Random, Regular BSOD - need help analysing

[sambomartin]

Hi all,

I have recently started to get random BSODs - 5 year old dell, no hardware changes and no deliberate changes to drivers etc out side of standard windows updates.

• SFC ok
• CHKDSK Analysis ok
• memory check ok

This is my Crash Dump Analysis, can anyone give me any pointers?

Thanks in advance!
Sam

=============================
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02a0b000 PsLoadedModuleList = 0xfffff800`02c4e6d0
Debug session time: Thu Apr 3 19:31:36.655 2014 (UTC - 4:00)
System Uptime: 0 days 10:52:55.363
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa80077bd820, Terminating object
Arg3: fffffa80077bdb00, Process image file name
Arg4: fffff80002d857b0, Explanatory message (ascii)

Debugging Details:
------------------

----- ETW minidump data unavailable-----TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

PROCESS_OBJECT: fffffa80077bd820

IMAGE_NAME: wininit.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: wininit

FAULTING_MODULE: 0000000000000000

PROCESS_NAME: wininit.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_fffff800c0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

CURRENT_IRQL: 0

STACK_TEXT:
fffff880`081890e8 fffff800`02e0eab2 : 00000000`000000f4 00000000`00000003 fffffa80`077bd820 fffffa80`077bdb00 : nt!KeBugCheckEx
fffff880`081890f0 fffff800`02db9abb : ffffffff`ffffffff fffffa80`0f408280 fffffa80`077bd820 fffffa80`077bd820 : nt!PspCatchCriticalBreak+0x92
fffff880`08189130 fffff800`02d39674 : ffffffff`ffffffff 00000000`00000001 fffffa80`077bd820 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17486
fffff880`08189180 fffff800`02a7fe53 : fffffa80`077bd820 fffff800`c0000005 fffffa80`0f408280 00000000`00cc06d0 : nt!NtTerminateProcess+0xf4
fffff880`08189200 fffff800`02a7c410 : fffff800`02acb82f fffff880`08189b78 fffff880`081898d0 fffff880`08189c20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08189398 fffff800`02acb82f : fffff880`08189b78 fffff880`081898d0 fffff880`08189c20 00000000`76ec94f8 : nt!KiServiceLinkage
fffff880`081893a0 fffff800`02a80242 : fffff880`08189b78 00000000`00d40000 fffff880`08189c20 00000000`76ed5600 : nt! ?? ::FNODOBFM::`string'+0x488e4
fffff880`08189a40 fffff800`02a7edba : 00000000`00000001 00000000`00cc0c88 00000000`00cc8b01 00000000`00d40000 : nt!KiExceptionDispatch+0xc2
fffff880`08189c20 00000000`76ef8e5d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`00cc0c90 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ef8e5d


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0xF4_fffff800c0000005_IMAGE_wininit.exe

BUCKET_ID: X64_0xF4_fffff800c0000005_IMAGE_wininit.exe

Followup: MachineOwner
---------

 

[Thedoctor44]

You said "memory check ok" what memory check did you use? You have memory corruption which generally points to faulty RAM. Please run memtest86 for at least 8 passes. Follow these instructions.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {fffff6fc40006130, ffffffffc000000e, 9bf8c860, fffff88000c26260}

*** WARNING: Unable to verify checksum for win32k.sys
GetPointerFromAddress: unable to read from fffff80002caf278
[COLOR="Red"]Probably caused by : memory_corruption[/COLOR]

 

[sambomartin]

memtest, window tool when loading

can you tell from logs what driver is raising the exception?

thanks

 

[Thedoctor44]

You should run it for at least 8 passes.
Yes you can see which driver is causing the fault. It is generally locate in the thread stack.