Jump to content

BSOD WIndbg analysis needed

okozar

By okozar
in Windows Vista

 Share

Recommended Posts

okozar

okozar

Posted
Posted

Hi, I've this somewhat older batch of computer parts sitting around for a while and I finally got around to slapping them and a couple new ones together for a stronger (secondary) computer. At the same time I decided to make the move for my new computer and this older newer one to Vista X64 Ultimate

The Computer has all the vista updates..

All clocks are stock

x2 4200

x1800xt 512

1 GB PC 3200 Kingston Hyper-x (2x512mb) (Ya I know for Vista this badly needs to move to two

DFI Lanparty NF4 UT-D Mobo

I slapped this together on the 17th (last Tuesday night) and have since received

NINE! BSOD :(

Anyway here they are, I've read 80% of Blue Screens are caused by drivers so I guess I find it alarming that as far as I can tell these are mostly program, not driver related. The first one clearly appears to be the Hard drive as far as I can tell, but it doesn't concern me since it's A) Brand new and B) only occurred once.

17A

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, fffffa600179d6e8, fffffa600179d0c0, fffffa60011109bc}

Probably caused by : Ntfs.sys ( Ntfs!EfsCleanup+4c )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

NTFS_FILE_SYSTEM (24)

If you see NtfsExceptionFilter on the stack then the 2nd and 3rd

parameters are the exception record and context record. Do a .cxr

on the 3rd parameter and then kb to obtain a more informative stack

trace.

Arguments:

Arg1: 00000000001904aa

Arg2: fffffa600179d6e8

Arg3: fffffa600179d0c0

Arg4: fffffa60011109bc

Debugging Details:

------------------

EXCEPTION_RECORD: fffffa600179d6e8 -- (.exr 0xfffffa600179d6e8)

ExceptionAddress: fffffa60011109bc (Ntfs!EfsCleanup+0x000000000000004c)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000001

Parameter[1]: 000000000030e000

Attempt to write to address 000000000030e000

CONTEXT: fffffa600179d0c0 -- (.cxr 0xfffffa600179d0c0)

rax=0000000000000000 rbx=0000000000300000 rcx=000000004c5828f9

rdx=0000000000300000 rsi=fffff88000aaed68 rdi=000000000030e000

rip=fffffa60011109bc rsp=fffffa600179d920 rbp=fffffa8001d23180

r8=0000000000000004 r9=0000000000000019 r10=ffffffffffee4bc0

r11=00000000000007ff r12=0000000000000000 r13=0000000000000000

r14=fffffa8002d29cc0 r15=fffffa8001d23180

iopl=0 nv up ei pl nz ac pe nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010212

Ntfs!EfsCleanup+0x4c:

fffffa60`011109bc f3aa rep stos byte ptr [rdi]

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a30080

000000000030e000

BUGCHECK_STR: 0x24

EXCEPTION_DOESNOT_MATCH_CODE: This indicates a hardware error.

Instruction at fffffa60011109bc does not read/write to 000000000030e000

LAST_CONTROL_TRANSFER: from fffffa60010fa4e9 to fffffa60011109bc

STACK_TEXT:

fffffa60`0179d920 fffffa60`010fa4e9 : fffffa60`0179d9e8 00000000`00000703 00000000`00000018 fffff880`6f66744e : Ntfs!EfsCleanup+0x4c

fffffa60`0179d950 fffffa60`0100d579 : 00000000`00000000 00000000`00000001 00000000`00000000 fffff880`00aaeaa0 : Ntfs! ?? ::NNGAKEGL::`string'+0x47fd

fffffa60`0179d990 fffffa60`0100d9d3 : 00000000`00000000 fffff880`00aaebd0 fffff880`00aaeaa0 fffffa60`0179da88 : Ntfs!NtfsPrepareFcbForRemoval+0x89

fffffa60`0179d9e0 fffffa60`010bd6d8 : fffffa80`02d29cc0 fffffa80`01d23180 fffff880`07607010 fffff880`07607448 : Ntfs!NtfsTeardownFromLcb+0x393

fffffa60`0179da80 fffffa60`01014b92 : fffffa80`02d29cc0 fffffa60`0179dc70 00000000`00000000 fffff880`07607010 : Ntfs!NtfsTeardownStructures+0xd8

fffffa60`0179db10 fffffa60`010c8e18 : fffffa60`0179dc70 fffff800`019998a0 fffff880`07607010 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2

fffffa60`0179db50 fffffa60`010b1e0e : fffffa80`02d29cc0 fffff880`07607140 fffff880`07607010 fffffa80`01d23180 : Ntfs!NtfsCommonClose+0x348

fffffa60`0179dc20 fffff800`01869066 : 00000000`00000000 fffff800`01a05800 fffff800`01999801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15e

fffffa60`0179dcf0 fffff800`01a7fde3 : fffffa60`01062ee8 00000000`004e0046 fffffa80`00c81720 00000000`00000080 : nt!ExpWorkerThread+0x11a

fffffa60`0179dd50 fffff800`01896536 : fffffa60`005ec180 fffffa80`00c81720 fffffa60`005f5d40 00000000`00000001 : nt!PspSystemThreadStartup+0x57

fffffa60`0179dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

FOLLOWUP_IP:

Ntfs!EfsCleanup+4c

fffffa60`011109bc f3aa rep stos byte ptr [rdi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!EfsCleanup+4c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 479190d1

STACK_COMMAND: .cxr 0xfffffa600179d0c0; kb

FAILURE_BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

BUCKET_ID: X64_0x24_CODE_ADDRESS_MISMATCH_Ntfs!EfsCleanup+4c

Followup: MachineOwner

---------

18A

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, c, 0, fffff80001868f3e}

Probably caused by : fileinfo.sys ( fileinfo!FIPfInterfaceOpen+803 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 0000000000000004, memory referenced

Arg2: 000000000000000c, IRQL

Arg3: 0000000000000000, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: fffff80001868f3e, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a31080

0000000000000004

CURRENT_IRQL: c

FAULTING_IP:

nt!ExpReleaseResourceForThreadLite+16e

fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: fffffa600643ac40 -- (.trap 0xfffffa600643ac40)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffff80001a33440 rbx=01c8d1c91abb2851 rcx=fffff8000197ccf0

rdx=0000000000000000 rsi=fffffa8001250210 rdi=0000000000000000

rip=fffff80001868f3e rsp=fffffa600643add0 rbp=0000000000000000

r8=0000000000000000 r9=01c8d1c91abb2801 r10=0000000000000070

r11=0000000000008000 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl zr na po nc

nt!ExpReleaseResourceForThreadLite+0x16e:

fffff800`01868f3e 8b4e04 mov ecx,dword ptr [rsi+4] ds:0008:fffffa80`01250214=????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000185d12e to fffff8000185d390

STACK_TEXT:

fffffa60`0643aaf8 fffff800`0185d12e : 00000000`0000000a 00000000`00000004 00000000`0000000c 00000000`00000000 : nt!KeBugCheckEx

fffffa60`0643ab00 fffff800`0185c00b : 00000000`00000000 fffffa80`01638db0 fffffa80`01638e00 fffffa80`01334860 : nt!KiBugCheckDispatch+0x6e

fffffa60`0643ac40 fffff800`01868f3e : fffffa80`01f29010 00000000`00000000 01c85bd8`33275f11 01c85bd8`33275f11 : nt!KiPageFault+0x20b

fffffa60`0643add0 fffffa60`01016c05 : fffffa60`0643afa0 00000000`00000000 fffffa60`0643af00 fffffa60`00a0a2ee : nt!ExpReleaseResourceForThreadLite+0x16e

fffffa60`0643ae50 fffffa60`01018c04 : fffffa80`0159f470 00000000`00000000 fffffa80`03d27760 00000000`00000001 : Ntfs!NtfsCleanupIrpContext+0x3d5

fffffa60`0643aea0 fffffa60`010cea8a : fffffa80`0159f470 fffffa80`0159f470 00000000`00000000 fffffa80`0159f400 : Ntfs!NtfsExtendedCompleteRequest+0xd4

fffffa60`0643aee0 fffffa60`01017a46 : fffffa80`0159f470 fffffa80`03d27760 fffffa80`02b29401 fffffa80`01250200 : Ntfs!NtfsCommonSetInformation+0xe40

fffffa60`0643afc0 fffffa60`00a07e17 : 00000000`00000801 fffffa80`03d27760 fffffa80`00ceba01 fffffa80`01d15180 : Ntfs!NtfsFsdSetInformation+0x316

fffffa60`0643b070 fffffa60`00a070dd : fffffa80`00d02440 fffffa80`03d27760 fffffa80`01f2a400 00000000`00000000 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x227

fffffa60`0643b0e0 fffff800`01aac8df : 00000000`00000028 fffffa80`01250260 00000000`00000028 fffffa80`00ceba00 : fltmgr!FltpDispatch+0xcd

fffffa60`0643b140 fffff800`0185ce33 : ffffffff`80000978 fffffa80`03d89060 fffffa60`0643b498 fffffa60`00000028 : nt!NtSetInformationFile+0x5fb

fffffa60`0643b270 fffff800`0185d340 : fffffa60`00a57353 00000000`00000000 00000000`00000000 fffffa80`02b299a0 : nt!KiSystemServiceCopyEnd+0x13

fffffa60`0643b478 fffffa60`00a57353 : 00000000`00000000 00000000`00000000 fffffa80`02b299a0 00000000`00000000 : nt!KiServiceLinkage

fffffa60`0643b480 fffff800`01b62097 : fffffa80`00c86501 fffff800`01864f01 00000000`00000000 fffffa80`02b299a0 : fileinfo!FIPfInterfaceOpen+0x803

fffffa60`0643b600 fffff800`01c0a907 : 00000000`00000020 ffffffff`ffe91ca0 fffffa60`0643b718 fffffa80`00000000 : nt!PfpOpenHandleCreate+0x117

fffffa60`0643b6d0 fffff800`01c0cc26 : 00000000`00000000 fffff880`09140178 fffff880`0913e000 fffffa60`00000060 : nt!PfpFileBuildReadSupport+0xe7

fffffa60`0643b7c0 fffff800`01c36609 : fffff880`00000000 00000000`00000005 00000000`000000af 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x126

fffffa60`0643b8c0 fffff800`01c368c2 : 00000000`00000000 fffffa60`0643bca0 fffffa60`0643ba08 fffff880`0913e001 : nt!PfpPrefetchRequestPerform+0x2f9

fffffa60`0643b960 fffff800`01c36b26 : fffffa60`0643ba08 00000000`00000001 fffffa80`039d0930 00000000`00000000 : nt!PfpPrefetchRequest+0x171

fffffa60`0643b9d0 fffff800`01c49258 : 00000000`00000000 00000000`00000004 fffffa80`00d35000 00000000`00000001 : nt!PfSetSuperfetchInformation+0x1a5

fffffa60`0643bab0 fffff800`0185ce33 : fffffa80`03d89060 00000000`00000000 00000000`00000001 00000000`05195e50 : nt!NtSetSystemInformation+0x8fb

fffffa60`0643bc20 00000000`777770ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`0343f7b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777770ea

STACK_COMMAND: kb

FOLLOWUP_IP:

fileinfo!FIPfInterfaceOpen+803

fffffa60`00a57353 8a8c2488010000 mov cl,byte ptr [rsp+188h]

SYMBOL_STACK_INDEX: d

SYMBOL_NAME: fileinfo!FIPfInterfaceOpen+803

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME: fileinfo.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919323

FAILURE_BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

BUCKET_ID: X64_0xA_fileinfo!FIPfInterfaceOpen+803

Followup: MachineOwner

---------

18B

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80001db338a, 1, 38}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29317 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff80001db338a, The address that the exception occurred at

Arg3: 0000000000000001, Parameter 0 of the exception

Arg4: 0000000000000038, Parameter 1 of the exception

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

+fffff80001db338a

fffff800`01db338a ?? ???

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 0000000000000038

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a80080

0000000000000038

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x1E

PROCESS_NAME: hl2.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6005dc79a0 -- (.trap 0xfffffa6005dc79a0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000

rdx=00000000000007ff rsi=fffff800019cb680 rdi=0000000000000000

rip=fffff80001db338a rsp=fffffa6005dc7b30 rbp=fffffa80036e1440

r8=0000000000000000 r9=0000000000007e00 r10=0000000000000008

r11=fffffa8000fc1794 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz na po nc

fffff800`01db338a ?? ???

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80001885e67 to fffff800018ac390

STACK_TEXT:

fffffa60`05dc71b8 fffff800`01885e67 : 00000000`0000001e ffffffff`c0000005 fffff800`01db338a 00000000`00000001 : nt!KeBugCheckEx

fffffa60`05dc71c0 fffff800`018ac1e9 : fffffa60`05dc78f8 00000000`00000000 fffffa60`05dc79a0 fffffa80`03f83ca8 : nt! ?? ::FNODOBFM::`string'+0x29317

fffffa60`05dc77c0 fffff800`018aafe5 : 00000000`00000001 fffffa60`0300c743 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xa9

fffffa60`05dc79a0 fffff800`01db338a : 00000000`00000468 00000000`00400000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x1e5

fffffa60`05dc7b30 00000000`00000468 : 00000000`00400000 00000000`00000000 00000000`00000008 fffff800`019cb680 : 0xfffff800`01db338a

fffffa60`05dc7b38 00000000`00400000 : 00000000`00000000 00000000`00000008 fffff800`019cb680 00000000`00000000 : 0x468

fffffa60`05dc7b40 00000000`00000000 : 00000000`00000008 fffff800`019cb680 00000000`00000000 00000000`00000000 : 0x400000

fffffa60`05dc7b48 00000000`00000008 : fffff800`019cb680 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

fffffa60`05dc7b50 fffff800`019cb680 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x8

fffffa60`05dc7b58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitialPCR+0x180

fffffa60`05dc7b60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

fffffa60`05dc7b68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

fffffa60`05dc7b70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : 0x0

fffffa60`05dc7b78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : 0x0

fffffa60`05dc7b80 00000000`00000000 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00000000 : 0x0

fffffa60`05dc7b88 00000000`00000000 : 00000000`00000001 00000000`00000000 00000000`00000000 fffffa60`05dc7ca0 : 0x0

fffffa60`05dc7b90 00000000`00000001 : 00000000`00000000 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 : 0x0

fffffa60`05dc7b98 00000000`00000000 : 00000000`00000000 fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 : 0x1

fffffa60`05dc7ba0 00000000`00000000 : fffffa60`05dc7ca0 fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 : 0x0

fffffa60`05dc7ba8 fffffa60`05dc7ca0 : fffffa80`036e1440 fffff800`01b27e38 00000000`00000000 fffff800`00000006 : 0x0

fffffa60`05dc7bb0 fffffa80`036e1440 : fffff800`01b27e38 00000000`00000000 fffff800`00000006 00000000`00000001 : 0xfffffa60`05dc7ca0

fffffa60`05dc7bb8 fffff800`01b27e38 : 00000000`00000000 fffff800`00000006 00000000`00000001 fffffa60`05dc7c00 : 0xfffffa80`036e1440

fffffa60`05dc7bc0 fffff800`018abe33 : fffffa80`03f83bb0 00000000`00000000 00000000`00000000 fffffa80`036e1440 : nt!NtWaitForSingleObject+0x98

fffffa60`05dc7c20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

STACK_COMMAND: kb

FOLLOWUP_IP:

nt! ?? ::FNODOBFM::`string'+29317

fffff800`01885e67 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+29317

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

FAILURE_BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

BUCKET_ID: X64_0x1E_W_nt!_??_::FNODOBFM::_string_+29317

Followup: MachineOwner

---------

19A

...

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, d00000, 0, 0}

Probably caused by : win32k.sys ( win32k!UserDeleteW32Thread+6c )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

BAD_POOL_HEADER (19)

The pool is already corrupt at the time of the current request.

This may or may not be due to the caller.

The internal pool links must be walked to figure out a possible cause of

the problem, and then special pool applied to the suspect tags or the driver

verifier to a suspect driver.

Arguments:

Arg1: 0000000000000022,

Arg2: 0000000000d00000

Arg3: 0000000000000000

Arg4: 0000000000000000

Debugging Details:

------------------

BUGCHECK_STR: 0x19_22

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a48080

0000000000d00000

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: RivaTuner.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff800018c3635 to fffff80001874390

STACK_TEXT:

fffffa60`06af4908 fffff800`018c3635 : 00000000`00000019 00000000`00000022 00000000`00d00000 00000000`00000000 : nt!KeBugCheckEx

fffffa60`06af4910 fffff800`0195307b : fffff800`0181f000 00000000`00000000 fffff800`019b2160 fffff800`0187bfa9 : nt! ?? ::FNODOBFM::`string'+0x37e6

fffffa60`06af4970 fffff960`00109da0 : fffffa80`018ba810 fffffa80`00c79930 fffffa80`00000000 fffffa80`016059e0 : nt!ExFreePoolWithTag+0x4bb

fffffa60`06af4a20 fffff960`00108bad : fffffa80`016059e0 fffffa80`044e6660 fffffa80`016059e0 fffff900`c08bfc60 : win32k!UserDeleteW32Thread+0x6c

fffffa60`06af4a50 fffff960`00104e90 : fffffa80`04527830 fffffa80`016059e0 00000000`00000000 00000000`00000000 : win32k!DereferenceW32Thread+0x15

fffffa60`06af4a80 fffff800`01b1c877 : fffffa80`04527830 00000000`00000000 00000000`00000000 fffffa80`016059e0 : win32k!W32pThreadCallout+0x94

fffffa60`06af4ab0 fffff800`01b1cd3d : 00000000`00000000 fffffa80`01605901 00000000`00000000 00000000`00000000 : nt!PspExitThread+0x523

fffffa60`06af4b70 fffff800`01ad3c7a : 00000000`00000000 00000000`0000000c 00000000`7efdd000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d

fffffa60`06af4bc0 fffff800`01873e33 : fffffa80`018ba810 fffffa80`016059e0 fffffa60`06af4ca0 00000000`7efdd000 : nt!NtTerminateProcess+0xfa

fffffa60`06af4c20 00000000`77765d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`0007e598 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77765d3a

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!UserDeleteW32Thread+6c

fffff960`00109da0 488b8bb0000000 mov rcx,qword ptr [rbx+0B0h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!UserDeleteW32Thread+6c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

FAILURE_BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

BUCKET_ID: X64_0x19_22_win32k!UserDeleteW32Thread+6c

Followup: MachineOwner

19B

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8004fc5ad0, 0, fffff8000194dc03, 0}

Could not read faulting driver name

Probably caused by : dxgkrnl.sys ( dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215 )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: fffffa8004fc5ad0, memory referenced.

Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.

Arg3: fffff8000194dc03, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 0000000000000000, (reserved)

Debugging Details:

------------------

Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a43080

fffffa8004fc5ad0

FAULTING_IP:

nt!ExFreePoolWithTag+43

fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: 3DMark06.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6007ded5e0 -- (.trap 0xfffffa6007ded5e0)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=fffff88000000174 rcx=fffffa8004fc5ae0

rdx=0000000000000000 rsi=fffffa8004326500 rdi=000000006d4d6956

rip=fffff8000194dc03 rsp=fffffa6007ded770 rbp=0000000000000000

r8=0000000000000003 r9=0000000000000175 r10=00000000005b5ac0

r11=fffffa6007ded800 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na pe nc

nt!ExFreePoolWithTag+0x43:

fffff800`0194dc03 418b45f0 mov eax,dword ptr [r13-10h] ds:ffffffff`fffffff0=????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000187e371 to fffff8000186f390

STACK_TEXT:

fffffa60`07ded4e8 fffff800`0187e371 : 00000000`00000050 fffffa80`04fc5ad0 00000000`00000000 fffffa60`07ded5e0 : nt!KeBugCheckEx

fffffa60`07ded4f0 fffff800`0186df19 : 00000000`00000000 fffff800`01874f8a fffffa80`0423ba00 fffffa80`04b4f5c0 : nt!MmAccessFault+0x1371

fffffa60`07ded5e0 fffff800`0194dc03 : fffff880`07fb3010 00000000`00000001 fffff880`05f173d0 fffffa60`028c4ce3 : nt!KiPageFault+0x119

fffffa60`07ded770 fffffa60`028c0515 : 00000000`00000000 00000000`00000000 fffff880`07fb3010 00000000`00000000 : nt!ExFreePoolWithTag+0x43

fffffa60`07ded820 fffffa60`028c02c4 : 00000000`00000000 fffffa60`00000000 00000000`00000001 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+0x215

fffffa60`07ded8f0 fffffa60`02844f29 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!VIDMM_GLOBAL::CloseAllocation+0x44

fffffa60`07ded920 fffffa60`02848e07 : 00000000`00000000 fffff880`07f1b1d0 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x41d

fffffa60`07deda10 fffffa60`0284b235 : fffff880`06e20000 fffffa60`07dedb30 fffff880`06e20001 fffffa60`07dedc01 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x3e3

fffffa60`07dedab0 fffff960`00262516 : fffffa60`00000000 fffffa80`01887a70 00000000`7efda000 00000000`00000020 : dxgkrnl!DxgkDestroyAllocation+0x8dd

fffffa60`07dedbf0 fffff800`0186ee33 : fffffa80`01887a70 00000000`00000000 00000000`00000000 fffffa80`0283c4b0 : win32k!NtGdiDdDDIDestroyAllocation+0x12

fffffa60`07dedc20 00000000`75d2b5ca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`035de7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75d2b5ca

STACK_COMMAND: kb

FOLLOWUP_IP:

dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

fffffa60`028c0515 488b4b20 mov rcx,qword ptr [rbx+20h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dxgkrnl

IMAGE_NAME: dxgkrnl.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 479193e6

FAILURE_BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

BUCKET_ID: X64_0x50_dxgkrnl!VIDMM_GLOBAL::CloseOneAllocation+215

Followup: MachineOwner

19C

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88007d0a0b0, 0, fffff80001b0b093, 2}

Could not read faulting driver name

Probably caused by : ntkrnlmp.exe ( nt!CmpCacheLookup+193 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: fffff88007d0a0b0, memory referenced.

Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.

Arg3: fffff80001b0b093, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 0000000000000002, (reserved)

Debugging Details:

------------------

Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001a70080

fffff88007d0a0b0

FAULTING_IP:

nt!CmpCacheLookup+193

fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: AirPlusCFG.exe

CURRENT_IRQL: 0

TRAP_FRAME: fffffa6005069060 -- (.trap 0xfffffa6005069060)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000091ec4f9a rbx=fffffa6005069db0 rcx=fffff88007d0a0b0

rdx=0000000010650760 rsi=0006010704020503 rdi=fffffa6005069678

rip=fffff80001b0b093 rsp=fffffa60050691f0 rbp=fffffa60050693c0

r8=00000000de532e42 r9=0000000000000008 r10=0000000000000000

r11=fffffa60050691e0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl zr na po nc

nt!CmpCacheLookup+0x193:

fffff800`01b0b093 3819 cmp byte ptr [rcx],bl ds:8060:fffff880`07d0a0b0=??

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800018aa534 to fffff8000189c390

STACK_TEXT:

fffffa60`05068f68 fffff800`018aa534 : 00000000`00000050 fffff880`07d0a0b0 00000000`00000000 fffffa60`05069060 : nt!KeBugCheckEx

fffffa60`05068f70 fffff800`0189af19 : 00000000`00000000 fffff880`057c0a58 00000000`10650700 00000000`00000000 : nt!MmAccessFault+0x534

fffffa60`05069060 fffff800`01b0b093 : fffffa60`05069750 fffffa60`05069330 fffffa60`05069840 fffffa60`05069768 : nt!KiPageFault+0x119

fffffa60`050691f0 fffff800`01b0bcc5 : fffffa60`05069330 fffffa60`00000007 fffffa60`05069770 fffffa60`05069750 : nt!CmpCacheLookup+0x193

fffffa60`050692d0 fffff800`01b0c69a : fffffa60`05069b70 fffffa60`05069750 fffffa60`05069740 fffffa60`05069758 : nt!CmpBuildHashStackAndLookupCache+0x276

fffffa60`05069670 fffff800`01b1d999 : 00000000`00000040 00000000`00000104 fffffa80`012a8b10 fffff880`069b6601 : nt!CmpParseKey+0x20a

fffffa60`05069910 fffff800`01b21884 : 00000000`00000000 fffffa80`04bffa01 00000000`00000040 fffffa80`00c70080 : nt!ObpLookupObjectName+0x5eb

fffffa60`05069a20 fffff800`01b0786f : fffffa80`00020019 00000000`75f53300 fffffa80`04c13001 00000000`00020006 : nt!ObOpenObjectByName+0x2f4

fffffa60`05069af0 fffff800`0189be33 : 00000000`005fe828 00000000`00020019 00000000`005fe8d0 00000000`00000000 : nt!CmOpenKey+0x25d

fffffa60`05069c20 00000000`77c75b9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`005fc108 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c75b9a

STACK_COMMAND: kb

FOLLOWUP_IP:

nt!CmpCacheLookup+193

fffff800`01b0b093 3819 cmp byte ptr [rcx],bl

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!CmpCacheLookup+193

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

FAILURE_BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

BUCKET_ID: X64_0x50_nt!CmpCacheLookup+193

Followup: MachineOwner

--------

20A

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff960001a5fdb, fffffa6005b5d760, 0}

Probably caused by : win32k.sys ( win32k!NextTopWindow+193 )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)

An exception happened while executing a system service routine.

Arguments:

Arg1: 00000000c0000005, Exception code that caused the bugcheck

Arg2: fffff960001a5fdb, Address of the exception record for the exception that caused the bugcheck

Arg3: fffffa6005b5d760, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

win32k!NextTopWindow+193

fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

CONTEXT: fffffa6005b5d760 -- (.cxr 0xfffffa6005b5d760)

rax=fffffa8004924e60 rbx=fffff900c0c7f3d0 rcx=ff7ec9a0ff7ec9a0

rdx=fffff900c0c00a60 rsi=fffff900c0c16d60 rdi=fffff900c0c25be0

rip=fffff960001a5fdb rsp=fffffa6005b5dfc0 rbp=fffff900c0c7f3d0

r8=0000000000000000 r9=fffff900c2e2b160 r10=fffff900c0c7f3d0

r11=fffff900c0c0f290 r12=0000000000000001 r13=0000000000000002

r14=fffff900c2e2b160 r15=0000000000000001

iopl=0 nv up ei ng nz na po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286

win32k!NextTopWindow+0x193:

fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h] ds:002b:ff7ec9a0`ff7ec9b0=????????????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: speedfan.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff96000175f2e to fffff960001a5fdb

STACK_TEXT:

fffffa60`05b5dfc0 fffff960`00175f2e : fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000002 fffff900`c2e2b160 : win32k!NextTopWindow+0x193

fffffa60`05b5e000 fffff960`0016488b : fffff900`c0c7f3d0 00000000`00000018 00000000`00000083 00000000`00000000 : win32k!xxxActivateWindow+0x122

fffffa60`05b5e060 fffff960`00183c63 : 00000000`00000001 fffff900`c0c7f3d0 fffff900`c0c7f3d0 00000000`00000000 : win32k!xxxShowWindow+0x41b

fffffa60`05b5e0d0 fffff960`001923cc : 00000000`00000001 fffff900`c0c7f3d0 00000000`00000018 fffff800`01cc8911 : win32k!xxxRealDefWindowProc+0x5b7

fffffa60`05b5e220 fffff960`00166567 : fffff900`c0c7f3d0 00000000`00000001 00000000`0000029e fffff900`c0c7f3d0 : win32k!xxxWrapRealDefWindowProc+0x3c

fffffa60`05b5e250 fffff960`001917d8 : 00000000`00040454 00000000`0000029e fffffa60`05b5e5d0 00000000`00000000 : win32k!NtUserfnNCDESTROY+0x27

fffffa60`05b5e290 fffff800`01a5ae33 : fffffa80`01263bb0 fffffa60`05b5e3f0 00000000`0007d588 fffffa60`05b5e318 : win32k!NtUserMessageCall+0x130

fffffa60`05b5e300 00000000`75209fea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`0007d568 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75209fea

FOLLOWUP_IP:

win32k!NextTopWindow+193

fffff960`001a5fdb 488b4110 mov rax,qword ptr [rcx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!NextTopWindow+193

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78e35

STACK_COMMAND: .cxr 0xfffffa6005b5d760; kb

FAILURE_BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

BUCKET_ID: X64_0x3B_win32k!NextTopWindow+193

Followup: MachineOwner

---------

20B

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1386af, 0, 0}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4b )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PFN_LIST_CORRUPT (4e)

Typically caused by drivers passing bad memory descriptor lists (ie: calling

MmUnlockPages twice with the same list, etc). If a kernel debugger is

available get the stack trace.

Arguments:

Arg1: 0000000000000099, A PTE or PFN is corrupt

Arg2: 00000000001386af, page frame number

Arg3: 0000000000000000, current page state

Arg4: 0000000000000000, 0

Debugging Details:

------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: windbg.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff80001ad43db to fffff80001a5d390

STACK_TEXT:

fffffa60`06cc8778 fffff800`01ad43db : 00000000`0000004e 00000000`00000099 00000000`001386af 00000000`00000000 : nt!KeBugCheckEx

fffffa60`06cc8780 fffff800`01a999a5 : fffff6fb`7dbed000 fffffa80`00a3f2f0 00000000`00000002 fffff6fb`7da00000 : nt!MiBadShareCount+0x4b

fffffa60`06cc87c0 fffff800`01a91a65 : 00000000`00000008 00000000`002a0000 00000000`00000000 fffff800`01bce850 : nt!MiDeletePageTableHierarchy+0x245

fffffa60`06cc88d0 fffff800`01a41696 : fffff6fb`7dbed011 00000000`0029ffff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x736

fffffa60`06cc8a60 fffff800`01d0584c : fffff880`06ee4ab0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCleanProcessAddressSpace+0x6ae

fffffa60`06cc8ab0 fffff800`01d05d3d : 00000000`00000000 fffffa80`04fb7b01 000007ff`fffda000 00000000`00000000 : nt!PspExitThread+0x4f8

fffffa60`06cc8b70 fffff800`01cbcc7a : 00000000`00000000 00000000`0000000c 00000000`00000000 fffff880`0000000c : nt!PspTerminateThreadByPointer+0x4d

fffffa60`06cc8bc0 fffff800`01a5ce33 : fffffa80`01417040 fffffa80`04fb7bb0 fffffa60`06cc8ca0 00000000`00000000 : nt!NtTerminateProcess+0xfa

fffffa60`06cc8c20 00000000`77cb5d3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`043ff838 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cb5d3a

STACK_COMMAND: kb

FOLLOWUP_IP:

nt!MiBadShareCount+4b

fffff800`01ad43db cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiBadShareCount+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 479192b7

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

BUCKET_ID: X64_0x4E_99_nt!MiBadShareCount+4b

Followup: MachineOwner

---------

20C

....

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80001a5f316, fffffa6005183eb0, 0}

Probably caused by : afd.sys ( afd! ?? ::GFJBLGFE::`string'+33e4 )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)

An exception happened while executing a system service routine.

Arguments:

Arg1: 00000000c0000005, Exception code that caused the bugcheck

Arg2: fffff80001a5f316, Address of the exception record for the exception that caused the bugcheck

Arg3: fffffa6005183eb0, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

Debugging Details:

------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

nt!RtlpInterlockedPushEntrySList+26

fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8

CONTEXT: fffffa6005183eb0 -- (.cxr 0xfffffa6005183eb0)

rax=0000000000000000 rbx=0000000000ec0000 rcx=fffffa80041863d0

rdx=0000000000ec0000 rsi=fffffa80041873d0 rdi=fffffa800143aae0

rip=fffff80001a5f316 rsp=fffffa6005184718 rbp=fffffa6000f5d220

r8=0000000000000000 r9=00001d8000000000 r10=0000000000000000

r11=00000000000007ff r12=fffffa8001804650 r13=fffffa80026fc700

r14=fffffa80042ae9a0 r15=fffffa8001804670

iopl=0 nv up ei pl zr ac po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010256

nt!RtlpInterlockedPushEntrySList+0x26:

fffff800`01a5f316 4c8902 mov qword ptr [rdx],r8 ds:002b:00000000`00ec0000=????????????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: WoW-1.12.x-to-2

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffffa600424eaf5 to fffff80001a5f316

STACK_TEXT:

fffffa60`05184718 fffffa60`0424eaf5 : 00000000`00ec0000 fffffa80`042ae9a0 fffffa80`026fc700 fffffa80`0156d010 : nt!RtlpInterlockedPushEntrySList+0x26

fffffa60`05184720 fffffa60`04209192 : 00000000`00000000 fffffa80`0143aae0 00000000`00000000 fffffa80`45656c41 : afd! ?? ::GFJBLGFE::`string'+0x33e4

fffffa60`05184760 fffffa60`00e62d86 : fffffa80`01306010 00000000`00000000 fffffa80`0272bc10 fffffa80`0263a010 : afd!AfdFreeConnectionEx+0x22

fffffa60`05184790 fffffa60`00e70ed8 : fffffa80`01306010 00000000`00000000 00000000`00000000 fffff800`01a93700 : tcpip!TcpCleanupTcbWorkQueueRoutine+0xd6

fffffa60`051847d0 fffffa60`00e713c8 : 00000000`00000000 fffffa60`0425a0be fffffa80`01306010 fffffa80`0159e102 : tcpip!TcpCloseTcbOlmNotifyTerminateComplete+0x78

fffffa60`05184870 fffffa60`00e713e9 : fffffa80`03ea4200 fffffa80`0143aae0 00000004`1000000e 80000000`00000000 : tcpip!TcpCloseTcb+0x78

fffffa60`051848d0 fffffa60`0423e01a : fffff800`01b81b00 fffff800`01b1fde9 fffff800`01b81b80 fffffa80`026fc710 : tcpip!TcpTlConnectionCloseEndpoint+0x9

fffffa60`05184900 fffffa60`0422c8f0 : fffffa80`0263a010 00000000`00000001 00000000`00000000 80000000`00000000 : afd!AfdCloseConnection+0x7a

fffffa60`05184940 fffffa60`0423c498 : 00000000`00000000 fffffa80`042ae9a0 fffffa80`026fc710 00000000`00000001 : afd!AfdCloseCore+0x180

fffffa60`051849d0 fffff800`01cda53e : fffffa80`01572cd0 fffffa80`01572cd0 00000000`00000004 fffffa60`05184a70 : afd!AfdDispatch+0x78

fffffa60`05184a10 fffff800`01a64e93 : 00000000`00000000 fffffa80`01572cd0 fffffa80`01572ca0 fffffa60`005ec180 : nt!IopDeleteFile+0x17e

fffffa60`05184aa0 fffff800`01cdbc5e : fffff880`07209510 fffffa80`00000001 fffffa80`0272bc10 00000000`00000002 : nt!ObfDereferenceObject+0x103

fffffa60`05184b30 fffff800`01cdbe04 : fffff880`07a829b0 fffff880`07a82900 00000000`00000001 00000000`00000544 : nt!ObpCloseHandleTableEntry+0xce

fffffa60`05184bd0 fffff800`01a5ce33 : fffffa80`026fc710 fffffa60`05184ca0 00000000`7efaf000 fffffa80`04231420 : nt!ObpCloseHandle+0x94

fffffa60`05184c20 00000000`76f95b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13

00000000`0060e848 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f95b6a

FOLLOWUP_IP:

afd! ?? ::GFJBLGFE::`string'+33e4

fffffa60`0424eaf5 90 nop

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: afd! ?? ::GFJBLGFE::`string'+33e4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47919ad7

STACK_COMMAND: .cxr 0xfffffa6005183eb0; kb

FAILURE_BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

BUCKET_ID: X64_0x3B_afd!_??_::GFJBLGFE::_string_+33e4

Followup: MachineOwner

---------


CoffeeFiend

CoffeeFiend

Posted
Posted

Yes, so many crashes of different kinds. I'm temped to think it's not just one bad driver causing all this. I'd bet $ some of your hardware is defective (and it's 2nd hand too, only makes it more suspicious), and to top it off it even says "This indicates a hardware error.", combined with memory corruption, very strange and unusual crashes and all. So I would definitely go back to the basics. Check the PSU voltages (not sure what it is -- good power is a must), see if the caps on the motherboard have a bulge, test your ram with memtest86+, etc. Swap parts one by one if you have any spare parts to play with if it comes down to that.

Part of it might be related to your video drivers though, seeing how so much of it is related to graphics:

PROCESS_NAME: hl2.exe -- video game

PROCESS_NAME: RivaTuner.exe -- video related again

Probably caused by : dxgkrnl.sys -- DirectX kernel, video again

PROCESS_NAME: 3DMark06.exe -- video related yet again

PROCESS_NAME: WoW-1.12.x-to-2 -- video game again

At the same time I decided to make the move for my new computer and this older newer one to Vista X64 Ultimate

(snip)

1 GB PC 3200 Kingston Hyper-x (2x512mb) (Ya I know for Vista this badly needs to move to two

1GB already isn't a whole lot for XP if you do intensive stuff (I normally go for 2 there).

And then, the Vista kernel uses about twice as much RAM as XP. And then the x64 stuff uses even more RAM (than x86). 1GB definitely won't cut it.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...