locked
Windows 7 Ultimate 32-Bit Crashes frequently with Blue screens. RRS feed

  • Question

  • Hi

    Hello every one I run Windows 7 32-Bit Ultimate/Ubuntu 11.10 dual boot system. My problem is my system crashes frequently with blue screens. Each the blue screen code differs. So foe additional information I am posting links to mini dump files.

    1. https://skydrive.live.com/redir.aspx?cid=60970af721cbedd3&resid=60970AF721CBEDD3!131&parid=60970AF721CBEDD3!120&authkey=!AGnm27vCUkzrXyM

    2. https://skydrive.live.com/redir.aspx?cid=60970af721cbedd3&resid=60970AF721CBEDD3!132&parid=60970AF721CBEDD3!120&authkey=!AC-KQ51riQcrVpM

    3. https://skydrive.live.com/redir.aspx?cid=60970af721cbedd3&resid=60970AF721CBEDD3!133&parid=60970AF721CBEDD3!120&authkey=!AI0ftTMT5LBlwSc

    4.https://skydrive.live.com/redir.aspx?cid=60970af721cbedd3&resid=60970AF721CBEDD3!134&parid=60970AF721CBEDD3!120&authkey=!AHGLN4JoIm-86lc

    5. https://skydrive.live.com/redir.aspx?cid=60970af721cbedd3&resid=60970AF721CBEDD3!135&parid=60970AF721CBEDD3!120&authkey=!AN3XxmV9N4dqQ14

    Sunday, March 4, 2012 11:10 AM

Answers

  • Check your memory.  A lot of BSODs can be traced to bad memory.

    Windows 7 has a built-in rudimentary memory checker that can help.

    Boot with a Windows 7 DVD.  At the first screen, hit <SHIFT>+<F10>.  You will see that you are at x:\Sources>.  CD into Recovery (cd recovery).  Type RecEnv.exe, click Next.  Select the top radio button that reads, "Use recovery tools . . . ."  Select Windows Memory Diagnostic and chose the restart now option.  

    For a more thorough check, however, head over to http://www.memtest.org/ and download the latest version.  Burn the ISO to a disk or make a bootable USB drive.  Boot and follow the on-screen instructions. 

    A not-so-nice screen of failed memory.







    • Marked as answer by Nicholas Li Wednesday, April 4, 2012 8:49 AM
    Sunday, March 4, 2012 6:23 PM
  • All the BSOD's are linked with drivers causing corruption.

    There are loaded drivers dating back to 2001! Any 3rd party driver pre-dating mid-2009 needs updating, removing or disabling.

    Debug session time: Sun Mar  4 10:47:07.572 2012 (UTC + 0:00)
    System Uptime: 0 days 0:09:56.710
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {c2c0dd89, 2, 1, 912ed81b}
    
    Unable to load image nvlddmkm.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for nvlddmkm.sys
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
    Probably caused by : hardware ( nvlddmkm+e781b )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: c2c0dd89, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 912ed81b, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b7d718
    Unable to read MiSystemVaType memory at 82b5d160
     c2c0dd89 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  System
    
    TRAP_FRAME:  93ff5844 -- (.trap 0xffffffff93ff5844)
    ErrCode = 00000002
    eax=8700acd8 ebx=8700ab80 ecx=d6fe1048 edx=00000004 esi=89138b50 edi=93ff58cc
    eip=912ed81b esp=93ff58b8 ebp=93ff58c3 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    nvlddmkm+0xe781b:
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl ds:0023:c2c0dd89=??
    Resetting default scope
    
    MISALIGNED_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    LAST_CONTROL_TRANSFER:  from 912ed81b to 82a5b86b
    
    STACK_TEXT:  
    93ff5844 912ed81b badb0d00 00000004 00000000 nt!KiTrap0E+0x2cf
    WARNING: Stack unwind information not available. Following frames may be wrong.
    93ff58c3 2fdb0e87 00000091 37300000 3792e08f nvlddmkm+0xe781b
    93ff58c7 00000000 37300000 3792e08f 00ab808f 0x2fdb0e87
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nvlddmkm+e781b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: hardware
    
    IMAGE_NAME:  hardware
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    FAILURE_BUCKET_ID:  IP_MISALIGNED_nvlddmkm.sys
    
    BUCKET_ID:  IP_MISALIGNED_nvlddmkm.sys
    
    Followup: MachineOwner
    
    ================================================================================
    
    Debug session time: Sat Mar  3 13:59:27.231 2012 (UTC + 0:00)
    System Uptime: 0 days 0:19:46.230
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {5000010, 2, 0, 835b5885}
    
    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+21f99 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 05000010, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 835b5885, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from 82bb9718
    Unable to read MiSystemVaType memory at 82b99160
     05000010 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    fltmgr!TreeFindNodeOrParent+11
    835b5885 8b4110          mov     eax,dword ptr [ecx+10h]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  explorer.exe
    
    TRAP_FRAME:  bf6b36bc -- (.trap 0xffffffffbf6b36bc)
    ErrCode = 00000000
    eax=05000000 ebx=bb3cedcc ecx=05000000 edx=00000000 esi=89f9bdd8 edi=00000000
    eip=835b5885 esp=bf6b3730 ebp=bf6b3730 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    fltmgr!TreeFindNodeOrParent+0x11:
    835b5885 8b4110          mov     eax,dword ptr [ecx+10h] ds:0023:05000010=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 835b5885 to 82a9786b
    
    STACK_TEXT:  
    bf6b36bc 835b5885 badb0d00 00000000 84b2c1e0 nt!KiTrap0E+0x2cf
    bf6b3730 835b5920 8bf60fd0 bb3cedcc 00000000 fltmgr!TreeFindNodeOrParent+0x11
    bf6b3758 835d11ee 8bf60fd0 89f9bdd8 bb3cedcc fltmgr!TreeInsert+0x20
    bf6b3780 835d1d27 00384d98 bb3cedcc 00000004 fltmgr!FltpvLinkResourceToFilter+0x10c
    bf6b37b0 84f69f99 89f32ec8 00000102 bf6b37e8 fltmgr!FltvGetFileNameInformation+0x53
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bf6b37cc 84f7067e 89f32ec8 00000102 bf6b37e8 klif+0x21f99
    bf6b37ec 84f70751 89f32ec8 00000001 bf6b380c klif+0x2867e
    bf6b3818 84f67429 89f32ec8 8c2fefa8 00000001 klif+0x28751
    bf6b38fc 835d2627 89f32ec8 bf6b3994 bf6b39c0 klif+0x1f429
    bf6b3974 835adaeb 89f32ec8 bf6b3994 bf6b39c0 fltmgr!FltvPreOperation+0x81
    bf6b39e0 835b09f0 bf6b3a24 9642ed08 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
    bf6b39f8 835c41fe bf6b3a24 835c7f3c 00000000 fltmgr!FltpPassThroughInternal+0x40
    bf6b3a0c 835c48b7 bf6b3a24 84b84a50 8c1ceaa0 fltmgr!FltpCreateInternal+0x24
    bf6b3a50 82d806c3 84b84a50 8bf14ae0 8594a5d8 fltmgr!FltpCreate+0x2c9
    bf6b3a74 82a8d473 00000000 8594a634 84b84a50 nt!IovCallDriver+0x258
    bf6b3a88 82c91b8d a77240d2 bf6b3c30 00000000 nt!IofCallDriver+0x1b
    bf6b3b60 82c725f3 8a722b00 85bc2f78 8c0d0008 nt!IopParseDevice+0xed7
    bf6b3bdc 82c987b9 00000000 bf6b3c30 00000040 nt!ObpLookupObjectName+0x4fa
    bf6b3c38 82c90b0b 04eee65c 84bc2f78 82a97601 nt!ObOpenObjectByName+0x165
    bf6b3cb4 82c9c422 04eee684 80100080 04eee65c nt!IopCreateFile+0x673
    bf6b3d00 82a9448a 04eee684 80100080 04eee65c nt!NtCreateFile+0x34
    bf6b3d00 77596194 04eee684 80100080 04eee65c nt!KiFastCallEntry+0x12a
    04eee688 00000000 00000000 00000000 00000000 0x77596194
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    klif+21f99
    84f69f99 ??              ???
    
    SYMBOL_STACK_INDEX:  5
    
    SYMBOL_NAME:  klif+21f99
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: klif
    
    IMAGE_NAME:  klif.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb73f
    
    FAILURE_BUCKET_ID:  0xD1_VRF_klif+21f99
    
    BUCKET_ID:  0xD1_VRF_klif+21f99
    
    Followup: MachineOwner
    ---------
    
    ============================================================================
    
    Debug session time: Mon Feb 20 05:37:45.429 2012 (UTC + 0:00)
    System Uptime: 0 days 0:22:29.536
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {b1da6edf, 0, 0, 82a33a52}
    
    Probably caused by : memory_corruption ( nt!MiTrimWorkingSet+e7 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: b1da6edf, memory referenced
    Arg2: 00000000, IRQL
    Arg3: 00000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 82a33a52, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from 82b79718
    Unable to read MiSystemVaType memory at 82b59160
     b1da6edf 
    
    CURRENT_IRQL:  0
    
    FAULTING_IP: 
    nt!MiTrimWorkingSet+e7
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  avp.exe
    
    TRAP_FRAME:  87b7daec -- (.trap 0xffffffff87b7daec)
    ErrCode = 00000000
    eax=c0022818 ebx=00000000 ecx=b1da6ed0 edx=00000020 esi=00022818 edi=c0802000
    eip=82a33a52 esp=87b7db60 ebp=87b7dc14 iopl=0         nv up ei pl nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
    nt!MiTrimWorkingSet+0xe7:
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]      ds:0023:b1da6edf=??
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 82a33a52 to 82a5786b
    
    STACK_TEXT:  
    87b7daec 82a33a52 badb0d00 00000020 00000000 nt!KiTrap0E+0x2cf
    87b7dc14 82a846ef 0000001a a0b73220 00000004 nt!MiTrimWorkingSet+0xe7
    87b7dc5c 82a84400 00000001 00000001 00000000 nt!MiProcessWorkingSets+0x20f
    87b7dc88 82a9a282 00000000 84bb9448 00000000 nt!MmWorkingSetManager+0xa4
    87b7dd50 82c1fa55 00000000 9fa8602f 00000000 nt!KeBalanceSetManager+0xf2
    87b7dd90 82ad1219 82a9a190 00000000 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiTrimWorkingSet+e7
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt!MiTrimWorkingSet+e7
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76ed3
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  0xA_VRF_nt!MiTrimWorkingSet+e7
    
    BUCKET_ID:  0xA_VRF_nt!MiTrimWorkingSet+e7
    
    Followup: MachineOwner
    ---------
    
    ==========================================================================
    
    Debug session time: Tue Feb 14 04:12:57.216 2012 (UTC + 0:00)
    System Uptime: 0 days 0:22:48.354
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {c000001d, 835c2097, 87b71a1c, 87b71600}
    
    Probably caused by : hardware ( fltmgr!FltpGetStreamListCtrl+1b7 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c000001d, The exception code that was not handled
    Arg2: 835c2097, The address that the exception occurred at
    Arg3: 87b71a1c, Exception Record Address
    Arg4: 87b71600, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.
    
    FAULTING_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    EXCEPTION_RECORD:  87b71a1c -- (.exr 0xffffffff87b71a1c)
    ExceptionAddress: 835c2097 (fltmgr!FltpGetStreamListCtrl+0x000001b7)
       ExceptionCode: c000001d (Illegal instruction)
      ExceptionFlags: 00000000
    NumberParameters: 0
    
    CONTEXT:  87b71600 -- (.cxr 0xffffffff87b71600)
    eax=00000000 ebx=b161aec8 ecx=a79d9114 edx=00000004 esi=8ce32460 edi=00000000
    eip=835c2097 esp=87b71ae4 ebp=87b71b14 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    fltmgr!FltpGetStreamListCtrl+0x1b7:
    835c2097 fe              ???
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0x7E
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.
    
    MISALIGNED_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    LAST_CONTROL_TRANSFER:  from 835baa9d to 835c2097
    
    FAILED_INSTRUCTION_ADDRESS: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    STACK_TEXT:  
    87b71b14 835baa9d 8bfc4ae0 8ce32460 00000000 fltmgr!FltpGetStreamListCtrl+0x1b7
    87b71b84 835bd9f0 87b71bd8 a59bad08 a59bafdc fltmgr!FltpPerformPreCallbacks+0x2ff
    87b71b9c 835bdf01 87b71bd8 00000000 8a7b6ac8 fltmgr!FltpPassThroughInternal+0x40
    87b71bc0 835be3ba 02b71bd8 a59bad08 8a7b6ac8 fltmgr!FltpPassThrough+0x203
    87b71bf0 82d776c3 8a7b6ac8 a59bad08 a59bad08 fltmgr!FltpDispatch+0xb4
    87b71c14 82a84473 00000000 8c043034 8a7b6ac8 nt!IovCallDriver+0x258
    87b71c28 82c8a327 84bcdf78 8ce32448 00000000 nt!IofCallDriver+0x1b
    87b71c6c 82c69b10 8ce32460 8ce32460 8ce32448 nt!IopDeleteFile+0x10c
    87b71c84 82ab10a0 00000000 000c0000 00000000 nt!ObpRemoveObjectRoutine+0x59
    87b71c98 82ab1010 8ce32460 82c79f55 89ff4d50 nt!ObfDereferenceObjectWithTag+0x88
    87b71ca0 82c79f55 89ff4d50 89ff4d78 82bb26c0 nt!ObfDereferenceObject+0xd
    87b71ccc 82a73f19 89ff4d50 00000000 00000000 nt!MiSegmentDelete+0x191
    87b71d28 82a73e31 84bd3020 00000000 00000000 nt!MiProcessDereferenceList+0xdb
    87b71d50 82c56a55 00000000 9fadf0f9 00000000 nt!MiDereferenceSegmentThread+0xc5
    87b71d90 82b08219 82a73d6a 00000000 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
    
    
    FOLLOWUP_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  fltmgr!FltpGetStreamListCtrl+1b7
    
    FOLLOWUP_NAME:  MachineOwner
    
    IMAGE_NAME:  hardware
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    STACK_COMMAND:  .cxr 0xffffffff87b71600 ; kb
    
    MODULE_NAME: hardware
    
    FAILURE_BUCKET_ID:  IP_MISALIGNED
    
    BUCKET_ID:  IP_MISALIGNED
    
    Followup: MachineOwner
    ---------
    
    ===========================================================================
    
    Debug session time: Tue Feb 14 06:03:12.804 2012 (UTC + 0:00)
    System Uptime: 0 days 0:04:46.911
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000008E, {c0000005, 9b2c188b, b7296a00, 0}
    
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 9b2c188b, The address that the exception occurred at
    Arg3: b7296a00, Trap Frame
    Arg4: 00000000
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    win32k!xxxDCEWindowHitTest2+34
    9b2c188b 3b00            cmp     eax,dword ptr [eax]
    
    TRAP_FRAME:  b7296a00 -- (.trap 0xffffffffb7296a00)
    ErrCode = 00000000
    eax=00000000 ebx=00000000 ecx=000001c9 edx=000001ab esi=fca00618 edi=00000001
    eip=9b2c188b esp=b7296a74 ebp=b7296aac iopl=0         nv up ei pl nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
    win32k!xxxDCEWindowHitTest2+0x34:
    9b2c188b 3b00            cmp     eax,dword ptr [eax]  ds:0023:00000000=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0x8E
    
    PROCESS_NAME:  taskmgr.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 9b2c16f9 to 9b2c188b
    
    STACK_TEXT:  
    b7296aac 9b2c16f9 fca00618 00000200 00000000 win32k!xxxDCEWindowHitTest2+0x34
    b7296ae8 9b2c4c5f fca00618 00000200 00000000 win32k!xxxDCEWindowHitTest+0x4d
    b7296c50 9b30add2 fe14c8c0 b7296ce8 00000000 win32k!xxxScanSysQueue+0x873
    b7296cb8 9b31233b b7296ce8 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x32e
    b7296d1c 82a8f48a 0022f610 00000000 00000000 win32k!NtUserGetMessage+0x3f
    b7296d1c 77ad6194 0022f610 00000000 00000000 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0022f5e8 00000000 00000000 00000000 00000000 0x77ad6194
    
    
    STACK_COMMAND:  kb
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -db !win32k
    8 errors : !win32k (9b2c1884-9b2c18bc)
    9b2c1880  ff  ff  89  5d *00  89  55  f0  89  4d  f4  3b *00  75  07  33 ...]..U..M.;.u.3
    9b2c1890  c0  e9  02  01 *0d  00  f6  46  23  10  74  f3 *40  9e  a4  00 .......F#.t.@...
    9b2c18a0  00  00  74  3a *00  45  24  04  75  34  8b  86 *00  00  00  00 ..t:.E$.u4......
    9b2c18b0  3b  c3  74  0a *0d  4d  d4  51  50  e8  a8  0d *40  00  8d  45 ;.t..M.QP...@..E
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MEMORY_CORRUPTOR:  STRIDE
    
    FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
    
    BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
    
    Followup: memory_corruption
    ---------
    

    • Marked as answer by Nicholas Li Wednesday, April 4, 2012 8:49 AM
    Monday, March 5, 2012 12:48 PM

All replies

  • Check your memory.  A lot of BSODs can be traced to bad memory.

    Windows 7 has a built-in rudimentary memory checker that can help.

    Boot with a Windows 7 DVD.  At the first screen, hit <SHIFT>+<F10>.  You will see that you are at x:\Sources>.  CD into Recovery (cd recovery).  Type RecEnv.exe, click Next.  Select the top radio button that reads, "Use recovery tools . . . ."  Select Windows Memory Diagnostic and chose the restart now option.  

    For a more thorough check, however, head over to http://www.memtest.org/ and download the latest version.  Burn the ISO to a disk or make a bootable USB drive.  Boot and follow the on-screen instructions. 

    A not-so-nice screen of failed memory.







    • Marked as answer by Nicholas Li Wednesday, April 4, 2012 8:49 AM
    Sunday, March 4, 2012 6:23 PM
  • All the BSOD's are linked with drivers causing corruption.

    There are loaded drivers dating back to 2001! Any 3rd party driver pre-dating mid-2009 needs updating, removing or disabling.

    Debug session time: Sun Mar  4 10:47:07.572 2012 (UTC + 0:00)
    System Uptime: 0 days 0:09:56.710
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {c2c0dd89, 2, 1, 912ed81b}
    
    Unable to load image nvlddmkm.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for nvlddmkm.sys
    *** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
    Probably caused by : hardware ( nvlddmkm+e781b )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: c2c0dd89, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 912ed81b, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b7d718
    Unable to read MiSystemVaType memory at 82b5d160
     c2c0dd89 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  System
    
    TRAP_FRAME:  93ff5844 -- (.trap 0xffffffff93ff5844)
    ErrCode = 00000002
    eax=8700acd8 ebx=8700ab80 ecx=d6fe1048 edx=00000004 esi=89138b50 edi=93ff58cc
    eip=912ed81b esp=93ff58b8 ebp=93ff58c3 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    nvlddmkm+0xe781b:
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl ds:0023:c2c0dd89=??
    Resetting default scope
    
    MISALIGNED_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    LAST_CONTROL_TRANSFER:  from 912ed81b to 82a5b86b
    
    STACK_TEXT:  
    93ff5844 912ed81b badb0d00 00000004 00000000 nt!KiTrap0E+0x2cf
    WARNING: Stack unwind information not available. Following frames may be wrong.
    93ff58c3 2fdb0e87 00000091 37300000 3792e08f nvlddmkm+0xe781b
    93ff58c7 00000000 37300000 3792e08f 00ab808f 0x2fdb0e87
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nvlddmkm+e781b
    912ed81b 088b0932c03b    or      byte ptr [ebx+3BC03209h],cl
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nvlddmkm+e781b
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: hardware
    
    IMAGE_NAME:  hardware
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    FAILURE_BUCKET_ID:  IP_MISALIGNED_nvlddmkm.sys
    
    BUCKET_ID:  IP_MISALIGNED_nvlddmkm.sys
    
    Followup: MachineOwner
    
    ================================================================================
    
    Debug session time: Sat Mar  3 13:59:27.231 2012 (UTC + 0:00)
    System Uptime: 0 days 0:19:46.230
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck D1, {5000010, 2, 0, 835b5885}
    
    Unable to load image \SystemRoot\system32\DRIVERS\klif.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for klif.sys
    *** ERROR: Module load completed but symbols could not be loaded for klif.sys
    Probably caused by : klif.sys ( klif+21f99 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arguments:
    Arg1: 05000010, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 835b5885, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from 82bb9718
    Unable to read MiSystemVaType memory at 82b99160
     05000010 
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    fltmgr!TreeFindNodeOrParent+11
    835b5885 8b4110          mov     eax,dword ptr [ecx+10h]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xD1
    
    PROCESS_NAME:  explorer.exe
    
    TRAP_FRAME:  bf6b36bc -- (.trap 0xffffffffbf6b36bc)
    ErrCode = 00000000
    eax=05000000 ebx=bb3cedcc ecx=05000000 edx=00000000 esi=89f9bdd8 edi=00000000
    eip=835b5885 esp=bf6b3730 ebp=bf6b3730 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    fltmgr!TreeFindNodeOrParent+0x11:
    835b5885 8b4110          mov     eax,dword ptr [ecx+10h] ds:0023:05000010=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 835b5885 to 82a9786b
    
    STACK_TEXT:  
    bf6b36bc 835b5885 badb0d00 00000000 84b2c1e0 nt!KiTrap0E+0x2cf
    bf6b3730 835b5920 8bf60fd0 bb3cedcc 00000000 fltmgr!TreeFindNodeOrParent+0x11
    bf6b3758 835d11ee 8bf60fd0 89f9bdd8 bb3cedcc fltmgr!TreeInsert+0x20
    bf6b3780 835d1d27 00384d98 bb3cedcc 00000004 fltmgr!FltpvLinkResourceToFilter+0x10c
    bf6b37b0 84f69f99 89f32ec8 00000102 bf6b37e8 fltmgr!FltvGetFileNameInformation+0x53
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bf6b37cc 84f7067e 89f32ec8 00000102 bf6b37e8 klif+0x21f99
    bf6b37ec 84f70751 89f32ec8 00000001 bf6b380c klif+0x2867e
    bf6b3818 84f67429 89f32ec8 8c2fefa8 00000001 klif+0x28751
    bf6b38fc 835d2627 89f32ec8 bf6b3994 bf6b39c0 klif+0x1f429
    bf6b3974 835adaeb 89f32ec8 bf6b3994 bf6b39c0 fltmgr!FltvPreOperation+0x81
    bf6b39e0 835b09f0 bf6b3a24 9642ed08 00000000 fltmgr!FltpPerformPreCallbacks+0x34d
    bf6b39f8 835c41fe bf6b3a24 835c7f3c 00000000 fltmgr!FltpPassThroughInternal+0x40
    bf6b3a0c 835c48b7 bf6b3a24 84b84a50 8c1ceaa0 fltmgr!FltpCreateInternal+0x24
    bf6b3a50 82d806c3 84b84a50 8bf14ae0 8594a5d8 fltmgr!FltpCreate+0x2c9
    bf6b3a74 82a8d473 00000000 8594a634 84b84a50 nt!IovCallDriver+0x258
    bf6b3a88 82c91b8d a77240d2 bf6b3c30 00000000 nt!IofCallDriver+0x1b
    bf6b3b60 82c725f3 8a722b00 85bc2f78 8c0d0008 nt!IopParseDevice+0xed7
    bf6b3bdc 82c987b9 00000000 bf6b3c30 00000040 nt!ObpLookupObjectName+0x4fa
    bf6b3c38 82c90b0b 04eee65c 84bc2f78 82a97601 nt!ObOpenObjectByName+0x165
    bf6b3cb4 82c9c422 04eee684 80100080 04eee65c nt!IopCreateFile+0x673
    bf6b3d00 82a9448a 04eee684 80100080 04eee65c nt!NtCreateFile+0x34
    bf6b3d00 77596194 04eee684 80100080 04eee65c nt!KiFastCallEntry+0x12a
    04eee688 00000000 00000000 00000000 00000000 0x77596194
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    klif+21f99
    84f69f99 ??              ???
    
    SYMBOL_STACK_INDEX:  5
    
    SYMBOL_NAME:  klif+21f99
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: klif
    
    IMAGE_NAME:  klif.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb73f
    
    FAILURE_BUCKET_ID:  0xD1_VRF_klif+21f99
    
    BUCKET_ID:  0xD1_VRF_klif+21f99
    
    Followup: MachineOwner
    ---------
    
    ============================================================================
    
    Debug session time: Mon Feb 20 05:37:45.429 2012 (UTC + 0:00)
    System Uptime: 0 days 0:22:29.536
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {b1da6edf, 0, 0, 82a33a52}
    
    Probably caused by : memory_corruption ( nt!MiTrimWorkingSet+e7 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: b1da6edf, memory referenced
    Arg2: 00000000, IRQL
    Arg3: 00000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 82a33a52, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from 82b79718
    Unable to read MiSystemVaType memory at 82b59160
     b1da6edf 
    
    CURRENT_IRQL:  0
    
    FAULTING_IP: 
    nt!MiTrimWorkingSet+e7
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  avp.exe
    
    TRAP_FRAME:  87b7daec -- (.trap 0xffffffff87b7daec)
    ErrCode = 00000000
    eax=c0022818 ebx=00000000 ecx=b1da6ed0 edx=00000020 esi=00022818 edi=c0802000
    eip=82a33a52 esp=87b7db60 ebp=87b7dc14 iopl=0         nv up ei pl nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
    nt!MiTrimWorkingSet+0xe7:
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]      ds:0023:b1da6edf=??
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from 82a33a52 to 82a5786b
    
    STACK_TEXT:  
    87b7daec 82a33a52 badb0d00 00000020 00000000 nt!KiTrap0E+0x2cf
    87b7dc14 82a846ef 0000001a a0b73220 00000004 nt!MiTrimWorkingSet+0xe7
    87b7dc5c 82a84400 00000001 00000001 00000000 nt!MiProcessWorkingSets+0x20f
    87b7dc88 82a9a282 00000000 84bb9448 00000000 nt!MmWorkingSetManager+0xa4
    87b7dd50 82c1fa55 00000000 9fa8602f 00000000 nt!KeBalanceSetManager+0xf2
    87b7dd90 82ad1219 82a9a190 00000000 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    nt!MiTrimWorkingSet+e7
    82a33a52 8a510f          mov     dl,byte ptr [ecx+0Fh]
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  nt!MiTrimWorkingSet+e7
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: nt
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76ed3
    
    IMAGE_NAME:  memory_corruption
    
    FAILURE_BUCKET_ID:  0xA_VRF_nt!MiTrimWorkingSet+e7
    
    BUCKET_ID:  0xA_VRF_nt!MiTrimWorkingSet+e7
    
    Followup: MachineOwner
    ---------
    
    ==========================================================================
    
    Debug session time: Tue Feb 14 04:12:57.216 2012 (UTC + 0:00)
    System Uptime: 0 days 0:22:48.354
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {c000001d, 835c2097, 87b71a1c, 87b71600}
    
    Probably caused by : hardware ( fltmgr!FltpGetStreamListCtrl+1b7 )
    
    Followup: MachineOwner
    ---------
    
    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c000001d, The exception code that was not handled
    Arg2: 835c2097, The address that the exception occurred at
    Arg3: 87b71a1c, Exception Record Address
    Arg4: 87b71600, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.
    
    FAULTING_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    EXCEPTION_RECORD:  87b71a1c -- (.exr 0xffffffff87b71a1c)
    ExceptionAddress: 835c2097 (fltmgr!FltpGetStreamListCtrl+0x000001b7)
       ExceptionCode: c000001d (Illegal instruction)
      ExceptionFlags: 00000000
    NumberParameters: 0
    
    CONTEXT:  87b71600 -- (.cxr 0xffffffff87b71600)
    eax=00000000 ebx=b161aec8 ecx=a79d9114 edx=00000004 esi=8ce32460 edi=00000000
    eip=835c2097 esp=87b71ae4 ebp=87b71b14 iopl=0         nv up ei pl nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
    fltmgr!FltpGetStreamListCtrl+0x1b7:
    835c2097 fe              ???
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
    
    BUGCHECK_STR:  0x7E
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.
    
    MISALIGNED_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    LAST_CONTROL_TRANSFER:  from 835baa9d to 835c2097
    
    FAILED_INSTRUCTION_ADDRESS: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    STACK_TEXT:  
    87b71b14 835baa9d 8bfc4ae0 8ce32460 00000000 fltmgr!FltpGetStreamListCtrl+0x1b7
    87b71b84 835bd9f0 87b71bd8 a59bad08 a59bafdc fltmgr!FltpPerformPreCallbacks+0x2ff
    87b71b9c 835bdf01 87b71bd8 00000000 8a7b6ac8 fltmgr!FltpPassThroughInternal+0x40
    87b71bc0 835be3ba 02b71bd8 a59bad08 8a7b6ac8 fltmgr!FltpPassThrough+0x203
    87b71bf0 82d776c3 8a7b6ac8 a59bad08 a59bad08 fltmgr!FltpDispatch+0xb4
    87b71c14 82a84473 00000000 8c043034 8a7b6ac8 nt!IovCallDriver+0x258
    87b71c28 82c8a327 84bcdf78 8ce32448 00000000 nt!IofCallDriver+0x1b
    87b71c6c 82c69b10 8ce32460 8ce32460 8ce32448 nt!IopDeleteFile+0x10c
    87b71c84 82ab10a0 00000000 000c0000 00000000 nt!ObpRemoveObjectRoutine+0x59
    87b71c98 82ab1010 8ce32460 82c79f55 89ff4d50 nt!ObfDereferenceObjectWithTag+0x88
    87b71ca0 82c79f55 89ff4d50 89ff4d78 82bb26c0 nt!ObfDereferenceObject+0xd
    87b71ccc 82a73f19 89ff4d50 00000000 00000000 nt!MiSegmentDelete+0x191
    87b71d28 82a73e31 84bd3020 00000000 00000000 nt!MiProcessDereferenceList+0xdb
    87b71d50 82c56a55 00000000 9fadf0f9 00000000 nt!MiDereferenceSegmentThread+0xc5
    87b71d90 82b08219 82a73d6a 00000000 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
    
    
    FOLLOWUP_IP: 
    fltmgr!FltpGetStreamListCtrl+1b7
    835c2097 fe              ???
    
    SYMBOL_STACK_INDEX:  0
    
    SYMBOL_NAME:  fltmgr!FltpGetStreamListCtrl+1b7
    
    FOLLOWUP_NAME:  MachineOwner
    
    IMAGE_NAME:  hardware
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    STACK_COMMAND:  .cxr 0xffffffff87b71600 ; kb
    
    MODULE_NAME: hardware
    
    FAILURE_BUCKET_ID:  IP_MISALIGNED
    
    BUCKET_ID:  IP_MISALIGNED
    
    Followup: MachineOwner
    ---------
    
    ===========================================================================
    
    Debug session time: Tue Feb 14 06:03:12.804 2012 (UTC + 0:00)
    System Uptime: 0 days 0:04:46.911
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................
    Loading User Symbols
    Loading unloaded module list
    ....
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000008E, {c0000005, 9b2c188b, b7296a00, 0}
    
    Probably caused by : memory_corruption
    
    Followup: memory_corruption
    ---------
    
    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 9b2c188b, The address that the exception occurred at
    Arg3: b7296a00, Trap Frame
    Arg4: 00000000
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    FAULTING_IP: 
    win32k!xxxDCEWindowHitTest2+34
    9b2c188b 3b00            cmp     eax,dword ptr [eax]
    
    TRAP_FRAME:  b7296a00 -- (.trap 0xffffffffb7296a00)
    ErrCode = 00000000
    eax=00000000 ebx=00000000 ecx=000001c9 edx=000001ab esi=fca00618 edi=00000001
    eip=9b2c188b esp=b7296a74 ebp=b7296aac iopl=0         nv up ei pl nz na po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
    win32k!xxxDCEWindowHitTest2+0x34:
    9b2c188b 3b00            cmp     eax,dword ptr [eax]  ds:0023:00000000=????????
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  CODE_CORRUPTION
    
    BUGCHECK_STR:  0x8E
    
    PROCESS_NAME:  taskmgr.exe
    
    CURRENT_IRQL:  0
    
    LAST_CONTROL_TRANSFER:  from 9b2c16f9 to 9b2c188b
    
    STACK_TEXT:  
    b7296aac 9b2c16f9 fca00618 00000200 00000000 win32k!xxxDCEWindowHitTest2+0x34
    b7296ae8 9b2c4c5f fca00618 00000200 00000000 win32k!xxxDCEWindowHitTest+0x4d
    b7296c50 9b30add2 fe14c8c0 b7296ce8 00000000 win32k!xxxScanSysQueue+0x873
    b7296cb8 9b31233b b7296ce8 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x32e
    b7296d1c 82a8f48a 0022f610 00000000 00000000 win32k!NtUserGetMessage+0x3f
    b7296d1c 77ad6194 0022f610 00000000 00000000 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0022f5e8 00000000 00000000 00000000 00000000 0x77ad6194
    
    
    STACK_COMMAND:  kb
    
    CHKIMG_EXTENSION: !chkimg -lo 50 -db !win32k
    8 errors : !win32k (9b2c1884-9b2c18bc)
    9b2c1880  ff  ff  89  5d *00  89  55  f0  89  4d  f4  3b *00  75  07  33 ...]..U..M.;.u.3
    9b2c1890  c0  e9  02  01 *0d  00  f6  46  23  10  74  f3 *40  9e  a4  00 .......F#.t.@...
    9b2c18a0  00  00  74  3a *00  45  24  04  75  34  8b  86 *00  00  00  00 ..t:.E$.u4......
    9b2c18b0  3b  c3  74  0a *0d  4d  d4  51  50  e8  a8  0d *40  00  8d  45 ;.t..M.QP...@..E
    
    MODULE_NAME: memory_corruption
    
    IMAGE_NAME:  memory_corruption
    
    FOLLOWUP_NAME:  memory_corruption
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  0
    
    MEMORY_CORRUPTOR:  STRIDE
    
    FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
    
    BUCKET_ID:  MEMORY_CORRUPTION_STRIDE
    
    Followup: memory_corruption
    ---------
    

    • Marked as answer by Nicholas Li Wednesday, April 4, 2012 8:49 AM
    Monday, March 5, 2012 12:48 PM