Finally.
Code:
Microsoft (R) Windows Debugger Version 6.2.9200.20512 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\USER\Downloads\Compressed\RECKM-PC-Thu_08_21_2014_110110_00\082014-27034-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`0364f000 PsLoadedModuleList = 0xfffff800`03892890
Debug session time: Thu Aug 21 12:25:58.699 2014 (UTC + 6:00)
System Uptime: 0 days 0:31:43.917
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {ffffffffffffffff, 1, fffff800039afcde, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObLogSecurityDescriptor+23f )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffff, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800039afcde, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800038fc100
GetUlongFromAddress: unable to read from fffff800038fc1c0
ffffffffffffffff
FAULTING_IP:
nt!ObLogSecurityDescriptor+23f
fffff800`039afcde 4c8928 mov qword ptr [rax],r13
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: dota.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88007efb790 -- (.trap 0xfffff88007efb790)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffffffffffffff rbx=0000000000000000 rcx=fffff8a0051c724c
rdx=0000000000bb2d10 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800039afcde rsp=fffff88007efb920 rbp=fffffa800a7a7b50
r8=0000000000000000 r9=0000000000000000 r10=000003ea1cf28368
r11=00000000000000dc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!ObLogSecurityDescriptor+0x23f:
fffff800`039afcde 4c8928 mov qword ptr [rax],r13 ds:ffffffff`ffffffff=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80003742bf0 to fffff800036c4bc0
STACK_TEXT:
fffff880`07efb628 fffff800`03742bf0 : 00000000`00000050 ffffffff`ffffffff 00000000`00000001 fffff880`07efb790 : nt!KeBugCheckEx
fffff880`07efb630 fffff800`036c2cee : 00000000`00000001 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`07efb790 fffff800`039afcde : 00000000`00000090 00000000`00000000 fffff8a0`030206f8 00000000`000007ff : nt!KiPageFault+0x16e
fffff880`07efb920 fffff800`0395edf8 : 00000000`000000dc fffff880`07efb9d8 fffff880`00000010 00000000`000000dc : nt!ObLogSecurityDescriptor+0x23f
fffff880`07efb990 fffff800`039af374 : 00000000`00000090 fffff880`07efbb40 fffff880`07efbad8 00000000`00000002 : nt!ObSetSecurityDescriptorInfo+0xf0
fffff880`07efba20 fffff800`03990429 : 00000000`00000002 fffff8a0`0e62ce20 fffff8a0`0f7f35b0 fffff8a0`03020700 : nt!SeDefaultObjectMethod+0xd4
fffff880`07efba70 fffff800`039715ab : fffff8a0`03020700 fffffa80`0a7a7b00 fffff8a0`00000004 fffff8a0`0f7f3580 : nt!SepAppendAdminAceToTokenAcl+0x239
fffff880`07efbb30 fffff800`039717dd : fffffa80`077115f0 fffffa80`077115f0 fffff880`07efbc78 fffffa80`013cb690 : nt!SeSubProcessToken+0x14f
fffff880`07efbc00 fffff800`0396dc57 : 00000000`00000000 00000000`000000a0 00000000`00000080 00000000`00000000 : nt!PspInitializeProcessSecurity+0x71
fffff880`07efbc60 fffff800`0396ee14 : fffffa80`09e2b600 00000000`00333af0 fffff880`07efc5b0 fffffa80`0820da6e : nt!PspAllocateProcess+0xcb7
fffff880`07efbf40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtCreateUserProcess+0x4a3
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObLogSecurityDescriptor+23f
fffff800`039afcde 4c8928 mov qword ptr [rax],r13
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ObLogSecurityDescriptor+23f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb
FAILURE_BUCKET_ID: X64_0x50_nt!ObLogSecurityDescriptor+23f
BUCKET_ID: X64_0x50_nt!ObLogSecurityDescriptor+23f
Followup: MachineOwner
---------
This indicates that invalid system memory has been referenced.
Cause
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Please complete the steps below.
Remove the following software completely -
gdrv.sys Fri Mar 13 09:22:29 2009 (49B9D175)
Gigabyte Easy Saver - mobo power utility driver
http://www.carrona.org/drivers/driver.php?id=gdrv.sys
AppleCharger.sys Wed Nov 2 08:46:00 2011 (4EB0AEE8)
GIGABYTE On/Off Charge driver. See here for details -
GIGABYTE ON/OFF Charge [br] May cause BSOD on Win7/8 systems - uninstall to test)
Driver Reference Table - AppleCharger.sys
Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program:
How to Clean Left Over Driver Files with Driver Sweeper
Use
Revo Uninstaller to uninstall stubborn software. Opt for
Advance Mode while uninstalling which allows you to remove leftover registry:-
*Remove Norton - it tends to cause BSOD's. Use Microsoft Security Essentials for the time being.
Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability
compared to other antivirus or internet security software. It is free and lightweight:-
Warning
Do not start the
free trial of Malware Bytes; remember to
deselect that option when prompted.
Run
Disk Check on your
Hard Drive for file system errors and bad sectors on it:
Upload a screenshot of your hard disk using
Crystal Disk Info:
Make
scans with the following:
Kaspersky TDSSKiller
ESET online scanner:
Run the System File Checker that scans the of all protected
Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
- Click on the
rb:
- Type CMD on Search
- Left click and Run as Administrator
- Type SFC /scannow
Full tutorial here:
Check for heating issues using
Speccy or
HWMonitor. Upload a screen shot with either of the tools:
Post back with results.
