BSOD - ntoskrnl.exe+289fc

writhziden · Jan 18, 2012

Ellendway said:
I updated chipset drivers and few minutes ago I had BSOD again.

Can be it a problem with my system? I just checked my disk with Windows and it's a bit scratchy (I mean DVD disk with installer). Anyway I'm buying new memory tomorrow (2x 4GB) so I hope it will be better.

Can you post the crash files as you did before? Also, did you make sure the new memory will be compatible with your motherboard?

When you get new memory, make sure you replace the old memory and don't put the new with the old unless it is the same brand and timing. Sometimes, buying RAM at different times (say you bought one set in 2010 and another in 2012) can cause conflicts, as well, so it is necessary to put RAM in that is bought at the same time.

Ellendway · Jan 18, 2012

Yes, they will be ok. I had a chat with some people about it.

Anyway, logs are uploaded.

writhziden · Jan 18, 2012

Code:

[list=1]

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011612-20014-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03207000 PsLoadedModuleList = 0xfffff800`0344c670
Debug session time: Mon Jan 16 12:30:59.731 2012 (UTC - 7:00)
System Uptime: 0 days 5:24:15.871
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff96000600001, 8, fffff96000600001, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600001, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600001, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b6100
 fffff96000600001 

FAULTING_IP: 
+3034323862323064
fffff960`00600001 ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  perfmon.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003f08e20 -- (.trap 0xfffff88003f08e20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8006e71601 rbx=0000000000000000 rcx=fffffa8006e71601
rdx=fffffa800963a200 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600001 rsp=fffff88003f08fb0 rbp=fffff88003f09520
 r8=fffffa8009691e30  r9=00000000000000a0 r10=fffff88002fd5d60
r11=fffffa8006cc3e10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
fffff960`00600001 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000322f9fc to fffff80003283c40

STACK_TEXT:  
fffff880`03f08cb8 fffff800`0322f9fc : 00000000`00000050 fffff960`00600001 00000000`00000008 fffff880`03f08e20 : nt!KeBugCheckEx
fffff880`03f08cc0 fffff800`03281d6e : 00000000`00000008 fffff960`00600001 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`03f08e20 fffff960`00600001 : fffffa80`06aff570 00000000`00000001 00000000`00000000 fffffa80`06e71601 : nt!KiPageFault+0x16e
fffff880`03f08fb0 fffffa80`06aff570 : 00000000`00000001 00000000`00000000 fffffa80`06e71601 00000000`06a00101 : 0xfffff960`00600001
fffff880`03f08fb8 00000000`00000001 : 00000000`00000000 fffffa80`06e71601 00000000`06a00101 00000000`00000000 : 0xfffffa80`06aff570
fffff880`03f08fc0 00000000`00000000 : fffffa80`06e71601 00000000`06a00101 00000000`00000000 00000000`00000000 : 0x1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`0322f9fc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4611f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

Followup: MachineOwner
---------
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011712-30232-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345f670
Debug session time: Tue Jan 17 04:12:21.146 2012 (UTC - 7:00)
System Uptime: 0 days 0:01:30.301
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa800962eb30, fffffa800962ee10, fffff8000359a8b0}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa800962eb30, Terminating object
Arg3: fffffa800962ee10, Process image file name
Arg4: fffff8000359a8b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa800962eb30

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_C0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`03307b58 fffff800`036215e2 : 00000000`000000f4 00000000`00000003 fffffa80`0962eb30 fffffa80`0962ee10 : nt!KeBugCheckEx
fffff880`03307b60 fffff800`035ce99b : ffffffff`ffffffff fffffa80`09354b60 fffffa80`0962eb30 fffffa80`0962eb30 : nt!PspCatchCriticalBreak+0x92
fffff880`03307ba0 fffff800`0354e448 : ffffffff`ffffffff 00000000`00000001 fffffa80`0962eb30 fffffa80`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`03307bf0 fffff800`03295ed3 : fffffa80`0962eb30 fffff980`c0000005 fffffa80`09354b60 fffff980`014431f8 : nt!NtTerminateProcess+0xf4
fffff880`03307c70 fffff800`03292470 : fffff800`032e267f fffff880`03308a00 fffff880`03308340 fffff880`03308c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`03307e08 fffff800`032e267f : fffff880`03308a00 fffff880`03308340 fffff880`03308c20 00000000`00000002 : nt!KiServiceLinkage
fffff880`03307e10 fffff800`032e4af8 : fffff880`03308a00 fffff880`03308a00 fffff880`03308c20 fffff880`033084e0 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`033084b0 fffff800`032989fb : fffff880`03308a00 fffffa80`09354b60 00000000`003d1e88 fffff880`03308bc0 : nt!KiRaiseException+0x1b4
fffff880`03308ae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtRaiseException+0x7b


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------


[/list]

Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Missing Windows Updates... Drivers...
- You may need to check your disks again; I'll leave it up to you whether you feel this is necessary since you did not have errors before. Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
- Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
- Install all updates through Windows Updates.
- An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.
A windows system process was terminated unexpectedly. Do the following steps.
- Update all drivers that you are able to. If you need help finding a driver, let us know.
  You may use the following sites as references for finding drivers. We recommend finding the manufacturer of the driver and downloading drivers directly from the manufacturer or software developer. If you have trouble finding a driver or driver manufacturer, let us know and we will do our best to assist you. If you need help, please provide the device name, manufacturer, and the driver .sys file that you are looking for.
  1. Driver Reference is a good site to find the driver .sys files, their descriptions, and the site most likely to contain an update.
  2. Driver Search Methods provides driver manufacturers and links to their homepages.
  There are a few methods for updating drivers.
  To fully re-install a driver, use the following steps.
  1. Click Start Menu
  2. Right Click My Computer/Computer
  3. Click Manage
  4. Click Device Manager from the list on the left
  5. Find the device you are trying to uninstall by expanding the appropriate set of devices
  6. Right click the device
  7. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  8. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  9. Restart your computer
  10. Install the latest driver for the device once Windows starts.
  Alternatively:
  1. Login as an adminstrative user.
  2. Click Start Menu
  3. Click Control Panel
  4. Click Hardware and Sound
  5. Click Device Manager (the last link under Devices and Printers)
  6. Find the device you are trying to uninstall by expanding the appropriate set of devices
  7. Right click the device
  8. Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  9. Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
  10. Restart your computer
  11. Install the latest driver for the device once Windows starts.
- Check for viruses.
  
  Download and install the free version of Malwarebytes : Free anti-malware, anti-virus and spyware removal download (do not start the trial) and make sure it is updated. Do not run a scan yet.
  Download VIPRE Rescue - VIPRE Computer Recovery Solution from Sunbelt Software but do not unzip it yet
  Download the Fakerean removal tool but do not run it yet.
  Start your computer in http://www.sevenforums.com/tutorials/69585-safe-mode.html
  Unzip VIPRE Rescue and let it run.
  Run a full scan with Malwarebytes.
  Run the fakerean removal tool.

Thanks to Dave76 for help understanding possible causes.

Ellendway · Jan 18, 2012

All drivers are up-to-date, I'm trying to keep my Windows Updates updated too. I haven't got any virus in computer I think. I'm doing weekly maintenance with Malwarebytes and Microsoft Security Essentials.

I will do disk check again tomorrow. Anyway isn't system reinstall better way?

writhziden · Jan 18, 2012

Ellendway said:
All drivers are up-to-date, I'm trying to keep my Windows Updates updated too. I haven't got any virus in computer I think. I'm doing weekly maintenance with Malwarebytes and Microsoft Security Essentials.

I will do disk check again tomorrow. Anyway isn't system reinstall better way?

If you http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html, the only candidates for problems are hardware related. You have to use the diskpart clean all command to rule out any viruses in the rootkits, though. See http://www.sevenforums.com/tutorials/52129-disk-clean-clean-all-diskpart-command.html for using the clean all command.

Ellendway · Jan 19, 2012

So I'm on new system right now. I hope everything will be ok with new memory and system. I'm going to install important Windows Updates and drivers for hardware.

Thanks for your awesome advices.

writhziden · Jan 19, 2012

Ellendway said:
So I'm on new system right now. I hope everything will be ok with new memory and system. I'm going to install important Windows Updates and drivers for hardware.

Thanks for your awesome advices.

No problem. Good luck!

BSOD - ntoskrnl.exe+289fc

writhziden

Closed by request.

My Computer

Ellendway

New member

My Computer

writhziden

Closed by request.

My Computer

Ellendway

New member

My Computer

writhziden

Closed by request.

My Computer

Ellendway

New member

My Computer

writhziden

Closed by request.

My Computer

Similar threads

BSOD - ntoskrnl.exe+289fc

writhziden

Closed by request.

My Computer My Computer

Ellendway

New member

My Computer My Computer

writhziden

Closed by request.

My Computer My Computer

Ellendway

New member

My Computer My Computer

writhziden

Closed by request.

My Computer My Computer

Ellendway

New member

My Computer My Computer

writhziden

Closed by request.

My Computer My Computer

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer