locked
Windows 7 x64 Ultimate BSOD RRS feed

  • Question

  • Fresh install of Windows 7 x64 Ultimate. I'm actually getting a No Screen of Death and have to hard reset. The following is from my minidump:

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [c:\Windows\Minidump\122910-8626-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7600 MP (2 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
    Machine Name:
    Kernel base = 0xfffff800`02a4e000 PsLoadedModuleList = 0xfffff800`02c8be50
    Debug session time: Wed Dec 29 19:02:37.408 2010 (UTC - 5:00)
    System Uptime: 0 days 1:23:34.468
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..........................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                       *
    *            Bugcheck Analysis                  *
    *                                       *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 7E, {ffffffffc0000005, fffff880012178cb, fffff8800a92b938, fffff8800a92b1a0}
    
    Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveClose+a3 )
    
    Followup: MachineOwner
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                       *
    *            Bugcheck Analysis                  *
    *                                       *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff880012178cb, The address that the exception occurred at
    Arg3: fffff8800a92b938, Exception Record Address
    Arg4: fffff8800a92b1a0, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    Ntfs!NtfsRemoveClose+a3
    fffff880`012178cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh
    
    EXCEPTION_RECORD: fffff8800a92b938 -- (.exr 0xfffff8800a92b938)
    ExceptionAddress: fffff880012178cb (Ntfs!NtfsRemoveClose+0x00000000000000a3)
      ExceptionCode: c0000005 (Access violation)
     ExceptionFlags: 00000000
    NumberParameters: 2
      Parameter[0]: 0000000000000000
      Parameter[1]: ffffffffffffffff
    Attempt to read from address ffffffffffffffff
    
    CONTEXT: fffff8800a92b1a0 -- (.cxr 0xfffff8800a92b1a0)
    rax=93b4fc8ef752c917 rbx=fffffa800a5646a0 rcx=fffff88001271220
    rdx=fffff88001271220 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff880012178cb rsp=fffff8800a92bb70 rbp=fffff80002c635a0
     r8=00000000ffffffff r9=0000000000000727 r10=fffff8800126f700
    r11=fffff8a0013b5960 r12=fffff88001271000 r13=0000000000000000
    r14=fffff8800a92bc08 r15=0000000000000000
    iopl=0     nv up ei ng nz na pe nc
    cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b       efl=00010282
    Ntfs!NtfsRemoveClose+0xa3:
    fffff880`012178cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh ds:002b:93b4fc8e`f752c9fb=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT: 1
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    PROCESS_NAME: System
    
    CURRENT_IRQL: 0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1: 0000000000000000
    
    EXCEPTION_PARAMETER2: ffffffffffffffff
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cf60e0
     ffffffffffffffff 
    
    FOLLOWUP_IP: 
    Ntfs!NtfsRemoveClose+a3
    fffff880`012178cb f08380e4000000ff lock add dword ptr [rax+0E4h],0FFFFFFFFh
    
    BUGCHECK_STR: 0x7E
    
    LAST_CONTROL_TRANSFER: from fffff88001297286 to fffff880012178cb
    
    STACK_TEXT: 
    fffff880`0a92bb70 fffff880`01297286 : fffffa80`0b7a2a90 00000000`00000000 fffff8a0`013ba670 fffffa80`08148180 : Ntfs!NtfsRemoveClose+0xa3
    fffff880`0a92bba0 fffff800`02acb961 : 00000000`00000000 fffff880`01216200 fffff800`02cc5100 fffff880`00000005 : Ntfs!NtfsFspClose+0x56
    fffff880`0a92bc70 fffff800`02d62c06 : fffff880`00000001 fffffa80`0b3a6040 00000000`00000080 fffffa80`06d07040 : nt!ExpWorkerThread+0x111
    fffff880`0a92bd00 fffff800`02a9cc26 : fffff880`009ee180 fffffa80`0b3a6040 fffffa80`08d62770 fffff880`01224a90 : nt!PspSystemThreadStartup+0x5a
    fffff880`0a92bd40 00000000`00000000 : fffff880`0a92c000 fffff880`0a926000 fffff880`0a92b6c0 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX: 0
    
    SYMBOL_NAME: Ntfs!NtfsRemoveClose+a3
    
    FOLLOWUP_NAME: MachineOwner
    
    MODULE_NAME: Ntfs
    
    IMAGE_NAME: Ntfs.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
    
    STACK_COMMAND: .cxr 0xfffff8800a92b1a0 ; kb
    
    FAILURE_BUCKET_ID: X64_0x7E_Ntfs!NtfsRemoveClose+a3
    
    BUCKET_ID: X64_0x7E_Ntfs!NtfsRemoveClose+a3
    
    Followup: MachineOwner
    ---------
    
    Verbose mode ON.
    

    My first guess is RAM related, but I've done memtest on them for 24 hours with no issues. Any help would be much appreciated!

    Thursday, December 30, 2010 3:36 PM

Answers

  • ok, try the other card and also test your RAM with memtest86+, please:

    http://memtest.org/


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by l1fe Wednesday, January 19, 2011 6:35 PM
    Tuesday, January 11, 2011 3:43 PM

All replies

  • BUCKET_ID: X64_0x7E_Ntfs!NtfsRemoveClos e+a3 Followup: MachineOwner --------- Verbose mode ON.

     

    Any help would be much appreciated!

    This maybe a NTFS issue.

    Run Chkdsk /f /r to detect and resolve any file system structural corruption. You must restart the system before the disk scan begins on a system partition.


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, December 30, 2010 8:33 PM
  • Checking file system on C:
    The type of the file system is NTFS.
    
    A disk check has been scheduled.
    Windows will now check the disk.             
    
    CHKDSK is verifying files (stage 1 of 5)...
     96512 file records processed.                     File verification completed.
     103 large file records processed.                   0 bad file records processed.                    2 EA records processed.                       60 reparse records processed.                    CHKDSK is verifying indexes (stage 2 of 5)...
     150470 index entries processed.                     Index verification completed.
     0 unindexed files scanned.                      0 unindexed files recovered.                    CHKDSK is verifying security descriptors (stage 3 of 5)...
     96512 file SDs/SIDs processed.                     Cleaning up 186 unused index entries from index $SII of file 0x9.
    Cleaning up 186 unused index entries from index $SDH of file 0x9.
    Cleaning up 186 unused security descriptors.
    Security descriptor verification completed.
     26980 data files processed.                      CHKDSK is verifying Usn Journal...
     35785024 USN bytes processed.                       Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
     96496 files processed.                         File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
     3215733 free clusters processed.                     Free space verification is complete.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.
    
     31260671 KB total disk space.
     18150596 KB in 69285 files.
       48164 KB in 26981 indexes.
         0 KB in bad sectors.
      198975 KB in use by the system.
       65536 KB occupied by the log file.
     12862936 KB available on disk.
    
       4096 bytes in each allocation unit.
      7815167 total allocation units on disk.
      3215734 allocation units available on disk.
    
    Internal Info:
    00 79 01 00 15 78 01 00 d5 c5 02 00 00 00 00 00 .y...x..........
    cf 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 ....<...........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    
    Windows has finished checking your disk.
    Please wait while your computer restarts.
    

    And on my second partition:

    CHKDSK is verifying files (stage 1 of 5)...
     341248 file records processed.
    File verification completed.
     104 large file records processed.
     0 bad file records processed.
     0 EA records processed.
     104 reparse records processed.
    CHKDSK is verifying indexes (stage 2 of 5)...
     386006 index entries processed.
    Index verification completed.
     0 unindexed files scanned.
     0 unindexed files recovered.
    CHKDSK is verifying security descriptors (stage 3 of 5)...
     341248 file SDs/SIDs processed.
    Security descriptor verification completed.
     22380 data files processed.
    CHKDSK is verifying Usn Journal...
     35822792 USN bytes processed.
    Usn Journal verification completed.
    CHKDSK is verifying file data (stage 4 of 5)...
     341232 files processed.
    File data verification completed.
    CHKDSK is verifying free space (stage 5 of 5)...
     2585204 free clusters processed.
    Free space verification is complete.
    CHKDSK discovered free space marked as allocated in the
    master file table (MFT) bitmap.
    CHKDSK discovered free space marked as allocated in the volume bitmap.
    Windows has made corrections to the file system.
    
     31258623 KB total disk space.
     20423044 KB in 99456 files.
       51100 KB in 22381 indexes.
         0 KB in bad sectors.
      443659 KB in use by the system.
       65536 KB occupied by the log file.
     10340820 KB available on disk.
    
       4096 bytes in each allocation unit.
      7814655 total allocation units on disk.
      2585205 allocation units available on disk.
    It looks like the SSD is fine...guess I'll have to wait for it to crash again for more info.

    Thursday, December 30, 2010 9:32 PM
  • chkdsk was able to fix some issue. Wait 1 or 2 days and look if you have new crashes. If not, chkdsk fixed it.


    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Thursday, December 30, 2010 9:43 PM
  • Hi,

     

    Did you try Andre.Ziegler’s method?

     

    Please give us any update.

     

    Best Regards,

    Miya Yao

    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     


    This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, January 4, 2011 6:52 AM
  • I did indeed run the chkdsk. I have had 2 BSODs since then. The most recent one:

     

    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

    Copyright (c) Microsoft Corporation. All rights reserved.

     

     

    Loading Dump File [c:\Windows\Minidump\010511-8314-01.dmp]

    Mini Kernel Dump File: Only registers and stack trace are available

     

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/downloads/symbols

    Executable search path is: 

    Windows 7 Kernel Version 7600 MP (2 procs) Free x64

    Product: WinNt, suite: TerminalServer SingleUserTS

    Built by: 7600.16617.amd64fre.win7_gdr.100618-1621

    Machine Name:

    Kernel base = 0xfffff800`02c16000 PsLoadedModuleList = 0xfffff800`02e53e50

    Debug session time: Tue Jan  4 22:43:31.308 2011 (UTC - 5:00)

    System Uptime: 3 days 0:02:37.243

    Loading Kernel Symbols

    ...............................................................

    ................................................................

    ................................

    Loading User Symbols

    Loading unloaded module list

    .............

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    Use !analyze -v to get detailed debugging information.

     

    BugCheck 7E, {ffffffffc0000005, fffff80002c89905, fffff8800e051248, fffff8800e050ab0}

     

    Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+30d )

     

    Followup: MachineOwner

    ---------

     

    0: kd> !analyze -v

    *******************************************************************************

    *                                                                             *

    *                        Bugcheck Analysis                                    *

    *                                                                             *

    *******************************************************************************

     

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)

    This is a very common bugcheck.  Usually the exception address pinpoints

    the driver/function that caused the problem.  Always note this address

    as well as the link date of the driver/image that contains this address.

    Arguments:

    Arg1: ffffffffc0000005, The exception code that was not handled

    Arg2: fffff80002c89905, The address that the exception occurred at

    Arg3: fffff8800e051248, Exception Record Address

    Arg4: fffff8800e050ab0, Context Record Address

     

    Debugging Details:

    ------------------

     

     

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

     

    FAULTING_IP: 

    nt!ExpInterlockedPopEntrySListFault16+0

    fffff800`02c89905 498b08          mov     rcx,qword ptr [r8]

     

    EXCEPTION_RECORD:  fffff8800e051248 -- (.exr 0xfffff8800e051248)

    ExceptionAddress: fffff80002c89905 (nt!ExpInterlockedPopEntrySListFault16)

       ExceptionCode: c0000005 (Access violation)

      ExceptionFlags: 00000000

    NumberParameters: 2

       Parameter[0]: 0000000000000000

       Parameter[1]: ffffffffffffffff

    Attempt to read from address ffffffffffffffff

     

    CONTEXT:  fffff8800e050ab0 -- (.cxr 0xfffff8800e050ab0)

    rax=0000000ddc9900ff rbx=0000000000000000 rcx=fffffa800799e3d0

    rdx=0064004d00300051 rsi=fffff8a003f0e5b0 rdi=fffffa800799d000

    rip=fffff80002c89905 rsp=fffff8800e051480 rbp=0000000040000bc0

     r8=0064004d00300050  r9=0000000000000001 r10=fffffa800799e3d0

    r11=fffff8a001b90000 r12=fffff8800e0515f8 r13=0000000000000102

    r14=fffff8800e051670 r15=0000000000000001

    iopl=0         nv up ei pl nz na po nc

    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206

    nt!ExpInterlockedPopEntrySListFault16:

    fffff800`02c89905 498b08          mov     rcx,qword ptr [r8] ds:002b:0064004d`00300050=????????????????

    Resetting default scope

     

    CUSTOMER_CRASH_COUNT:  1

     

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

     

    PROCESS_NAME:  csrss.exe

     

    CURRENT_IRQL:  0

     

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

     

    EXCEPTION_PARAMETER1:  0000000000000000

     

    EXCEPTION_PARAMETER2:  ffffffffffffffff

     

    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ebe0e0

     ffffffffffffffff 

     

    FOLLOWUP_IP: 

    dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+30d

    fffff880`03d3c161 483bc3          cmp     rax,rbx

     

    BUGCHECK_STR:  0x7E

     

    LAST_CONTROL_TRANSFER:  from fffff88003d3c161 to fffff80002c89905

     

    STACK_TEXT:  

    fffff880`0e051480 fffff880`03d3c161 : 00000000`00000002 00000000`00000000 fffff8a0`00000001 fffff8a0`00000000 : nt!ExpInterlockedPopEntrySListFault16

    fffff880`0e051490 fffff880`03d1e257 : 00000000`00000000 fffff8a0`01b90000 00000000`40000bc0 fffff8a0`091f55e0 : dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+0x30d

    fffff880`0e0515b0 fffff960`0067b3fa : 00000000`00000000 fffff900`c1c3cd20 fffff900`c1c3b020 ffffffff`fffe7960 : dxgkrnl!DxgkCddSubmitPresentHistory+0x20b

    fffff880`0e051650 fffff960`006795d5 : fffffa80`09b58110 fffffa80`09b58110 00000000`00000000 fffff900`c1c3b020 : cdd!CHwCommandBuffer::FlushGdiCommands+0x24a

    fffff880`0e051940 fffff960`00675c6e : ffffffff`fffd7522 00000000`00000010 ffffffff`00000001 00000000`00000000 : cdd!CDDPDEV::FlushGdiOutput+0x81

    fffff880`0e051970 fffff800`02f2ac06 : 00000000`056ae089 fffffa80`08a78b60 00000000`00000080 fffffa80`099f4730 : cdd!PresentWorkerThread+0x902

    fffff880`0e051d00 fffff800`02c64c26 : fffff800`02e00e80 fffffa80`08a78b60 fffffa80`09d36060 fffff880`01263534 : nt!PspSystemThreadStartup+0x5a

    fffff880`0e051d40 00000000`00000000 : fffff880`0e052000 fffff880`0e04c000 fffff880`0e0514b0 00000000`00000000 : nt!KxStartSystemThread+0x16

     

     

    SYMBOL_STACK_INDEX:  1

     

    SYMBOL_NAME:  dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+30d

     

    FOLLOWUP_NAME:  MachineOwner

     

    MODULE_NAME: dxgkrnl

     

    IMAGE_NAME:  dxgkrnl.sys

     

    DEBUG_FLR_IMAGE_TIMESTAMP:  4ac5509e

     

    STACK_COMMAND:  .cxr 0xfffff8800e050ab0 ; kb

     

    FAILURE_BUCKET_ID:  X64_0x7E_dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+30d

     

    BUCKET_ID:  X64_0x7E_dxgkrnl!DXGCONTEXT::SubmitPresentHistoryToken+30d

     

    Followup: MachineOwner

    ---------

    Wednesday, January 5, 2011 3:22 PM
  • dxgkrnl = driver for Aero. So update the driver for your graphic card.


    André


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, January 5, 2011 3:30 PM
  • I have the latest public versions for my integrated and discrete graphics cards. It seems like each BSOD is random. Maybe this is indicative of CPU/RAM issues?
    Wednesday, January 5, 2011 6:27 PM
  • please zip the dmp files and upload them.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Wednesday, January 5, 2011 9:27 PM
  • Hi,

     

    As Andre.Ziegler said, please provide us with the dump file and upload it in a public folder, you can use SkyDrive.

     

    Best Regards,

    Miya Yao

    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     


    This posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, January 7, 2011 3:47 AM
  • Sorry, was on a brief vacay. The files can be found here.

    Thanks,

    Alex

    P.S. Added another dump file from today...:'(

    • Edited by l1fe Saturday, January 8, 2011 9:35 PM added another dump file from today
    Saturday, January 8, 2011 9:10 PM
  • SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)

    This bug check indicates that a system thread generated an exception that the error handler did not catch.

    http://msdn.microsoft.com/en-us/library/ff559239%28VS.85%29.aspx


    STACK_TEXT: 
    Ntfs!NtfsRemoveClose +0xa3
    Ntfs!NtfsFspClose +0x56
    nt!ExpWorkerThread+0x111


    Check your HDD with chkdsk C: /r /f, please.

    PAGE_FAULT_IN_NONPAGED_AREA (50) - Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.

    STACK_TEXT: 
    nt!KeBugCheckEx
    nt! ?? ::FNODOBFM::`string'+0x42837
    nt!KiPageFault+0x16e
    nt!RtlCopyMemoryNonTemporal+0x79
    cdd!CopySurfBits +0xb5

    the cdd.dll is part of the Aero subsystem.


    Also which graphic device do you use? the Intel GMA X4500HD IGP or the nVIDIA GeForce G210M ?

    Check if both drivers can be updated:

    igdkmd64.sys Wed Aug 25 21:35:58 2010
    nvlddmkm.sys Sat Oct 16 19:12:46 2010

    Also update this older ACPI driver:

    ATK64AMD.sys Fri Oct 27 14:45:25 2006


    If nothing helps, please enable Driver verifier to get the causing driver:

    http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

    http://support.microsoft.com/?kbid=244617

    and configure your Windows Windows to create a kernel dump [1].

    If you get a new BSOD, boot to safe mode, disable driver verifier, reboot to normal mode and upload the zipped dump (C:\Windows\memory.dmp) to your SkyDrive.

    André

    [1] http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Proposed as answer by Miya Yao Monday, January 10, 2011 7:53 AM
    Saturday, January 8, 2011 10:01 PM
  • Another BSOD:

     

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: fffff80002df5310, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff80002e80302, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ae0e0
     fffff80002df5310 
    
    CURRENT_IRQL: 2
    
    FAULTING_IP: 
    nt!KiTimerWaitTest+1e2
    fffff800`02e80302 f0490fbaaf9044000000 lock bts qword ptr [r15+4490h],0
    
    CUSTOMER_CRASH_COUNT: 1
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    BUGCHECK_STR: 0xA
    
    PROCESS_NAME: System
    
    TRAP_FRAME: fffff80000b9c390 -- (.trap 0xfffff80000b9c390)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
    rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002e80302 rsp=fffff80000b9c520 rbp=fffffa800b420258
     r8=fffff80002ff3001 r9=0000000000000002 r10=0000000000000098
    r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0   nv up ei ng nz na pe nc
    nt!KiTimerWaitTest+0x1e2:
    fffff800`02e80302 f0490fbaaf9044000000 lock bts qword ptr [r15+4490h],0 ds:0001:00000000`00004490=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER: from fffff80002e75ca9 to fffff80002e76740
    
    STACK_TEXT: 
    fffff800`00b9c248 fffff800`02e75ca9 : 00000000`0000000a fffff800`02df5310 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff800`00b9c250 fffff800`02e74920 : 00000000`00000000 fffffa80`0b420258 fffffa80`082b81a0 fffffa80`0837c1a0 : nt!KiBugCheckDispatch+0x69
    fffff800`00b9c390 fffff800`02e80302 : ffffffff`fffdb610 fffff800`02e8229e fffff800`00b9c5f0 00000000`00000000 : nt!KiPageFault+0x260
    fffff800`00b9c520 fffff800`02e81d7d : fffffa80`0b420250 fffffa80`06e30868 fffffa80`06e30868 00000000`00000102 : nt!KiTimerWaitTest+0x1e2
    fffff800`00b9c5a0 fffff800`02e824be : 000000be`d15488e4 fffff800`00b9cc18 00000000`00502998 fffff800`02ff4588 : nt!KiProcessExpiredTimerList+0x6d
    fffff800`00b9cbf0 fffff800`02e81cb7 : 00000020`4d04cdc1 00000020`00502998 00000020`4d04cdd4 00000000`00000098 : nt!KiTimerExpiration+0x1be
    fffff800`00b9cc90 fffff800`02e7eeea : fffff800`02ff0e80 fffff800`02ffec40 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
    fffff800`00b9cd40 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd00 00000000`00000000 : nt!KiIdleLoop+0x5a
    
    
    STACK_COMMAND: kb
    
    FOLLOWUP_IP: 
    nt!KiTimerWaitTest+1e2
    fffff800`02e80302 f0490fbaaf9044000000 lock bts qword ptr [r15+4490h],0
    
    SYMBOL_STACK_INDEX: 3
    
    SYMBOL_NAME: nt!KiTimerWaitTest+1e2
    
    FOLLOWUP_NAME: MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME: ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
    
    FAILURE_BUCKET_ID: X64_0xA_nt!KiTimerWaitTest+1e2
    
    BUCKET_ID: X64_0xA_nt!KiTimerWaitTest+1e2
    
    Followup: MachineOwner

     

    I tried to enable driver verifier...but my system would freeze while logging on. Kernel dumps are enabled, but my paging file size was smaller than my 8GB of RAM so I was unable to get a memory.dmp. Have upped the page file size.

    Argh, this is frustrating...

    Oh, and I'm using the Intel integrated, although it can switch to the discrete graphics card. 

    • Edited by l1fe Monday, January 10, 2011 9:59 PM answered question
    Monday, January 10, 2011 8:44 PM
  • ok, try the other card and also test your RAM with memtest86+, please:

    http://memtest.org/


    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    • Marked as answer by l1fe Wednesday, January 19, 2011 6:35 PM
    Tuesday, January 11, 2011 3:43 PM
  • KMODE_EXCEPTION_NOT_HANDLED (1e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: fffff960003227db, The address that the exception occurred at
    Arg3: 0000000000000000, Parameter 0 of the exception
    Arg4: 0000000000000030, Parameter 1 of the exception
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    win32k!GreGetDIBitsInternalWorker+3b
    fffff960`003227db 4c8b4830    mov   r9,qword ptr [rax+30h]
    
    EXCEPTION_PARAMETER1: 0000000000000000
    
    EXCEPTION_PARAMETER2: 0000000000000030
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ad0e0
     0000000000000030 
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    BUGCHECK_STR: 0x1E_c0000005
    
    CUSTOMER_CRASH_COUNT: 1
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    PROCESS_NAME: explorer.exe
    
    CURRENT_IRQL: 0
    
    EXCEPTION_RECORD: fffff88008aa5168 -- (.exr 0xfffff88008aa5168)
    ExceptionAddress: fffff960003227db (win32k!GreGetDIBitsInternalWorker+0x000000000000003b)
      ExceptionCode: c0000005 (Access violation)
     ExceptionFlags: 00000008
    NumberParameters: 2
      Parameter[0]: 0000000000000000
      Parameter[1]: 0000000000000030
    Attempt to read from address 0000000000000030
    
    TRAP_FRAME: fffff88008aa5210 -- (.trap 0xfffff88008aa5210)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000028
    rdx=fffff900c1f747f0 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff960003227db rsp=fffff88008aa53a8 rbp=0000000000000028
     r8=fffff900c3188470 r9=fffff88008aa5638 r10=0000000000000000
    r11=fffff88008aa5510 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0     nv up ei ng nz na pe nc
    win32k!GreGetDIBitsInternalWorker+0x3b:
    fffff960`003227db 4c8b4830    mov   r9,qword ptr [rax+30h] ds:00e0:00000000`00000030=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER: from fffff80002eafa39 to fffff80002e75740
    
    STACK_TEXT: 
    fffff880`08aa4998 fffff800`02eafa39 : 00000000`0000001e ffffffff`c0000005 fffff960`003227db 00000000`00000000 : nt!KeBugCheckEx
    fffff880`08aa49a0 fffff800`02e74d82 : fffff880`08aa5168 fffff880`08aa55a0 fffff880`08aa5210 00000000`00000028 : nt!KiDispatchException+0x1b9
    fffff880`08aa5030 fffff800`02e738fa : 00000000`00000000 fffff880`08aa55a0 fffff880`08aa5500 fffff880`08aa55f0 : nt!KiExceptionDispatch+0xc2
    fffff880`08aa5210 fffff960`003227db : fffff960`002d27bd 00000000`00000020 00000000`00000000 fffff900`c021ab08 : nt!KiPageFault+0x23a
    fffff880`08aa53a8 fffff960`0017aacb : 00000000`50247c89 fffff880`08aa55a0 fffff880`08aa5590 fffff880`08aa5638 : win32k!GreGetDIBitsInternalWorker+0x3b
    fffff880`08aa5518 fffff880`08aa57e0 : fffff960`00190a09 00000000`00000400 00000000`420511cb 00000000`00000000 : win32k!GreGetDIBitsInternal+0x3df
    fffff880`08aa5608 fffff960`00190a09 : 00000000`00000400 00000000`420511cb 00000000`00000000 fffffa80`00000010 : 0xfffff880`08aa57e0
    fffff880`08aa5610 fffff800`02e74993 : 00000000`07010181 00000000`420511cb 00000000`00000000 ffffffff`00000010 : win32k!NtGdiGetDIBitsInternal+0x3cd
    fffff880`08aa56f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    
    
    STACK_COMMAND: kb
    
    FOLLOWUP_IP: 
    win32k!GreGetDIBitsInternalWorker+3b
    fffff960`003227db 4c8b4830    mov   r9,qword ptr [rax+30h]
    
    SYMBOL_STACK_INDEX: 4
    
    SYMBOL_NAME: win32k!GreGetDIBitsInternalWorker+3b
    
    FOLLOWUP_NAME: MachineOwner
    
    MODULE_NAME: win32k
    
    IMAGE_NAME: win32k.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5d3e
    
    FAILURE_BUCKET_ID: X64_0x1E_c0000005_win32k!GreGetDIBitsInternalWorker+3b
    
    BUCKET_ID: X64_0x1E_c0000005_win32k!GreGetDIBitsInternalWorker+3b
    
    Followup: MachineOwner
    
    And another one...I'm running some prime95 now will do memtest later.
    Tuesday, January 11, 2011 7:18 PM
  • BUCKET_ID: X64_0x1E_c0000005_win32k!GreGetDIBitsInternalWorker+3b
    
    this is a GDI operation. So update the graphic driver.

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 11, 2011 9:12 PM
  • ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
    An attempt was made to write to readonly memory. The guilty driver is on the
    stack trace (and is typically the current instruction pointer).
    When possible, the guilty driver's name (Unicode string) is printed on
    the bugcheck screen and saved in KiBugCheckDriver.
    Arguments:
    Arg1: fffff88000172610, Virtual address for the attempted write.
    Arg2: 0000000230400121, PTE contents.
    Arg3: fffff880037d9920, (reserved)
    Arg4: 000000000000000a, (reserved)
    
    Debugging Details:
    ------------------
    
    
    CUSTOMER_CRASH_COUNT: 1
    
    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
    
    BUGCHECK_STR: 0xBE
    
    PROCESS_NAME: chrome.exe
    
    CURRENT_IRQL: 2
    
    TRAP_FRAME: fffff880037d9920 -- (.trap 0xfffff880037d9920)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
    rdx=fffffa800852aa58 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002e91e09 rsp=fffff880037d9ab0 rbp=fffff80003007e80
     r8=0000000000000000 r9=0000000000000000 r10=fffffa8006d56200
    r11=00000000001f0003 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0     nv up ei ng nz na pe nc
    nt!KiTryUnwaitThread+0x159:
    fffff800`02e91e09 f0480fbaaf9044000000 lock bts qword ptr [rdi+4490h],0 ds:9b20:00000000`00004490=????????????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER: from fffff80002f0c448 to fffff80002e8d740
    
    STACK_TEXT: 
    fffff880`037d97b8 fffff800`02f0c448 : 00000000`000000be fffff880`00172610 00000002`30400121 fffff880`037d9920 : nt!KeBugCheckEx
    fffff880`037d97c0 fffff800`02e8b82e : fffffa80`0d3cd660 fffffa80`0852a950 fffffa80`0d14ac10 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x409b4
    fffff880`037d9920 fffff800`02e91e09 : 00000000`00000000 fffff800`031489af fffff880`037d9c60 fffffa80`0d3cd660 : nt!KiPageFault+0x16e
    fffff880`037d9ab0 fffff800`02e917d2 : fffffa80`0ce20e90 00000000`00000000 00000000`00000000 fffff800`03007e80 : nt!KiTryUnwaitThread+0x159
    fffff880`037d9b10 fffff800`031aa154 : fffff880`00000000 fffff8a0`00000001 fffffa80`06d56200 fffffa80`0ce20e98 : nt!KeSetEvent+0x142
    fffff880`037d9b80 fffff800`02e8c993 : fffffa80`0c969b60 fffffa80`07f80b01 fffff880`00000000 fffffa80`0ce20e90 : nt!NtSetEvent+0x90
    fffff880`037d9be0 00000000`74852dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`036aeee8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74852dd9
    
    
    STACK_COMMAND: kb
    
    FOLLOWUP_IP: 
    nt! ?? ::FNODOBFM::`string'+409b4
    fffff800`02f0c448 cc       int   3
    
    SYMBOL_STACK_INDEX: 1
    
    SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+409b4
    
    FOLLOWUP_NAME: MachineOwner
    
    MODULE_NAME: nt
    
    IMAGE_NAME: ntkrnlmp.exe
    
    DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
    
    FAILURE_BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+409b4
    
    BUCKET_ID: X64_0xBE_nt!_??_::FNODOBFM::_string_+409b4
    
    Followup: MachineOwner

    And another one. Not sure what else I can do with the graphic drivers. Both are up to date (I even rolled back to the laptop's latest drivers). Does this latest dump also indicate a graphics problem?
    Tuesday, January 11, 2011 9:50 PM
  • check your RAM please!

    "A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
    Tuesday, January 11, 2011 10:11 PM
  • The ASUS software for my laptop does a software overclock in Windows, which I think is ultimately leading to the instability (even though it's using the "factory settings"). I turned off their "Turbo Mode" and was able to do prime95 testing for 20+ hours. Will check if that solves the problem, but ultimately may have to RMA to ASUS since the hardware is not supporting the the main feature of the UL80VT (an overclocked ULV). If this is indeed the problem, I'll mark the RAM as being the answer.

    Thanks for the help.

    Wednesday, January 12, 2011 6:19 PM