locked
Blue Screen Error RRS feed

  • Question

  • Hi, please could you help me with this. I keep getting the following message even though I've scanned for memory problems numerous times.

    Problem signature:

      Problem Event Name:                        BlueScreen

      OS Version:                                          6.1.7600.2.0.0.768.3

      Locale ID:                                             2057

     

    Additional information about the problem:

      BCCode:                                               1a

      BCP1:                                                    0000000000041284

      BCP2:                                                    FFFFF9801AAFB001

      BCP3:                                                    0000000000002835

      BCP4:                                                    FFFFF780C0000000

      OS Version:                                          6_1_7600

      Service Pack:                                       0_0

      Product:                                               768_1

     

    Tuesday, December 20, 2011 10:01 PM

Answers

  • Hello,

    I would recommend proceeding like that:

    • Update all possible drivers
    • Uninstall all unused programs
    • Run msconfig and disable all startup items / services except Microsoft ones
    • Disable all security softwares that you have

    Once done, restart your computer and check results.

    You can also contact Microsoft CSS for assistance.



    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    • Proposed as answer by Niki Han Monday, December 26, 2011 2:40 AM
    • Marked as answer by Niki Han Friday, December 30, 2011 8:13 AM
    Wednesday, December 21, 2011 9:42 PM

All replies

  • This is 0x1A, MEMORY_MANAGEMENT, please see here for initial
    troubleshooting steps,
     
     

    -- Mike Burr
    Technology
    • Marked as answer by Niki Han Monday, December 26, 2011 2:40 AM
    • Unmarked as answer by Niki Han Monday, December 26, 2011 2:40 AM
    Tuesday, December 20, 2011 10:46 PM
  • I would like to suggest you update the BIOS and the hardware drivers for Windows 7 first.

     If the issue persists, please upload the minidump files as required.

    You may also analyze them with Debugging Tools by yourself. You need to install it and it’s Symbol Packages from the following link:

    http://www.microsoft.com/whdc/Devtools/Debugging/default.mspx

    WinDbg will tell you the possible cause.

    If no clue can be found, you may contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. Please be advised that contacting phone support will be a charged call.

    To obtain the phone numbers for specific technology request please take a look at the web site listed below:

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607

    Regards
    Wednesday, December 21, 2011 10:27 AM
  • Hi, thanks for all the help. I've updated the BIOS for my laptop and I also used the debugging tools to find out what was going on. Unfortunately, I am completely hopeless with computers and so I would like a bit more guidance if that's alright?

     I got the following from WinDbg:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

     

     

    Loading Dump File [C:\Windows\Minidump\122111-45396-01.dmp]

    Mini Kernel Dump File: Only registers and stack trace are available

     

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is: 

    Windows 7 Kernel Version 7600 MP (2 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS Personal

    Built by: 7600.16841.amd64fre.win7_gdr.110622-1503

    Machine Name:

    Kernel base = 0xfffff800`02e4d000 PsLoadedModuleList = 0xfffff800`0308ae70

    Debug session time: Wed Dec 21 16:04:15.543 2011 (UTC + 0:00)

    System Uptime: 0 days 1:08:13.291

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    ................................................................

    .................................

    Loading User Symbols

    Loading unloaded module list

    ...........

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    Use !analyze -v to get detailed debugging information.

     

    BugCheck A, {fffff68000327878, 0, 0, fffff80002e919c7}

     

    Probably caused by : memory_corruption ( nt!MiDeleteAddressesInWorkingSet+11b )

     

    Followup: MachineOwner

    ---------

     

    0: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    IRQL_NOT_LESS_OR_EQUAL (a)

    An attempt was made to access a pageable (or completely invalid) address at an

    interrupt request level (IRQL) that is too high.  This is usually

    caused by drivers using improper addresses.

    If a kernel debugger is available get the stack backtrace.

    Arguments:

    Arg1: fffff68000327878, memory referenced

    Arg2: 0000000000000000, IRQL

    Arg3: 0000000000000000, bitfield :

    bit 0 : value 0 = read operation, 1 = write operation

    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

    Arg4: fffff80002e919c7, address which referenced memory

     

    Debugging Details:

    ------------------

     

     

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f50e0

     fffff68000327878 

     

    CURRENT_IRQL:  0

     

    FAULTING_IP: 

    nt!MiDeleteAddressesInWorkingSet+11b

    fffff800`02e919c7 488b1e          mov     rbx,qword ptr [rsi]

     

    CUSTOMER_CRASH_COUNT:  1

     

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

     

    BUGCHECK_STR:  0xA

     

    PROCESS_NAME:  chrome.exe

     

    TRAP_FRAME:  fffff8800c1da050 -- (.trap 0xfffff8800c1da050)

    NOTE: The trap frame does not contain all registers.

    Some register values may be zeroed or incorrect.

    rax=0000098000000000 rbx=0000000000000000 rcx=0000000000006960

    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff80002e919c7 rsp=fffff8800c1da1e0 rbp=fffff70001083a08

     r8=fffffa8007418ec8  r9=0000000000000001 r10=000000000000012b

    r11=fffff70001080000 r12=0000000000000000 r13=0000000000000000

    r14=0000000000000000 r15=0000000000000000

    iopl=0         nv up ei ng nz na po cy

    nt!MiDeleteAddressesInWorkingSet+0x11b:

    fffff800`02e919c7 488b1e          mov     rbx,qword ptr [rsi] ds:000a:00000000`00000000=????????????????

    Resetting default scope

     

    LAST_CONTROL_TRANSFER:  from fffff80002ebcb29 to fffff80002ebd5c0

     

    STACK_TEXT:  

    fffff880`0c1d9f08 fffff800`02ebcb29 : 00000000`0000000a fffff680`00327878 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx

    fffff880`0c1d9f10 fffff800`02ebb7a0 : 00000000`00000000 0000000f`ffffffff 00000000`00001000 fffff800`02ff1bfe : nt!KiBugCheckDispatch+0x69

    fffff880`0c1da050 fffff800`02e919c7 : 00000003`00000000 eae00000`08624025 fffff700`010839f8 fffff680`002d0a40 : nt!KiPageFault+0x260

    fffff880`0c1da1e0 fffff800`02e9060e : fffffa80`07418b30 fffffa80`00000000 00000000`0000012b fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x11b

    fffff880`0c1daa90 fffff800`0319fa8b : fffff8a0`0f5e7060 00000000`00000001 00000000`00000000 fffffa80`07cf1b60 : nt!MmCleanProcessAddressSpace+0x96

    fffff880`0c1daae0 fffff800`0317735b : 00000000`c0000005 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x92f

    fffff880`0c1daba0 fffff800`02ebc813 : fffffa80`07418b30 00000000`c0000005 00000000`002aed01 fffffa80`07cf1b60 : nt!NtTerminateProcess+0x25b

    fffff880`0c1dac20 00000000`7718f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

    00000000`0018e208 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7718f97a

     

     

    STACK_COMMAND:  kb

     

    FOLLOWUP_IP: 

    nt!MiDeleteAddressesInWorkingSet+11b

    fffff800`02e919c7 488b1e          mov     rbx,qword ptr [rsi]

     

    SYMBOL_STACK_INDEX:  3

     

    SYMBOL_NAME:  nt!MiDeleteAddressesInWorkingSet+11b

     

    FOLLOWUP_NAME:  MachineOwner

     

    MODULE_NAME: nt

     

    DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

     

    IMAGE_NAME:  memory_corruption

     

    FAILURE_BUCKET_ID:  X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

     

    BUCKET_ID:  X64_0xA_nt!MiDeleteAddressesInWorkingSet+11b

     

    Followup: MachineOwner

    ---------

     

    0: kd> lmvm nt

    start             end                 module name

    fffff800`02e4d000 fffff800`03429000   nt         (pdb symbols)          c:\symbols\ntkrnlmp.pdb\5FB647682585460196DBF36D2E3CC3A02\ntkrnlmp.pdb

        Loaded symbol image file: ntkrnlmp.exe

        Mapped memory image file: c:\symbols\ntoskrnl.exe\4E02AA445dc000\ntoskrnl.exe

        Image path: ntkrnlmp.exe

        Image name: ntkrnlmp.exe

        Timestamp:        Thu Jun 23 03:51:48 2011 (4E02AA44)

        CheckSum:         00542941

        ImageSize:        005DC000

        File version:     6.1.7600.16841

        Product version:  6.1.7600.16841

        File flags:       0 (Mask 3F)

        File OS:          40004 NT Win32

        File type:        1.0 App

        File date:        00000000.00000000

        Translations:     0409.04b0

        CompanyName:      Microsoft Corporation

        ProductName:      Microsoft® Windows® Operating System

        InternalName:     ntkrnlmp.exe

        OriginalFilename: ntkrnlmp.exe

        ProductVersion:   6.1.7600.16841

        FileVersion:      6.1.7600.16841 (win7_gdr.110622-1503)

        FileDescription:  NT Kernel & System

        LegalCopyright:   © Microsoft Corporation. All rights reserved.

    Wednesday, December 21, 2011 5:08 PM
  • IRQL_NOT_LESS_OR_EQUAL generally follows this line,
     
     
    Since it is due to memory_corruption, you should probably rule out a
    hardware issue with the memory first,
     
     
    If memtest86+ doesn't turn up anything, then you may want to enable
    driver verifier and analyze the dumps that occur after the verifier is
    enabled,
     
     

    -- Mike Burr
    Technology
    • Proposed as answer by Niki Han Friday, December 30, 2011 8:13 AM
    Wednesday, December 21, 2011 5:22 PM
  • Hi, I did the memory scan and found out there were no errors. I went onto the next step and enabled the driver verifier which gave me the following dump file: 

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

     

     

    Loading Dump File [C:\Windows\Minidump\122111-32401-01.dmp]

    Mini Kernel Dump File: Only registers and stack trace are available

     

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

    Executable search path is: 

    Windows 7 Kernel Version 7600 MP (2 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS Personal

    Built by: 7600.16841.amd64fre.win7_gdr.110622-1503

    Machine Name:

    Kernel base = 0xfffff800`02e02000 PsLoadedModuleList = 0xfffff800`0303fe70

    Debug session time: Wed Dec 21 19:50:01.641 2011 (UTC + 0:00)

    System Uptime: 0 days 0:05:08.264

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    ................................................................

    ...................................

    Loading User Symbols

    Loading unloaded module list

    .....

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    Use !analyze -v to get detailed debugging information.

     

    BugCheck 1E, {ffffffffc0000005, fffff80000b9cb80, 0, ffffffffffffffff}

     

    Probably caused by : ntkrnlmp.exe ( nt!KiDispatchException+1b9 )

     

    Followup: MachineOwner

    ---------

     

    0: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    KMODE_EXCEPTION_NOT_HANDLED (1e)

    This is a very common bugcheck.  Usually the exception address pinpoints

    the driver/function that caused the problem.  Always note this address

    as well as the link date of the driver/image that contains this address.

    Arguments:

    Arg1: ffffffffc0000005, The exception code that was not handled

    Arg2: fffff80000b9cb80, The address that the exception occurred at

    Arg3: 0000000000000000, Parameter 0 of the exception

    Arg4: ffffffffffffffff, Parameter 1 of the exception

     

    Debugging Details:

    ------------------

     

     

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

     

    FAULTING_IP: 

    +3332333431616164

    fffff800`00b9cb80 0000            add     byte ptr [rax],al

     

    EXCEPTION_PARAMETER1:  0000000000000000

     

    EXCEPTION_PARAMETER2:  ffffffffffffffff

     

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030aa0e0

     ffffffffffffffff 

     

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

     

    BUGCHECK_STR:  0x1E_c0000005

     

    CUSTOMER_CRASH_COUNT:  1

     

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

     

    PROCESS_NAME:  System

     

    CURRENT_IRQL:  d

     

    EXCEPTION_RECORD:  fffff80000b9c8a8 -- (.exr 0xfffff80000b9c8a8)

    ExceptionAddress: fffff80000b9cb80

       ExceptionCode: c0000005 (Access violation)

      ExceptionFlags: 00000000

    NumberParameters: 2

       Parameter[0]: 0000000000000000

       Parameter[1]: ffffffffffffffff

    Attempt to read from address ffffffffffffffff

     

    TRAP_FRAME:  fffff80000b9c950 -- (.trap 0xfffff80000b9c950)

    NOTE: The trap frame does not contain all registers.

    Some register values may be zeroed or incorrect.

    rax=69029c60ff43f200 rbx=0000000000000000 rcx=0000000000000011

    rdx=000000000000dda9 rsi=0000000000000000 rdi=0000000000000000

    rip=fffff80000b9cb80 rsp=fffff80000b9cae0 rbp=0000000000000000

     r8=00000000000107d2  r9=0000000000000000 r10=0000000000000000

    r11=fffff80000b9cab0 r12=0000000000000000 r13=0000000000000000

    r14=0000000000000000 r15=0000000000000000

    iopl=0         nv up ei pl zr na po nc

    fffff800`00b9cb80 0000            add     byte ptr [rax],al ds:33cc:69029c60`ff43f200=??

    Resetting default scope

     

    LAST_CONTROL_TRANSFER:  from fffff80002eac919 to fffff80002e725c0

     

    STACK_TEXT:  

    fffff800`00b9c0d8 fffff800`02eac919 : 00000000`0000001e ffffffff`c0000005 fffff800`00b9cb80 00000000`00000000 : nt!KeBugCheckEx

    fffff800`00b9c0e0 fffff800`02e71c02 : fffff800`00b9c8a8 fffff800`0340d460 fffff800`00b9c950 00000000`00000000 : nt!KiDispatchException+0x1b9

    fffff800`00b9c770 fffff800`02e7050a : 0004b98b`00000003 00000000`00000000 fffffa80`053b056c fffffa80`053b053d : nt!KiExceptionDispatch+0xc2

    fffff800`00b9c950 fffff800`00b9cb80 : fffff800`0340d460 00000000`00000000 00000000`00000000 fffff800`00000000 : nt!KiGeneralProtectionFault+0x10a

    fffff800`00b9cae0 fffff800`0340d460 : 00000000`00000000 00000000`00000000 fffff800`00000000 fffff800`02fece80 : 0xfffff800`00b9cb80

    fffff800`00b9cae8 00000000`00000000 : 00000000`00000000 fffff800`00000000 fffff800`02fece80 fffff800`02ecf5f1 : hal!HalpKInterruptHeap+0x460

     

     

    STACK_COMMAND:  kb

     

    FOLLOWUP_IP: 

    nt!KiDispatchException+1b9

    fffff800`02eac919 cc              int     3

     

    SYMBOL_STACK_INDEX:  1

     

    SYMBOL_NAME:  nt!KiDispatchException+1b9

     

    FOLLOWUP_NAME:  MachineOwner

     

    MODULE_NAME: nt

     

    IMAGE_NAME:  ntkrnlmp.exe

     

    DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aa44

     

    FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!KiDispatchException+1b9

     

    BUCKET_ID:  X64_0x1E_c0000005_nt!KiDispatchException+1b9

     

    Followup: MachineOwner

    ---------

     

    0: kd> !analyze -v

    I don't know if this is any different to the previous one i uploaded and I apologise if it is. I am so confused!!

    Wednesday, December 21, 2011 8:14 PM
  • Hello,

    I would recommend proceeding like that:

    • Update all possible drivers
    • Uninstall all unused programs
    • Run msconfig and disable all startup items / services except Microsoft ones
    • Disable all security softwares that you have

    Once done, restart your computer and check results.

    You can also contact Microsoft CSS for assistance.



    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    • Proposed as answer by Niki Han Monday, December 26, 2011 2:40 AM
    • Marked as answer by Niki Han Friday, December 30, 2011 8:13 AM
    Wednesday, December 21, 2011 9:42 PM