Solved Several BSOD a day, The bugcheck was: 0x0000001e

[Lauren17]

Hi all,
This has been an ongoing battle for about 2 weeks. I have reformatted and re-installed windows at least 4 times. re-flashed my BIOS. At first it was freezing while attempting to go into sleep mode...I believe that is fixed... Now it freezes even while in games. I have even run check disk on the HDD a few times as well. I am this close to chalking this to a bad HDD and buying a new one...Could someone please take a look and confirm? I also am aware I have several hosts file errors too...but I don't know if that's part of it or something else entirety. I would be so grateful for any incite.

x86 (32-bit) or x64 ?
- the original installed OS on the system? Windows 7 professional 64 bit
- an OEM or full retail version? OEM
- What is the age of system (hardware)? a little over a year
- What is the age of OS installation (have you re-installed the OS?) yes and about a week

Thank You,
Lauren

 

[zigzag3143]

If you think it is a HD run chkdsk

A- CHKDSK /R /F:

Run CHKDSK /R /F from an elevated (Run as administrator) Command Prompt.

Do this for each hard drive on your system.

When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter.

Then reboot and let the test run.

It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors.

See "CHKDSK LogFile" below in order to check the results of the test.

B- Elevated Command Prompt:

Go to Start and type in "cmd.exe" (without the quotes)

At the top of the Search Box, right click on Cmd.exe and select "Run as administrator"

C-CHKDSK LogFile:

Go to Start and type in "eventvwr.msc" (without the quotes) and press Enter

Expand the Windows logs heading, then select the Application log file entry.

Double click on the Source column header.

Scroll down the list until you find the Chkdsk entry (wininit for Win7) (winlogon for XP).

Copy/paste the results into your next post.

Just to be sure I would also download malwarebytes and run a scan.

Please download the free version of Malwarebytes.
Update it immediately.
Do a full system scan
Let us know the results at the end.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!





These crashes were caused by memory corruption/exception (probably a driver).
Please run these two tests to verify your memory and find which driver is causing the problem.

* If you are overclocking anything reset to default before running these tests.
In other words STOP!!!

* If you have raid update its Driver.



Memtest.

*Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Memtest86+ - Advanced Memory Diagnostic Tool

*Boot from the CD, and leave it running for at least 5 or 6 passes.

Just remember, any time Memtest reports errors, it can be either bad RAM or a bad motherboard slot.

Test the sticks individually, and if you find a good one, test it in all slots.

Any errors are indicative of a memory problem.

If a known good stick fails in a motherboard slot it is probably the slot.

http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html



Driver verifier

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Special Pool", "Force Pending I/O Requests" and "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen.
Continue to use your system normally, and if you know what causes the crash, do that repeatedly.
The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.
If it doesn't crash for you, then let it run for at least 36 hours of continuous operation.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.

 

[Lauren17]

Hi,
Here is the result of the check disk I ran 2 days ago. When I boot into windows I now receive several pop ups "Log.iniis" Attached is an example of that. Also I have downloaded and ran Malwarebytes and it only found 1 object which is my PDF creator. I don't think that is the issue but i removed it anyways. Attached is that file as well. Also yesterday I decided to uninstall my display drivers and re-install them just to see if that might be the issue.

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
163584 file records processed. File verification completed.
572 large file records processed. 0 bad file records processed. 2 EA records processed. 76 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
217486 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
163584 file SDs/SIDs processed. Cleaning up 198 unused index entries from index $SII of file 0x9.
Cleaning up 198 unused index entries from index $SDH of file 0x9.
Cleaning up 198 unused security descriptors.
Security descriptor verification completed.
26952 data files processed. CHKDSK is verifying Usn Journal...
35061712 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc000009c at offset 0x3c0fd2000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3c0fd9000 for 0x1000 bytes.
Read failure with status 0xc000009c at offset 0x3c101a000 for 0x10000 bytes.
Read failure with status 0xc000009c at offset 0x3c1027000 for 0x1000 bytes.
Windows replaced bad clusters in file 104926
of name \Windows\System32\DRIVER~1\FILERE~1\NV_DIS~3.INF\nvoglv32.dll.
163568 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
145305142 free clusters processed. Free space verification is complete.
Adding 2 bad clusters to the Bad Clusters File.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

976657407 KB total disk space.
395079044 KB in 91569 files.
63288 KB in 26953 indexes.
8 KB in bad sectors.
294495 KB in use by the system.
65536 KB occupied by the log file.
581220572 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
145305143 allocation units available on disk.

Internal Info:
00 7f 02 00 05 cf 01 00 2e 69 03 00 00 00 00 00 .........i......
02 13 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[zigzag3143]

OK so there were errors in the file system and they were repaired. Are you still crashing?

 

[Lauren17]

Hi,
Sadly I left my game running and walked away from the computer when I came back maybe 15 min later is was frozen on the MB logo screen. I have attached a new DMP file.

 

[zigzag3143]

Hi,
Sadly I left my game running and walked away from the computer when I came back maybe 15 min later is was frozen on the MB logo screen. I have attached a new DMP file.

No dmp files included in upload

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[Lauren17]

Ok, sorry for the delay. I actually ran Western Digital diags on my HDD and it failed the extended test. I returned the HDD under warenty and got a new one. Now 3 days with the replacement...I am BSOD constantly when I run SWTOR. I cant even stay in the game 10min. attached is a new mini dump with the health report.

Thanks !

 

[Lauren17]

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
163072 file records processed. File verification completed.
515 large file records processed. 0 bad file records processed. 2 EA records processed. 60 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
221018 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
163072 file SDs/SIDs processed. Cleaning up 535 unused index entries from index $SII of file 0x9.
Cleaning up 535 unused index entries from index $SDH of file 0x9.
Cleaning up 535 unused security descriptors.
Security descriptor verification completed.
28974 data files processed. CHKDSK is verifying Usn Journal...
37324264 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
163056 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
226981279 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

976657407 KB total disk space.
68341724 KB in 123951 files.
94112 KB in 28975 indexes.
0 KB in bad sectors.
296451 KB in use by the system.
65536 KB occupied by the log file.
907925120 KB available on disk.

4096 bytes in each allocation unit.
244164351 total allocation units on disk.
226981280 allocation units available on disk.

Internal Info:
00 7d 02 00 69 55 02 00 72 7d 04 00 00 00 00 00 .}..iU..r}......
ff 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[writhziden]

[list=1]
[*]
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\Kingston\BSODDmpFiles\Lauren17\Windows_NT6_BSOD_jcgriff2\021812-16926-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02e0d000 PsLoadedModuleList = 0xfffff800`0304ae70
Debug session time: Sat Feb 18 19:44:18.986 2012 (GMT-7)
System Uptime: 0 days 0:14:08.749
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffffffff010e6, 1, fffff80002e2fa16, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CcPerformReadAhead+26e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffff010e6, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002e2fa16, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b50e0
 fffffffffff010e6 

FAULTING_IP: 
nt!CcPerformReadAhead+26e
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002f9a940 -- (.trap 0xfffff88002f9a940)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000023df000 rbx=0000000000000000 rcx=0000000000001000
rdx=fffffa80070e3a40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e2fa16 rsp=fffff88002f9aad0 rbp=fffff800030225a0
 r8=fffffa80070e3bb0  r9=0000000000800000 r10=0000000000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
nt!CcPerformReadAhead+0x26e:
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002efddf4 to fffff80002e7d5c0

STACK_TEXT:  
fffff880`02f9a7d8 fffff800`02efddf4 : 00000000`00000050 ffffffff`fff010e6 00000000`00000001 fffff880`02f9a940 : nt!KeBugCheckEx
fffff880`02f9a7e0 fffff800`02e7b6ae : 00000000`00000001 00000000`023de000 00000000`00000000 fffff800`02e5fa64 : nt! ?? ::FNODOBFM::`string'+0x426f7
fffff880`02f9a940 fffff800`02e2fa16 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`02f9aad0 fffff800`02e71442 : fffffa80`06e89c60 fffffa80`06a3b000 fffff880`00000000 fffff880`03f77734 : nt!CcPerformReadAhead+0x26e
fffff880`02f9ac00 fffff800`02e8a7e1 : fffffa80`06a41ab0 fffff800`02e71224 fffff800`03084170 fffffa80`00000000 : nt!CcWorkerThread+0x21e
fffff880`02f9acb0 fffff800`0311d6fa : 00000000`00000000 fffffa80`06a3b040 00000000`00000080 fffffa80`069ab840 : nt!ExpWorkerThread+0x111
fffff880`02f9ad40 fffff800`02e5bb46 : fffff880`02d64180 fffffa80`06a3b040 fffff880`02d6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02f9ad80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!CcPerformReadAhead+26e
fffff800`02e2fa16 4181e600f0ffff  and     r14d,0FFFFF000h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!CcPerformReadAhead+26e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

FAILURE_BUCKET_ID:  X64_0x50_nt!CcPerformReadAhead+26e

BUCKET_ID:  X64_0x50_nt!CcPerformReadAhead+26e

Followup: MachineOwner
---------
[/list]

1. Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers... Antivirus Software... Faulty System Service...

Thanks to Dave76 for help understanding possible causes.



Do the following steps.

• If you are overclocking any hardware, please stop.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
  
• Use the |MG| Video Memory Stress Test 1.7.116 Download to test your graphics card memory.
  
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations. Await further instructions after posting your results before proceeding to the next steps.
  
  
  
• Update to Service Pack 1 (SP1)
  
  Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 (KB947821) [August 2011]
  
  Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [August 2011]
  
  Steps to follow before you install Windows 7 Service Pack 1 from the Microsoft Download Center
  
  Service Pack 1 Download site
  ​
  Links to Service Pack 1 (SP1) and preparation for SP1 courtesy of JMH
  
  
  
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[Lauren17]

Hi,

1) ran memtest86+ overnight for about 10+hours, no errors
and windows memory diag tool for one pass
2) I was not overclocking
3) I ran the |MG| Video Memory Stress Test 1.7.116 Download for about 3 hours, no errors
4) ran sfc /scannow once, no errors
5) did a clean start up in windows 7
6) did an 'upgrade' on windows 7 from the cd
7) reseated all power connectors and cables on the mother board

I just got another blue screen this morning and I got one last night. Please see attached minidumps.

Thank you

 

[writhziden]

[list=1]
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Lauren17\Windows_NT6_BSOD_jcgriff2\022012-17706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e1d000 PsLoadedModuleList = 0xfffff800`0305ae50
Debug session time: Mon Feb 20 12:14:17.466 2012 (GMT-7)
System Uptime: 0 days 0:13:58.229
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ebf110, fffff88005d7f120, 0}

Probably caused by : memory_corruption ( nt!MiGetPreviousNode+10 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ebf110, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88005d7f120, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiGetPreviousNode+10
fffff800`02ebf110 488b10          mov     rdx,qword ptr [rax]

CONTEXT:  fffff88005d7f120 -- (.cxr 0xfffff88005d7f120)
rax=ffbffa800a0a0240 rbx=fffffa800a86b010 rcx=fffffa800a86b010
rdx=0000000000000a70 rsi=fffffa8009e7c750 rdi=fffffa800a163060
rip=fffff80002ebf110 rsp=fffff88005d7fb08 rbp=0000000000000000
 r8=0000000000000000  r9=00000460006c0001 r10=fffff800031a51fc
r11=00000000003156fc r12=000000000012b000 r13=0000000000000000
r14=0000000000b9afff r15=0000000000a70000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!MiGetPreviousNode+0x10:
fffff800`02ebf110 488b10          mov     rdx,qword ptr [rax] ds:002b:ffbffa80`0a0a0240=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800031a4db2 to fffff80002ebf110

STACK_TEXT:  
fffff880`05d7fb08 fffff800`031a4db2 : 00000000`0023fd00 fffffa80`09e7c750 fffffa80`0a163030 fffff8a0`01079300 : nt!MiGetPreviousNode+0x10
fffff880`05d7fb10 fffff800`031a525b : 00000000`00000000 00000000`00a70000 fffffa80`00000001 00000000`00000401 : nt!MiUnmapViewOfSection+0x112
fffff880`05d7fbd0 fffff800`02e8e153 : fffffa80`0a163060 fffff880`05d7fca0 fffffa80`09e7c750 fffffa80`06d12ca0 : nt!NtUnmapViewOfSection+0x5f
fffff880`05d7fc20 00000000`7724015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c5fa18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7724015a


FOLLOWUP_IP: 
nt!MiGetPreviousNode+10
fffff800`02ebf110 488b10          mov     rdx,qword ptr [rax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiGetPreviousNode+10

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff88005d7f120 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiGetPreviousNode+10

BUCKET_ID:  X64_0x3B_nt!MiGetPreviousNode+10

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\Lauren17\Windows_NT6_BSOD_jcgriff2\022012-18439-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02ea2e50
Debug session time: Mon Feb 20 00:07:50.915 2012 (GMT-7)
System Uptime: 0 days 0:37:15.461
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffffffffffffff, 0, 1, fffff80002cf70de}

Probably caused by : afd.sys ( afd!AfdAllocateMdlChain32+fa )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffffffffffffff, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cf70de, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0d0e0
 ffffffffffffffff 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MmProbeAndLockPages+3ae
fffff800`02cf70de 4823f0          and     rsi,rax

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  swtor.exe

TRAP_FRAME:  fffff880086565d0 -- (.trap 0xfffff880086565d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000fffffffff rbx=0000000000000000 rcx=fffff6fb7dbed000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cf70de rsp=fffff88008656760 rbp=fffff88008656ca0
 r8=fffff6fb40003d60  r9=0000000000000002 r10=fffff6fb7da00018
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!MmProbeAndLockPages+0x3ae:
fffff800`02cf70de 4823f0          and     rsi,rax
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002cd6469 to fffff80002cd6f00

STACK_TEXT:  
fffff880`08656488 fffff800`02cd6469 : 00000000`0000000a ffffffff`ffffffff 00000000`00000000 00000000`00000001 : nt!KeBugCheckEx
fffff880`08656490 fffff800`02cd50e0 : 00000000`00000001 ffffffff`ffffffff 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`086565d0 fffff800`02cf70de : 00000000`00000002 00000000`00000102 00000000`00000020 00000000`00000020 : nt!KiPageFault+0x260
fffff880`08656760 fffff880`02bac4ba : fffffa80`06d19180 00000000`00000801 00000000`00000001 00000000`00000002 : nt!MmProbeAndLockPages+0x3ae
fffff880`08656870 fffff880`02ba9df4 : fffffa80`00000800 00000000`0d35f3b4 fffffa80`00000001 fffff800`00000001 : afd!AfdAllocateMdlChain32+0xfa
fffff880`08656900 fffff800`02fef3a7 : fffffa80`09f514c0 fffffa80`0ab20d40 00000000`00000000 fffffa80`00000020 : afd! ?? ::GFJBLGFE::`string'+0xeecc
fffff880`08656a10 fffff800`02fefc06 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`e6e80e70 : nt!IopXxxControlFile+0x607
fffff880`08656b40 fffff800`02cd6153 : fffffa80`06da7b60 fffff880`08656ca0 00000000`0d07e228 fffff880`08656c20 : nt!NtDeviceIoControlFile+0x56
fffff880`08656bb0 00000000`75492dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0d07eb08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75492dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
afd!AfdAllocateMdlChain32+fa
fffff880`02bac4ba 4d892f          mov     qword ptr [r15],r13

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  afd!AfdAllocateMdlChain32+fa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: afd

IMAGE_NAME:  afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc184

FAILURE_BUCKET_ID:  X64_0xA_afd!AfdAllocateMdlChain32+fa

BUCKET_ID:  X64_0xA_afd!AfdAllocateMdlChain32+fa

Followup: MachineOwner
---------
[/list]

Update to Service Pack 1 (SP1)

Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 (KB947821) [August 2011]

Download Details - Microsoft Download Center - System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [August 2011]

Steps to follow before you install Windows 7 Service Pack 1 from the Microsoft Download Center

Service Pack 1 Download site
​

Links to Service Pack 1 (SP1) and preparation for SP1 courtesy of JMH



Download and install CPU-Z and Upload screenshots of the CPU, Mainboard, Memory, and SPD tabs. In the SPD tab, upload an image of each slot.

Also, go into your BIOS and post all Voltages (CPU, RAM, NB, IMC, etc.) and all RAM settings (timings, frequency, etc.)

Thanks to Dave76 for help learning RAM Stability

 

[Lauren17]

I reinstalled windows and I am still getting BSOD:
Here is the mini dump file.


*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffffffffffad, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800171cc13, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c6100
ffffffffffffffad

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!IpFlcReceivePackets+1b3
fffff880`0171cc13 00488d add byte ptr [rax-73h],cl

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: fffff88006ef9120 -- (.trap 0xfffff88006ef9120)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=ffffffffffffffff
rdx=fffffa800aa8fca0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800171cc13 rsp=fffff88006ef92b0 rbp=0000000000000000
r8=0000000000000001 r9=0000000000000001 r10=0000000000000001
r11=0000000000000800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
tcpip!IpFlcReceivePackets+0x1b3:
fffff880`0171cc13 00488d add byte ptr [rax-73h],cl ds:ffffffff`ffffffad=??
Resetting default scope

MISALIGNED_IP:
tcpip!IpFlcReceivePackets+1b3
fffff880`0171cc13 00488d add byte ptr [rax-73h],cl

LAST_CONTROL_TRANSFER: from fffff80002e931e9 to fffff80002e93c40

STACK_TEXT:
fffff880`06ef8fd8 fffff800`02e931e9 : 00000000`0000000a ffffffff`ffffffad 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06ef8fe0 fffff800`02e91e60 : fffffa80`079a3000 fffff880`0171fd3a 00000000`00000000 00000000`133057a1 : nt!KiBugCheckDispatch+0x69
fffff880`06ef9120 fffff880`0171cc13 : 00000000`00000001 fffffa80`079a3000 fffff880`0183f9a0 00000000`08875b01 : nt!KiPageFault+0x260
fffff880`06ef92b0 fffff880`0171c6a2 : fffffa80`0887b4f0 fffffa80`0aa8fca0 fffffa80`08875b01 00000000`00000001 : tcpip!IpFlcReceivePackets+0x1b3
fffff880`06ef94b0 fffff880`0171bb3a : fffffa80`08875ba0 fffff880`06ef95e0 fffffa80`08875ba0 00000000`00000000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff880`06ef9590 fffff800`02ea0618 : fffffa80`0aa8fca0 00000000`00004800 fffffa80`07c84660 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff880`06ef95e0 fffff880`0171c202 : fffff880`0171ba60 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`06ef96c0 fffff880`015a60eb : fffffa80`08875460 00000000`00000000 fffffa80`0926b1a0 fffffa80`0926b1a0 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`06ef9730 fffff880`0156fad6 : fffff880`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`06ef97a0 fffff880`01537a3e : fffffa80`0926b1a0 00000000`00000002 00000000`00000000 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`06ef9c20 fffff880`01537d33 : fffffa80`0926b1a0 fffffa80`0926b1a0 00000000`00000000 fffffa80`0926c300 : ndis!ndisDoPeriodicReceivesIndication+0x14e
fffff880`06ef9c80 fffff880`01521f3d : 00000000`00010302 00000000`00000002 00000000`00000000 fffffa80`0926c388 : ndis!ndisPeriodicReceivesWorker+0x63
fffff880`06ef9cb0 fffff800`0312efee : 88a7e695`00000001 fffffa80`07c84660 00000000`00000080 88a7e695`e82c563d : ndis!ndisReceiveWorkerThread+0x1bd
fffff880`06ef9d40 fffff800`02e855e6 : fffff880`009e9180 fffffa80`07c84660 fffffa80`08391b60 88a7e695`e82c563d : nt!PspSystemThreadStartup+0x5a
fffff880`06ef9d80 00000000`00000000 : fffff880`06efa000 fffff880`06ef4000 fffff880`06ef9a00 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
tcpip!IpFlcReceivePackets+1b3
fffff880`0171cc13 00488d add byte ptr [rax-73h],cl

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: tcpip!IpFlcReceivePackets+1b3

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: X64_IP_MISALIGNED

BUCKET_ID: X64_IP_MISALIGNED

Followup: MachineOwner

 

[writhziden]

What antivirus are you running? I see a lot of network related items on the stack.

 

[Lauren17]

At the moment I am not using an anti virus because I just reinstalled windows a few days ago. I was nervous to install microsoft security essentials because I was afraid that was causing the issue. But since I am still getting BSOD while playing star wars I guess I can rule that out. I just got another BSOD a few min ago...this one is different then the last. Is it possible my mother board went bad?

Attached is a recent health report and the minidumps.

Thanks in Advance!

 

[writhziden]

Suspect device for previous crash:

                                 802.11n USB Wireless LAN Card
                                 Connection Name: Wireless Network Connection
                                 DHCP Enabled:    Yes

USB wireless adapters are inherently unstable. USB does not provide enough power for these devices to work properly. We recommend using an actual wireless PCI card rather than a USB wireless dongle. USB wireless is a common cause of crashes reported on these forums.

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Kingston\BSODDmpFiles\Lauren17\Windows_NT6_BSOD_jcgriff2\022312-18252-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e03000 PsLoadedModuleList = 0xfffff800`03048670
Debug session time: Thu Feb 23 16:11:38.792 2012 (UTC - 7:00)
System Uptime: 0 days 15:56:38.010
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ea81ce, fffff8800b7bbc20, 0}

Probably caused by : ntkrnlmp.exe ( nt!RtlGetExtendedContextLength+62 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ea81ce, Address of the instruction which caused the bugcheck
Arg3: fffff8800b7bbc20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!RtlGetExtendedContextLength+62
fffff800`02ea81ce 41ba04000000    mov     r10d,4

CONTEXT:  fffff8800b7bbc20 -- (.cxr 0xfffff8800b7bbc20)
rax=0000000000000000 rbx=000000000001003f rcx=0000000000000000
rdx=0000000000000001 rsi=000000000001003f rdi=fffff8800b7bc664
rip=fffff80002ea81ce rsp=fffff8800b7bc600 rbp=fffff8800b7bc660
 r8=fffff8800b7bc640  r9=0000000000010040 r10=fffff8800b7bc660
r11=00000000000002cc r12=000000000c3ddb01 r13=00000000000002cc
r14=fffffffffffffffe r15=fffffa8007302060
iopl=0         nv up ei pl zr na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010247
nt!RtlGetExtendedContextLength+0x62:
fffff800`02ea81ce 41ba04000000    mov     r10d,4
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  swtor.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002ea81ce

STACK_TEXT:  
fffff880`0b7bc600 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlGetExtendedContextLength+0x62


FOLLOWUP_IP: 
nt!RtlGetExtendedContextLength+62
fffff800`02ea81ce 41ba04000000    mov     r10d,4

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!RtlGetExtendedContextLength+62

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff8800b7bbc20 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!RtlGetExtendedContextLength+62

BUCKET_ID:  X64_0x3B_nt!RtlGetExtendedContextLength+62

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...

Remove your USB wireless network device and replace with something more stable. Then we can determine if it is the cause of the problems you are experiencing or if more troubleshooting needs to be done.


Did you replace the wireless USB with something more stable?

 

[Lauren17]

it was a bad motherboard

 

[writhziden]

Thank you for letting us know. Glad it was resolved.