Blue Screen - System Crash

[brt]

Any ideas on what I can do, i would appreciat. is(new) pc crash 3-4 times a day.i attacht info,let me know if right filesor need any other...appreciat any help.

Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 4105

Additional information about the problem:
BCCode: d1
BCP1: 000001F1FFFFFF91
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF88001682163
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

 

[brt]

New ( re) Build

Any ideas on what I can do, i would appreciat. is(new rebuild) pc crash 3-4 times a day.i attacht info,let me know if right filesor need any other...appreciat any help.
pc get with bad motherbord, replaced new one ...
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 4105

Additional information about the problem:
BCCode: d1
BCP1: 000001F1FFFFFF91
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF88001682163
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 4105

Additional information about the problem:
BCCode: d1
BCP1: 000001F1FFFFFF91
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF88001682163
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

 

[brt]

thank for this many(0) help,great forum....

 

[brt]

attachment ,can anybody help?

 

[brt]

i would like to know list reason why nobody help me?

 

[brt]

-System
-Provider[ Name] Microsoft-Windows-Kernel-EventTracing[ Guid] {B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}
EventID2Version0Level2Task2Opcode12Keywords0x8000000000000010-TimeCreated[ SystemTime] 2012-01-18T18:34:57.830287500Z
EventRecordID75Correlation-Execution[ ProcessID] 980[ ThreadID] 3184
ChannelMicrosoft-Windows-Kernel-EventTracing/AdminComputerlaci-PC-Security[ UserID] S-1-5-19

-EventData
SessionNameFileNameErrorCode3221225485LoggingMode285212677

 

[writhziden]

I apologize that no one saw your thread had not received help. When you respond multiple times to your own thread, many of us helping see multiple replies and conclude that someone is already helping you.

[list=1]
[*]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-25958-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c63000 PsLoadedModuleList = 0xfffff800`02ea8670
Debug session time: Sun Jan 22 14:18:14.380 2012 (UTC - 7:00)
System Uptime: 0 days 0:17:45.301
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, 0, fffff8a00e223710}

GetPointerFromAddress: unable to read from fffff80002f12100
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+43a )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: fffff8a00e223710, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffff8a00e223710 

FREED_POOL_TAG:  CM39

BUGCHECK_STR:  0xc2_7_CM39

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  VSSVC.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002e0dbe9 to fffff80002cdfc40

STACK_TEXT:  
fffff880`08427558 fffff800`02e0dbe9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`00000000 : nt!KeBugCheckEx
fffff880`08427560 fffff880`012aa27a : fffffa80`07b99180 fffff880`08427a80 fffff8a0`044a74e0 00000000`00000009 : nt!ExDeferredFreePool+0x1201
fffff880`08427610 fffff880`01299357 : fffffa80`075422d0 fffff8a0`044a7610 fffff8a0`044a74e0 fffffa80`07b99180 : Ntfs!NtfsCommonClose+0x43a
fffff880`084276e0 fffff880`01288291 : fffffa80`07b99180 00000000`00000400 fffff800`02e68901 00000000`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`084277b0 fffff880`01290fad : fffffa80`06cce010 fffffa80`07b99180 00000000`00120101 00000000`00000000 : Ntfs!NtfsFlushVolume+0x75
fffff880`084278e0 fffff880`012916b4 : fffffa80`06cce010 fffffa80`0b1bec10 fffffa80`095189b0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`084279c0 fffff880`0108dbcf : fffffa80`0b1befb0 fffffa80`0b1bec10 fffffa80`06cce010 fffff880`084279e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`08427a30 fffff880`0108c6df : fffffa80`07940de0 00000000`00000000 fffffa80`07940d00 fffffa80`0b1bec10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`08427ac0 fffff800`02fe821b : 00000000`00000002 fffffa80`095189b0 00000000`00000000 fffffa80`0b1bec10 : fltmgr!FltpDispatch+0xcf
fffff880`08427b20 fffff800`02f7cb85 : fffffa80`0b1bec10 fffffa80`08d5db60 fffffa80`095189b0 fffff880`02fd5180 : nt!IopSynchronousServiceTail+0xfb
fffff880`08427b90 fffff800`02cdeed3 : fffffa80`08d5db60 00000000`ffe62270 fffffa80`07940de0 fffffa80`095189b0 : nt!NtFlushBuffersFile+0x171
fffff880`08427c20 00000000`774c17ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0213f848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774c17ca


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonClose+43a
fffff880`012aa27a 488b07          mov     rax,qword ptr [rdi]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsCommonClose+43a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0xc2_7_CM39_Ntfs!NtfsCommonClose+43a

BUCKET_ID:  X64_0xc2_7_CM39_Ntfs!NtfsCommonClose+43a

Followup: MachineOwner
---------
[*]
Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-22011-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0341c000 PsLoadedModuleList = 0xfffff800`03661670
Debug session time: Sun Jan 22 18:42:09.975 2012 (UTC - 7:00)
System Uptime: 0 days 1:22:36.912
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800037934ce, 0, 90}

Probably caused by : win32k.sys ( win32k!DrvEnumDisplayDevices+655 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800037934ce, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000090, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ObpLookupObjectName+21e
fffff800`037934ce 498bb890000000  mov     rdi,qword ptr [r8+90h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000090

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036cb100
 0000000000000090 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800af4b910 -- (.trap 0xfffff8800af4b910)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000d4 rbx=0000000000000000 rcx=fffff8a0011b4db0
rdx=000000000000007a rsi=0000000000000000 rdi=0000000000000000
rip=fffff800037934ce rsp=fffff8800af4baa0 rbp=fffffa800ac461c8
 r8=0000000000000000  r9=0000000000000000 r10=fffff8a00009f160
r11=00000000000f003f r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
nt!ObpLookupObjectName+0x21e:
fffff800`037934ce 498bb890000000  mov     rdi,qword ptr [r8+90h] ds:00000000`00000090=????????????????
Resetting default scope

LOCK_ADDRESS:  fffff80003697b80 -- (!locks fffff80003697b80)

Resource @ nt!PiEngineLock (0xfffff80003697b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0xfffff80003697b80
	Thread Count  : 0
	Thread address: 0x0000000000000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff800034e4588 to fffff80003498c40

STACK_TEXT:  
fffff880`0af4b088 fffff800`034e4588 : 00000000`0000001e ffffffff`c0000005 fffff800`037934ce 00000000`00000000 : nt!KeBugCheckEx
fffff880`0af4b090 fffff800`034982c2 : fffff880`0af4b868 fffff800`0341c000 fffff880`0af4b910 fffff8a0`0009f130 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0af4b730 fffff800`03496e3a : 00000000`00000000 00000000`00000090 00000000`00000000 fffff800`0341c000 : nt!KiExceptionDispatch+0xc2
fffff880`0af4b910 fffff800`037934ce : 00000000`00000000 fffffa80`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0af4baa0 fffff800`03794a56 : ffffffff`80000034 fffffa80`0ac46010 fffff880`0af4bd70 fffffa80`0674d7b0 : nt!ObpLookupObjectName+0x21e
fffff880`0af4bb90 fffff800`037682bc : fffff8a0`00023010 00000000`00000000 fffff8a0`0a347100 fffff800`035c7fbd : nt!ObOpenObjectByName+0x306
fffff880`0af4bc60 fffff800`03773392 : fffff880`0af4c078 00000000`00020019 fffff880`0af4bfb0 00000000`00000000 : nt!CmOpenKey+0x28a
fffff880`0af4bdb0 fffff800`03497ed3 : fffff8a0`00152130 fffff800`036e94de fffff8a0`00000019 fffff880`0af4be70 : nt!NtOpenKey+0x12
fffff880`0af4bdf0 fffff800`03494470 : fffff800`03707e58 00000000`00000100 00000000`00000348 fffffa80`066a39e0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0af4bf88 fffff800`03707e58 : 00000000`00000100 00000000`00000348 fffffa80`066a39e0 00000000`00000000 : nt!KiServiceLinkage
fffff880`0af4bf90 fffff800`03707e11 : 00000000`00000000 00000000`00000100 00000000`00000000 00000000`00000000 : nt!IopOpenRegistryKeyEx+0x38
fffff880`0af4bff0 fffff800`03708141 : 00000000`00000001 fffffa80`074e6060 fffffa80`072016e0 00000000`00000401 : nt!PnpDeviceObjectToDeviceInstance+0x39
fffff880`0af4c020 fffff800`03708318 : 00000000`00000000 00000000`00000007 fffffa80`072016e0 00000000`00000000 : nt!PiGetDeviceRegistryProperty+0x75
fffff880`0af4c180 fffff960`002418c5 : 00000000`00000042 00000000`00000000 fffff900`c2295010 00000000`0000007f : nt!IoGetDeviceProperty+0xbc
fffff880`0af4c260 fffff960`00161bb8 : 00000000`00000000 00000000`00000000 fffff880`0af4c480 fffffa80`0a59fa90 : win32k!DrvEnumDisplayDevices+0x655
fffff880`0af4c450 fffff800`03497ed3 : fffffa80`0b697990 fffff880`0af4c520 00000000`00000000 00000000`00000020 : win32k!NtUserEnumDisplayDevices+0x98
fffff880`0af4c4a0 00000000`755c0d4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`030bcb98 fffff800`03490210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x755c0d4a
fffff880`0af4c880 fffff900`c065f0c0 : 00000000`00000000 00000058`00000578 fffff800`034a282b 00000000`00002bf2 : nt!KiCallUserMode
fffff880`0af4c888 00000000`00000000 : 00000058`00000578 fffff800`034a282b 00000000`00002bf2 fffff880`0af4cdb0 : 0xfffff900`c065f0c0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!DrvEnumDisplayDevices+655
fffff960`002418c5 3d230000c0      cmp     eax,0C0000023h

SYMBOL_STACK_INDEX:  e

SYMBOL_NAME:  win32k!DrvEnumDisplayDevices+655

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5a

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_win32k!DrvEnumDisplayDevices+655

BUCKET_ID:  X64_0x1E_c0000005_win32k!DrvEnumDisplayDevices+655

Followup: MachineOwner
---------


[*]
Loading Dump File [J:\BSODDmpFiles\brt\Windows_NT6_BSOD_jcgriff2\012212-20326-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03459000 PsLoadedModuleList = 0xfffff800`0369e670
Debug session time: Sun Jan 22 21:14:31.916 2012 (UTC - 7:00)
System Uptime: 0 days 0:46:15.243
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 109b, acee, fffff8a00a8e9b30}

GetPointerFromAddress: unable to read from fffff80003708100
Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+168 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000109b, (reserved)
Arg3: 000000000000acee, Memory contents of the pool block
Arg4: fffff8a00a8e9b30, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  fffff8a00a8e9b30 

FREED_POOL_TAG:  MPsc

BUGCHECK_STR:  0xc2_7_MPsc

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  mscorsvw.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003603be9 to fffff800034d5c40

STACK_TEXT:  
fffff880`07465998 fffff800`03603be9 : 00000000`000000c2 00000000`00000007 00000000`0000109b 00000000`0000acee : nt!KeBugCheckEx
fffff880`074659a0 fffff800`037d23d8 : fffffa80`07604e60 00000000`00000001 fffffa80`0789d030 fffffa80`07604e60 : nt!ExDeferredFreePool+0x1201
fffff880`07465a50 fffff800`034dfaf4 : 00000000`00000001 fffffa80`0a5b7960 fffffa80`0671bc90 fffffa80`072b3600 : nt!IopDeleteFile+0x168
fffff880`07465ae0 fffff800`037ccf44 : fffffa80`0a5b7960 00000000`00000000 fffffa80`0d564b60 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`07465b40 fffff800`037cd4f4 : 00000000`00000410 fffffa80`0a5b7960 fffff8a0`0845ce60 00000000`00000410 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`07465bd0 fffff800`034d4ed3 : fffffa80`0d564b60 fffff880`07465ca0 00000000`00000410 00000000`0263db98 : nt!ObpCloseHandle+0x94
fffff880`07465c20 00000000`7771140a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01ead888 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7771140a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IopDeleteFile+168
fffff800`037d23d8 488b8bb0000000  mov     rcx,qword ptr [rbx+0B0h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!IopDeleteFile+168

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0xc2_7_MPsc_nt!IopDeleteFile+168

BUCKET_ID:  X64_0xc2_7_MPsc_nt!IopDeleteFile+168

Followup: MachineOwner
---------


[/list]

1. Possible cause is Drivers... Yours was prompted by the Volume Shadow Copy service. This is likely backup related, but it could also be due to corrupted Windows files.
2. Possible causes are Memory problems... Viruses... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
   Thanks to JMH for helping with my understanding of this crash.
3. Possible cause is Drivers... Yours was prompted by a part of the .NET framework. Could be due to corrupted Windows files.

Thanks to Dave76 for help understanding possible causes.

We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

• If you are overclocking anything, please stop.
  
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
  
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​