locked
Blue Screens (BSOD) after Windows 7 Reinstallation RRS feed

  • Question

  • Hello Microsoft Experts,

    I recently reinstalled Windows 7 Pro 64-bit on my desktop, installed all Windows Updates, and then installed device drivers.

    I've had two Blue Screen shutdowns since the drivers were installed and I would appreciate your help analyzing my Dump files to determine what's causing the problem.

    I saved the minidump files and msinfo32 information to my google drive, but this post won't let me include the link until it verifies my account?

    Your help is greatly appreciated.  Please advise.

    Friday, June 5, 2015 9:57 PM

Answers

  • Two different errors

    One crash was related to bitlocker.  I would remove/disable it

    The second was related to your video driver and is called BCC116

    These crashes were called BCC116 and are related to your video sub system.  Please follow the instructions in this wiki

    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\052815-14632-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    Machine Name:
    Kernel base = 0xfffff800`02a16000 PsLoadedModuleList = 0xfffff800`02c5d730
    Debug session time: Thu May 28 23:31:46.407 2015 (UTC - 4:00)
    System Uptime: 0 days 0:20:11.204
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, a802, fffff880035a0dc8, fffff880035a0620}
    
    Probably caused by : fvevol.sys ( fvevol!FveFilterDeviceControl+1d0 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: 000000000000a802, The address that the exception occurred at
    Arg3: fffff880035a0dc8, Exception Record Address
    Arg4: fffff880035a0620, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    +1
    00000000`0000a802 ??              ???
    
    EXCEPTION_RECORD:  fffff880035a0dc8 -- (.exr 0xfffff880035a0dc8)
    ExceptionAddress: 000000000000a802
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000008
       Parameter[1]: 000000000000a802
    Attempt to execute non-executable address 000000000000a802
    
    CONTEXT:  fffff880035a0620 -- (.cxr 0xfffff880035a0620;r)
    rax=000000000000000e rbx=fffff880016313b0 rcx=fffffa80169853d0
    rdx=fffffa8012ba33f0 rsi=fffffa8012ba33f0 rdi=fffffa80169d0a90
    rip=000000000000a802 rsp=fffff880035a1008 rbp=0000000000000001
     r8=fffffa80169853d0  r9=000000000000000e r10=fffff80002c1e588
    r11=fffffa80127cb660 r12=fffffa80169d0940 r13=fffffa8016adfe40
    r14=0000000000000002 r15=0000000000000001
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    00000000`0000a802 ??              ???
    Last set context:
    rax=000000000000000e rbx=fffff880016313b0 rcx=fffffa80169853d0
    rdx=fffffa8012ba33f0 rsi=fffffa8012ba33f0 rdi=fffffa80169d0a90
    rip=000000000000a802 rsp=fffff880035a1008 rbp=0000000000000001
     r8=fffffa80169853d0  r9=000000000000000e r10=fffff80002c1e588
    r11=fffffa80127cb660 r12=fffffa80169d0940 r13=fffffa8016adfe40
    r14=0000000000000002 r15=0000000000000001
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    00000000`0000a802 ??              ???
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000008
    
    EXCEPTION_PARAMETER2:  000000000000a802
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc7100
    GetUlongFromAddress: unable to read from fffff80002cc71c0
     000000000000a802 Nonpaged pool
    
    FOLLOWUP_IP: 
    fvevol!FveFilterDeviceControl+1d0
    fffff880`01602808 8bd8            mov     ebx,eax
    
    FAILED_INSTRUCTION_ADDRESS: 
    +1d0
    00000000`0000a802 ??              ???
    
    BUGCHECK_STR:  0x7E
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff88001602808 to 000000000000a802
    
    STACK_TEXT:  
    fffff880`035a1008 fffff880`01602808 : 00000000`00000400 fffff800`02a9c521 fffff6fc`00000000 00000000`00000000 : 0xa802
    fffff880`035a1010 fffff880`01752082 : fffffa80`12ba33f0 00000000`00000000 fffffa80`12ba3820 fffffa80`169c9190 : fvevol!FveFilterDeviceControl+0x1d0
    fffff880`035a1080 fffff800`02d45db2 : fffffa80`169c9040 fffffa80`169c9040 00000000`00000000 fffff880`035a19f0 : volsnap!VolSnapDeviceControl+0x72
    fffff880`035a10f0 fffff880`017482c5 : 00000000`00000000 fffff880`01747cf0 00000000`00000000 fffffa80`169c9190 : nt!IoVolumeDeviceToDosName+0x92
    fffff880`035a19c0 fffff880`01747d1c : 00000000`00000001 fffff880`01747cf0 fffffa80`14ea5b38 fffffa80`127cb660 : volsnap!VspLogErrorWorker+0x85
    fffff880`035a1b40 fffff800`02a944b5 : fffff880`01747cf0 fffff800`02c342d8 fffffa80`127cb660 fffff800`02c342d8 : volsnap!VspMediumPriorityWorkItem+0x2c
    fffff880`035a1b70 fffff800`02d24456 : 00000000`00000000 fffffa80`127cb660 00000000`00000080 fffffa80`127b7040 : nt!ExpWorkerThread+0x111
    fffff880`035a1c00 fffff800`02a7c2c6 : fffff880`03389180 fffffa80`127cb660 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`035a1c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  fvevol!FveFilterDeviceControl+1d0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: fvevol
    
    IMAGE_NAME:  fvevol.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5100a65c
    
    IMAGE_VERSION:  6.1.7601.18062
    
    STACK_COMMAND:  .cxr 0xfffff880035a0620 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_BAD_IP_fvevol!FveFilterDeviceControl+1d0
    
    BUCKET_ID:  X64_0x7E_BAD_IP_fvevol!FveFilterDeviceControl+1d0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_bad_ip_fvevol!fvefilterdevicecontrol+1d0
    
    FAILURE_ID_HASH:  {75206e01-297e-a077-d55f-d7345d9137f6}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    Saturday, June 6, 2015 3:53 PM
  • "I thought Bitlocker was only available for Win 7 Ultimate and Enterprise." - not quite. BL has a viewer component ("bitlocker reader") which is present in all editions of 7, so that you may mount bitlocker2go drives.
    Monday, June 8, 2015 6:30 PM

All replies

  • Until the dump file get analyzed one can not say why are you getting BSOD. You need to upload that mini dump file here.

    S.Sengupta, Windows Experience MVP

    Friday, June 5, 2015 10:48 PM
  • Replace HTTP:// with HXXP:// and it should allow you to post the dumps

    If you are being told you cant post a link, or embed a picture (or any other restriction) you just need to post to this thread saying your account has not been validated

    Look for the verify your account thread that is stuck to the top of the page.

    http://social.technet.microsoft.com/Forums/en-US/home?forum=reportabug


    Wanikiya and Dyami--Team Zigzag

    Friday, June 5, 2015 10:55 PM
  • I tried to post the link for my dump files with my original message, but your website wouldn't let me until my account was validated, or verified.

    My link is below.  Please replace the XX with tt and it should take you to zip folder on my google drive.

    hXXps://drive.google.com/open?id=0By65UPtUwSEpTk9MRXc4dGpUS3c&authuser=0

    Thank you so much.

    Friday, June 5, 2015 11:56 PM
  • Two different errors

    One crash was related to bitlocker.  I would remove/disable it

    The second was related to your video driver and is called BCC116

    These crashes were called BCC116 and are related to your video sub system.  Please follow the instructions in this wiki

    Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.
    
    
    Loading Dump File [C:\Users\zigza\Desktop\052815-14632-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    
    
    ************* Symbol Path validation summary **************
    Response                         Time (ms)     Location
    Deferred                                       SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: 
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7601.18839.amd64fre.win7sp1_gdr.150427-0707
    Machine Name:
    Kernel base = 0xfffff800`02a16000 PsLoadedModuleList = 0xfffff800`02c5d730
    Debug session time: Thu May 28 23:31:46.407 2015 (UTC - 4:00)
    System Uptime: 0 days 0:20:11.204
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ....................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck 1000007E, {ffffffffc0000005, a802, fffff880035a0dc8, fffff880035a0620}
    
    Probably caused by : fvevol.sys ( fvevol!FveFilterDeviceControl+1d0 )
    
    Followup: MachineOwner
    ---------
    
    4: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: ffffffffc0000005, The exception code that was not handled
    Arg2: 000000000000a802, The address that the exception occurred at
    Arg3: fffff880035a0dc8, Exception Record Address
    Arg4: fffff880035a0620, Context Record Address
    
    Debugging Details:
    ------------------
    
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    FAULTING_IP: 
    +1
    00000000`0000a802 ??              ???
    
    EXCEPTION_RECORD:  fffff880035a0dc8 -- (.exr 0xfffff880035a0dc8)
    ExceptionAddress: 000000000000a802
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000008
       Parameter[1]: 000000000000a802
    Attempt to execute non-executable address 000000000000a802
    
    CONTEXT:  fffff880035a0620 -- (.cxr 0xfffff880035a0620;r)
    rax=000000000000000e rbx=fffff880016313b0 rcx=fffffa80169853d0
    rdx=fffffa8012ba33f0 rsi=fffffa8012ba33f0 rdi=fffffa80169d0a90
    rip=000000000000a802 rsp=fffff880035a1008 rbp=0000000000000001
     r8=fffffa80169853d0  r9=000000000000000e r10=fffff80002c1e588
    r11=fffffa80127cb660 r12=fffffa80169d0940 r13=fffffa8016adfe40
    r14=0000000000000002 r15=0000000000000001
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    00000000`0000a802 ??              ???
    Last set context:
    rax=000000000000000e rbx=fffff880016313b0 rcx=fffffa80169853d0
    rdx=fffffa8012ba33f0 rsi=fffffa8012ba33f0 rdi=fffffa80169d0a90
    rip=000000000000a802 rsp=fffff880035a1008 rbp=0000000000000001
     r8=fffffa80169853d0  r9=000000000000000e r10=fffff80002c1e588
    r11=fffffa80127cb660 r12=fffffa80169d0940 r13=fffffa8016adfe40
    r14=0000000000000002 r15=0000000000000001
    iopl=0         nv up ei ng nz na pe nc
    cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
    00000000`0000a802 ??              ???
    Resetting default scope
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    PROCESS_NAME:  System
    
    CURRENT_IRQL:  0
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000008
    
    EXCEPTION_PARAMETER2:  000000000000a802
    
    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc7100
    GetUlongFromAddress: unable to read from fffff80002cc71c0
     000000000000a802 Nonpaged pool
    
    FOLLOWUP_IP: 
    fvevol!FveFilterDeviceControl+1d0
    fffff880`01602808 8bd8            mov     ebx,eax
    
    FAILED_INSTRUCTION_ADDRESS: 
    +1d0
    00000000`0000a802 ??              ???
    
    BUGCHECK_STR:  0x7E
    
    ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
    
    LAST_CONTROL_TRANSFER:  from fffff88001602808 to 000000000000a802
    
    STACK_TEXT:  
    fffff880`035a1008 fffff880`01602808 : 00000000`00000400 fffff800`02a9c521 fffff6fc`00000000 00000000`00000000 : 0xa802
    fffff880`035a1010 fffff880`01752082 : fffffa80`12ba33f0 00000000`00000000 fffffa80`12ba3820 fffffa80`169c9190 : fvevol!FveFilterDeviceControl+0x1d0
    fffff880`035a1080 fffff800`02d45db2 : fffffa80`169c9040 fffffa80`169c9040 00000000`00000000 fffff880`035a19f0 : volsnap!VolSnapDeviceControl+0x72
    fffff880`035a10f0 fffff880`017482c5 : 00000000`00000000 fffff880`01747cf0 00000000`00000000 fffffa80`169c9190 : nt!IoVolumeDeviceToDosName+0x92
    fffff880`035a19c0 fffff880`01747d1c : 00000000`00000001 fffff880`01747cf0 fffffa80`14ea5b38 fffffa80`127cb660 : volsnap!VspLogErrorWorker+0x85
    fffff880`035a1b40 fffff800`02a944b5 : fffff880`01747cf0 fffff800`02c342d8 fffffa80`127cb660 fffff800`02c342d8 : volsnap!VspMediumPriorityWorkItem+0x2c
    fffff880`035a1b70 fffff800`02d24456 : 00000000`00000000 fffffa80`127cb660 00000000`00000080 fffffa80`127b7040 : nt!ExpWorkerThread+0x111
    fffff880`035a1c00 fffff800`02a7c2c6 : fffff880`03389180 fffffa80`127cb660 fffff880`033940c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
    fffff880`035a1c40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
    
    
    SYMBOL_STACK_INDEX:  1
    
    SYMBOL_NAME:  fvevol!FveFilterDeviceControl+1d0
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: fvevol
    
    IMAGE_NAME:  fvevol.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  5100a65c
    
    IMAGE_VERSION:  6.1.7601.18062
    
    STACK_COMMAND:  .cxr 0xfffff880035a0620 ; kb
    
    FAILURE_BUCKET_ID:  X64_0x7E_BAD_IP_fvevol!FveFilterDeviceControl+1d0
    
    BUCKET_ID:  X64_0x7E_BAD_IP_fvevol!FveFilterDeviceControl+1d0
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0x7e_bad_ip_fvevol!fvefilterdevicecontrol+1d0
    
    FAILURE_ID_HASH:  {75206e01-297e-a077-d55f-d7345d9137f6}
    
    Followup: MachineOwner
    ---------
    
    


    Wanikiya and Dyami--Team Zigzag

    Saturday, June 6, 2015 3:53 PM
  • Thank you for the quick reply.  I appreciate your help.

    I understand the video driver problem and will try a newer version of AMD Catalyst Control System.

    But the Bitlocker problem is a puzzle.  My operating system is Windows 7 Professional x64.  I thought Bitlocker Drive Encryption was only available in Windows 7 Ultimate and Enterprise versions, not the Professional version that I'm running.  Is my assumption incorrect?

    Could the Bitlocker driver be on my system, even though the program is not?

    Could something else have caused the crash and made it look like it was a Bitlocker event?

    Should I even worry about this if the BSOD doesn't repeat?

    Thanks.

    Sunday, June 7, 2015 1:31 PM
  • I would not worry about the crashes unless they continue (they probably will) and if they do run driver verifier to find the underlying cause

    These crashes were related to memory corruption (probably caused by a driver). 

    Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.


    If you are over-clocking anything reset to default before running these tests.
    In other words STOP!!!  If you do not know what this means you probably are not


    1-Driver verifier (for complete directions see our wiki here)

    2-Memtest. (You can read more about running memtest here)



    Wanikiya and Dyami--Team Zigzag

    Sunday, June 7, 2015 2:33 PM
  • Thanks again, Team Zigzag.

    Since I know that the AMD Video Card driver was one of the culprits, I think I'll uninstall it first, before I run the Driver Verifier.

    I might even use a System Restore point to go back in time before the AMD software was installed, too, so it's completely gone.

    Thanks.

    Sunday, June 7, 2015 4:49 PM
  • Hello again, team Zigzag.

    I forgot to ask... why would Bitlocker (driver) have caused a crash on my Win 7 Pro system?

    I thought Bitlocker was only available for Win 7 Ultimate and Enterprise.

    Sunday, June 7, 2015 6:11 PM
  • "I thought Bitlocker was only available for Win 7 Ultimate and Enterprise." - not quite. BL has a viewer component ("bitlocker reader") which is present in all editions of 7, so that you may mount bitlocker2go drives.
    Monday, June 8, 2015 6:30 PM