Jump to content

cluberti

Patron
  • Posts

    11,045
  • Joined

  • Last visited

  • Donations

    0.00 USD 
  • Country

    country-ZZ

Everything posted by cluberti

  1. All of these are memory_corruption/driver or high IRQL/driver bugchecks, indicating a probable driver causing the issue - if they were all memory corruption I'd blame RAM, but the 4E (PFN corrupt) dump leads me to believe it's a driver. The first three are STOP 0xD3 bugchecks, meaning a driver tried to access a memory address that was invalid or paged out to disk. The problem with minidumps are that the callstacks are usually not entirely there, especially in D3 bugchecks. However, I can see that the 3 D3 dumps are all going through win32k.sys' CallHook function before the machine crashes, meaning some driver has a global hook that win32k.sys is passing processing off to. In looking at the one STOP 0x4E dump (PFN_LIST_CORRUPT), this is quite obviously a driver passing in a bad memory descriptor list: 0: kd> k Child-SP RetAddr Call Site fffffa60`0c8ab168 fffff800`01ee93db nt!KeBugCheckEx fffffa60`0c8ab170 fffff800`01ed201d nt!MiBadShareCount+0x4b fffffa60`0c8ab1b0 fffff800`020f0e89 nt!MmUnmapViewInSystemCache+0x3e72d fffffa60`0c8ab480 fffff800`01e847ae nt!CcUnmapVacb+0x59 fffffa60`0c8ab4c0 fffff800`01ea585d nt!CcUnmapVacbArray+0x2be fffffa60`0c8ab540 fffff800`01e8a4b8 nt!CcGetVacbMiss+0x3fd fffffa60`0c8ab5d0 fffff800`020a6cc7 nt!CcGetVirtualAddress+0x348 fffffa60`0c8ab650 fffff800`01e45551 nt!CcMapDataCommon+0x5f fffffa60`0c8ab6c0 fffff800`020dc279 nt!CcMapDataForOverwrite+0xb5 fffffa60`0c8ab740 fffffa60`012f61a7 nt!CcPreparePinWrite+0x69 fffffa60`0c8ab800 fffffa60`012d2a21 Ntfs!LfsAllocateLbcb+0x117 fffffa60`0c8ab860 fffffa60`012d2c65 Ntfs!LfsWriteLogRecordIntoLogPage+0x4f1 fffffa60`0c8ab8d0 fffffa60`012d3692 Ntfs!LfsWrite+0x135 fffffa60`0c8ab990 fffffa60`012da2b6 Ntfs!NtfsWriteLog+0x452 fffffa60`0c8abbe0 fffffa60`012dbcd0 Ntfs!NtfsChangeAttributeValue+0x286 fffffa60`0c8abd80 fffffa60`012b819e Ntfs!NtfsUpdateStandardInformation+0x26e fffffa60`0c8abe90 fffffa60`012c4786 Ntfs!NtfsUpdateAllInformation+0x3e fffffa60`0c8abf00 fffffa60`012e2e28 Ntfs!NtfsOpenExistingPrefixFcb+0x3d6 fffffa60`0c8abfe0 fffffa60`012de9a4 Ntfs!NtfsFindStartingNode+0x5f8 fffffa60`0c8ac0b0 fffffa60`0122510d Ntfs!NtfsCommonCreate+0x3a4 fffffa60`0c8ac2b0 fffff800`01e933b1 Ntfs!NtfsCommonCreateCallout+0x1d fffffa60`0c8ac2e0 fffffa60`0122583a nt!KeExpandKernelStackAndCalloutEx+0x2e1 fffffa60`0c8ac370 fffffa60`012dd56d Ntfs!NtfsCommonCreateOnNewStack+0x4a fffffa60`0c8ac3d0 fffffa60`00d5de17 Ntfs!NtfsFsdCreate+0x1ad fffffa60`0c8ac570 fffffa60`00d7a26c fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227 fffffa60`0c8ac5e0 fffffa60`0c012608 fltmgr!FltpCreate+0x25d fffffa60`0c8ac690 00000000`656e6f4e amon+0x4608 fffffa60`0c8ac698 00000000`00000030 0x656e6f4e fffffa60`0c8ac6a0 fffffa80`065a7470 0x30 fffffa60`0c8ac6a8 00000000`00000000 0xfffffa80`065a7470 fffffa60`0c8ac6b0 00000020`00000040 0x0 fffffa60`0c8ac6b8 00000000`00000000 0x20`00000040 fffffa60`0c8ac6c0 fffffa80`06b67480 0x0 fffffa60`0c8ac6c8 00000000`00000000 0xfffffa80`06b67480 fffffa60`0c8ac6d0 fffffa80`067dfbc0 0x0 fffffa60`0c8ac6d8 fffffa80`065a7470 0xfffffa80`067dfbc0 fffffa60`0c8ac6e0 fffffa80`067dfc58 0xfffffa80`065a7470 fffffa60`0c8ac6e8 fffffa80`048d2b10 0xfffffa80`067dfc58 fffffa60`0c8ac6f0 00000000`00000040 0xfffffa80`048d2b10 fffffa60`0c8ac6f8 fffff800`020f9cc3 0x40 fffffa60`0c8ac700 fffff800`020f3999 nt!IopParseDevice+0x5e3 fffffa60`0c8ac8a0 fffff800`020f7884 nt!ObpLookupObjectName+0x5eb fffffa60`0c8ac9b0 fffff800`02103e30 nt!ObOpenObjectByName+0x2f4 fffffa60`0c8aca80 fffff800`02104968 nt!IopCreateFile+0x290 fffffa60`0c8acb20 fffff800`01e71e33 nt!NtCreateFile+0x78 fffffa60`0c8acbb0 00000000`77805fca nt!KiSystemServiceCopyEnd+0x13 00000000`0007e4c8 00000000`00000000 0x77805fca 0: kd> lmvm amon start end module name fffffa60`0c00e000 fffffa60`0c08a000 amon T (no symbols) Loaded symbol image file: amon.sys Image path: amon.sys Image name: amon.sys Timestamp: Fri May 11 02:23:04 2007 (46440BC8) CheckSum: 0002D3DB ImageSize: 0007C000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4 We can plainly see that we come out of the callback list for an NTFS IRP (doing some file I/O here) that we're passed through amon.sys, which is a part of the NOD32 antivirus product. I might suggest uninstalling (not disabling, but UNINSTALLING) the NOD32 antivirus application and trying to reproduce the problem. If it still happens, get more dump data. While it's not uncommon to see antivirus drivers loaded during filesystem work, a quick internet search on these bugcheck codes and amon.sys does turn up other hits with people having the same problems as you when NOD32 is installed, so an educated guess (plus the above data) seems to implicate NOD32 in your crashes.
  2. They might be using MDT 2008 or SCCM 2007 to deploy the OS, which would work this way.
  3. Configure your machine for a complete memory dump, and the next time it bugchecks and creates a .dmp you can compress/upload it somewhere so we can see what actually happened.
  4. Are you capturing this from a WinPE disk? It would appear the image is either corrupt or needs drivers for the disk controller (remember, sysprep on Vista kills the drivers installed).
  5. The error code is STATUS_NO_SUCH_DEVICE, so I'm wondering if you're restoring to hardware that you have drivers integrated for?
  6. If it's a PC, only the software. If it's a blue-ray standalone player, both (like the Playstation 3, for instance, is a BR player and is BR Live compatible). You will be fine with your choices for BR Live.
  7. Whilst I agree the sarcasm is a little over the top (expect that from jcarle), you do appear to be asking if the CPU needs to be cooled.
  8. Dyslexic maybe?? I suppose
  9. Opening folders from the desktop are going to be spawned as children of explorer.exe, regardless of the setting you have. If you open a folder from the desktop, it's considered part of the "shell" process - I don't know if this is an official bug or not becuase opening a folder from the desktop doesn't actually open it in a new process (the desktop itself is a special process, whereas folders launched from the start menu or run call shellexecute on the folder path, and can thus spawn a new explorer.exe window - it's the calling of ShellExecute[Ex] that allows this, and that's not done when a folder is opened from the desktop), but it's well known.
  10. BluRay Live requires a player that supports the feature - so if the BR player in your PC supports it, then yes. It's not something intrinsic to the BR disc though, it also requires the player software to support it.
  11. Basically, yes. Faster RAM on a slow bus with a slow memory controller will still be slower than slower RAM on a faster bus with a faster memory controller. As to politics, Microsoft doesn't design hardware, and Intel's design before i7 *is* really quite old and inefficient.
  12. The memory controller in an AMD platform being on the CPU does make it faster than a comparable Intel system, and the system bus itself on an AMD motherboard (HT) is generally quite a bit faster as well. It favors it only because it's a better design (i7 nonwithstanding, which emulates the AMD processor/chipset design by Intel by moving things on-die).
  13. The KB isn't your problem. It's the speed/bandwidth your memory is performing at - Memory Performance 3539.15 MB/s. That will definitely not get you above a 4.8.
  14. I don't really know what you mean here....where would i look for this? nvidia control panel doesn't seem to have anything like that? I checked the mouse properties and "snap to" is unchecked Right-click the desktop, choose personalize. Then choose the Windows Classic theme.
  15. Any particular reason you aren't using 6801 or 6956?
  16. If the CPU comes with one when purchased in retail form, then yes. It does. A heatsink for the motherboard isn't going to do anything to help keep your CPU cool.
  17. On both machines, run the command "winsat mem -v" from a command prompt, to see what it says your memory performance is. This number determines where your system will score - for reference, the older Vista SP1 box with whatever Dell put in here (8GB of something) gives a memory performance of 4728.04MB/s, which scores a 5.5 on the Memory test. Knowing that they both score ~4.8, you probably are getting similar bandwidth numbers from both machines. Otherwise, this may (I stress MAY) be a problem as described in KB933478.
  18. You should contact the university's licensing/IT department to make sure they have enough licenses to cover multiple machines (they may have unlimited licensing, but you should check to be sure). Enterprise version usage falls under the number of licenses your organization has paid for from Microsoft (one license is used for each install), whereas versions like Home & Student explicitly allow multiple installs on one license.
  19. Moving here for now, so more eyes can see it (hijack this log).
  20. Did you follow this guide yet?
  21. Then I got you wrong. Because you are registered in the group " Software developers" and you said "No, No (Been asked hundreds of times and the answer will always be NO!) It's to dangerous to have dozens of hacked up vLite versions." I thought you develop vLite and you knew what you were talking about. At least I'm sure now that I won't use vLite unless there is a possibility to check what it is doing. 1. Nuhi developed vLite, not jaclaz or Kels. Before spouting off at the mouth (or in this case, keyboard), do some research. This is common knowledge. 2. I suggest you stop using Windows as well. It is also not open source, and by your logic you should consider not using it either (ironic, not wanting to use a tool to modify Windows because you cannot "check what it is doing", and Windows itself is just another tool you cannot "check what it is doing" either - sorry, gave me a chuckle). And yes, stop trolling. [Closed].
  22. What happens when you're using the basic/classic interface? If it only happens under aero, then it's a driver draw issue. Note that I also see this when people have multi-mon setups, but have one (or more) monitors with negative pixel information (pixel 0,0 should be assigned to the leftmost-monitor in the setup). It is pretty rare, but I've seen it.
  23. It's saying the servicing stack update failed to install or is installed improperly, otherwise the SP would have installed. The 4371 error seems to indicate this is what is happening.
  24. Getting a network trace of the app trying to download binaries might also be helpful.
×
×
  • Create New...