Need help to understand this BSOD

[hatemf23]

After OCing my CPU it was stable for a few weeks then strange crashes started happening, I dont get a bluescreen just a black empty screen, on restart I get message that windows recovered and a dmp file. I uploaded it here. Would appreciate if some one would take a look at it, maybe its mentioned what is causing them, they are not frequent but still annoying.

 

[ICIT2LOL]

Hello mate I cannot open those RAR things so could you do these for us

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

&

http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[hatemf23]

Hi ICIT, here is the file you needed, as for the 1st guide Im not sure whats needed, should I set it to kernel dump or small memory dump?

 

[ICIT2LOL]

Ok hatem mate where did you get this copy of Windows?? because in the dump and it was really not what we see generally speaking.

Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
[COLOR=red]Windows 7 Kernel Version 7600[/COLOR] MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e08000 PsLoadedModuleList = 0xfffff800`03045e50
Debug session time: Tue Sep  8 01:21:57.650 2015 (UTC + 10:00)
System Uptime: 0 days 6:06:36.978
Loading Kernel Symbols

The build should read 7601 as the 7600 is the original version without the Service Pack 1 in this it seems to me the system looks to be a bit of a muddle in this next dump read out.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c24835c0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600036c69d, If non-zero, the instruction address which referenced the bad memory
 address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b00e0
GetUlongFromAddress: unable to read from fffff800030b0198
 fffff900c24835c0 
FAULTING_IP: 
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
fffff960`0036c69d 488b4f20        mov     rcx,qword ptr [rdi+20h]
MM_INTERNAL_CODE:  0
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  dwm.exe
CURRENT_IRQL:  0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME:  fffff8800ba93920 -- (.trap 0xfffff8800ba93920)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000011 rbx=0000000000000000 rcx=fffff900c00f7280
rdx=000000000a12168f rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600036c69d rsp=fffff8800ba93ab0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000410 r10=fffff80002e08000
r11=0000000000000020 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d:
fffff960`0036c69d 488b4f20        mov     rcx,qword ptr [rdi+20h] ds:00000000`00000020=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff80002ef91e4 to fffff80002e79f00
STACK_TEXT:  
fffff880`0ba937b8 fffff800`02ef91e4 : 00000000`00000050 fffff900`c24835c0 00000000`00000000 fffff880`0ba93920 : nt!KeBugCheckEx
fffff880`0ba937c0 fffff800`02e77fee : 00000000`00000000 fffff900`c00f7280 fffffa80`35616c00 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x42907
fffff880`0ba93920 fffff960`0036c69d : 00000000`00000000 00000000`0a12168f 00000000`0a12168f 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`0ba93ab0 fffff960`0036bbae : fffff900`c00f7280 00000000`00000000 0000168f`624d4653 00000000`0000001d : win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+0x2d
fffff880`0ba93ae0 fffff960`0036cab3 : 00000000`00000000 00000000`0a12168f fffff900`c00f7280 00000000`0ada574c : win32k!SFMLOGICALSURFACE::DeInitialize+0x4e
fffff880`0ba93b20 fffff960`002c95ff : 00000000`00000000 fffff900`c00bf010 fffff900`c00f7280 00000000`00000020 : win32k!bhLSurfDestroyLogicalSurfaceObject+0x4b
fffff880`0ba93b60 fffff960`002ea908 : 00000000`00000001 00000000`00000001 fffff880`0ba93ca0 00000000`00000000 : win32k!GreSfmCloseCompositorRef+0x10f
fffff880`0ba93ba0 fffff800`02e79153 : fffffa80`088f8b60 fffff880`0ba93ca0 00000000`000000f0 fffffa80`088f75e0 : win32k!NtGdiHLSurfSetInformation+0x1a8
fffff880`0ba93c20 000007fe`fe404efa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`037af1c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fe404efa

STACK_COMMAND:  kb
FOLLOWUP_IP: 
win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
fffff960`0036c69d 488b4f20        mov     rcx,qword ptr [rdi+20h]
SYMBOL_STACK_INDEX:  3
SYMBOL_NAME:  win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: win32k
IMAGE_NAME:  [COLOR=red]win32k.sys[/COLOR]
DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0
IMAGE_VERSION:  6.1.7600.16385
FAILURE_BUCKET_ID:  X64_0x50_win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
BUCKET_ID:  X64_0x50_win32k!SFMLOGICALSURFACE::OwnsSurfaceCleanup+2d
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:x64_0x50_win32k!sfmlogicalsurface::ownssurfacecleanup+2d
FAILURE_ID_HASH:  {422c0597-aeb5-515f-65d6-15149510f84c}
Followup: MachineOwner

I will await your reply before we go any further because if you bought this copy other than a genuine retail or OEM then I would suspect it might be counterfeit.

 

[hatemf23]

Hi again,

It was a cheap copy that I bought, most likely not original, and SP1 isnt included with it, most of the time I update manually but this time I forgot. Is this going to be a problem?

 

[ICIT2LOL]

Yep well you can always check using the validation feature Genuine Windows - Windows Help but I don't hold much hope that it is anything but a counterfeit mate - sorry.

If you know the seller then I suppose you can always go back for your money and let them know it is a counterfeit or at very best a non genuine Windows copy.

If you continue with it because of it likely not to be genuine then things like being flagged by Microsoft, have problems like this happen a lot of the time and generally have a miserable time trying to fix things up.
The SP1 is absolutely necessary for the proper function of the system and I think if I a not terribly wrong will eventually end up with a system that will not function correctly.

My advice is to get hold of an OEM if you can or buy a key from a genuine source and use a download or this tutorial to install 7 http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html read the part regarding the ei.cfg removal tool. It is something you can use if you know a friend or relative who has a Windows DVD.
Anyway the choice is yours I know what I would do because it is not worth the grief.

 

[hatemf23]

Thanks I will do that soon, as for this BSOD, I was hoping it would point out to a hardware fault, OC related or not, maybe take another look at it? I doubt that a windows installation would BSOD/malfunction because its not genuine.

Also it would help me alot to do a fresh install on stable hardware.

 

[ICIT2LOL]

I agree that a fresh install and using a genuine copy would be the way to go. Now you are doubting if the non genuine software would affect the system.

Well for one thing if the system is non genuine how sure would you be that the correct drivers for example would be loaded? the system without SP1 again is not going to let you install updates as is needed. Agreed the hard ware may have problems but I don't see the point of chasing them down when as I said earlier the drivers cannot be loaded properly.

So personally I would go with a new copy of 7 it really is the only way.

Now there are several ways of doing this
1. Get an OEM or retail copy
2. Buy a key direct from Microsoft and use this tutorial http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html and as in the tutorial if you have a friend with a genuine DVD of Windows you can use that with the key or activation code you get. This is because very DVD has all the versions of Windows on it and you use the ei.cfg removal tool to let you get the version you need.
3. You could try the market again but with 7 it is getting progressively more difficult to find a copy.