdatePosition+0x104
917fdc04 82432f69 fe440ba0 00000000 fe440ba0 win32k!vSpDeleteSprite+0x3d
917fdc38 82353e09 00000001 00010044 fe440ba0 win32k!GdiDeleteSprite+0x1e3
917fdce0 8235383e ffb8f748 00000000 85a196d8 win32k!GreTransferSpriteStateToDwmState+0x45c
917fdd00 82353768 85a196d8 00000001 00000000 win32k!zzzComposeDesktop+0x31
917fdd18 823530ed 85a196d8 0151f650 917fdd34 win32k!zzzDwmStartRedirection+0x87
917fdd28 82a5842a 00000001 0151f65c 775364f4 win32k!NtUserDwmStartRedirection+0x44
917fdd28 775364f4 00000001 0151f65c 775364f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0151f65c 00000000 00000000 00000000 00000000 0x775364f4

STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
823560c3 - win32k!psoSpCreateSurface+39
[ d8:58 ]
1 error : !win32k (823560c3)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------

It seemed that both dump files talk about different things ... and I've also done a memory test with memory diagnostic tool, and I don't think they have any problem:

Problem Event Name: MemDiagV1
Range of memory size: 0
Launch type: Response
Schedule type: Immediate
Completion type: MemTestError
Test type: Unknown
Failed tests: 0
Number of bad pages: 0
Test duration in seconds: 0
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 18441

So can someone enlighten me what's happening here and what I should do?


Thanks and Cheers

 

[zigzag3143]

Hi all,

I've recently installed Windows 7 Ultimate 32-bit ... and I think it was only until today that I've encountered BSOD. I was playing Burnout, and there's this part where they will take your photo for your license (or something similar). At that point, dang - BSOD. At first, I thought it might just be some temperature hi-cups, so I didn't really went to look at the dump, not did I report to Action Centre.

However, the problem persist no matter what. So, I was quite fed-up (and I forgotten about the dump files) and went to format my PC, reinstall Windows 7 (and it was during installing Windows 7 that I remembered about the dump files).

However, it didn't turn out better. I've experience BSOD when i was installing Windows 7 ... 2 times to be precise - one during expanding files and the other during completion. When I've finally installed Windows 7 cleanly, I thought the problem was gone ... and I was wrong -.-"

Right at the Windows Update point (after downloading and begining to install), I got BSOD AGAIN. This time, I've taken note of the dump file (once bitten twice shy you could say), and here it is:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001904fb
Arg2: 8c62b9d4
Arg3: 8c62b5b0
Arg4: 88a959fd
Debugging Details:
------------------

EXCEPTION_RECORD: 8c62b9d4 -- (.exr 0xffffffff8c62b9d4)
ExceptionAddress: 88a959fd (Ntfs!NtfsFlushVolume+0x00000552)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 28c7dbf4
Attempt to write to address 28c7dbf4
CONTEXT: 8c62b5b0 -- (.cxr 0xffffffff8c62b5b0)
eax=28c7dbf4 ebx=00000000 ecx=00000001 edx=84b3f3a8 esi=00000000 edi=85673240
eip=88a959fd esp=8c62ba9c ebp=8c62bb20 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsFlushVolume+0x552:
88a959fd f00fc108 lock xadd dword ptr [eax],ecx ds:0023:28c7dbf4=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: VSSVC.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 00000001
EXCEPTION_PARAMETER2: 28c7dbf4
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b7c718
Unable to read MiSystemVaType memory at 82b5c160
28c7dbf4
FOLLOWUP_IP:
Ntfs!NtfsFlushVolume+552
88a959fd f00fc108 lock xadd dword ptr [eax],ecx
FAULTING_IP:
Ntfs!NtfsFlushVolume+552
88a959fd f00fc108 lock xadd dword ptr [eax],ecx
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 88aa3fab to 88a959fd
STACK_TEXT:
8c62bb20 88aa3fab 84b3f2e0 856730d8 00000001 Ntfs!NtfsFlushVolume+0x552
8c62bba4 88aa476b 84b3f2e0 84f2f3a8 04c49747 Ntfs!NtfsCommonFlushBuffers+0x1a9
8c62bc0c 82a504bc 85673020 84f2f3a8 84f2f3a8 Ntfs!NtfsFsdFlushBuffers+0xf7
8c62bc24 889bc20c 8567ac50 84f2f3a8 00000000 nt!IofCallDriver+0x63
8c62bc48 889bc3cb 8c62bc68 8567ac50 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
8c62bc80 82a504bc 8567ac50 84f2f3a8 84f2f3a8 fltmgr!FltpDispatch+0xc5
8c62bc98 82c51eee 84f2f3a8 869b49e0 00000000 nt!IofCallDriver+0x63
8c62bcb8 82c32e5a 8567ac50 869b49e0 00000000 nt!IopSynchronousServiceTail+0x1f8
8c62bd24 82a5742a 848b8c80 01d7fa60 01d7fa68 nt!NtFlushBuffersFile+0x1d7
8c62bd24 77af64f4 848b8c80 01d7fa60 01d7fa68 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d7fa68 00000000 00000000 00000000 00000000 0x77af64f4

SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFlushVolume+552
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf45
STACK_COMMAND: .cxr 0xffffffff8c62b5b0 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsFlushVolume+552
BUCKET_ID: 0x24_Ntfs!NtfsFlushVolume+552
Followup: MachineOwner
---------

After I've restarted, and gone over the Windows Update paranoid, I've another BSOD when I wanted to rate my computer at the Performance Information and Tool. Just at the point where it says "Finalizing Assessment" ... it went BSOD. And the worst thing is, no matter how many time I click "Rate This Computer" at the Performace Information and Tool, nothing happen ... that button seemed to become a dummy. Oh, and here's a dump file:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 823560cc, 917fd938, 0}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 823560cc, The address that the exception occurred at
Arg3: 917fd938, Trap Frame
Arg4: 00000000
Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!psoSpCreateSurface+42
823560cc 89481c mov dword ptr [eax+1Ch],ecx
TRAP_FRAME: 917fd938 -- (.trap 0xffffffff917fd938)
ErrCode = 00000002
eax=00000018 ebx=00000000 ecx=ffb8f748 edx=00000001 esi=ffb8f790 edi=00000006
eip=823560cc esp=917fd9ac ebp=917fd9b4 iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
win32k!psoSpCreateSurface+0x42:
823560cc 89481c mov dword ptr [eax+1Ch],ecx ds:0023:00000034=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82435e25 to 823560cc
STACK_TEXT:
917fd9b4 82435e25 ffb8f790 00000000 00000036 win32k!psoSpCreateSurface+0x42
917fd9e8 8243762d 00000036 00000870 917fda7c win32k!psoSpGetComposite+0xe3
917fda90 8243472c fe440ba0 00000001 ffb8f790 win32k!vSpRedrawUncoveredArea+0x58
917fdb70 82431b29 ffb8f790 00000000 00000000 win32k!bSpUpdatePosition+0x104
917fdc04 82432f69 fe440ba0 00000000 fe440ba0 win32k!vSpDeleteSprite+0x3d
917fdc38 82353e09 00000001 00010044 fe440ba0 win32k!GdiDeleteSprite+0x1e3
917fdce0 8235383e ffb8f748 00000000 85a196d8 win32k!GreTransferSpriteStateToDwmState+0x45c
917fdd00 82353768 85a196d8 00000001 00000000 win32k!zzzComposeDesktop+0x31
917fdd18 823530ed 85a196d8 0151f650 917fdd34 win32k!zzzDwmStartRedirection+0x87
917fdd28 82a5842a 00000001 0151f65c 775364f4 win32k!NtUserDwmStartRedirection+0x44
917fdd28 775364f4 00000001 0151f65c 775364f4 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0151f65c 00000000 00000000 00000000 00000000 0x775364f4

STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
823560c3 - win32k!psoSpCreateSurface+39
[ d8:58 ]
1 error : !win32k (823560c3)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------

It seemed that both dump files talk about different things ... and I've also done a memory test with memory diagnostic tool, and I don't think they have any problem:

Problem Event Name: MemDiagV1
Range of memory size: 0
Launch type: Response
Schedule type: Immediate
Completion type: MemTestError
Test type: Unknown
Failed tests: 0
Number of bad pages: 0
Test duration in seconds: 0
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 18441

So can someone enlighten me what's happening here and what I should do?


Thanks and Cheers

Hi and welcome

Good job. there are a few things i can tell from just this info. If you still have the dmp files I can get alot more info.

Both of these crashes involve memory. itn the first a driver that VSS is using wrote a memory instruction to an area that is restricted.

In the second It is a pure stack corruption.

Both point to memory. Are you using memtestx86 for testing? you should. you should run it for several hours at least.

You can also run a system file check to verify and repair system files
run it by typing cmd insearch>right click run as admin>
SFC /SCANNOW
let us know the results

Hope this helps, and if you need help with reading dmps feel free to PM me


Ken J+

 

[TruthOrDare]

Hi Ken,

Thanks for your reply.

I'm only using Windows Memory Diagnostic Tools, so yeah, not sure if they skipped any errors.

But thanks for your info on memtest x86. I will use it now.

And, I've also uploaded my minidumps. Minidump 1 refers to my first dump file I've shown at my previous thread (BSOD during Windows Update) and Minidump 2 refers to the other one (during rate this computer).

Thanks for your help. I will post the result for memtest x86 asap.

 

[TruthOrDare]

Oh, I want to ask you one more thing while waiting for the test. I've got a GT210 graphic card from Leadtek, and the requirement is a

A minimum of 300W or greater power supply with a minimum of 12V current rating of 18A

However, my PC's power supply is 450W but with only 12 V current rating of 16A.

So, could that be a problem that causes BSOD too?

 

[torrentg]

Oh, I want to ask you one more thing while waiting for the test. I've got a GT210 graphic card from Leadtek, and the requirement is a

A minimum of 300W or greater power supply with a minimum of 12V current rating of 18A

However, my PC's power supply is 450W but with only 12 V current rating of 16A.

So, could that be a problem that causes BSOD too?

Yes.
It could also cause poor performance in games even if no bsod.

 

[TruthOrDare]

It seems that it IS a memory problem. Got it workin' now.
Gonna change the power supply since the FPS is horribly slow >.>

Thanks for you guys' help, especially ken

 

[Howdr]

It seems that it IS a memory problem. Got it workin' now.
Gonna change the power supply since the FPS is horribly slow >.>

Thanks for you guys' help, especially ken

So are the memory sticks the same or different? Sometimes even the manufactures put in sticks different in speed and make.

But other times the memory is just failing, I too had problems a few months back, mem test was fine but they went away when I upgraded the memory.