BSOD on Different Times and Different Errors

shriekyphantom · Feb 25, 2012

I bought a new laptop.

There are times I got BSOD and have different errors. I can't determine if the problem is in the software or in the hardware.

Sometimes, I get BSOD when I'm in the middle of transferring of files.
Sometimes, just after turning the laptop on from Hibernate.
Sometimes, after the windows load and before the desktop shows.
Sometimes, when I'm just installing a driver.

Please help me solve this.

My specs:

ePeen · Feb 25, 2012

Hello, welcome to SevenForums!

Many different errors, nothing really as far as processes go to lead on. Two things I'd like you two do:

1. Memtest. Read the following to learn how to download and run memtest to test your memory for errors.

2. If Memtest comes back clean, it's most likely software / driver related. Hopefully we can further diagnose it if it comes to that by enabling Driver Verifier.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800dbe5a68
Arg3: fffff8800dbe52d0
Arg4: fffff80002e5d725

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800dbe5a68 -- (.exr 0xfffff8800dbe5a68)
ExceptionAddress: fffff80002e5d725 (nt!MmFlushSection+0x0000000000000105)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800dbe52d0 -- (.cxr 0xfffff8800dbe52d0)
rax=0000000000000002 rbx=0000000000000000 rcx=fffffa800779a4df
rdx=0000000000000000 rsi=ff6efa8007545320 rdi=fffff88002f64180
rip=fffff80002e5d725 rsp=fffff8800dbe5ca0 rbp=0000000000000000
 r8=0000000000000000  r9=fffff8800dbe5a88 r10=fffffa80090e6400
r11=fffff8800dbe5c70 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
nt!MmFlushSection+0x105:
fffff800`02e5d725 f00fba6e481f    lock bts dword ptr [rsi+48h],1Fh ds:002b:ff6efa80`07545368=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030a90e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFlushUserStream+92
fffff880`014df642 389c24a0000000  cmp     byte ptr [rsp+0A0h],bl

FAULTING_IP: 
nt!MmFlushSection+105
fffff800`02e5d725 f00fba6e481f    lock bts dword ptr [rsi+48h],1Fh

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002e5d119 to fffff80002e5d725

STACK_TEXT:  
fffff880`0dbe5ca0 fffff800`02e5d119 : fffffa80`06d87e18 fffff880`0dbe5e00 00000000`00100000 fffffa80`00000000 : nt!MmFlushSection+0x105
fffff880`0dbe5d60 fffff880`014df642 : fffffa80`06d87e18 fffff880`00000000 fffffa80`00000000 00000000`00100000 : nt!CcFlushCache+0x5e9
fffff880`0dbe5e60 fffff880`014e06ba : fffff8a0`0a873c70 fffff8a0`0a873c70 fffff8a0`0a873c70 fffffa80`095c1370 : Ntfs!NtfsFlushUserStream+0x92
fffff880`0dbe5ee0 fffff880`014df88e : fffffa80`095c1370 fffff8a0`0a873c70 00000000`00000000 fffffa80`0a303060 : Ntfs!NtfsPerformOptimisticFlush+0x7a
fffff880`0dbe5f40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x12a


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsFlushUserStream+92

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff8800dbe52d0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushUserStream+92

BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushUserStream+92

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022, 
Arg2: 0091000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff8000302e1b0

BUGCHECK_STR:  0x19_22

POOL_ADDRESS:  0091000000000000 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002eddbb0 to fffff80002e885c0

STACK_TEXT:  
fffff880`0adbdfd8 fffff800`02eddbb0 : 00000000`00000019 00000000`00000022 00910000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`0adbdfe0 fffff800`02fbd518 : 00000000`00000000 fffff880`0adbe130 fffff880`0adbe0a0 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x7288
fffff880`0adbe070 fffff800`02e74fb0 : 00000000`00000000 00000000`000000d0 fffffa80`093310d0 00000000`00000000 : nt!ExFreePoolWithTag+0x468
fffff880`0adbe120 fffff800`02e9db1e : 00000000`ffffffff fffff880`0adbe2a8 00000000`00000001 fffff8a0`0b1ca001 : nt!ExDeleteResourceLite+0x190
fffff880`0adbe180 fffff800`02e77f87 : fffffa80`074451a0 fffff880`0adbe2a8 00000000`00000000 fffffa80`074451a0 : nt!CcUnpinFileDataEx+0x3fe
fffff880`0adbe200 fffff800`02e7417b : fffffa80`074452d8 fffff880`0adbe3a0 00000000`00009000 00000000`00000000 : nt!CcReleaseByteRangeFromWrite+0xa7
fffff880`0adbe250 fffff880`012ec665 : fffffa80`074452d8 00000000`00000000 fffffa80`00000000 fffffa80`00009000 : nt!CcFlushCache+0x64b
fffff880`0adbe350 fffff880`012b0b3e : fffffa80`075fe010 00000000`00000000 fffff880`ffffdf01 00000000`00000000 : Ntfs!NtfsFlushLsnStreams+0x295
fffff880`0adbe3f0 fffff880`01395038 : fffffa80`075fe010 fffffa80`074fc180 fffff880`0adbe900 00000000`00000001 : Ntfs!NtfsCheckpointVolume+0xe8e
fffff880`0adbe7f0 fffff880`012d438e : fffffa80`075fe010 00000000`00000000 fffff880`c0000188 00000000`00000001 : Ntfs!NtfsCheckpointForLogFileFull+0x48
fffff880`0adbe840 fffff880`011b223f : fffff880`0adbe990 fffffa80`09474010 fffff880`0adbe901 fffffa80`075fe010 : Ntfs!NtfsFsdFileSystemControl+0x1de
fffff880`0adbe8e0 fffff880`011d191e : fffffa80`09331990 fffffa80`06fcda30 fffffa80`09331900 fffffa80`09474010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0adbe970 fffff800`031a0597 : fffffa80`06fcda30 fffff880`0adbec60 fffffa80`094743b0 fffffa80`09474010 : fltmgr!FltpFsControl+0xee
fffff880`0adbe9d0 fffff800`031697da : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0adbeb00 fffff800`02e87813 : ffffffff`ffffffff 00000000`0054d748 00000000`0054d760 00000000`00000004 : nt!NtFsControlFile+0x56
fffff880`0adbeb70 00000000`77b1fa4a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0054d9f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b1fa4a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+7288
fffff800`02eddbb0 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+7288

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+7288

BUCKET_ID:  X64_0x19_22_nt!_??_::FNODOBFM::_string_+7288

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff960001a55ed, Address of the instruction which caused the bugcheck
Arg3: fffff88006392180, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!UserSurfaceAccessCheck+1d
fffff960`001a55ed 488b8078010000  mov     rax,qword ptr [rax+178h]

CONTEXT:  fffff88006392180 -- (.cxr 0xfffff88006392180)
rax=ff4ef900c1fab250 rbx=0000000000000000 rcx=0a3f1f2000000004
rdx=0000077ffdb0c9a0 rsi=0000000000000000 rdi=0a3f1f2000000004
rip=fffff960001a55ed rsp=fffff88006392b50 rbp=fffff88006392c60
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=ff4ef900c1fab250 r12=00000000002782d0 r13=0000000000000000
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
win32k!UserSurfaceAccessCheck+0x1d:
fffff960`001a55ed 488b8078010000  mov     rax,qword ptr [rax+178h] ds:002b:ff4ef900`c1fab3c8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff9600023bab3 to fffff960001a55ed

STACK_TEXT:  
fffff880`06392b50 fffff960`0023bab3 : 00000000`00000000 0000007f`00000060 00000000`00000000 0000007f`fffffff8 : win32k!UserSurfaceAccessCheck+0x1d
fffff880`06392b80 fffff800`02e85813 : fffffa80`0aca5980 00000001`ffffffff 00000000`03e9c601 00000000`00000001 : win32k!NtGdiDdDDIGetDeviceState+0x57
fffff880`06392be0 000007fe`ff3c131a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`03e9f518 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`ff3c131a


FOLLOWUP_IP: 
win32k!UserSurfaceAccessCheck+1d
fffff960`001a55ed 488b8078010000  mov     rax,qword ptr [rax+178h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!UserSurfaceAccessCheck+1d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

STACK_COMMAND:  .cxr 0xfffff88006392180 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!UserSurfaceAccessCheck+1d

BUCKET_ID:  X64_0x3B_win32k!UserSurfaceAccessCheck+1d

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002ef5cd5, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiResolveDemandZeroFault+135
fffff800`02ef5cd5 66833c0200      cmp     word ptr [rdx+rax],0

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031100e0
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88003b74758 -- (.exr 0xfffff88003b74758)
ExceptionAddress: fffff80002ef5cd5 (nt!MiResolveDemandZeroFault+0x0000000000000135)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88003b74800 -- (.trap 0xfffff88003b74800)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ff7ffa80068fb400 rbx=0000000000000000 rcx=000000000000003f
rdx=0000000000000060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ef5cd5 rsp=fffff88003b74990 rbp=fffff88003b74a00
 r8=0000000000000006  r9=fffff6800001ea90 r10=0000000000000000
r11=fffff88003b74be0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!MiResolveDemandZeroFault+0x135:
fffff800`02ef5cd5 66833c0200      cmp     word ptr [rdx+rax],0 ds:2000:ff7ffa80`068fb460=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f12919 to fffff80002ed85c0

STACK_TEXT:  
fffff880`03b73f88 fffff800`02f12919 : 00000000`0000001e ffffffff`c0000005 fffff800`02ef5cd5 00000000`00000000 : nt!KeBugCheckEx
fffff880`03b73f90 fffff800`02ed7c02 : fffff880`03b74758 00000000`00000002 fffff880`03b74800 fffffa80`0ac2aec8 : nt!KiDispatchException+0x1b9
fffff880`03b74620 fffff800`02ed650a : 00000000`00000000 000007fe`fa40a042 ffffffff`ffffffff fffffa80`06257010 : nt!KiExceptionDispatch+0xc2
fffff880`03b74800 fffff800`02ef5cd5 : fffffa80`0adea890 00000000`00000000 00000000`00001000 fffff880`03b74c60 : nt!KiGeneralProtectionFault+0x10a
fffff880`03b74990 fffff800`02ef2816 : 00000000`00000001 00000000`03d52ff8 fffff880`03b74be0 fffff680`0001ea90 : nt!MiResolveDemandZeroFault+0x135
fffff880`03b74a80 fffff800`02ed66ae : 00000000`00000001 00000000`000e0000 000007fe`00000001 fffffa80`0ade11e0 : nt!MmAccessFault+0x5c6
fffff880`03b74be0 00000000`76dc7958 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0226ea10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76dc7958


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiResolveDemandZeroFault+135
fffff800`02ef5cd5 66833c0200      cmp     word ptr [rdx+rax],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!MiResolveDemandZeroFault+135

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!MiResolveDemandZeroFault+135

BUCKET_ID:  X64_0x1E_c0000005_nt!MiResolveDemandZeroFault+135

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600079c1d0, Address of the instruction which caused the bugcheck
Arg3: fffff8800709d7f0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
cdd!CStagingPool::GetGdiSurface+100
fffff960`0079c1d0 48894808        mov     qword ptr [rax+8],rcx

CONTEXT:  fffff8800709d7f0 -- (.cxr 0xfffff8800709d7f0)
rax=ff7ff900c00c1250 rbx=fffffa800a4ef8d0 rcx=fffff900c00c12a0
rdx=fffff900c00c1278 rsi=0000000000000000 rdi=fffff900c00c0fa0
rip=fffff9600079c1d0 rsp=fffff8800709e1c0 rbp=fffff8800709e3a0
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff80003038e80 r12=0000000000000040 r13=fffff8800709e780
r14=0000000000000100 r15=0000000076edf70a
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
cdd!CStagingPool::GetGdiSurface+0x100:
fffff960`0079c1d0 48894808        mov     qword ptr [rax+8],rcx ds:002b:ff7ff900`c00c1258=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff9600079c1d0

STACK_TEXT:  
fffff880`0709e1c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cdd!CStagingPool::GetGdiSurface+0x100


FOLLOWUP_IP: 
cdd!CStagingPool::GetGdiSurface+100
fffff960`0079c1d0 48894808        mov     qword ptr [rax+8],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  cdd!CStagingPool::GetGdiSurface+100

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cdd

IMAGE_NAME:  cdd.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bde94

STACK_COMMAND:  .cxr 0xfffff8800709d7f0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_cdd!CStagingPool::GetGdiSurface+100

BUCKET_ID:  X64_0x3B_cdd!CStagingPool::GetGdiSurface+100

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002c6bc3d, Address of the instruction which caused the bugcheck
Arg3: fffff8800a714e70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!AlpcpQueueIoCompletionPort+1ad
fffff800`02c6bc3d 48894108        mov     qword ptr [rcx+8],rax

CONTEXT:  fffff8800a714e70 -- (.cxr 0xfffff8800a714e70)
rax=fffffa8006a91168 rbx=fffffa800aaeac20 rcx=fffdfa800aaeac28
rdx=fffffa800a2a5168 rsi=fffff88002f64180 rdi=fffffa800ab12d30
rip=fffff80002c6bc3d rsp=fffff8800a715850 rbp=0000000000000000
 r8=fffffa8006a91168  r9=0000000000000000 r10=0000000000020000
r11=0000000000000000 r12=fffffa800aaeac28 r13=fffffa8009346060
r14=fffff8a001b9b400 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!AlpcpQueueIoCompletionPort+0x1ad:
fffff800`02c6bc3d 48894108        mov     qword ptr [rcx+8],rax ds:002b:fffdfa80`0aaeac30=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  lsm.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002c6bc3d

STACK_TEXT:  
fffff880`0a715850 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!AlpcpQueueIoCompletionPort+0x1ad


FOLLOWUP_IP: 
nt!AlpcpQueueIoCompletionPort+1ad
fffff800`02c6bc3d 48894108        mov     qword ptr [rcx+8],rax

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!AlpcpQueueIoCompletionPort+1ad

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff8800a714e70 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!AlpcpQueueIoCompletionPort+1ad

BUCKET_ID:  X64_0x3B_nt!AlpcpQueueIoCompletionPort+1ad

Followup: MachineOwner

shriekyphantom · Feb 25, 2012

I already got errors without even completing a pass. Does this mean that the problem is in the laptop and not in the software?

So, do I need to open the laptop? I can't do that because if I did, the replacement/warranty period will be void. The only thing I can do if the problem is in the hardware is to turn the laptop over to the seller/manufacturer, right?

ePeen · Feb 25, 2012

That is correct

shriekyphantom · Feb 25, 2012

Ok. Thanks!

Here's the result of memtest.

An error occurred during the test #4 of pass 0. I rerun the memtest and an error occurred again but it happened on the test 3 and it has the same failing address.

ePeen · Feb 25, 2012

Yep, any errors are a sign of failing memory. Now you'll want to contact the manufacturer directly and get an RMA sorted

shriekyphantom · Feb 25, 2012

Thank you very much.

ePeen · Feb 25, 2012

My pleasure, let us know how things are working when the replacement sticks arrive

shriekyphantom · Mar 23, 2012

Sorry, late reply. I run a memtest last night, the time I got the laptop with new RAM sticks, and I didn't got any errors but still, there's a blue screen. With the Driver Verifier, after logging on to windows but before the desktop appears, a BSOD will appear. It has an 0x0000000a error.

Here are the new reports.

ePeen · Mar 23, 2012

Verifier dumps showed the culprit as MBfilt64.sys, which is the Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver).

I'd recommend fully uninstalling your Realtek drivers via programs & features in the Control Pnael, and then update your Realtek drivers here.

shriekyphantom · Mar 24, 2012

Done reinstalling the 3 Realtek Drivers. When I ran the verifier again, it gave me the IRQL_NOT_LESS_ OR_EQUAL again.
What should I do? Shoulvd reinstall my OS?

Here are the new dump files, together with the old ones.

ePeen · Mar 24, 2012

Two out of the three new dumps are debuggable, and they both show the culprit as MBfilt64.sys, which again, is
Realtek HiDefinition Audio driver (file labelled as Creative Audio Driver).

You can reinstall the OS if you'd like, it's entirely up to you. However, realistically you should just have to uninstall Realtek's drivers from programs & features, restart, and then install the newer ones. I'd maybe give Driver Sweeper a try too to get rid of any old Realtek library files and the uninstallation.

shriekyphantom · Mar 24, 2012

I already reinstalled all the Realtek's drivers using the installers coming from their website. I'll try Driver Sweeper.

After cleaning Realtek's sound and rebooting, I got a BSoD.

ePeen · Mar 25, 2012

Latest dump culprit labeled ntkrnlmp, which is more than unlikely the cause of the crash.

Enable Driver Verifier:

Driver Verifier:

Read the following to enable Driver Verifier. Use Driver Second if Memtest finds nothing, as it's likely a software / driver issue, we just aren't being told what it is, and hopefully Driver Verifier will than force a crash if it finds the violating driver.

Before enabling Driver Verifier, my recommendation is to set a backup / restore point as in severe cases Driver Verifier can break your Windows. If you have difficulty getting into Windows, boot into Safe Mode and disable Driver Verifier there.

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\032512-27003-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`0304ce50
Debug session time: Sat Mar 24 23:28:20.236 2012 (UTC - 4:00)
System Uptime: 0 days 0:00:40.625
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002e5d7ff, fffff88009dc6a70, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiDeliverApc+a7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002e5d7ff, Address of the instruction which caused the bugcheck
Arg3: fffff88009dc6a70, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiDeliverApc+a7
fffff800`02e5d7ff 498b4a30        mov     rcx,qword ptr [r10+30h]

CONTEXT:  fffff88009dc6a70 -- (.cxr 0xfffff88009dc6a70)
rax=0000000000000002 rbx=fffffa800b464060 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa800b4640b0 rdi=0000000000000003
rip=fffff80002e5d7ff rsp=fffff88009dc7450 rbp=0000000000000000
 r8=ff49fa800b4640b0  r9=0000000000000000 r10=ff49fa800b4640a0
r11=fffffa800b464060 r12=0000000000000001 r13=0000000000000000
r14=fffffa800bc27b30 r15=fffff88009dc7560
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!KiDeliverApc+0xa7:
fffff800`02e5d7ff 498b4a30        mov     rcx,qword ptr [r10+30h] ds:002b:ff49fa80`0b4640d0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002e5d7ff

STACK_TEXT:  
fffff880`09dc7450 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0xa7


FOLLOWUP_IP: 
nt!KiDeliverApc+a7
fffff800`02e5d7ff 498b4a30        mov     rcx,qword ptr [r10+30h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiDeliverApc+a7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff88009dc6a70 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KiDeliverApc+a7

BUCKET_ID:  X64_0x3B_nt!KiDeliverApc+a7

Followup: MachineOwner
---------

shriekyphantom · Mar 27, 2012

I've got a new error with verifier running .

Dump files together with the old ones.

ePeen · Mar 27, 2012

All of them are still A* bugcheck with MBfilt64.sys culprit. The newest one however points to dxgkrnl.sys, which is the DirectX Graphics Kernel. You can either repair or or ensure you're up to date by downloading this.

Regardless, we should not be constantly seeing this audio driver culprits if you've successfully removed them. You have uninstalled everything Realtek related, even gave cleaning Realtek with Driver Sweeper a try, correct? Well, you went ahead and installed the latest Realtek drivers for your system, right?

Dumps for reference:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\032712-26691-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e55000 PsLoadedModuleList = 0xfffff800`03092e50
Debug session time: Tue Mar 27 07:35:30.260 2012 (UTC - 4:00)
System Uptime: 0 days 0:00:23.665
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff8800530b541, fffff8800748ee90, 0}

Probably caused by : dxgkrnl.sys ( dxgkrnl!DpiDispatchClose+45 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8800530b541, Address of the instruction which caused the bugcheck
Arg3: fffff8800748ee90, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
dxgkrnl!DpiDispatchClose+45
fffff880`0530b541 ffd0            call    rax

CONTEXT:  fffff8800748ee90 -- (.cxr 0xfffff8800748ee90)
rax=0004000000000000 rbx=0000000000000000 rcx=fffffa800b66b200
rdx=fffff98024fd8ee0 rsi=fffff98024fd8ee0 rdi=fffffa800b66b200
rip=fffff8800530b541 rsp=fffff8800748f870 rbp=fffffa800b66b350
 r8=fffffa800a9f9610  r9=fffff98024fd8fb0 r10=fffff8000335bbb0
r11=fffffa800a31cb40 r12=0000000000000000 r13=0000000000000000
r14=fffffa800b66b200 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
dxgkrnl!DpiDispatchClose+0x45:
fffff880`0530b541 ffd0            call    rax {00040000`00000000}
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x3B

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff8800530b541

STACK_TEXT:  
fffff880`0748f870 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!DpiDispatchClose+0x45


FOLLOWUP_IP: 
dxgkrnl!DpiDispatchClose+45
fffff880`0530b541 ffd0            call    rax

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  dxgkrnl!DpiDispatchClose+45

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgkrnl

IMAGE_NAME:  dxgkrnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc590

STACK_COMMAND:  .cxr 0xfffff8800748ee90 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_VRF_dxgkrnl!DpiDispatchClose+45

BUCKET_ID:  X64_0x3B_VRF_dxgkrnl!DpiDispatchClose+45

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\032512-16848-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c18000 PsLoadedModuleList = 0xfffff800`02e55e50
Debug session time: Sat Mar 24 12:45:34.074 2012 (UTC - 4:00)
System Uptime: 0 days 0:00:22.479
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002c8e0b6}

Unable to load image \SystemRoot\system32\drivers\MBfilt64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for MBfilt64.sys
*** ERROR: Module load completed but symbols could not be loaded for MBfilt64.sys
Probably caused by : MBfilt64.sys ( MBfilt64+1817 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c8e0b6, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec00e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02c8e0b6 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003324a50 -- (.trap 0xfffff88003324a50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880065b32d0 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c8e0b6 rsp=fffff88003324be0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000100 r10=0000000000000000
r11=0000000000010725 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po cy
nt!KeSetEvent+0x226:
fffff800`02c8e0b6 488b09          mov     rcx,qword ptr [rcx] ds:4c10:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c89469 to fffff80002c89f00

STACK_TEXT:  
fffff880`03324908 fffff800`02c89469 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03324910 fffff800`02c880e0 : 00000000`00000160 fffff880`065b32c8 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`03324a50 fffff800`02c8e0b6 : fffffa80`0b625002 fffffa80`0b6250e0 00000000`00000000 fffff980`032b8ea0 : nt!KiPageFault+0x260
fffff880`03324be0 fffff880`077a9817 : fffff880`00000000 fffff980`00000008 fffff800`02e36400 fffffa80`0b3e4cb0 : nt!KeSetEvent+0x226
fffff880`03324c50 fffff880`00000000 : fffff980`00000008 fffff800`02e36400 fffffa80`0b3e4cb0 fffffa80`0b6250e0 : MBfilt64+0x1817
fffff880`03324c58 fffff980`00000008 : fffff800`02e36400 fffffa80`0b3e4cb0 fffffa80`0b6250e0 fffff800`0312e2eb : 0xfffff880`00000000
fffff880`03324c60 fffff800`02e36400 : fffffa80`0b3e4cb0 fffffa80`0b6250e0 fffff800`0312e2eb fffffa80`0b6250e0 : 0xfffff980`00000008
fffff880`03324c68 fffffa80`0b3e4cb0 : fffffa80`0b6250e0 fffff800`0312e2eb fffffa80`0b6250e0 fffffa80`0b6250e0 : nt!ViVerifyFlags
fffff880`03324c70 fffffa80`0b6250e0 : fffff800`0312e2eb fffffa80`0b6250e0 fffffa80`0b6250e0 fffff980`032b9000 : 0xfffffa80`0b3e4cb0
fffff880`03324c78 fffff800`0312e2eb : fffffa80`0b6250e0 fffffa80`0b6250e0 fffff980`032b9000 fffff980`032b8ea0 : 0xfffffa80`0b6250e0
fffff880`03324c80 fffff800`0312e36c : fffff800`02e364e0 00000000`00000080 fffffa80`069bc890 00000080`40000000 : nt!ViPendingCompleteAfterWait+0x7b
fffff880`03324cc0 fffff800`02f2d166 : 442af701`57000001 10000000`80000004 0400fd00`43000000 00080000`00000000 : nt!ViPendingWorkerThread+0x2c
fffff880`03324d00 fffff800`02c68486 : fffff880`009e9180 fffffa80`07662040 fffff880`009f3fc0 00000100`04000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03324d40 00000000`00000000 : fffff880`03325000 fffff880`0331f000 fffff880`033249d0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
MBfilt64+1817
fffff880`077a9817 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  MBfilt64+1817

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: MBfilt64

IMAGE_NAME:  MBfilt64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a7267b0

FAILURE_BUCKET_ID:  X64_0xA_VRF_MBfilt64+1817

BUCKET_ID:  X64_0xA_VRF_MBfilt64+1817

Followup: MachineOwner
---------

shriekyphantom · Mar 29, 2012

I've got the latest DirectX.
I 'll redo the one related with Realtek's.

I've got this error when I restarted, with Verifier off and after uninstalling Realtek's and after using the driver sweeper.

ePeen · Mar 30, 2012

Latest dump points to the culprit as ntkrnlmp.exe, which is more than likely incorrect. We'll most likely need verifier enabled to get an analyzable dump.

shriekyphantom · Mar 30, 2012

I see. Well, I got a BSoD again when I just about to turn the verifier on and the laptop just opened.

Just after almost 10 hours after the BSoD above, I got again another one with Verifier on. After some time, BSoD again. BSoD again. OTL
BSoD for the fifth time.

First BSoD: 033112-25147-01.zip
Second BSoD: 033112-24632-01.zip
Thirs BSoD: 033112-22339-01.zip
4th BSoD: 033112-21637-01.rar
5th: 040112-21481-01.zip

ePeen · Apr 3, 2012

Since you edited your post and didn't re-post, it didn't notify me that you ever updated this thread, my apologies!

Probable causes listed: 4x ntkrnlmp.exe dumps and 1x cdd.dll. All of these dumps are verifier enabled and are pointing to Microsoft files, normally it's very unlikely for Microsoft files to be actual causes because MS files are protected by the SFC (System File Checker).

Edit: Alright, I ran a !thread on one of the dumps, and it showed a culprit as ewusbnet.sys, which is the
Huawei DataCard USB PN driver. Please update this driver or uninstall it. Interestingly enough, running a !thread on every ntkrnmp.exe dump shows ewusbnet.sys as a culprit, but not on the cdd.dll dump.

If doing what I recommended for the driver above does not help, move onto this:

Run a chkdsk:

Open the "Computer" window
Right-click on the drive in question
Select the "Tools" tab
In the Error-checking area, click <Check Now>.

I'd also do a Memtest to ensure that your RAM is not an issue here. You're not getting any memory corruption / management causes, but it's just something to make sure isn't the issue here:

Memtest:

Read the following to test your memory for errors.

Dumps for reference:

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Icarus\Downloads\033112-21637-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e67000 PsLoadedModuleList = 0xfffff800`030a4e50
Debug session time: Sat Mar 31 09:55:57.390 2012 (UTC - 4:00)
System Uptime: 0 days 0:17:22.420
Loading Kernel Symbols
...............................................................
................................................................
............................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff8000317c166, 2, 0, fffff80002f05f62}

Probably caused by : ntkrnlmp.exe ( nt!RtlDispatchException+122 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8000317c166, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f05f62, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310f0e0
 fffff8000317c166 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!RtlDispatchException+122
fffff800`02f05f62 410fb60c24      movzx   ecx,byte ptr [r12]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff88003ac0710 -- (.trap 0xfffff88003ac0710)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff800030f7348 rbx=0000000000000000 rcx=fffff8000317c1a4
rdx=fffff8000317c10c rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f05f62 rsp=fffff88003ac08a0 rbp=fffff88003ac1758
 r8=0000000000002046  r9=0000000000002045 r10=fffff88003ac1d00
r11=fffff88003ac08e8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!RtlDispatchException+0x122:
fffff800`02f05f62 410fb60c24      movzx   ecx,byte ptr [r12] ds:285b:00000000`00000000=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed8469 to fffff80002ed8f00

STACK_TEXT:  
fffff880`03ac05c8 fffff800`02ed8469 : 00000000`0000000a fffff800`0317c166 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03ac05d0 fffff800`02ed70e0 : 00000000`0000e8b3 00000000`0000005a fffff800`03051e80 00000000`00000008 : nt!KiBugCheckDispatch+0x69
fffff880`03ac0710 fffff800`02f05f62 : fffff800`0317c166 fffff880`03ac08e8 fffff880`03ac1758 fffff880`02600000 : nt!KiPageFault+0x260
fffff880`03ac08a0 fffff800`02f131b5 : fffff880`03ac1758 fffff880`03ac0fb0 fffff880`00000000 fffffa80`0c19ab60 : nt!RtlDispatchException+0x122
fffff880`03ac0f80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x135


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlDispatchException+122
fffff800`02f05f62 410fb60c24      movzx   ecx,byte ptr [r12]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!RtlDispatchException+122

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xA_VRF_nt!RtlDispatchException+122

BUCKET_ID:  X64_0xA_VRF_nt!RtlDispatchException+122

Followup: MachineOwner
---------

3: kd> !thread
GetPointerFromAddress: unable to read from fffff8000310f000
THREAD fffffa800c19ab60  Cid 0004.0588  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 3
Not impersonating
GetUlongFromAddress: unable to read from fffff8000304db74
Owning Process            fffffa8007423740       Image:         System
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      66821        
Context Switch Count      44220             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Unable to load image \SystemRoot\system32\DRIVERS\ewusbnet.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ewusbnet.sys
*** ERROR: Module load completed but symbols could not be loaded for ewusbnet.sys
Win32 Start Address ewusbnet (0xfffff88002605f40)
Stack Init fffff88003ac1d70 Current fffff88003ac1670
Base fffff88003ac2000 Limit fffff88003abc000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`03ac05c8 fffff800`02ed8469 : 00000000`0000000a fffff800`0317c166 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03ac05d0 fffff800`02ed70e0 : 00000000`0000e8b3 00000000`0000005a fffff800`03051e80 00000000`00000008 : nt!KiBugCheckDispatch+0x69
fffff880`03ac0710 fffff800`02f05f62 : fffff800`0317c166 fffff880`03ac08e8 fffff880`03ac1758 fffff880`02600000 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`03ac0710)
fffff880`03ac08a0 fffff800`02f131b5 : fffff880`03ac1758 fffff880`03ac0fb0 fffff880`00000000 fffffa80`0c19ab60 : nt!RtlDispatchException+0x122
fffff880`03ac0f80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x135



Loading Dump File [C:\Users\Icarus\Downloads\033112-25147-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e50000 PsLoadedModuleList = 0xfffff800`0308de50
Debug session time: Fri Mar 30 20:32:59.556 2012 (UTC - 4:00)
System Uptime: 0 days 0:00:33.945
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002e9e7ff, fffff8800927e628, fffff8800927de80}

Probably caused by : cdd.dll ( cdd!CDDPDEV::FlushGdiOutput+51 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e9e7ff, The address that the exception occurred at
Arg3: fffff8800927e628, Exception Record Address
Arg4: fffff8800927de80, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiDeliverApc+a7
fffff800`02e9e7ff 498b4a30        mov     rcx,qword ptr [r10+30h]

EXCEPTION_RECORD:  fffff8800927e628 -- (.exr 0xfffff8800927e628)
ExceptionAddress: fffff80002e9e7ff (nt!KiDeliverApc+0x00000000000000a7)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800927de80 -- (.cxr 0xfffff8800927de80)
rax=0000000000000002 rbx=fffffa800b512b60 rcx=0000000000000001
rdx=0000000000000000 rsi=fffffa800b512bb0 rdi=0000000000000000
rip=fffff80002e9e7ff rsp=fffff8800927e860 rbp=0000000000000000
 r8=ff49fa800b512bb0  r9=0000000000000000 r10=ff49fa800b512ba0
r11=fffffa80073b5274 r12=0000000000000001 r13=0000000000000000
r14=fffffa800b4a9b30 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!KiDeliverApc+0xa7:
fffff800`02e9e7ff 498b4a30        mov     rcx,qword ptr [r10+30h] ds:002b:ff49fa80`0b512bd0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f80e0
 ffffffffffffffff 

FOLLOWUP_IP: 
cdd!CDDPDEV::FlushGdiOutput+51
fffff960`006395a5 40f6c702        test    dil,2

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002e73ba9 to fffff80002e9e7ff

STACK_TEXT:  
fffff880`0927e860 fffff800`02e73ba9 : 00000000`00000000 00000000`00000000 00000000`00000004 00000000`00000001 : nt!KiDeliverApc+0xa7
fffff880`0927e8e0 fffff800`02e57c7d : fffff900`c00c0020 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`0927e910 fffff960`006395a5 : fffffa80`0b4d1830 ffffffff`fffd74ea 00000000`00000004 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4630d
fffff880`0927e940 fffff960`00635c21 : ffffffff`fffd74ea 00000000`00000001 00000000`00000001 fffffa80`00000000 : cdd!CDDPDEV::FlushGdiOutput+0x51
fffff880`0927e970 fffff800`03165166 : 00000000`02b0ec59 fffffa80`0b512b60 00000000`00000080 fffffa80`0b4a9b30 : cdd!PresentWorkerThread+0x8b5
fffff880`0927ed00 fffff800`02ea0486 : fffff800`0303ae80 fffffa80`0b512b60 fffff800`03048c40 fffff880`0141ea90 : nt!PspSystemThreadStartup+0x5a
fffff880`0927ed40 00000000`00000000 : fffff880`0927f000 fffff880`09279000 fffff880`0927e4b0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  cdd!CDDPDEV::FlushGdiOutput+51

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cdd

IMAGE_NAME:  cdd.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bde94

STACK_COMMAND:  .cxr 0xfffff8800927de80 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_cdd!CDDPDEV::FlushGdiOutput+51

BUCKET_ID:  X64_0x7E_cdd!CDDPDEV::FlushGdiOutput+51

Followup: MachineOwner
---------

2: kd> !thread
GetPointerFromAddress: unable to read from fffff800030f8000
THREAD fffffa800b512b60  Cid 02a0.02d0  Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80003036b74
Owning Process            fffffa800b4a9b30       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      2175         
Context Switch Count      516             
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address cdd!PresentWorkerThread (0xfffff9600063536c)
Stack Init fffff8800927ed70 Current fffff8800927e4b0
Base fffff8800927f000 Limit fffff88009279000 Call 0
Priority 14 BasePriority 14 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0927e860 fffff800`02e73ba9 : 00000000`00000000 00000000`00000000 00000000`00000004 00000000`00000001 : nt!KiDeliverApc+0xa7
fffff880`0927e8e0 fffff800`02e57c7d : fffff900`c00c0020 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiCheckForKernelApcDelivery+0x25
fffff880`0927e910 fffff960`006395a5 : fffffa80`0b4d1830 ffffffff`fffd74ea 00000000`00000004 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4630d
fffff880`0927e940 fffff960`00635c21 : ffffffff`fffd74ea 00000000`00000001 00000000`00000001 fffffa80`00000000 : cdd!CDDPDEV::FlushGdiOutput+0x51
fffff880`0927e970 fffff800`03165166 : 00000000`02b0ec59 fffffa80`0b512b60 00000000`00000080 fffffa80`0b4a9b30 : cdd!PresentWorkerThread+0x8b5
fffff880`0927ed00 fffff800`02ea0486 : fffff800`0303ae80 fffffa80`0b512b60 fffff800`03048c40 fffff880`0141ea90 : nt!PspSystemThreadStartup+0x5a
fffff880`0927ed40 00000000`00000000 : fffff880`0927f000 fffff880`09279000 fffff880`0927e4b0 00000000`00000000 : nt!KxStartSystemThread+0x16

BSOD on Different Times and Different Errors

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

New member

My Computer

Banned

My Computer

Similar threads