none
Windows 7 BSOD On My Grandma's Computer (With Dumps)

    Question

  • Hello,

    This may be a bit tricky, because I'm trying to pry information out of my Grandmother. She says this is the first time she's experienced a Blue Screen, however there were 6 or 7 dmp files on her computer when I got there.  Admittedly, my tech level is pretty low too, but I do know a thing or two. I can go over and attempt to get more information if needed.

    So, she says she turned her computer on and went to the store. By the time she came back, she had the Blue Screen. I restarted the computer and it started normally. I let it run for a good 15 minutes while doing random tasks (surfing web, getting the dmp files, etc.)  Nothing was happening, and I noticed she didn't have SP1 installed. I decided to download/install it. It got to about 19% downloaded when I got a blue screen.

    This Blue Screen only stayed up for about 1 second, then the computer restarted. I tried to start up in safe mode, only to get another Blue Screen as the drivers were loading. Again, it restarted after about 1 second. I retried one more time, and got safe mode to boot. I opened the folder to grab the additional dmp files (if there were any), and got another Blue Screen. I then stopped.

    I really don't know what to do here, so any help is GREATLY appreciated from both my Grandma and I. Here are the dmp files I collected, not including the BS's that happened with the restarts:

    http://cid-a3a201ef938ae097.office.live.com/browse.aspx/.Documents

    ^^^I made the documents public

    Please ask any questions you need to.

    Thanks again,

    Bob

    Saturday, May 28, 2011 7:30 PM

Answers

  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff0, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80002d85990, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------
    Could not read faulting driver name
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc20e0
     fffffffffffffff0 
    FAULTING_IP: 
    nt!ObDereferenceSecurityDescriptor+20
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h]
    MM_INTERNAL_CODE:  0
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x50
    PROCESS_NAME:  avgscana.exe
    CURRENT_IRQL:  0
    TRAP_FRAME:  fffff880089b18d0 -- (.trap 0xfffff880089b18d0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff880089b1a88 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000009 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002d85990 rsp=fffff880089b1a60 rbp=fffffa8009dd6060
     r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
    r11=fffff880089b1b38 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    nt!ObDereferenceSecurityDescriptor+0x20:
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h] ds:00000000`00000010=????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff80002b0b024 to fffff80002a8a700
    STACK_TEXT:  
    fffff880`089b1768 fffff800`02b0b024 : 00000000`00000050 ffffffff`fffffff0 00000000`00000000 fffff880`089b18d0 : nt!KeBugCheckEx
    fffff880`089b1770 fffff800`02a887ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`0000000a : nt! ?? ::FNODOBFM::`string'+0x427f7
    fffff880`089b18d0 fffff800`02d85990 : 00000000`00000000 fffffa80`0a4b0a40 00000000`00000000 fffffa80`04876c90 : nt!KiPageFault+0x16e
    fffff880`089b1a60 fffff800`02d4fe34 : 00000000`00000000 fffffa80`09dd6060 fffffa80`0370b080 00000000`00000000 : nt!ObDereferenceSecurityDescriptor+0x20
    fffff880`089b1a90 fffff800`02a8f8ee : 00000000`00000000 fffffa80`03768060 fffffa80`0370b080 00000000`004a8d20 : nt!SeDefaultObjectMethod+0xa8
    fffff880`089b1ae0 fffff800`02d9f264 : fffffa80`03768060 00000000`00000000 fffffa80`03bbf060 00000000`00000000 : nt!ObfDereferenceObject+0x10e
    fffff880`089b1b40 fffff800`02d9f164 : 00000000`000004d4 fffffa80`03768060 fffff8a0`08374430 00000000`000004d4 : nt!ObpCloseHandleTableEntry+0xc4
    fffff880`089b1bd0 fffff800`02a89953 : fffffa80`03bbf060 fffff880`089b1ca0 00000000`01ef2000 00000000`01b4e070 : nt!ObpCloseHandle+0x94
    fffff880`089b1c20 00000000`778ef7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`01b4ebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778ef7aa
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    nt!ObDereferenceSecurityDescriptor+20
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h]
    SYMBOL_STACK_INDEX:  3
    SYMBOL_NAME:  nt!ObDereferenceSecurityDescriptor+20
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34
    FAILURE_BUCKET_ID:  X64_0x50_nt!ObDereferenceSecurityDescriptor+20
    BUCKET_ID:  X64_0x50_nt!ObDereferenceSecurityDescriptor+20
    Followup: MachineOwner
    ---------
    ----------------------------------------------
    Please upload all possible drivers and run memtest86+ to check that all is okay with your RAM. If there is a faulty one, replace it.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Sunday, May 29, 2011 1:25 AM
  • I see errors here. Check that your RAM are plugged correctly. Once done, run the test again.

    If problem persists then I recommend that you determine the faulty RAM and replace it.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Sunday, May 29, 2011 9:46 PM

All replies

  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffffffffff0, memory referenced.
    Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
    Arg3: fffff80002d85990, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 0000000000000000, (reserved)
    Debugging Details:
    ------------------
    Could not read faulting driver name
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cc20e0
     fffffffffffffff0 
    FAULTING_IP: 
    nt!ObDereferenceSecurityDescriptor+20
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h]
    MM_INTERNAL_CODE:  0
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
    BUGCHECK_STR:  0x50
    PROCESS_NAME:  avgscana.exe
    CURRENT_IRQL:  0
    TRAP_FRAME:  fffff880089b18d0 -- (.trap 0xfffff880089b18d0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=fffff880089b1a88 rbx=0000000000000000 rcx=0000000000000000
    rdx=0000000000000009 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff80002d85990 rsp=fffff880089b1a60 rbp=fffffa8009dd6060
     r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
    r11=fffff880089b1b38 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei ng nz na po nc
    nt!ObDereferenceSecurityDescriptor+0x20:
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h] ds:00000000`00000010=????????
    Resetting default scope
    LAST_CONTROL_TRANSFER:  from fffff80002b0b024 to fffff80002a8a700
    STACK_TEXT:  
    fffff880`089b1768 fffff800`02b0b024 : 00000000`00000050 ffffffff`fffffff0 00000000`00000000 fffff880`089b18d0 : nt!KeBugCheckEx
    fffff880`089b1770 fffff800`02a887ee : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`0000000a : nt! ?? ::FNODOBFM::`string'+0x427f7
    fffff880`089b18d0 fffff800`02d85990 : 00000000`00000000 fffffa80`0a4b0a40 00000000`00000000 fffffa80`04876c90 : nt!KiPageFault+0x16e
    fffff880`089b1a60 fffff800`02d4fe34 : 00000000`00000000 fffffa80`09dd6060 fffffa80`0370b080 00000000`00000000 : nt!ObDereferenceSecurityDescriptor+0x20
    fffff880`089b1a90 fffff800`02a8f8ee : 00000000`00000000 fffffa80`03768060 fffffa80`0370b080 00000000`004a8d20 : nt!SeDefaultObjectMethod+0xa8
    fffff880`089b1ae0 fffff800`02d9f264 : fffffa80`03768060 00000000`00000000 fffffa80`03bbf060 00000000`00000000 : nt!ObfDereferenceObject+0x10e
    fffff880`089b1b40 fffff800`02d9f164 : 00000000`000004d4 fffffa80`03768060 fffff8a0`08374430 00000000`000004d4 : nt!ObpCloseHandleTableEntry+0xc4
    fffff880`089b1bd0 fffff800`02a89953 : fffffa80`03bbf060 fffff880`089b1ca0 00000000`01ef2000 00000000`01b4e070 : nt!ObpCloseHandle+0x94
    fffff880`089b1c20 00000000`778ef7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
    00000000`01b4ebb8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778ef7aa
    STACK_COMMAND:  kb
    FOLLOWUP_IP: 
    nt!ObDereferenceSecurityDescriptor+20
    fffff800`02d85990 8b4610          mov     eax,dword ptr [rsi+10h]
    SYMBOL_STACK_INDEX:  3
    SYMBOL_NAME:  nt!ObDereferenceSecurityDescriptor+20
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd34
    FAILURE_BUCKET_ID:  X64_0x50_nt!ObDereferenceSecurityDescriptor+20
    BUCKET_ID:  X64_0x50_nt!ObDereferenceSecurityDescriptor+20
    Followup: MachineOwner
    ---------
    ----------------------------------------------
    Please upload all possible drivers and run memtest86+ to check that all is okay with your RAM. If there is a faulty one, replace it.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Sunday, May 29, 2011 1:25 AM
  • Yikes. OK, I ran the memtest86+, and here are my results. I video taped when it started going bad:

    http://www.youtube.com/watch?v=n-tKZlyuOdQ

     

    Does this mean one of the RAM chips plugged into the Motherboard are bad, or could this potentially mean something else?

     

    EDIT: Also, after this I tried to boot the computer in safe mode to retrieve driver information. I got to the point where it asked if I wanted to start in Safe Mode. I entered yes, but that was it. The screen went black, and the monitor said it was powering off on screen (paraphrasing. I forget what it says when the computer is off and the monitor is still on).  The tower power light was still on however.


    Sunday, May 29, 2011 9:01 PM
  • If you have 2x 1GB sticks of RAM installed, it looks like the 2nd stick is bad. Repeat the tests with 1 stick at a time installed to check. Then check the slot the suspect RAM stick was installed in with a known good stick.

     

    No point in testing/checking drivers or software until the hardware installed has been cleared of suspicion.

    Sunday, May 29, 2011 9:17 PM
  • I see errors here. Check that your RAM are plugged correctly. Once done, run the test again.

    If problem persists then I recommend that you determine the faulty RAM and replace it.

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Sunday, May 29, 2011 9:46 PM