locked
Windows 7 Blue Screen after clicking Shutdown RRS feed

  • Question

  • I have just reformatted my Laptop 3-4 days ago and i did a clean installation (format my hard-disk as well) and updating all my drivers and started using the computer like usual.

    Just a moment ago, I decided to shut down my laptop, and i noticed that there's an update so i decided to let it shutdown and update but the moment i clicked it, it showed a blue screen and i was worried that my laptop has the problem as i need it for school.

    Turning it back on, It was slower then usual but back to normal so i decided to update it and it was alright and i tried to turn off the laptop again and hope that it doesn't show the blue screen and it shut down properly this time.

    • Dell™ Inspiron™ 14R
    • Intel® Core™ i3- 350M processor (2.26Ghz)
    • Genuine Windows® 7 Home Premium (64bit)
    • 2GB (1x2GB) DDR3 SDRAM
    • 320GB Hard Drive
    • 14.0″ Widescreen HD WLED Glossy Display with TrueLife™
    • Intel® HD Graphics
    Here's the dump file.

    Tuesday, August 3, 2010 2:17 PM

Answers

  • It looks like there was an error deleting a file that resulted in an
    access violation. I would recommend testing the memory with a tool such
    as memtest86 (http://www.memtest86.com/) or Windows Memory Diagnostic
     
    I would also check the file system for errors. This is done from an
    administrative command prompt,
     
    chkdsk /R
     
    If there are no memory errors reported and the chkdsk comes back clean,
    then I would troubleshoot this as a driver issue and verify that all of
    the drivers/BIOS are up to the latest versions.
     # for hex 0xc0000005 / decimal -1073741819 :
      STATUS_ACCESS_VIOLATION                            ntstatus.h
    # The instruction at "0x%08lx" referenced memory at
     
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 3B, {c0000005, fffff800031ed85b, fffff8800544a4e0, 0}
     
    Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+24b )
     
    Followup: MachineOwner
    ---------
     
    3: kd> !analyze -v
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800031ed85b, Address of the instruction which caused the bugcheck
    Arg3: fffff8800544a4e0, Address of the context record for the exception
    that caused the bugcheck
    Arg4: 0000000000000000, zero.
     
    Debugging Details:
    ------------------
     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    FAULTING_IP:
    nt!IopDeleteFile+24b
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
     
    CONTEXT:  fffff8800544a4e0 -- (.cxr 0xfffff8800544a4e0)
    rax=fffff8a00175e570 rbx=fffffa80016d9900 rcx=00000000fffffffe
    rdx=fffff880031d3180 rsi=fffffa800174bde0 rdi=fffffa80027d8030
    rip=fffff800031ed85b rsp=fffff8800544aeb0 rbp=0000000000000001
     r8=0000000000000001  r9=0000000000000090 r10=fffff80002e66000
    r11=0000000000000189 r12=fffffa800266cda0 r13=fffffa800696ab00
    r14=fffffa800696ac00 r15=fffff8a0015ae880
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b
    efl=00010202
    nt!IopDeleteFile+0x24b:
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
    ds:002b:00000000`fffffffe=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    BUGCHECK_STR:  0x3B
     
    PROCESS_NAME:  quickset.exe
     
    CURRENT_IRQL:  0
     
    LAST_CONTROL_TRANSFER:  from fffff80002edb7b4 to fffff800031ed85b
     
    STACK_TEXT:
    fffff880`0544aeb0 fffff800`02edb7b4 : fffff8a0`0175e590
    fffff8a0`015ae880 fffffa80`0174bde0 fffffa80`0174a660 :
    nt!IopDeleteFile+0x24b
    fffff880`0544af40 fffff800`031ed4b4 : fffff8a0`015ae880
    00000000`00000000 fffffa80`0694a060 00000000`00000000 :
    nt!ObfDereferenceObject+0xd4
    fffff880`0544afa0 00000000`00000000 : 00000000`00000000
    00000000`00000000 00000000`00000000 00000000`00000000 :
    nt!ObpCloseHandleTableEntry+0xc4
     FOLLOWUP_IP:
    nt!IopDeleteFile+24b
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
     
    SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  nt!IopDeleteFile+24b
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: nt
     
    IMAGE_NAME:  ntkrnlmp.exe
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb
     
    STACK_COMMAND:  .cxr 0xfffff8800544a4e0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x3B_nt!IopDeleteFile+24b
     
    BUCKET_ID:  X64_0x3B_nt!IopDeleteFile+24b
     
    Followup: MachineOwner
    ---------
     
    3: kd> kp
    Child-SP          RetAddr           Call Site
    fffff880`05449c18 fffff800`02ed5b69 nt!KeBugCheckEx
    fffff880`05449c20 fffff800`02ed54bc nt!KiBugCheckDispatch+0x69
    fffff880`05449d60 fffff800`02efc2ed nt!KiSystemServiceHandler+0x7c
    fffff880`05449da0 fffff800`02f03950 nt!RtlpExecuteHandlerForException+0xd
    fffff880`05449dd0 fffff800`02f108df nt!RtlDispatchException+0x410
    fffff880`0544a4b0 fffff800`02ed5c42 nt!KiDispatchException+0x16f
    fffff880`0544ab40 fffff800`02ed47ba nt!KiExceptionDispatch+0xc2
    fffff880`0544ad20 fffff800`031ed85b nt!KiPageFault+0x23a
    fffff880`0544aeb0 fffff800`02edb7b4 nt!IopDeleteFile+0x24b
    fffff880`0544af40 fffff800`031ed4b4 nt!ObfDereferenceObject+0xd4
    fffff880`0544afa0 00000000`00000000 nt!ObpCloseHandleTableEntry+0xc4
     

    -- Mike Burr
    • Marked as answer by Ein1993 Tuesday, August 3, 2010 2:54 PM
    Tuesday, August 3, 2010 2:31 PM

All replies

  • It looks like there was an error deleting a file that resulted in an
    access violation. I would recommend testing the memory with a tool such
    as memtest86 (http://www.memtest86.com/) or Windows Memory Diagnostic
     
    I would also check the file system for errors. This is done from an
    administrative command prompt,
     
    chkdsk /R
     
    If there are no memory errors reported and the chkdsk comes back clean,
    then I would troubleshoot this as a driver issue and verify that all of
    the drivers/BIOS are up to the latest versions.
     # for hex 0xc0000005 / decimal -1073741819 :
      STATUS_ACCESS_VIOLATION                            ntstatus.h
    # The instruction at "0x%08lx" referenced memory at
     
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    Use !analyze -v to get detailed debugging information.
     
    BugCheck 3B, {c0000005, fffff800031ed85b, fffff8800544a4e0, 0}
     
    Probably caused by : ntkrnlmp.exe ( nt!IopDeleteFile+24b )
     
    Followup: MachineOwner
    ---------
     
    3: kd> !analyze -v
    *******************************************************************************
    *
          *
    *                        Bugcheck Analysis
          *
    *
          *
    *******************************************************************************
     
    SYSTEM_SERVICE_EXCEPTION (3b)
    An exception happened while executing a system service routine.
    Arguments:
    Arg1: 00000000c0000005, Exception code that caused the bugcheck
    Arg2: fffff800031ed85b, Address of the instruction which caused the bugcheck
    Arg3: fffff8800544a4e0, Address of the context record for the exception
    that caused the bugcheck
    Arg4: 0000000000000000, zero.
     
    Debugging Details:
    ------------------
     EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
    referenced memory at 0x%08lx. The memory could not be %s.
     
    FAULTING_IP:
    nt!IopDeleteFile+24b
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
     
    CONTEXT:  fffff8800544a4e0 -- (.cxr 0xfffff8800544a4e0)
    rax=fffff8a00175e570 rbx=fffffa80016d9900 rcx=00000000fffffffe
    rdx=fffff880031d3180 rsi=fffffa800174bde0 rdi=fffffa80027d8030
    rip=fffff800031ed85b rsp=fffff8800544aeb0 rbp=0000000000000001
     r8=0000000000000001  r9=0000000000000090 r10=fffff80002e66000
    r11=0000000000000189 r12=fffffa800266cda0 r13=fffffa800696ab00
    r14=fffffa800696ac00 r15=fffff8a0015ae880
    iopl=0         nv up ei pl nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b
    efl=00010202
    nt!IopDeleteFile+0x24b:
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
    ds:002b:00000000`fffffffe=????????????????
    Resetting default scope
     
    CUSTOMER_CRASH_COUNT:  1
     
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
     
    BUGCHECK_STR:  0x3B
     
    PROCESS_NAME:  quickset.exe
     
    CURRENT_IRQL:  0
     
    LAST_CONTROL_TRANSFER:  from fffff80002edb7b4 to fffff800031ed85b
     
    STACK_TEXT:
    fffff880`0544aeb0 fffff800`02edb7b4 : fffff8a0`0175e590
    fffff8a0`015ae880 fffffa80`0174bde0 fffffa80`0174a660 :
    nt!IopDeleteFile+0x24b
    fffff880`0544af40 fffff800`031ed4b4 : fffff8a0`015ae880
    00000000`00000000 fffffa80`0694a060 00000000`00000000 :
    nt!ObfDereferenceObject+0xd4
    fffff880`0544afa0 00000000`00000000 : 00000000`00000000
    00000000`00000000 00000000`00000000 00000000`00000000 :
    nt!ObpCloseHandleTableEntry+0xc4
     FOLLOWUP_IP:
    nt!IopDeleteFile+24b
    fffff800`031ed85b 488b09          mov     rcx,qword ptr [rcx]
     
    SYMBOL_STACK_INDEX:  0
     
    SYMBOL_NAME:  nt!IopDeleteFile+24b
     
    FOLLOWUP_NAME:  MachineOwner
     
    MODULE_NAME: nt
     
    IMAGE_NAME:  ntkrnlmp.exe
     
    DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb
     
    STACK_COMMAND:  .cxr 0xfffff8800544a4e0 ; kb
     
    FAILURE_BUCKET_ID:  X64_0x3B_nt!IopDeleteFile+24b
     
    BUCKET_ID:  X64_0x3B_nt!IopDeleteFile+24b
     
    Followup: MachineOwner
    ---------
     
    3: kd> kp
    Child-SP          RetAddr           Call Site
    fffff880`05449c18 fffff800`02ed5b69 nt!KeBugCheckEx
    fffff880`05449c20 fffff800`02ed54bc nt!KiBugCheckDispatch+0x69
    fffff880`05449d60 fffff800`02efc2ed nt!KiSystemServiceHandler+0x7c
    fffff880`05449da0 fffff800`02f03950 nt!RtlpExecuteHandlerForException+0xd
    fffff880`05449dd0 fffff800`02f108df nt!RtlDispatchException+0x410
    fffff880`0544a4b0 fffff800`02ed5c42 nt!KiDispatchException+0x16f
    fffff880`0544ab40 fffff800`02ed47ba nt!KiExceptionDispatch+0xc2
    fffff880`0544ad20 fffff800`031ed85b nt!KiPageFault+0x23a
    fffff880`0544aeb0 fffff800`02edb7b4 nt!IopDeleteFile+0x24b
    fffff880`0544af40 fffff800`031ed4b4 nt!ObfDereferenceObject+0xd4
    fffff880`0544afa0 00000000`00000000 nt!ObpCloseHandleTableEntry+0xc4
     

    -- Mike Burr
    • Marked as answer by Ein1993 Tuesday, August 3, 2010 2:54 PM
    Tuesday, August 3, 2010 2:31 PM
  • couldn't do 'chkdsk /r' but was able to do 'chkdsk' and it found no problem..

     

    C:\Windows\system32>chkdsk /r

    The type of the file system is NTFS.

    Cannot lock current drive.

     

    Chkdsk cannot run because the volume is in use by another

    process.  Would you like to schedule this volume to be

    checked the next time the system restarts? (Y/N) n

     

    I do not have a empty disk with me right now therefore unable to do the first one but will do so again sooner or later when i get one empty disk.

    So i don't have to worry that this would happen again i suppose, Thanks for your help!

    Tuesday, August 3, 2010 2:53 PM
  • I would recommend setting it up for the next reboot. It is normally safe to run without backing up to a seaparate disk. It does not delete any of the data on the drive, rather it looks for bad blocks and attempts to recover unreadable sectors that might be causing problems. Here is sort of an OK description of what it does,

    http://technet.microsoft.com/en-us/library/cc938973.aspx


    -- Mike Burr
    Tuesday, August 3, 2010 3:44 PM

  • "I decided to do it an hour ago and it seems that there's no problems with it whatsoever, it's clean so i'm guessing it's cleared/safe.. for now..
    This is my second hard-drive (i just bought this laptop two months ago), first one failed and got a replacement from dell via warranty..
    I don't wanna call them again to get another hard drive replacement.. nor any other problem..
    Thanks for your help 'Mike', Cheers! =D"
    Tuesday, August 3, 2010 6:01 PM
  • The hard drive seems like it might be OK, did you run a memory
    diagnostic with memtest86 or windiag?
     

    -- Mike Burr
    Wednesday, August 4, 2010 11:11 PM
  • I current do not have an empty disk nor any portable drive to do any of the both, until i get them.
    Thursday, August 5, 2010 4:31 AM