NEW PC HARDWARE BSODS - minidumps in

[Wallonn7]

You may want to remove Avast. Uninstall it using Programs and Features, and run its cleanup utility: http://files.avast.com/files/eng/aswclear5.exe

Then download and install Microsoft Security Essentials.

Why?! Avast was the guilty?!

 

[zigzag3143]

Let's start from beginning:
BSODs happens this way: as today, I turn pc on and use it 'till 2pm - turn it off and the no break too. At 3h32pm I turn it on and there comes another BSOD. System restarts and normally, no safe mode. And here I'm. I could use pc all day long, play games, do everything and it won't crash... but, if I turn it off and turn it on later, I'll probably face a BSOD. All drivers are up-to-date.
I really need to discover what's going on here, please!!!

This was probably caused by pool corruption (memory), but I did notice aswmonflt.sys (Your avast AV) was loaded at the time.

I would test the memory by downloading memtestx86 and running it for at least 5 passes.

I would also un-install avast and install MSE in its place

Let us know if you need help with it

Ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042810-21715-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c67000 PsLoadedModuleList = 0xfffff800`02ea4e50
Debug session time: Wed Apr 28 14:31:38.208 2010 (GMT-4)
System Uptime: 0 days 0:00:45.504
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa800397daa0, fffbfa800397daa0, fffffa800397daa0}

Unable to load image aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800397daa0, the pool entry being checked.
Arg3: fffbfa800397daa0, the read back flink freelist value (should be the same as 2).
Arg4: fffffa800397daa0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  CCC.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002e0ad6f to fffff80002cd7600

STACK_TEXT:  
fffff880`0a155688 fffff800`02e0ad6f : 00000000`00000019 00000000`00000003 fffffa80`0397daa0 fffbfa80`0397daa0 : nt!KeBugCheckEx
fffff880`0a155690 fffff800`02cff8f4 : 00000000`00000000 fffffa80`07d18f90 00000000`00000008 00000000`00000000 : nt!ExFreePool+0x536
fffff880`0a155780 fffff800`02d00e14 : fffffa80`04645200 00000000`00000040 fffff6fc`c0083800 fffff880`0a155880 : nt!MiAddViewsForSection+0x1d4
fffff880`0a155810 fffff800`02d002d7 : fffff8a0`02b57eb0 fffff880`02f64830 fffff880`0a1559b8 fffff8a0`0237d8e0 : nt!MmMapViewInSystemCache+0x194
fffff880`0a155980 fffff800`02cf6170 : fffff980`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcGetVacbMiss+0x177
fffff880`0a155a40 fffff800`02ff58d2 : 00000000`00000000 00000000`00000000 fffff880`0a155b10 fffff880`0a155ba0 : nt!CcGetVirtualAddress+0x1b0
fffff880`0a155ad0 fffff880`01219fc0 : fffff8a0`00000000 00000000`00000005 fffffa80`07d15420 fffff880`0126d001 : nt!CcCopyRead+0x132
fffff880`0a155b90 fffff880`0121e303 : 00000000`00000000 fffff8a0`02b59140 fffff880`0a155dc0 00000000`00000001 : Ntfs!NtfsCachedRead+0x180
fffff880`0a155bf0 fffff880`01220f78 : fffffa80`07d15420 fffff980`150f6c10 fffff880`0a155d01 fffffa80`06400000 : Ntfs!NtfsCommonRead+0x583
fffff880`0a155d90 fffff800`0317dc16 : fffff980`150f6c10 fffff980`150f6c10 fffffa80`06400030 fffffa80`07cab2a0 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0a155e40 fffff880`0111523f : fffff980`150f6fb0 fffff880`0a155ee0 fffffa80`077e48c0 fffffa80`07cab2a0 : nt!IovCallDriver+0x566
fffff880`0a155ea0 fffff880`0111794a : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`077e48c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0a155f30 fffff880`01124204 : fffffa80`07225020 00000000`00000019 fffffa80`05995800 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`0a155fd0 fffff880`011543b6 : fffffa80`07d18010 fffff880`0a1561e0 00000000`00000400 00000000`00000004 : fltmgr!FltReadFile+0x334
fffff880`0a1560b0 fffff880`06bc4cf7 : 00000000`00000000 fffff880`0a156180 fffffa80`0722b9e0 fffffa80`07ba97d0 : fltmgr!FltvReadFile+0xa6
fffff880`0a156120 00000000`00000000 : fffff880`0a156180 fffffa80`0722b9e0 fffffa80`07ba97d0 fffffa80`07d18010 : aswMonFlt+0x2cf7


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+536
fffff800`02e0ad6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+536

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

Followup: Pool_corruption
---------

 

[Wallonn7]

Let's start from beginning:
BSODs happens this way: as today, I turn pc on and use it 'till 2pm - turn it off and the no break too. At 3h32pm I turn it on and there comes another BSOD. System restarts and normally, no safe mode. And here I'm. I could use pc all day long, play games, do everything and it won't crash... but, if I turn it off and turn it on later, I'll probably face a BSOD. All drivers are up-to-date.
I really need to discover what's going on here, please!!!

This was probably caused by pool corruption (memory), but I did notice aswmonflt.sys (Your avast AV) was loaded at the time.

I would test the memory by downloading memtestx86 and running it for at least 5 passes.

I would also un-install avast and install MSE in its place

Let us know if you need help with it

Ken

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042810-21715-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c67000 PsLoadedModuleList = 0xfffff800`02ea4e50
Debug session time: Wed Apr 28 14:31:38.208 2010 (GMT-4)
System Uptime: 0 days 0:00:45.504
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffffa800397daa0, fffbfa800397daa0, fffffa800397daa0}

Unable to load image aswMonFlt.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswMonFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for aswMonFlt.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+536 )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffffa800397daa0, the pool entry being checked.
Arg3: fffbfa800397daa0, the read back flink freelist value (should be the same as 2).
Arg4: fffffa800397daa0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  CCC.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002e0ad6f to fffff80002cd7600

STACK_TEXT:  
fffff880`0a155688 fffff800`02e0ad6f : 00000000`00000019 00000000`00000003 fffffa80`0397daa0 fffbfa80`0397daa0 : nt!KeBugCheckEx
fffff880`0a155690 fffff800`02cff8f4 : 00000000`00000000 fffffa80`07d18f90 00000000`00000008 00000000`00000000 : nt!ExFreePool+0x536
fffff880`0a155780 fffff800`02d00e14 : fffffa80`04645200 00000000`00000040 fffff6fc`c0083800 fffff880`0a155880 : nt!MiAddViewsForSection+0x1d4
fffff880`0a155810 fffff800`02d002d7 : fffff8a0`02b57eb0 fffff880`02f64830 fffff880`0a1559b8 fffff8a0`0237d8e0 : nt!MmMapViewInSystemCache+0x194
fffff880`0a155980 fffff800`02cf6170 : fffff980`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcGetVacbMiss+0x177
fffff880`0a155a40 fffff800`02ff58d2 : 00000000`00000000 00000000`00000000 fffff880`0a155b10 fffff880`0a155ba0 : nt!CcGetVirtualAddress+0x1b0
fffff880`0a155ad0 fffff880`01219fc0 : fffff8a0`00000000 00000000`00000005 fffffa80`07d15420 fffff880`0126d001 : nt!CcCopyRead+0x132
fffff880`0a155b90 fffff880`0121e303 : 00000000`00000000 fffff8a0`02b59140 fffff880`0a155dc0 00000000`00000001 : Ntfs!NtfsCachedRead+0x180
fffff880`0a155bf0 fffff880`01220f78 : fffffa80`07d15420 fffff980`150f6c10 fffff880`0a155d01 fffffa80`06400000 : Ntfs!NtfsCommonRead+0x583
fffff880`0a155d90 fffff800`0317dc16 : fffff980`150f6c10 fffff980`150f6c10 fffffa80`06400030 fffffa80`07cab2a0 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0a155e40 fffff880`0111523f : fffff980`150f6fb0 fffff880`0a155ee0 fffffa80`077e48c0 fffffa80`07cab2a0 : nt!IovCallDriver+0x566
fffff880`0a155ea0 fffff880`0111794a : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`077e48c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0a155f30 fffff880`01124204 : fffffa80`07225020 00000000`00000019 fffffa80`05995800 00000000`00000000 : fltmgr!FltPerformSynchronousIo+0x2ca
fffff880`0a155fd0 fffff880`011543b6 : fffffa80`07d18010 fffff880`0a1561e0 00000000`00000400 00000000`00000004 : fltmgr!FltReadFile+0x334
fffff880`0a1560b0 fffff880`06bc4cf7 : 00000000`00000000 fffff880`0a156180 fffffa80`0722b9e0 fffffa80`07ba97d0 : fltmgr!FltvReadFile+0xa6
fffff880`0a156120 00000000`00000000 : fffff880`0a156180 fffffa80`0722b9e0 fffffa80`07ba97d0 fffffa80`07d18010 : aswMonFlt+0x2cf7


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+536
fffff800`02e0ad6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+536

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+536

Followup: Pool_corruption
---------

I'll follow your advices. How about BSODs MO - modus operandi?!

 

[Wallonn7]

One more BSOD... is it news?! I don't think so... Same BSOD M.O.: turn pc off for few hours; turn it on and...
Can anybody take a look at minidump, please?!

 

[zigzag3143]

I do notice in the last three DMP's the CCC.exe (the catalyst control panel) was loaded. Did you completely remove the old driver before reinstalling the new one?


Ken

 

[Wallonn7]

I do notice in the last three DMP's the CCC.exe (the catalyst control panel) was loaded. Did you completely remove the old driver before reinstalling the new one?


Ken

No... I install it one upon another... Should I uninstall each mobo driver before update it?!

Thanks for helping!!!

 

[zigzag3143]

I do notice in the last three DMP's the CCC.exe (the catalyst control panel) was loaded. Did you completely remove the old driver before reinstalling the new one?


Ken

No... I install it one upon another... Should I uninstall each mobo driver before update it?!

Thanks for helping!!!

You need to go to your video drivers site and find their un-install tool. use it to remove everything, and just install the driver back, not the control panel, etc.

 

[Wallonn7]

All ATI components were removed. Driver Sweeper under Safe Mode. Reinstall JUST video driver. Three boot ups towards this process, as required. Turn pc off. Turn it on one hour later... what happened?!...

 

[zigzag3143]

All ATI components were removed. Driver Sweeper under Safe Mode. Reinstall JUST video driver. Three boot ups towards this process, as required. Turn pc off. Turn it on one hour later... what happened?!...

Nothing has changed. there is almost nothing in this dmp to help you. This particular bug check is Usual causes: System service, Device driver, graphics driver, ?memory.

We have asked you to test the memory, to run a system file check.

If you are overclocking stop

then if you still have them you are going to need to run driver verifier. before you do you will need to have a restore point and a backup, plus a win 7 dvd.

Let us know when you have them.

Ken

 

[Wallonn7]

All ATI components were removed. Driver Sweeper under Safe Mode. Reinstall JUST video driver. Three boot ups towards this process, as required. Turn pc off. Turn it on one hour later... what happened?!...

Nothing has changed. there is almost nothing in this dmp to help you. This particular bug check is Usual causes: System service, Device driver, graphics driver, ?memory.

We have asked you to test the memory, to run a system file check.

If you are overclocking stop

then if you still have them you are going to need to run driver verifier. before you do you will need to have a restore point and a backup, plus a win 7 dvd.

Let us know when you have them.

Ken

I'll test memory tomorrow.

Sfc /scannow begins and suddenly goes to 78% ( ?! )... and found no problem - as you may see at attachment.

No O.C.. I've just rise ram voltage to 1.515v, 'cause at defaults 1.500v, BIOS shows 1.488v. After rise to 1.515v, BIOS shows 1.505v now.

Driver Verifier is running since post #13, or yesterday tonight. All latest BSODs came under Driver Verifier running.

Thanks a lot for helping!

 

[zigzag3143]

All ATI components were removed. Driver Sweeper under Safe Mode. Reinstall JUST video driver. Three boot ups towards this process, as required. Turn pc off. Turn it on one hour later... what happened?!...

Nothing has changed. there is almost nothing in this dmp to help you. This particular bug check is Usual causes: System service, Device driver, graphics driver, ?memory.

We have asked you to test the memory, to run a system file check.

If you are overclocking stop

then if you still have them you are going to need to run driver verifier. before you do you will need to have a restore point and a backup, plus a win 7 dvd.

Let us know when you have them.

Ken

I'll test memory tomorrow.

Sfc /scannow begins and suddenly goes to 78% ( ?! )... and found no problem - as you may see at attachment.

No O.C.. I've just rise ram voltage to 1.515v, 'cause at defaults 1.500v, BIOS shows 1.488v. After rise to 1.515v, BIOS shows 1.505v now.

Driver Verifier is running since post #13, or yesterday tonight. All latest BSODs came under Driver Verifier running.

Thanks a lot for helping!

Yoou should give us the CBS.log file created from sfc /scannow

 

[Wallonn7]

Here is CBS:

 

[zigzag3143]

Here is CBS:

When it finished did it say it found errors and fixed them, found errors and couldnt fix them, or didnt find any errors?

 

[Wallonn7]

Here is CBS:

When it finished did it say it found errors and fixed them, found errors and couldnt fix them, or didnt find any errors?

Found no errors - this under CMD.

 

[zigzag3143]

Here is CBS:

When it finished did it say it found errors and fixed them, found errors and couldnt fix them, or didnt find any errors?

Found no errors - this under CMD.

For what ever reason something is causing these. We have thrown the entire book at you and yet they still happen. Something must be amiss. You must be at default, nothing overclocked, under volted, etc. Start pulling off pieces of hardware till just the key boear, mouse, monitor, and mobo, are connected.

Also do me a favor and post the answers so if someone else comes along they will know what is going on.

Ken

 

[Wallonn7]

When it finished did it say it found errors and fixed them, found errors and couldnt fix them, or didnt find any errors?

Found no errors - this under CMD.

For what ever reason something is causing these. We have thrown the entire book at you and yet they still happen. Something must be amiss. You must be at default, nothing overclocked, under volted, etc. Start pulling off pieces of hardware till just the key boear, mouse, monitor, and mobo, are connected.

Also do me a favor and post the answers so if someone else comes along they will know what is going on.

Ken

Sorry about didn't post the answers...
I'll do everything you saying and let you know the results... but just tomorrow 'cause I'm going to sleep right know...

Thanks for dedication and patience!!

 

[Wallonn7]

Ok. Last tonight before sleep:
BIOS was set to defaults. RAM Timings are 9-9-9-24 now. By G.Skill spec they should be: 7-7-7-21.
CPU-Z and Everest shows DRAM frequency "671.3MHz"?! Is that normal?!
I pulled one from two ram modules off.
In this morning I turn pc on. everything runs fine. Turn it off. After I came back from job, I turn it on and at the desktop, "explorer.exe" stop working and it closes. At Task Manager, I tried to restart it... Task Manager freezes and BSOD - CACHE_MANAGER. Restart Windows wihout problems, what's normal at "my" BSODs context. Now I'll try another RAM module.
Is normal "sfc /scanow" shows 78% and report it ends and found no errors?! And why "sfc /verifyonly" says it "cannot execute solicited operation"?!
Until next report!

 

[zigzag3143]

Ok. Last tonight before sleep:
BIOS was set to defaults. RAM Timings are 9-9-9-24 now. By G.Skill spec they should be: 7-7-7-21.
CPU-Z and Everest shows DRAM frequency "671.3MHz"?! Is that normal?!
I pulled one from two ram modules off.
In this morning I turn pc on. everything runs fine. Turn it off. After I came back from job, I turn it on and at the desktop, "explorer.exe" stop working and it closes. At Task Manager, I tried to restart it... Task Manager freezes and BSOD - CACHE_MANAGER. Restart Windows wihout problems, what's normal at "my" BSODs context. Now I'll try another RAM module.
Is normal "sfc /scanow" shows 78% and report it ends and found no errors?! And why "sfc /verifyonly" says it "cannot execute solicited operation"?!
Until next report!

No it is not normal. At some point you need to start thinking about a clean re-install. There is obviously something wrong with either your hardware, or software.


This last one was definative. Memory Corruption


see below

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042910-20202-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Thu Apr 29 09:16:46.731 2010 (GMT-4)
System Uptime: 0 days 0:04:38.011
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50830, fffff880031564f8, fffff88003155d60, fffff80002cf763a}

Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+ca )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880031564f8
Arg3: fffff88003155d60
Arg4: fffff80002cf763a

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031564f8 -- (.exr 0xfffff880031564f8)
ExceptionAddress: fffff80002cf763a (nt!MmUnmapViewInSystemCache+0x00000000000000ca)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003155d60 -- (.cxr 0xfffff88003155d60)
rax=fffbf8a0029dc370 rbx=fffffa80018e9680 rcx=0000000000000000
rdx=0000000fffffffff rsi=fffff8a0029e08b0 rdi=fffff6fcc0063600
rip=fffff80002cf763a rsp=fffff88003156730 rbp=0000000000000000
 r8=0000000000000000  r9=fffff9800c6c0000 r10=fffffa800504e098
r11=fffff88003156ad8 r12=0000000000000000 r13=0000000000000000
r14=fffffa8000325350 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!MmUnmapViewInSystemCache+0xca:
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax] ds:002b:fffbf8a0`029dc370=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

FAULTING_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff80002fe5155 to fffff80002cf763a

STACK_TEXT:  
fffff880`03156730 fffff800`02fe5155 : fffff980`0c6c0000 fffff8a0`029e08b0 00000000`00000000 00000000`00000000 : nt!MmUnmapViewInSystemCache+0xca
fffff880`03156a10 fffff800`02ce6447 : 00000000`00000000 fffffa80`018b1300 00000000`00000000 00000000`00100000 : nt!CcUnmapVacb+0x5d
fffff880`03156a50 fffff800`02cbd174 : 00000000`00000001 fffffa80`055f7640 fffffa80`0541d300 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`03156ae0 fffff800`02cc0c1c : fffffa80`0541d340 fffff880`041946ff fffffa80`0541d340 fffffa80`018e9600 : nt!CcDeleteSharedCacheMap+0x140
fffff880`03156b50 fffff800`02cc141c : fffff880`041abd00 fffff880`03156c58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`03156c00 fffff800`02cda861 : fffffa80`018ec4f0 fffff800`02cc1254 fffff800`02ed4140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8
fffff880`03156cb0 fffff800`02f72a86 : 00000000`00000000 fffffa80`018e9680 00000000`00000080 fffffa80`018ca040 : nt!ExpWorkerThread+0x111
fffff880`03156d40 fffff800`02cabb06 : fffff880`02f64180 fffffa80`018e9680 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03156d80 00000000`00000000 : fffff880`03157000 fffff880`03151000 fffff880`03155c60 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmUnmapViewInSystemCache+ca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88003155d60 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

Followup: MachineOwner
---------

 

[Wallonn7]

Ok. Last tonight before sleep:
BIOS was set to defaults. RAM Timings are 9-9-9-24 now. By G.Skill spec they should be: 7-7-7-21.
CPU-Z and Everest shows DRAM frequency "671.3MHz"?! Is that normal?!
I pulled one from two ram modules off.
In this morning I turn pc on. everything runs fine. Turn it off. After I came back from job, I turn it on and at the desktop, "explorer.exe" stop working and it closes. At Task Manager, I tried to restart it... Task Manager freezes and BSOD - CACHE_MANAGER. Restart Windows wihout problems, what's normal at "my" BSODs context. Now I'll try another RAM module.
Is normal "sfc /scanow" shows 78% and report it ends and found no errors?! And why "sfc /verifyonly" says it "cannot execute solicited operation"?!
Until next report!

No it is not normal. At some point you need to start thinking about a clean re-install. There is obviously something wrong with either your hardware, or software.


This last one was definative. Memory Corruption


see below

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042910-20202-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Thu Apr 29 09:16:46.731 2010 (GMT-4)
System Uptime: 0 days 0:04:38.011
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50830, fffff880031564f8, fffff88003155d60, fffff80002cf763a}

Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+ca )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880031564f8
Arg3: fffff88003155d60
Arg4: fffff80002cf763a

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031564f8 -- (.exr 0xfffff880031564f8)
ExceptionAddress: fffff80002cf763a (nt!MmUnmapViewInSystemCache+0x00000000000000ca)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003155d60 -- (.cxr 0xfffff88003155d60)
rax=fffbf8a0029dc370 rbx=fffffa80018e9680 rcx=0000000000000000
rdx=0000000fffffffff rsi=fffff8a0029e08b0 rdi=fffff6fcc0063600
rip=fffff80002cf763a rsp=fffff88003156730 rbp=0000000000000000
 r8=0000000000000000  r9=fffff9800c6c0000 r10=fffffa800504e098
r11=fffff88003156ad8 r12=0000000000000000 r13=0000000000000000
r14=fffffa8000325350 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!MmUnmapViewInSystemCache+0xca:
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax] ds:002b:fffbf8a0`029dc370=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

FAULTING_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff80002fe5155 to fffff80002cf763a

STACK_TEXT:  
fffff880`03156730 fffff800`02fe5155 : fffff980`0c6c0000 fffff8a0`029e08b0 00000000`00000000 00000000`00000000 : nt!MmUnmapViewInSystemCache+0xca
fffff880`03156a10 fffff800`02ce6447 : 00000000`00000000 fffffa80`018b1300 00000000`00000000 00000000`00100000 : nt!CcUnmapVacb+0x5d
fffff880`03156a50 fffff800`02cbd174 : 00000000`00000001 fffffa80`055f7640 fffffa80`0541d300 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`03156ae0 fffff800`02cc0c1c : fffffa80`0541d340 fffff880`041946ff fffffa80`0541d340 fffffa80`018e9600 : nt!CcDeleteSharedCacheMap+0x140
fffff880`03156b50 fffff800`02cc141c : fffff880`041abd00 fffff880`03156c58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`03156c00 fffff800`02cda861 : fffffa80`018ec4f0 fffff800`02cc1254 fffff800`02ed4140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8
fffff880`03156cb0 fffff800`02f72a86 : 00000000`00000000 fffffa80`018e9680 00000000`00000080 fffffa80`018ca040 : nt!ExpWorkerThread+0x111
fffff880`03156d40 fffff800`02cabb06 : fffff880`02f64180 fffffa80`018e9680 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03156d80 00000000`00000000 : fffff880`03157000 fffff880`03151000 fffff880`03155c60 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmUnmapViewInSystemCache+ca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88003155d60 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

Followup: MachineOwner
---------

I'll try the other ram memory... report it later!!!

Thanks one more time for the support!!!

 

[zigzag3143]

Ok. Last tonight before sleep:
BIOS was set to defaults. RAM Timings are 9-9-9-24 now. By G.Skill spec they should be: 7-7-7-21.
CPU-Z and Everest shows DRAM frequency "671.3MHz"?! Is that normal?!
I pulled one from two ram modules off.
In this morning I turn pc on. everything runs fine. Turn it off. After I came back from job, I turn it on and at the desktop, "explorer.exe" stop working and it closes. At Task Manager, I tried to restart it... Task Manager freezes and BSOD - CACHE_MANAGER. Restart Windows wihout problems, what's normal at "my" BSODs context. Now I'll try another RAM module.
Is normal "sfc /scanow" shows 78% and report it ends and found no errors?! And why "sfc /verifyonly" says it "cannot execute solicited operation"?!
Until next report!

No it is not normal. At some point you need to start thinking about a clean re-install. There is obviously something wrong with either your hardware, or software.


This last one was definative. Memory Corruption


see below

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\042910-20202-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02c5d000 PsLoadedModuleList = 0xfffff800`02e9ae50
Debug session time: Thu Apr 29 09:16:46.731 2010 (GMT-4)
System Uptime: 0 days 0:04:38.011
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50830, fffff880031564f8, fffff88003155d60, fffff80002cf763a}

Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+ca )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880031564f8
Arg3: fffff88003155d60
Arg4: fffff80002cf763a

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031564f8 -- (.exr 0xfffff880031564f8)
ExceptionAddress: fffff80002cf763a (nt!MmUnmapViewInSystemCache+0x00000000000000ca)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003155d60 -- (.cxr 0xfffff88003155d60)
rax=fffbf8a0029dc370 rbx=fffffa80018e9680 rcx=0000000000000000
rdx=0000000fffffffff rsi=fffff8a0029e08b0 rdi=fffff6fcc0063600
rip=fffff80002cf763a rsp=fffff88003156730 rbp=0000000000000000
 r8=0000000000000000  r9=fffff9800c6c0000 r10=fffffa800504e098
r11=fffff88003156ad8 r12=0000000000000000 r13=0000000000000000
r14=fffffa8000325350 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010287
nt!MmUnmapViewInSystemCache+0xca:
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax] ds:002b:fffbf8a0`029dc370=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

FAULTING_IP: 
nt!MmUnmapViewInSystemCache+ca
fffff800`02cf763a 4c8b18          mov     r11,qword ptr [rax]

BUGCHECK_STR:  0x34

LAST_CONTROL_TRANSFER:  from fffff80002fe5155 to fffff80002cf763a

STACK_TEXT:  
fffff880`03156730 fffff800`02fe5155 : fffff980`0c6c0000 fffff8a0`029e08b0 00000000`00000000 00000000`00000000 : nt!MmUnmapViewInSystemCache+0xca
fffff880`03156a10 fffff800`02ce6447 : 00000000`00000000 fffffa80`018b1300 00000000`00000000 00000000`00100000 : nt!CcUnmapVacb+0x5d
fffff880`03156a50 fffff800`02cbd174 : 00000000`00000001 fffffa80`055f7640 fffffa80`0541d300 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`03156ae0 fffff800`02cc0c1c : fffffa80`0541d340 fffff880`041946ff fffffa80`0541d340 fffffa80`018e9600 : nt!CcDeleteSharedCacheMap+0x140
fffff880`03156b50 fffff800`02cc141c : fffff880`041abd00 fffff880`03156c58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`03156c00 fffff800`02cda861 : fffffa80`018ec4f0 fffff800`02cc1254 fffff800`02ed4140 fffffa80`00000003 : nt!CcWorkerThread+0x1c8
fffff880`03156cb0 fffff800`02f72a86 : 00000000`00000000 fffffa80`018e9680 00000000`00000080 fffffa80`018ca040 : nt!ExpWorkerThread+0x111
fffff880`03156d40 fffff800`02cabb06 : fffff880`02f64180 fffffa80`018e9680 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03156d80 00000000`00000000 : fffff880`03157000 fffff880`03151000 fffff880`03155c60 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmUnmapViewInSystemCache+ca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88003155d60 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

BUCKET_ID:  X64_0x34_nt!MmUnmapViewInSystemCache+ca

Followup: MachineOwner
---------

I'll try the other ram memory... report it later!!!

Thanks one more time for the support!!!

No problem thats why we are here.

Ken