Ultimate x64 Blue Screens..

eldriSs · Nov 23, 2010

Hey guys! This is my first post here so please, have mercy...

I bought a new system a few weeks ago and, since then, i have a serious problem: random blue screens...

This is my system:

Motherboard: Gigabyte GA-770TA-UD3
CPU: MD Phenom II X4 945 3.00GHz skt AM3 box rev. C3
Video Card: Gainward GeForce GTX 460 Golden Sample 2GB DDR5 256-bit
RAM: 2 x TeamGroup Elite Ram 2GB DDR3 1333MHz CL9
HDD: Samsung 500GB SATA-II 7200 rpm 16MB SpinPoint F3
PSU: Nexus RX-5300 530W

I really don`t have a clue whats wrong but i think it`s a problem with the RAM sticks or HDD. Anyway, i`m not 100% sure...

Please post if you have any suggestions!

Thanks!

eldriSs · Nov 24, 2010

Someone please?

Tews · Nov 24, 2010

Having a look now ...

Tews · Nov 24, 2010

The dmp(s) point to ntkrnlmp.exe or ntoskrnl.exe as the probable cause. We know this is not the case, as these are core OS files, and will definitely not cause a BSOD. They are just the default files the debuggers blame when they can't see a better cause. We need to enable driver verifier to help pinpoint the faulting driver..

- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Also please run the tool included in this link.. I includes other information that will aid in helping to solve your problem... Blue Screen of Death (BSOD) Posting Instructions

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002f70c35, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!ObpWaitForMultipleObjects+2ff )

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Tom\Desktop\112110-16832-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1f000 PsLoadedModuleList = 0xfffff800`02e5ce50
Debug session time: Sat Nov 20 22:36:24.679 2010 (UTC - 5:00)
System Uptime: 0 days 1:09:55.474
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002f6a56d, 0, ffffffffffffffff}

Probably caused by : ntkrnlmp.exe ( nt!CmpKcbCacheLookup+1dd )

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Tom\Desktop\112310-14383-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e58e50
Debug session time: Mon Nov 22 18:40:12.211 2010 (UTC - 5:00)
System Uptime: 0 days 0:02:08.616
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000137183, fffff88003ad8880, 0}

Probably caused by : win32k.sys ( win32k!IsTopLevelWindow+17 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000137183, Address of the instruction which caused the bugcheck
Arg3: fffff88003ad8880, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!IsTopLevelWindow+17
fffff960`00137183 488b4908        mov     rcx,qword ptr [rcx+8]

CONTEXT:  fffff88003ad8880 -- (.cxr 0xfffff88003ad8880)
rax=0000000000000000 rbx=fffff900c0815080 rcx=f7fffa8006147b90
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000137183 rsp=fffff88003ad9268 rbp=00000000fffffffe
 r8=fffff900c082db70  r9=fffff900c0815080 r10=000000270000032e
r11=0000000000000027 r12=fffff88003ad9730 r13=0000000000000200
r14=0000000000000000 r15=000000000027032e
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
win32k!IsTopLevelWindow+0x17:
fffff960`00137183 488b4908        mov     rcx,qword ptr [rcx+8] ds:002b:f7fffa80`06147b98=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000137183

STACK_TEXT:  
fffff880`03ad9268 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!IsTopLevelWindow+0x17


FOLLOWUP_IP: 
win32k!IsTopLevelWindow+17
fffff960`00137183 488b4908        mov     rcx,qword ptr [rcx+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!IsTopLevelWindow+17

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

STACK_COMMAND:  .cxr 0xfffff88003ad8880 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!IsTopLevelWindow+17

BUCKET_ID:  X64_0x3B_win32k!IsTopLevelWindow+17

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Tom\Desktop\112310-14898-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e86e50
Debug session time: Tue Nov 23 16:13:04.154 2010 (UTC - 5:00)
System Uptime: 0 days 4:32:19.544
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002fac1fc, fffff880031bd988, fffff880031bd1e0}

Probably caused by : ntkrnlmp.exe ( nt!CmpRemoveKeyHash+4c )

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Tom\Desktop\112410-15272-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c1b000 PsLoadedModuleList = 0xfffff800`02e58e50
Debug session time: Tue Nov 23 17:12:48.783 2010 (UTC - 5:00)
System Uptime: 0 days 0:07:25.188
Loading Kernel Symbols
...............................................................
................................................................
...........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88009589ce8, fffff88009589540, fffff880012f7d77}

Probably caused by : Ntfs.sys ( Ntfs!NtfsOpenExistingPrefixFcb+67 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88009589ce8
Arg3: fffff88009589540
Arg4: fffff880012f7d77

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88009589ce8 -- (.exr 0xfffff88009589ce8)
ExceptionAddress: fffff880012f7d77 (Ntfs!NtfsOpenExistingPrefixFcb+0x0000000000000067)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88009589540 -- (.cxr 0xfffff88009589540)
rax=fffff8a0024b7a90 rbx=fffff8a0024b7ed0 rcx=fffffa8005b5e010
rdx=f7fff8a0001e8000 rsi=fffffa8003f63c10 rdi=fffff8800958a490
rip=fffff880012f7d77 rsp=fffff88009589f20 rbp=0000000000000000
 r8=fffff8a0024b7ed0  r9=0000000000000000 r10=fffffa8005b5e010
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=fffffa8005b5e010 r15=000000000000004e
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsOpenExistingPrefixFcb+0x67:
fffff880`012f7d77 488b4a50        mov     rcx,qword ptr [rdx+50h] ds:002b:f7fff8a0`001e8050=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec30e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsOpenExistingPrefixFcb+67
fffff880`012f7d77 488b4a50        mov     rcx,qword ptr [rdx+50h]

FAULTING_IP: 
Ntfs!NtfsOpenExistingPrefixFcb+67
fffff880`012f7d77 488b4a50        mov     rcx,qword ptr [rdx+50h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880012f7d77

STACK_TEXT:  
fffff880`09589f20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsOpenExistingPrefixFcb+0x67


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsOpenExistingPrefixFcb+67

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88009589540 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenExistingPrefixFcb+67

BUCKET_ID:  X64_0x24_Ntfs!NtfsOpenExistingPrefixFcb+67

Followup: MachineOwner
---------

Ultimate x64 Blue Screens..

eldriSs

New member

My Computer

At a glance

eldriSs

New member

My Computer

At a glance

Tews

Professional Lurker

My Computer

At a glance

Tews

Professional Lurker

My Computer

At a glance

Similar threads

Ultimate x64 Blue Screens..

eldriSs

New member

My Computer My Computer

At a glance

eldriSs

New member

My Computer My Computer

At a glance

Tews

Professional Lurker

My Computer My Computer

At a glance

Tews

Professional Lurker

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer