locked
BSOD, system service exception, windows 8 RRS feed

  • Question

  • Hello i have had BSOD's for last few days. Last one was "system services exception". I uploaded all dmp files to my skydrive.

    https://skydrive.live.com/redir?resid=C285E9128F732862!411&authkey=!ALPdF8AZOHGwH5I

    pls help. thank you.

    Sunday, April 7, 2013 6:55 AM

Answers

  • YOu got SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) and DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    The DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) is caused by the Norton driver IDSvia64.sys:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff8800448b755, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800f7b57168
    GetUlongFromAddress: unable to read from fffff800f7b571f8
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    IDSvia64+3a755
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  AV
    
    PROCESS_NAME:  bitcoin-qt.exe
    
    TRAP_FRAME:  fffff8800e356e90 -- (.trap 0xfffff8800e356e90)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa80097f79e0 rbx=0000000000000000 rcx=fffffa80097f75b8
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800448b755 rsp=fffff8800e357020 rbp=fffff8800e357148
     r8=0000000000000001  r9=0000000000000001 r10=0000000000000801
    r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    IDSvia64+0x3a755:
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800f787b369 to fffff800f787c040
    
    STACK_TEXT:  
    fffff880`0e356d48 fffff800`f787b369 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e356d50 fffff800`f7879be0 : 00000000`00000000 fffffa80`097f75b8 00000000`00000000 fffff880`0e356e90 : nt!KiBugCheckDispatch+0x69
    fffff880`0e356e90 fffff880`0448b755 : ffff8029`10875b1e fffff880`0e357148 fffffa80`0c53c0b8 fffffa80`09e57701 : nt!KiPageFault+0x260
    fffff880`0e357020 ffff8029`10875b1e : fffff880`0e357148 fffffa80`0c53c0b8 fffffa80`09e57701 fffffa80`0b21f590 : IDSvia64+0x3a755
    fffff880`0e357028 fffff880`0e357148 : fffffa80`0c53c0b8 fffffa80`09e57701 fffffa80`0b21f590 00000000`00000000 : 0xffff8029`10875b1e
    fffff880`0e357030 fffffa80`0c53c0b8 : fffffa80`09e57701 fffffa80`0b21f590 00000000`00000000 fffff880`0e3571f0 : 0xfffff880`0e357148
    fffff880`0e357038 fffffa80`09e57701 : fffffa80`0b21f590 00000000`00000000 fffff880`0e3571f0 fffffa80`0bc8cb98 : 0xfffffa80`0c53c0b8
    fffff880`0e357040 fffffa80`0b21f590 : 00000000`00000000 fffff880`0e3571f0 fffffa80`0bc8cb98 fffffa80`0c53c010 : 0xfffffa80`09e57701
    fffff880`0e357048 00000000`00000000 : fffff880`0e3571f0 fffffa80`0bc8cb98 fffffa80`0c53c010 fffff880`04488f2e : 0xfffffa80`0b21f590
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    IDSvia64+3a755
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  IDSvia64+3a755
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: IDSvia64
    
    IMAGE_NAME:  IDSvia64.sys
    
    
        Loaded symbol image file: IDSvia64.sys
        Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.1.22\Definitions\IPSDefs\20130328.001\IDSvia64.sys
        Image name: IDSvia64.sys
        Timestamp:        Wed Aug 29 04:48:40 2012

    Update Norton.

    The other crash comes from the nVIDIA driver:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88004d38d78, The address that the exception occurred at
    Arg3: fffff8800dcec858, Exception Record Address
    Arg4: fffff8800dcec090, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    FAULTING_IP: 
    nvlddmkm+f1d78
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx
    
    EXCEPTION_RECORD:  fffff8800dcec858 -- (.exr 0xfffff8800dcec858)
    ExceptionAddress: fffff88004d38d78 (nvlddmkm+0x00000000000f1d78)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000010
    Attempt to read from address 0000000000000010
    
    CONTEXT:  fffff8800dcec090 -- (.cxr 0xfffff8800dcec090)
    rax=0000000000000000 rbx=fffff80110f1e788 rcx=fffffa8006988c60
    rdx=000000000000047c rsi=fffffa8009830400 rdi=fffffa80069902e0
    rip=fffff88004d38d78 rsp=fffff8800dceca90 rbp=fffff8800dceca90
     r8=00000000000001f0  r9=fffffa8009f3ab01 r10=0000000000000000
    r11=fffff8800dcecab0 r12=fffff8800dced001 r13=fffff8800dced000
    r14=000000000000047c r15=fffffa80069902d0
    iopl=0         nv up ei pl nz na po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
    nvlddmkm+0xf1d78:
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx ds:002b:00000000`00000010=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000010
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80110fde168
    GetUlongFromAddress: unable to read from fffff80110fde1f8
     0000000000000010 Nonpaged pool
    
    FOLLOWUP_IP: 
    nvlddmkm+f1d78
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx
    
    BUGCHECK_STR:  AV
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    LAST_CONTROL_TRANSFER:  from fffff8800dcecae0 to fffff88004d38d78
    
    STACK_TEXT:  
    fffff880`0dceca90 fffff880`0dcecae0 : fffff880`04d3938e 00000000`00000002 fffff801`10f1e788 fffffa80`09830400 : nvlddmkm+0xf1d78
    fffff880`0dceca98 fffff880`04d3938e : 00000000`00000002 fffff801`10f1e788 fffffa80`09830400 fffff880`0457637c : 0xfffff880`0dcecae0
    fffff880`0dcecaa0 00000000`00000002 : fffff801`10f1e788 fffffa80`09830400 fffff880`0457637c fffffa80`06a9fa80 : nvlddmkm+0xf238e
    fffff880`0dcecaa8 fffff801`10f1e788 : fffffa80`09830400 fffff880`0457637c fffffa80`06a9fa80 00000000`00000000 : 0x2
    fffff880`0dcecab0 fffffa80`09830400 : fffff880`0457637c fffffa80`06a9fa80 00000000`00000000 fffff880`0dced040 : nt!PspCreateThreadNotifyRoutine+0x8
    fffff880`0dcecab8 fffff880`0457637c : fffffa80`06a9fa80 00000000`00000000 fffff880`0dced040 fffff880`0dced000 : 0xfffffa80`09830400
    fffff880`0dcecac0 fffffa80`06a9fa80 : 00000000`00000000 fffff880`0dced040 fffff880`0dced000 fffff880`0dcecdd0 : SYMEVENT64x86+0x1037c
    fffff880`0dcecac8 00000000`00000000 : fffff880`0dced040 fffff880`0dced000 fffff880`0dcecdd0 fffff801`110b813d : 0xfffffa80`06a9fa80
    
    
    
    IMAGE_NAME:  nvlddmkm.sys
    
        Loaded symbol image file: nvlddmkm.sys
        Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
        Image name: nvlddmkm.sys
        Timestamp:        Fri Mar 15 02:37:00 2013
    
    
    
        Loaded symbol image file: SYMEVENT64x86.SYS
        Image path: \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
        Image name: SYMEVENT64x86.SYS
        Timestamp:        Thu May 24 02:52:24 2012 

    But there Symantec/Norton is also involved. So update or remove Norton if there is no Win8 compatible version.


    "A programmer is just a tool which converts caffeine into code"

    • Proposed as answer by ZigZag3143x Sunday, April 7, 2013 4:53 PM
    • Marked as answer by Leo Huang Thursday, April 18, 2013 9:48 AM
    Sunday, April 7, 2013 7:32 AM
    Answerer
  • It seems it is solved. I uninstalled Norton with Norton remover and reinstalled it.
    • Marked as answer by Leo Huang Thursday, April 18, 2013 9:48 AM
    Thursday, April 11, 2013 3:30 PM

All replies

  • YOu got SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e) and DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    The DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) is caused by the Norton driver IDSvia64.sys:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 0000000000000000, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
    Arg4: fffff8800448b755, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800f7b57168
    GetUlongFromAddress: unable to read from fffff800f7b571f8
     0000000000000000 Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    IDSvia64+3a755
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
    
    BUGCHECK_STR:  AV
    
    PROCESS_NAME:  bitcoin-qt.exe
    
    TRAP_FRAME:  fffff8800e356e90 -- (.trap 0xfffff8800e356e90)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffffa80097f79e0 rbx=0000000000000000 rcx=fffffa80097f75b8
    rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff8800448b755 rsp=fffff8800e357020 rbp=fffff8800e357148
     r8=0000000000000001  r9=0000000000000001 r10=0000000000000801
    r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na pe nc
    IDSvia64+0x3a755:
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx] ds:00000000`00000000=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff800f787b369 to fffff800f787c040
    
    STACK_TEXT:  
    fffff880`0e356d48 fffff800`f787b369 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e356d50 fffff800`f7879be0 : 00000000`00000000 fffffa80`097f75b8 00000000`00000000 fffff880`0e356e90 : nt!KiBugCheckDispatch+0x69
    fffff880`0e356e90 fffff880`0448b755 : ffff8029`10875b1e fffff880`0e357148 fffffa80`0c53c0b8 fffffa80`09e57701 : nt!KiPageFault+0x260
    fffff880`0e357020 ffff8029`10875b1e : fffff880`0e357148 fffffa80`0c53c0b8 fffffa80`09e57701 fffffa80`0b21f590 : IDSvia64+0x3a755
    fffff880`0e357028 fffff880`0e357148 : fffffa80`0c53c0b8 fffffa80`09e57701 fffffa80`0b21f590 00000000`00000000 : 0xffff8029`10875b1e
    fffff880`0e357030 fffffa80`0c53c0b8 : fffffa80`09e57701 fffffa80`0b21f590 00000000`00000000 fffff880`0e3571f0 : 0xfffff880`0e357148
    fffff880`0e357038 fffffa80`09e57701 : fffffa80`0b21f590 00000000`00000000 fffff880`0e3571f0 fffffa80`0bc8cb98 : 0xfffffa80`0c53c0b8
    fffff880`0e357040 fffffa80`0b21f590 : 00000000`00000000 fffff880`0e3571f0 fffffa80`0bc8cb98 fffffa80`0c53c010 : 0xfffffa80`09e57701
    fffff880`0e357048 00000000`00000000 : fffff880`0e3571f0 fffffa80`0bc8cb98 fffffa80`0c53c010 fffff880`04488f2e : 0xfffffa80`0b21f590
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    IDSvia64+3a755
    fffff880`0448b755 488b02          mov     rax,qword ptr [rdx]
    
    SYMBOL_STACK_INDEX:  3
    
    SYMBOL_NAME:  IDSvia64+3a755
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: IDSvia64
    
    IMAGE_NAME:  IDSvia64.sys
    
    
        Loaded symbol image file: IDSvia64.sys
        Image path: \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.1.22\Definitions\IPSDefs\20130328.001\IDSvia64.sys
        Image name: IDSvia64.sys
        Timestamp:        Wed Aug 29 04:48:40 2012

    Update Norton.

    The other crash comes from the nVIDIA driver:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff88004d38d78, The address that the exception occurred at
    Arg3: fffff8800dcec858, Exception Record Address
    Arg4: fffff8800dcec090, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    FAULTING_IP: 
    nvlddmkm+f1d78
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx
    
    EXCEPTION_RECORD:  fffff8800dcec858 -- (.exr 0xfffff8800dcec858)
    ExceptionAddress: fffff88004d38d78 (nvlddmkm+0x00000000000f1d78)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000000
       Parameter[1]: 0000000000000010
    Attempt to read from address 0000000000000010
    
    CONTEXT:  fffff8800dcec090 -- (.cxr 0xfffff8800dcec090)
    rax=0000000000000000 rbx=fffff80110f1e788 rcx=fffffa8006988c60
    rdx=000000000000047c rsi=fffffa8009830400 rdi=fffffa80069902e0
    rip=fffff88004d38d78 rsp=fffff8800dceca90 rbp=fffff8800dceca90
     r8=00000000000001f0  r9=fffffa8009f3ab01 r10=0000000000000000
    r11=fffff8800dcecab0 r12=fffff8800dced001 r13=fffff8800dced000
    r14=000000000000047c r15=fffffa80069902d0
    iopl=0         nv up ei pl nz na po cy
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
    nvlddmkm+0xf1d78:
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx ds:002b:00000000`00000010=????????????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
    
    EXCEPTION_PARAMETER1:  0000000000000000
    
    EXCEPTION_PARAMETER2:  0000000000000010
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80110fde168
    GetUlongFromAddress: unable to read from fffff80110fde1f8
     0000000000000010 Nonpaged pool
    
    FOLLOWUP_IP: 
    nvlddmkm+f1d78
    fffff880`04d38d78 48395010        cmp     qword ptr [rax+10h],rdx
    
    BUGCHECK_STR:  AV
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE
    
    LAST_CONTROL_TRANSFER:  from fffff8800dcecae0 to fffff88004d38d78
    
    STACK_TEXT:  
    fffff880`0dceca90 fffff880`0dcecae0 : fffff880`04d3938e 00000000`00000002 fffff801`10f1e788 fffffa80`09830400 : nvlddmkm+0xf1d78
    fffff880`0dceca98 fffff880`04d3938e : 00000000`00000002 fffff801`10f1e788 fffffa80`09830400 fffff880`0457637c : 0xfffff880`0dcecae0
    fffff880`0dcecaa0 00000000`00000002 : fffff801`10f1e788 fffffa80`09830400 fffff880`0457637c fffffa80`06a9fa80 : nvlddmkm+0xf238e
    fffff880`0dcecaa8 fffff801`10f1e788 : fffffa80`09830400 fffff880`0457637c fffffa80`06a9fa80 00000000`00000000 : 0x2
    fffff880`0dcecab0 fffffa80`09830400 : fffff880`0457637c fffffa80`06a9fa80 00000000`00000000 fffff880`0dced040 : nt!PspCreateThreadNotifyRoutine+0x8
    fffff880`0dcecab8 fffff880`0457637c : fffffa80`06a9fa80 00000000`00000000 fffff880`0dced040 fffff880`0dced000 : 0xfffffa80`09830400
    fffff880`0dcecac0 fffffa80`06a9fa80 : 00000000`00000000 fffff880`0dced040 fffff880`0dced000 fffff880`0dcecdd0 : SYMEVENT64x86+0x1037c
    fffff880`0dcecac8 00000000`00000000 : fffff880`0dced040 fffff880`0dced000 fffff880`0dcecdd0 fffff801`110b813d : 0xfffffa80`06a9fa80
    
    
    
    IMAGE_NAME:  nvlddmkm.sys
    
        Loaded symbol image file: nvlddmkm.sys
        Image path: \SystemRoot\system32\DRIVERS\nvlddmkm.sys
        Image name: nvlddmkm.sys
        Timestamp:        Fri Mar 15 02:37:00 2013
    
    
    
        Loaded symbol image file: SYMEVENT64x86.SYS
        Image path: \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
        Image name: SYMEVENT64x86.SYS
        Timestamp:        Thu May 24 02:52:24 2012 

    But there Symantec/Norton is also involved. So update or remove Norton if there is no Win8 compatible version.


    "A programmer is just a tool which converts caffeine into code"

    • Proposed as answer by ZigZag3143x Sunday, April 7, 2013 4:53 PM
    • Marked as answer by Leo Huang Thursday, April 18, 2013 9:48 AM
    Sunday, April 7, 2013 7:32 AM
    Answerer
  • It seems it is solved. I uninstalled Norton with Norton remover and reinstalled it.
    • Marked as answer by Leo Huang Thursday, April 18, 2013 9:48 AM
    Thursday, April 11, 2013 3:30 PM