BSOD on idle. File atached

[Dzeath]

Heya. I have Windows 7 Ultimate 64bit
C2D E6600 2.4Ghz
4 GB Ram
Nvidia GTS 250
Asus P5Q Deluxe
300GB hard drive
SB X-fi Fatality pro

So i got a BSOD, but its not when i bootup or stright after loging in. It hapened 2 or 3 times in ~3 days. PC was on for some hours and it hapened when PC was doing nothing (on idle). I came back from downstairs and find out pc rebooted. I uploaded my dump file that i found in windows minidump folder. I dont know anyhitng whats writen there Could anyone give me a hint what caused those few BOED's? Pls.
Thank you in advice


P.S. Or this is what i found after i saw my computer rebooted:

Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF880012C9FA9
BCP3: 0000000000000000
BCP4: FFFFFFFFFFFFFFFF
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\122209-27268-01.dmp
C:\Users\Egis\AppData\Local\Temp\WER-197278-0.sysdata.xml

 

[zigzag3143]

Heya. I have Windows 7 Ultimate 64bit
C2D E6600 2.4Ghz
4 GB Ram
Nvidia GTS 250
Asus P5Q Deluxe
300GB hard drive
SB X-fi Fatality pro

So i got a BSOD, but its not when i bootup or stright after loging in. It hapened 2 or 3 times in ~3 days. PC was on for some hours and it hapened when PC was doing nothing (on idle). I came back from downstairs and find out pc rebooted. I uploaded my dump file that i found in windows minidump folder. I dont know anyhitng whats writen there Could anyone give me a hint what caused those few BOED's? Pls.
Thank you in advice

122209-27268-01.dmp


P.S. Or this is what i found after i saw my computer rebooted:

Additional information about the problem:
BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF880012C9FA9
BCP3: 0000000000000000
BCP4: FFFFFFFFFFFFFFFF
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\122209-27268-01.dmp
C:\Users\Egis\AppData\Local\Temp\WER-197278-0.sysdata.xml

Hi and welcome


cant get to your dump file on mediashare usethese instructions http://www.sevenforums.com/crash-lockup-debug-how/34900-1-novice-how-ask-help-bsod-problem.html


Ken J+

 

[Dzeath]

Hi and welcome


cant get to your dump file on mediashare usethese instructions http://www.sevenforums.com/crash-lockup-debug-how/34900-1-novice-how-ask-help-bsod-problem.html


Ken J+

Hi and thank you for a tip. i copied my dump file to a different disk and rar'ed it. I now atached that file, i hope you can download it now. Thank you

 

[zigzag3143]

Hi and welcome


cant get to your dump file on mediashare usethese instructions http://www.sevenforums.com/crash-lockup-debug-how/34900-1-novice-how-ask-help-bsod-problem.html


Ken J+

Hi and thank you for a tip. i copied my dump file to a different disk and rar'ed it. I now atached that file, i hope you can download it now. Thank you[/QUOTE]


Hi and welcome this dmp was probably causwed by klif.sys, That is of course part of your Kaspersky av app and probably the rott kit.

I would get rid Of Kaspersky as there are better less troublesome AV's around

Hope this helps


Ken J+

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\122209-27268-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02812000 PsLoadedModuleList = 0xfffff800`02a4fe50
Debug session time: Tue Dec 22 13:56:35.273 2009 (GMT-5)
System Uptime: 0 days 6:11:30.068
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff880012c9fa9, 0, ffffffffffffffff}
[B]
Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : klif.sys ( klif+21b54 )
[/B]
Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

[B]KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880012c9fa9, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception[/B]

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
fltmgr!GetContextFromStreamList+99
fffff880`012c9fa9 488b4820        mov     rcx,qword ptr [rax+20h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aba0e0
 ffffffffffffffff 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

[B]PROCESS_NAME:  svchost.exe[/B]

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028c3a17 to fffff80002883f00

STACK_TEXT:  
fffff880`0aca4f98 fffff800`028c3a17 : 00000000`0000001e ffffffff`c0000005 fffff880`012c9fa9 00000000`00000000 : nt!KeBugCheckEx
fffff880`0aca4fa0 fffff800`02883542 : fffff880`0aca5778 00000000`00000000 fffff880`0aca5820 fffffa80`05914220 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`0aca5640 fffff800`02881e4a : 00000000`00000011 fffff800`028a671f fffffa80`07083010 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0aca5820 fffff880`012c9fa9 : fffff8a0`071264e0 00000000`00000000 fffff880`0aca5a60 fffff880`012c932e : nt!KiGeneralProtectionFault+0x10a
fffff880`0aca59b0 fffff880`012d4d4e : fffffa80`059141d0 fffff880`0aca5a90 00000000`00000000 00000000`00000000 : fltmgr!GetContextFromStreamList+0x99
fffff880`0aca5a30 fffff880`01b6ab54 : fffffa80`059141d0 fffffa80`0755de00 fffffa80`04ca7890 fffff880`01b6b302 : fltmgr!FltGetStreamContext+0x3e
fffff880`0aca5a60 fffffa80`059141d0 : fffffa80`0755de00 fffffa80`04ca7890 fffff880`01b6b302 00000000`00000001 : klif+0x21b54
fffff880`0aca5a68 fffffa80`0755de00 : fffffa80`04ca7890 fffff880`01b6b302 00000000`00000001 00000000`00000378 : 0xfffffa80`059141d0
fffff880`0aca5a70 fffffa80`04ca7890 : fffff880`01b6b302 00000000`00000001 00000000`00000378 00000000`00000000 : 0xfffffa80`0755de00
fffff880`0aca5a78 fffff880`01b6b302 : 00000000`00000001 00000000`00000378 00000000`00000000 00000000`00000000 : 0xfffffa80`04ca7890
fffff880`0aca5a80 00000000`00000001 : 00000000`00000378 00000000`00000000 00000000`00000000 fffff8a0`08d06440 : klif+0x22302
fffff880`0aca5a88 00000000`00000378 : 00000000`00000000 00000000`00000000 fffff8a0`08d06440 00000000`00000000 : 0x1
fffff880`0aca5a90 00000000`00000000 : 00000000`00000000 fffff8a0`08d06440 00000000`00000000 fffff8a0`071264e0 : 0x378


STACK_COMMAND:  kb

FOLLOWUP_IP: 
klif+21b54
fffff880`01b6ab54 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  klif+21b54

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: klif

[B]IMAGE_NAME:  klif.sys[/B]

DEBUG_FLR_IMAGE_TIMESTAMP:  4afabce0

FAILURE_BUCKET_ID:  X64_0x1E_klif+21b54

BUCKET_ID:  X64_0x1E_klif+21b54

Followup: MachineOwner
---------

 

[Dzeath]

Thank you so much, atleast i know what causes it now. I will try to get a different AV. Thanks and have a good Holydays !

 

[zigzag3143]

Thank you so much, atleast i know what causes it now. I will try to get a different AV. Thanks and have a good Holydays !

Glad to help was an easy one. there have been several comparisons of AV apps here if you want.

Happy holidays to you as well


Ken J+