blue screens and minidump...

BRANDELH · Jun 25, 2010

Hi,

I have a Windows 7 PC (AMD X4 945, 4 GB Kingston, Gigabyte) working rock stable and got now a second (AMD X2 250 - described here) one with ultimate ...

After installing the system I did install the driver from the gigabyte CD,
grafik driver from ATI homepage and some programs (FireFox ...) nothing unusual.

but 5 days ago there was the first blue screen. 6 total in not a week.

I red that you can look into these files to get the driver ?

Many thanks for your help

jason786 · Jun 25, 2010

Hey, you have a wide variety of blue screens there, it may take some time to evaluate all of them
AMD multi-vendor Miniport Driver seemed to have been the cause of one of your earlier blue screens
However, you have quite a few with bug check 0x1A which could mean that there is a memory problem

[FONT=Segoe UI, Arial]atikmpag.sys was the cause of one of the blue screens too

Press start > and in the search type cmd, right click this and select run as administrator

Then type "sfc /scannow" (without the quotes) and then press enter, let the scan complete

Restart when this is done, then proceed to check the memory by going to start > and typing in "memory" into the search bar. Select the Windows Memory Diagnostics test and let that run for now

You have the blue screen "MEMORY_MANAGEMENT" which could mean that you are not getting enough power to your system (PSU may need checking), but try the RAM test and Scan for now
[/FONT]

Lordbob75 · Jun 25, 2010

Alright, these BSoDs were really helpful. Looks like there are multiple causes for your BSoDs.

The main offending driver was atikmpag.sys, the ATI driver.
3 of them also had memory_corruption, so you need to run a test on your RAM, which you should do first as it could be the root cause.
Download Memtest86+ - Advanced Memory Diagnostic Tool, burn it to a CD, boot into it, and run it at least 5 passes. If you start getting errors, then we know you have some bad RAM.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062010-30607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02855000 PsLoadedModuleList = 0xfffff800`02a92e50
Debug session time: Sun Jun 20 10:16:56.137 2010 (UTC - 7:00)
System Uptime: 0 days 0:17:27.698
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 116, {fffffa800547a010, fffff880065b3c48, 0, 2}

Unable to load image \SystemRoot\system32\DRIVERS\atikmpag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmpag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
Probably caused by : atikmpag.sys ( atikmpag+6c48 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

VIDEO_TDR_FAILURE (116)
Attempt to reset the display driver and recover from timeout failed.
Arguments:
Arg1: fffffa800547a010, Optional pointer to internal TDR recovery context (TDR_RECOVERY_CONTEXT).
Arg2: fffff880065b3c48, The pointer into responsible device driver module (e.g. owner tag).
Arg3: 0000000000000000, Optional error code (NTSTATUS) of the last failed operation.
Arg4: 0000000000000002, Optional internal context dependent data.

Debugging Details:
------------------


FAULTING_IP: 
atikmpag+6c48
fffff880`065b3c48 4883ec28        sub     rsp,28h

DEFAULT_BUCKET_ID:  GRAPHICS_DRIVER_TDR_FAULT

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x116

PROCESS_NAME:  System

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`0244e9c8 fffff880`03e5ccbc : 00000000`00000116 fffffa80`0547a010 fffff880`065b3c48 00000000`00000000 : nt!KeBugCheckEx
fffff880`0244e9d0 fffff880`03e5c9c6 : fffff880`065b3c48 fffffa80`0547a010 fffffa80`0547cd50 fffffa80`03a02410 : dxgkrnl!TdrBugcheckOnTimeout+0xec
fffff880`0244ea10 fffff880`04548f07 : fffffa80`0547a010 00000000`00000000 fffffa80`0547cd50 fffffa80`03a02410 : dxgkrnl!TdrIsRecoveryRequired+0x1a2
fffff880`0244ea40 fffff880`04572b75 : 00000000`ffffffff 00000000`0001032a 00000000`00000000 00000000`00000002 : dxgmms1!VidSchiReportHwHang+0x40b
fffff880`0244eb20 fffff880`045712bb : 00000000`00000102 00000000`00000000 00000000`0001032a 00000000`00000000 : dxgmms1!VidSchiCheckHwProgress+0x71
fffff880`0244eb50 fffff880`045442c6 : ffffffff`ff676980 fffffa80`03a02410 00000000`00000000 00000000`00000000 : dxgmms1!VidSchiWaitForSchedulerEvents+0x1fb
fffff880`0244ebf0 fffff880`04570e7a : 00000000`00000000 00000000`0000000f 00000000`00000080 fffffa80`05e39c68 : dxgmms1!VidSchiScheduleCommandToRun+0x1da
fffff880`0244ed00 fffff800`02b6a166 : fffff880`08b13c90 fffffa80`04a37370 fffffa80`039cd040 fffff800`028bed87 : dxgmms1!VidSchiWorkerThread+0xba
fffff880`0244ed40 fffff800`028a5486 : fffff800`02a3fe80 fffffa80`04a37370 fffffa80`04238040 fffff880`01237a90 : nt!PspSystemThreadStartup+0x5a
fffff880`0244ed80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP: 
atikmpag+6c48
fffff880`065b3c48 4883ec28        sub     rsp,28h

SYMBOL_NAME:  atikmpag+6c48

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmpag

IMAGE_NAME:  atikmpag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bfe9d00

FAILURE_BUCKET_ID:  X64_0x116_IMAGE_atikmpag.sys

BUCKET_ID:  X64_0x116_IMAGE_atikmpag.sys

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-29640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a02000 PsLoadedModuleList = 0xfffff800`02c3fe50
Debug session time: Fri Jun 25 11:49:02.297 2010 (UTC - 7:00)
System Uptime: 0 days 0:10:50.858
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff68400037e00, 0, fffff80002b79235, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff68400037e00, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002b79235, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002caa0e0
 fffff68400037e00 

FAULTING_IP: 
nt!MiEmptyWorkingSet+1c5
fffff800`02b79235 488b02          mov     rax,qword ptr [rdx]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  avguard.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88005c894b0 -- (.trap 0xfffff88005c894b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=0000000400037e06
rdx=fffff68400037e00 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002b79235 rsp=fffff88005c89640 rbp=000000000000000d
 r8=0000000fffffffff  r9=0000000000000001 r10=0000000000000000
r11=0000000000000013 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!MiEmptyWorkingSet+0x1c5:
fffff800`02b79235 488b02          mov     rax,qword ptr [rdx] ds:4c46:fffff684`00037e00=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002af1801 to fffff80002a72600

STACK_TEXT:  
fffff880`05c89348 fffff800`02af1801 : 00000000`00000050 fffff684`00037e00 00000000`00000000 fffff880`05c894b0 : nt!KeBugCheckEx
fffff880`05c89350 fffff800`02a706ee : 00000000`00000000 ffffffff`ffffffff 00000000`76041000 00000000`03e90000 : nt! ?? ::FNODOBFM::`string'+0x40ecb
fffff880`05c894b0 fffff800`02b79235 : fffffa80`05c64a88 fffff880`05c89660 00000000`00000000 fffffa80`00000013 : nt!KiPageFault+0x16e
fffff880`05c89640 fffff800`02cba49d : fffffa80`05d46b60 00000000`00000001 ffffffff`ffffffff 00000000`000000c8 : nt!MiEmptyWorkingSet+0x1c5
fffff880`05c896f0 fffff800`02ec47ad : 00000000`00000001 fffff8a0`01776d50 00000000`00000000 00000000`00000000 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`05c89780 fffff800`02dcc22b : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`0173e6b0 : nt!PspSetQuotaLimits+0x32d
fffff880`05c898d0 fffff800`02a71853 : fffffa80`05d46b60 fffff880`05c89ca0 00000000`7efa1000 00000000`7efa1000 : nt! ?? ::NNGAKEGL::`string'+0x49e50
fffff880`05c89c20 00000000`77aeff1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0173e678 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77aeff1a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiEmptyWorkingSet+1c5
fffff800`02b79235 488b02          mov     rax,qword ptr [rdx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiEmptyWorkingSet+1c5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiEmptyWorkingSet+1c5

BUCKET_ID:  X64_0x50_nt!MiEmptyWorkingSet+1c5

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-26410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02818000 PsLoadedModuleList = 0xfffff800`02a55e50
Debug session time: Thu Jun 24 18:46:23.388 2010 (UTC - 7:00)
System Uptime: 0 days 0:02:31.902
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001904280, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001904280
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028fbede to fffff80002888600

STACK_TEXT:  
fffff880`087bc6e8 fffff800`028fbede : 00000000`0000001a 00000000`00041790 fffffa80`01904280 00000000`0000ffff : nt!KeBugCheckEx
fffff880`087bc6f0 fffff800`0285bb3b : ffffffff`00000000 00000000`0439ffff fffffa80`00000000 fffffa80`0639a060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`087bc8b0 fffff800`02b6ec4f : fffff8a0`02124660 fffff880`087bcc20 00000000`00000000 fffffa80`0639a060 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`087bc900 fffff800`02b474d1 : 00000000`000000ff 00000000`00000801 000007ff`fffa0000 fffffa80`05e57720 : nt!PspExitThread+0x92f
fffff880`087bc9c0 fffff800`028650e3 : 00000000`00000001 00000000`00000000 fffff880`00961000 fffff880`010bd711 : nt!PsExitSpecialApc+0x1d
fffff880`087bc9f0 fffff800`02865520 : 00000000`0456a930 fffff880`087bca70 fffff800`02b475dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`087bca70 fffff800`028878f7 : fffffa80`0639a060 00000000`0456a818 fffff880`087bcbc8 00000000`0099fe68 : nt!KiInitiateUserApc+0x70
fffff880`087bcbb0 00000000`7728046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0456a7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7728046a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33946
fffff800`028fbede cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33946

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062510-26410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02818000 PsLoadedModuleList = 0xfffff800`02a55e50
Debug session time: Thu Jun 24 18:46:23.388 2010 (UTC - 7:00)
System Uptime: 0 days 0:02:31.902
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001904280, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33946 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001904280
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028fbede to fffff80002888600

STACK_TEXT:  
fffff880`087bc6e8 fffff800`028fbede : 00000000`0000001a 00000000`00041790 fffffa80`01904280 00000000`0000ffff : nt!KeBugCheckEx
fffff880`087bc6f0 fffff800`0285bb3b : ffffffff`00000000 00000000`0439ffff fffffa80`00000000 fffffa80`0639a060 : nt! ?? ::FNODOBFM::`string'+0x33946
fffff880`087bc8b0 fffff800`02b6ec4f : fffff8a0`02124660 fffff880`087bcc20 00000000`00000000 fffffa80`0639a060 : nt!MmCleanProcessAddressSpace+0x62f
fffff880`087bc900 fffff800`02b474d1 : 00000000`000000ff 00000000`00000801 000007ff`fffa0000 fffffa80`05e57720 : nt!PspExitThread+0x92f
fffff880`087bc9c0 fffff800`028650e3 : 00000000`00000001 00000000`00000000 fffff880`00961000 fffff880`010bd711 : nt!PsExitSpecialApc+0x1d
fffff880`087bc9f0 fffff800`02865520 : 00000000`0456a930 fffff880`087bca70 fffff800`02b475dc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`087bca70 fffff800`028878f7 : fffffa80`0639a060 00000000`0456a818 fffff880`087bcbc8 00000000`0099fe68 : nt!KiInitiateUserApc+0x70
fffff880`087bcbb0 00000000`7728046a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0456a7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7728046a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+33946
fffff800`028fbede cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+33946

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33946

Followup: MachineOwner
---------

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_MiniDumpBRANDELH.zip\062210-37861-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02865000 PsLoadedModuleList = 0xfffff800`02aa2e50
Debug session time: Mon Jun 21 22:31:39.542 2010 (UTC - 7:00)
System Uptime: 0 days 22:02:15.103
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff880085aeeb8, fffff880085ae720, fffff880013046c5}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteInternalAttributeStream+c5 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff880085aeeb8
Arg3: fffff880085ae720
Arg4: fffff880013046c5

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880085aeeb8 -- (.exr 0xfffff880085aeeb8)
ExceptionAddress: fffff880013046c5 (Ntfs!NtfsDeleteInternalAttributeStream+0x00000000000000c5)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 000020000000005a
Attempt to write to address 000020000000005a

CONTEXT:  fffff880085ae720 -- (.cxr 0xfffff880085ae720)
rax=0000000000000001 rbx=fffff8a007fc3140 rcx=fffffa8004bbd880
rdx=0000000000000000 rsi=0000200000000000 rdi=0000000000000000
rip=fffff880013046c5 rsp=fffff880085af0f0 rbp=fffff880085af980
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8004bbd180
r11=fffff880085af730 r12=fffff880085af700 r13=0000000000000000
r14=0000000000000702 r15=fffff8a002ae0390
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
Ntfs!NtfsDeleteInternalAttributeStream+0xc5:
fffff880`013046c5 66897e5a        mov     word ptr [rsi+5Ah],di ds:002b:00002000`0000005a=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  000020000000005a

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b0d0e0
 000020000000005a 

FOLLOWUP_IP: 
Ntfs!NtfsDeleteInternalAttributeStream+c5
fffff880`013046c5 66897e5a        mov     word ptr [rsi+5Ah],di

FAULTING_IP: 
Ntfs!NtfsDeleteInternalAttributeStream+c5
fffff880`013046c5 66897e5a        mov     word ptr [rsi+5Ah],di

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012e6d88 to fffff880013046c5

STACK_TEXT:  
fffff880`085af0f0 fffff880`012e6d88 : fffff8a0`07fc3010 fffff880`085af980 fffff8a0`07fc3140 fffffa80`04713070 : Ntfs!NtfsDeleteInternalAttributeStream+0xc5
fffff880`085af140 fffff880`01255aa9 : fffffa80`06305bd0 00000000`00000000 fffff880`085af690 fffff880`0859e000 : Ntfs!NtfsCommonCleanup+0x758
fffff880`085af550 fffff800`028e4d4a : fffff880`085af690 00000000`00000000 fffff880`085af668 00000000`00000000 : Ntfs!NtfsCommonCleanupCallout+0x19
fffff880`085af580 fffff880`01255662 : fffff880`01255a90 fffff880`085af690 fffff880`085af900 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xda
fffff880`085af660 fffff880`012f7244 : fffff880`085af730 fffff880`085af730 fffff880`085af730 fffff880`085af748 : Ntfs!NtfsCommonCleanupOnNewStack+0x42
fffff880`085af6d0 fffff880`0116323f : fffff880`085af730 fffffa80`06305bd0 fffffa80`06305fb8 fffffa80`053c61e0 : Ntfs!NtfsFsdCleanup+0x144
fffff880`085af940 fffff880`011616df : fffffa80`049a9de0 00000000`00000000 00000000`00000000 fffffa80`06305bd0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`085af9d0 fffff800`02bec9af : fffffa80`06305bd0 fffffa80`05ca4b30 00000000`00000000 fffffa80`04713070 : fltmgr!FltpDispatch+0xcf
fffff880`085afa30 fffff800`02bd2604 : 00000000`00000000 fffffa80`05ca4b30 00000001`00060001 fffff880`085afad8 : nt!IopCloseFile+0x11f
fffff880`085afac0 fffff800`02bec4a1 : fffffa80`05ca4b30 fffffa80`00000001 fffff8a0`0113b4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`085afb40 fffff800`02bec3b4 : 00000000`00001208 fffffa80`05ca4b30 fffff8a0`0113b4e0 00000000`00001208 : nt!ObpCloseHandleTableEntry+0xb1
fffff880`085afbd0 fffff800`028d4853 : fffffa80`03d84470 fffff880`085afca0 00000000`06b6ec30 fffffa80`0617d640 : nt!ObpCloseHandle+0x94
fffff880`085afc20 00000000`7707ffaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06b6ea88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7707ffaa


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsDeleteInternalAttributeStream+c5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff880085ae720 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+c5

BUCKET_ID:  X64_0x24_Ntfs!NtfsDeleteInternalAttributeStream+c5

Followup: MachineOwner
---------

~Lordbob

BRANDELH · Jun 26, 2010

Thank you for your answers,

memtest86++ found NO errors in 8 loops.
[FONT=Segoe UI, Arial]sfc /scannow [/FONT]reports NO errors

The grafic card is this model: HIS HD 5450 Silence (DirectX 11/ Full HD 1080p) 512MB (64bit) DDR3 PCIe < HD 5400 Series < Desktop Grafik < Products | HIS Graphic Cards
Ok, the write PSU 400W++, but the card does have only 19W max and my X2 250 does only have 65 max,
the 2.5 HDs together 5W. The hole system have a max power consumption less then 80W - measure instrument from voltcraft.

Lordbob75 · Jun 26, 2010

You should still update your video driver.

~Lordbob

blue screens and minidump...

BRANDELH

New member

My Computer

jason786

New member

My Computer

Lordbob75

Computer Voodooist

My Computer

BRANDELH

New member

My Computer

Lordbob75

Computer Voodooist

My Computer

Similar threads

blue screens and minidump...

BRANDELH

New member

My Computer My Computer

jason786

New member

My Computer My Computer

Lordbob75

Computer Voodooist

My Computer My Computer

BRANDELH

New member

My Computer My Computer

Lordbob75

Computer Voodooist

My Computer My Computer

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer