Solved BSOD Multiple Times

[Jorediej]

Ok, I did all that. The system has created a log on another location as the BSOD. What to do next? Wait for another BSOD or run dm log collector again?

 

[Boozad]

Try running the collector again but I doubt there'll be any new info in there, if not wait for the next BSOD and run the tool again.

 

[Jorediej]

Ok. I followed all the steps again and received 2 new BSOD´s. The bluescreen itself reports that a dump file is created. However, when I start the dm log collecter again no new dump files are created. I searched the system for the dump files but all I got were the old ones (see attached).

 

[Jorediej]

I've did an entire new install of Windows and after one day I received another BSOD. Beginning to think this is cased by hardware failure. Anyway here is the new dump file.

 

[Jorediej]

And another one..

 

[Boozad]

Looking at your dump (another 0x109) it still looks like a driver is trying to access an address that's just bad.

CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
 or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
 debugger that was not attached when the system was booted. Normal breakpoints,
 "bp", can only be set if the debugger is attached at boot time. Hardware
 breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89cc6b4ec, Reserved
Arg2: b3b7465eef44f58e, Reserved
Arg3: fffff88003293640, Failure type dependent information
Arg4: 0000000000000003, Type of corrupted region, can be
    0 : A generic data region
    1 : Modification of a function or .pdata
    2 : A processor IDT
    3 : A processor GDT
    4 : Type 1 process list corruption
    5 : Type 2 process list corruption
    6 : Debug routine modification
    7 : Critical MSR modification

7: kd> !pool fffff88003293640
GetPointerFromAddress: unable to read from fffff8000330a100
Pool page fffff88003293640 region is GetUlongFromAddress: unable to read from fffff8000330a1c0
Nonpaged pool
GetUlongFromAddress: unable to read from fffff80003278a38
Unable to get pool big page table. Check for valid symbols.
fffff88003293000 is not valid pool. Checking for freed (or corrupt) pool
Bad allocation size @fffff88003293000, zero is invalid

***
*** An error (or corruption) in the pool was detected;
*** Attempting to diagnose the problem.
***
*** Use !poolval fffff88003293000 for more details.


Pool page [ fffff88003293000 ] is __inVALID.

Analyzing linked list...
[ fffff88003293000 --> fffff880032937d0 (size = 0x7d0 bytes)]: Corrupt region
[ fffff88003293bd0 --> fffff88003293dd0 (size = 0x200 bytes)]: Corrupt region


Scanning for single bit errors...

None found

7: kd> !poolval fffff88003293000
Pool page fffff88003293000 region is Nonpaged pool

Validating Pool headers for pool page: fffff88003293000

Pool page [ fffff88003293000 ] is __inVALID.

Enable Driver Verifier again and post up the resulting dumps.

 

[Jorediej]

Here is the new dump with driver verifier enabled.

 

[Jorediej]

The file above is the only BSOD I received the last couple of days. My system however is very laggy and "hangs" all the time. I get no BSOD but I do have to restart my PC often because it is not responding at all.

 

[Boozad]

Disable DV now, sorry I missed your last post I've been really busy the last couple of days. I'll get to the dumps later.

 

[Jorediej]

That's ok, take your time! I'm very happy you're helping me out here. I've disabled DV now and I look forward to your reply.

 

[Boozad]

Finally, we have something.

BugCheck A, {0, 2, 0, fffff800030d7b34}

[COLOR=Red]*** WARNING: Unable to verify timestamp for HD-Hypervisor-amd64.sys
*** ERROR: Module load completed but symbols could not be loaded for HD-Hypervisor-amd64.sys[/COLOR]
Probably caused by : HD-Hypervisor-amd64.sys ( HD_Hypervisor_amd64+a1bf )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030d7b34, address which referenced memory

Uninstall BlueStacks, this has finally shown its head above the parapet as the cause of the problems.

 

[Jorediej]

And what do I do if I want to keep using Bluestacks?

 

[Boozad]

Keep BSODs by the look of it. I can only report what I find and recommend a course of action, whether you choose to follow that is entirely up to you. BlueStacks is the issue here (I have no idea what BlueStacks is or what it does) and I've made you aware of that, that's where my job ends and your starts.

 

[Jorediej]

I guess you're right there! Now that we found the problem this thread can be marked as solved.
Thanks alot for your help!

 

[Boozad]

You're welcome. If you have any further issues don't hesitate to report back, we'll be here.