Bluescreen ntoskrnl.exe

[Rorschachtinger]

Hi Leute!

Ich hoffe ich bin hier mit meinem Problem richtig!

Seit ein paar Monaten habe ich ein Bluescreen Problem das ich leider nicht lösen kann. Die Bluescreens kommen total zufällig, nach dem Booten, beim rum ideln, musikkören, zocken,
surfen ect. In total unterschiedlichen abständen, manchmal 2-3 am stück dann wieder 1-2 Tage Pause.

Mein System:
Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)
Intel i7-4770K CPU @ 3.50GHz
be quiet! Dark Rock Pro 2
NVIDIA GeForce GTX 670
Gigabyte Z87X-UD3H-CF
Corsair XMS3 4x4GB DDR3 1333 MHz
Seasonic X-850 (SS-850KM) ATX23

Das einzige was ich übertaktet habe ist der CPU (Multiplier auf 40 gestellt) aber auch erst seit einer Woche (ca. 8h mit Prime95 getestet. Alles ohne Probleme. Die Temps bei den Tests sind alle ok!)


Ich hab alles Mögliche versucht den BS zu reproduzieren, leider ohne Erfolg:
- Unigine Heaven: ca. 1h.
- FurMark: 2-3 mal 30 min Bench 1080p.
- FurMark und Prime95 ca. 1h.
- memtest86+ vom USB-Stick aus hat auch keine Probleme angezeigt ca. 9h. In der Zwischenzeit habe ich auch mal einen neuen Arbeitsspeicher gekauft,
auch mit dem gab es Bluescreens. Habe dann wieder den alten eingebaut.

Hier ist das was ich schon versucht habe um den/die Fehler zu beheben:
- Treiber für MB und Graka aktualisiert, Obwohl ich mir bei den MB Treibern nicht wirklich sicher bin, Ich habe die Treiber fürs MB von der Gigabyte website.
- BIOS auf Default gesetzt
- Öfter mal mein System neu aufgesetzt.
- Den Vieren Schutz (Avira Free Antivirus) deinstalliert und nur mit Microsoft Security Essentials gearbeitet. Auch eine Zeitlang ohne Antiviren Programm.
- Chkdsk war alles ok!
- Zum schluss hab ich dann noch mein BIOS geflasht.

Ich habe bestimmt noch was vergessen aber es gab immer Bluescreens.

Beim auslesen der Minidumps kommt immer wieder: WIN7_DRIVER_FAULT, wie behebe ich das ganze?
Hier ein paar Minidumps:

Spoiler

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002c01000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

EXCEPTION_RECORD: fffff8800b37dd38 -- (.exr 0xfffff8800b37dd38)
ExceptionAddress: fffff80002cf2f00 (nt+0x00000000000f1f00)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000004000000000
Attempt to read from address 0000004000000000

CONTEXT: fffff8800b37d590 -- (.cxr 0xfffff8800b37d590)
rax=0000000000000000 rbx=fffffa800f855b00 rcx=fffffa800ec60058
rdx=0000000000000000 rsi=fffffa800ec60010 rdi=0000000000000000
rip=fffff80002cf2f00 rsp=fffff8800b37df70 rbp=0000000000000000
r8=fffffa800ec60000 r9=0000000000000006 r10=0000007c400189d8
r11=0000007ffffffff8 r12=0000004000000000 r13=0000000000000000
r14=0000000000000000 r15=fffff8a00482b1f8
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt+0xf1f00:
fffff800`02cf2f00 498b1c24 mov rbx,qword ptr [r12] ds:002b:00000040`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x24

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 2aaaaaaaaaaaaaab to fffff80002cf2f00

STACK_TEXT:
fffff880`0b37df70 2aaaaaaa`aaaaaaab : fffffa80`00475500 00000580`00000000 fffffa80`00475500 fffff800`00000030 : nt+0xf1f00
fffff880`0b37df78 fffffa80`00475500 : 00000580`00000000 fffffa80`00475500 fffff800`00000030 fffff800`02c80000 : 0x2aaaaaaa`aaaaaaab
fffff880`0b37df80 00000580`00000000 : fffffa80`00475500 fffff800`00000030 fffff800`02c80000 fffff880`0b37e0d0 : 0xfffffa80`00475500
fffff880`0b37df88 fffffa80`00475500 : fffff800`00000030 fffff800`02c80000 fffff880`0b37e0d0 fffff880`0b37e020 : 0x00000580`00000000
fffff880`0b37df90 fffff800`00000030 : fffff800`02c80000 fffff880`0b37e0d0 fffff880`0b37e020 00000000`00000000 : 0xfffffa80`00475500
fffff880`0b37df98 fffff800`02c80000 : fffff880`0b37e0d0 fffff880`0b37e020 00000000`00000000 00000000`00000200 : 0xfffff800`00000030
fffff880`0b37dfa0 fffff880`0b37e0d0 : fffff880`0b37e020 00000000`00000000 00000000`00000200 fffff880`03102180 : nt+0x7f000
fffff880`0b37dfa8 fffff880`0b37e020 : 00000000`00000000 00000000`00000200 fffff880`03102180 00000000`00000000 : 0xfffff880`0b37e0d0
fffff880`0b37dfb0 00000000`00000000 : 00000000`00000200 fffff880`03102180 00000000`00000000 fffffa80`0f855b00 : 0xfffff880`0b37e020


FOLLOWUP_IP:
nt+f1f00
fffff800`02cf2f00 498b1c24 mov rbx,qword ptr [r12]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+f1f00

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

STACK_COMMAND: .cxr 0xfffff8800b37d590 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Spoiler

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002c17000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP:
nt+36bc12
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h]

CONTEXT: fffff8800b00d090 -- (.cxr 0xfffff8800b00d090)
rax=0000000000000000 rbx=fffffa801193ca80 rcx=fffff80002e3eb80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f82c12 rsp=fffff8800b00da70 rbp=fffff8800b00db60
r8=fffff8a003ddc000 r9=0000000000000018 r10=0000000000000000
r11=0000000000100003 r12=0000000000000001 r13=0000000000000000
r14=00000000042eea50 r15=0000000073e92450
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt+0x36bc12:
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h] ds:002b:00000000`00000020=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff8800b00db00 to fffff80002f82c12

STACK_TEXT:
fffff880`0b00da70 fffff880`0b00db00 : fffffa80`00100000 00000000`00000000 fffffa80`0e4fc001 fffff880`746c6644 : nt+0x36bc12
fffff880`0b00da78 fffffa80`00100000 : 00000000`00000000 fffffa80`0e4fc001 fffff880`746c6644 fffff880`0b00daf8 : 0xfffff880`0b00db00
fffff880`0b00da80 00000000`00000000 : fffffa80`0e4fc001 fffff880`746c6644 fffff880`0b00daf8 00000000`00000000 : 0xfffffa80`00100000


FOLLOWUP_IP:
nt+36bc12
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+36bc12

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

STACK_COMMAND: .cxr 0xfffff8800b00d090 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Spoiler

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002c51000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

EXCEPTION_RECORD: fffff8800b397998 -- (.exr 0xfffff8800b397998)
ExceptionAddress: fffff80002c584a3 (nt+0x00000000000074a3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000059a33
Attempt to read from address 0000000000059a33

CONTEXT: fffff8800b3971f0 -- (.cxr 0xfffff8800b3971f0)
rax=0000000000000040 rbx=0000000000000040 rcx=fffffa800f324720
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa800f324720
rip=fffff80002c584a3 rsp=fffff8800b397bd0 rbp=fffff80002f01a00
r8=0000000000000000 r9=fffff8800b397df0 r10=0000000000000000
r11=fffff8800b397e68 r12=fffffa800f324720 r13=0000000000059a03
r14=fffffa800ca42c10 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt+0x74a3:
fffff800`02c584a3 4d8b4d30 mov r9,qword ptr [r13+30h] ds:002b:00000000`00059a33=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x24

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002c584a3

STACK_TEXT:
fffff880`0b397bd0 00000000`00000000 : fffffa80`0f8c89d0 00000000`00000020 fffffa80`0ca5e790 00000000`00000000 : nt+0x74a3


FOLLOWUP_IP:
nt+74a3
fffff800`02c584a3 4d8b4d30 mov r9,qword ptr [r13+30h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+74a3

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

STACK_COMMAND: .cxr 0xfffff8800b3971f0 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Spoiler

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002c05000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xDE

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002ce625d to fffff80002c7abc0

STACK_TEXT:
fffff880`0b090808 fffff800`02ce625d : 00000000`000000de 00000000`00000002 fffff8a0`1699e240 fffff8a0`1499e241 : nt+0x75bc0
fffff880`0b090810 00000000`000000de : 00000000`00000002 fffff8a0`1699e240 fffff8a0`1499e241 00000004`273238c0 : nt+0xe125d
fffff880`0b090818 00000000`00000002 : fffff8a0`1699e240 fffff8a0`1499e241 00000004`273238c0 00000000`00000000 : 0xde
fffff880`0b090820 fffff8a0`1699e240 : fffff8a0`1499e241 00000004`273238c0 00000000`00000000 00000000`00000001 : 0x2
fffff880`0b090828 fffff8a0`1499e241 : 00000004`273238c0 00000000`00000000 00000000`00000001 fffffa80`11064320 : 0xfffff8a0`1699e240
fffff880`0b090830 00000004`273238c0 : 00000000`00000000 00000000`00000001 fffffa80`11064320 fffffa80`11064320 : 0xfffff8a0`1499e241
fffff880`0b090838 00000000`00000000 : 00000000`00000001 fffffa80`11064320 fffffa80`11064320 fffffa80`110642e8 : 0x00000004`273238c0


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+75bc0
fffff800`02c7abc0 48894c2408 mov qword ptr [rsp+8],rcx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+75bc0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Spoiler

ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: dxgmms1

FAULTING_MODULE: fffff80002c0c000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 5164dc13

BUGCHECK_STR: 0x10e_1f

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff880019d022f to fffff80002c81bc0

STACK_TEXT:
fffff880`03e5b738 fffff880`019d022f : 00000000`0000010e 00000000`0000001f fffff8a0`0f608b10 00000000`00000004 : nt+0x75bc0
fffff880`03e5b740 00000000`0000010e : 00000000`0000001f fffff8a0`0f608b10 00000000`00000004 00000000`0001196c : watchdog+0x122f
fffff880`03e5b748 00000000`0000001f : fffff8a0`0f608b10 00000000`00000004 00000000`0001196c fffffa80`0eb50000 : 0x10e
fffff880`03e5b750 fffff8a0`0f608b10 : 00000000`00000004 00000000`0001196c fffffa80`0eb50000 fffffa80`10969330 : 0x1f
fffff880`03e5b758 00000000`00000004 : 00000000`0001196c fffffa80`0eb50000 fffffa80`10969330 00000000`00000004 : 0xfffff8a0`0f608b10
fffff880`03e5b760 00000000`0001196c : fffffa80`0eb50000 fffffa80`10969330 00000000`00000004 fffffa80`0eb71000 : 0x4
fffff880`03e5b768 fffffa80`0eb50000 : fffffa80`10969330 00000000`00000004 fffffa80`0eb71000 fffff880`0fdc51d0 : 0x1196c
fffff880`03e5b770 fffffa80`10969330 : 00000000`00000004 fffffa80`0eb71000 fffff880`0fdc51d0 fffff8a0`0f608b10 : 0xfffffa80`0eb50000
fffff880`03e5b778 00000000`00000004 : fffffa80`0eb71000 fffff880`0fdc51d0 fffff8a0`0f608b10 fffff8a0`0f608b10 : 0xfffffa80`10969330
fffff880`03e5b780 fffffa80`0eb71000 : fffff880`0fdc51d0 fffff8a0`0f608b10 fffff8a0`0f608b10 00000000`0001196c : 0x4
fffff880`03e5b788 fffff880`0fdc51d0 : fffff8a0`0f608b10 fffff8a0`0f608b10 00000000`0001196c 00000000`00000004 : 0xfffffa80`0eb71000
fffff880`03e5b790 fffff8a0`0f608b10 : fffff8a0`0f608b10 00000000`0001196c 00000000`00000004 00000000`00000000 : dxgmms1+0x211d0
fffff880`03e5b798 fffff8a0`0f608b10 : 00000000`0001196c 00000000`00000004 00000000`00000000 00000000`00000000 : 0xfffff8a0`0f608b10
fffff880`03e5b7a0 00000000`0001196c : 00000000`00000004 00000000`00000000 00000000`00000000 fffffa80`0eb71000 : 0xfffff8a0`0f608b10
fffff880`03e5b7a8 00000000`00000004 : 00000000`00000000 00000000`00000000 fffffa80`0eb71000 fffff880`0fdc29d3 : 0x1196c
fffff880`03e5b7b0 00000000`00000000 : 00000000`00000000 fffffa80`0eb71000 fffff880`0fdc29d3 00000000`00000000 : 0x4


STACK_COMMAND: kb

FOLLOWUP_IP:
dxgmms1+211d0
fffff880`0fdc51d0 ?? ???

SYMBOL_STACK_INDEX: b

SYMBOL_NAME: dxgmms1+211d0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: dxgmms1.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Hier ein Paar Bilder von Bluescreenview, CPU-Z, GPU-Z ect.

Spoiler

Ich bin absolut ratlos... hoffe ihr könnt mir helfen!

Vielen Dank und Grüße,



Rorschachtinger

 

[biosmanager]

Das ist ein blöde Angelegenheit aber ich tippe einfach mal auf eine Komponente die man weniger beachtet.

Bei mir hat z.b. mal ein Kartenleser Freezes verursacht.

Was ist denn außer der "normalen" HW so verbaut?

 

[Rorschachtinger]

Was ist denn außer der "normalen" HW so verbaut?

Mhh, ich hab ein Bluray-Laufwerk und in Kartenleser drin. Sonst nichts.
Ich werd den Kartenleser gleich mal abstecken, mal schaun was das so bringt!

 

[jamie]

Probier mal dieses praktische Tool: Resplendence Software - WhoCrashed, automatic crash dump analyzer
Der analysiert, wer Schuld ist, und schlägt gleich eine Lösung vor.

 

[simpel1970]

Der Debugger arbeitet wesentlich besser als WhoCrased oder Bluescreenview, etc. Allerdings benötigt er etwas Futter (sprich Symbole):

BUCKET_ID: WRONG_SYMBOLS

Die scheinen aber zu fehlen. Hast du dem Debugger einen Symbolpfad hinterlegt?

 

[Rorschachtinger]

Hast du dem Debugger einen Symbolpfad hinterlegt?

Oh Gott sorry... hier nochmal die Minidumps:

Spoiler

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b37dd38
Arg3: fffff8800b37d590
Arg4: fffff80002cf2f00

Debugging Details:
------------------


EXCEPTION_RECORD: fffff8800b37dd38 -- (.exr 0xfffff8800b37dd38)
ExceptionAddress: fffff80002cf2f00 (nt! ?? ::FNODOBFM::`string'+0x00000000000430b9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000004000000000
Attempt to read from address 0000004000000000

CONTEXT: fffff8800b37d590 -- (.cxr 0xfffff8800b37d590)
rax=0000000000000000 rbx=fffffa800f855b00 rcx=fffffa800ec60058
rdx=0000000000000000 rsi=fffffa800ec60010 rdi=0000000000000000
rip=fffff80002cf2f00 rsp=fffff8800b37df70 rbp=0000000000000000
r8=fffffa800ec60000 r9=0000000000000006 r10=0000007c400189d8
r11=0000007ffffffff8 r12=0000004000000000 r13=0000000000000000
r14=0000000000000000 r15=fffff8a00482b1f8
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt! ?? ::FNODOBFM::`string'+0x430b9:
fffff800`02cf2f00 498b1c24 mov rbx,qword ptr [r12] ds:002b:00000040`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000004000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eae100
GetUlongFromAddress: unable to read from fffff80002eae1c0
0000004000000000 Nonpaged pool

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+430b9
fffff800`02cf2f00 498b1c24 mov rbx,qword ptr [r12]

FAULTING_IP:
nt! ?? ::FNODOBFM::`string'+430b9
fffff800`02cf2f00 498b1c24 mov rbx,qword ptr [r12]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff80002c99f87 to fffff80002cf2f00

STACK_TEXT:
fffff880`0b37df70 fffff800`02c99f87 : 00000000`000000f1 fffffa80`00475500 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x430b9
fffff880`0b37dfe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmUnmapViewInSystemCache+0x657


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+430b9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

STACK_COMMAND: .cxr 0xfffff8800b37d590 ; kb

FAILURE_BUCKET_ID: X64_0x24_nt!_??_::FNODOBFM::_string_+430b9

BUCKET_ID: X64_0x24_nt!_??_::FNODOBFM::_string_+430b9

Followup: MachineOwner

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\020114-7144-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c17000 PsLoadedModuleList = 0xfffff800`02e5a6d0
Debug session time: Sat Feb 1 23:17:34.401 2014 (UTC + 1:00)
System Uptime: 0 days 1:03:21.213
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002f82c12, fffff8800b00d090, 0}

Probably caused by : ntkrnlmp.exe ( nt!NtWaitForSingleObject+b2 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002f82c12, Address of the instruction which caused the bugcheck
Arg3: fffff8800b00d090, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP:
nt!NtWaitForSingleObject+b2
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h]

CONTEXT: fffff8800b00d090 -- (.cxr 0xfffff8800b00d090)
rax=0000000000000000 rbx=fffffa801193ca80 rcx=fffff80002e3eb80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f82c12 rsp=fffff8800b00da70 rbp=fffff8800b00db60
r8=fffff8a003ddc000 r9=0000000000000018 r10=0000000000000000
r11=0000000000100003 r12=0000000000000001 r13=0000000000000000
r14=00000000042eea50 r15=0000000073e92450
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!NtWaitForSingleObject+0xb2:
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h] ds:002b:00000000`00000020=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: FlashPlayerPlu

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80002c8be53 to fffff80002f82c12

STACK_TEXT:
fffff880`0b00da70 fffff800`02c8be53 : fffffa80`10d1eb50 00000000`08ac0cc0 00000000`00000000 fffffa80`1193ca80 : nt!NtWaitForSingleObject+0xb2
fffff880`0b00dae0 00000000`73e92e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`042ee9d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73e92e09


FOLLOWUP_IP:
nt!NtWaitForSingleObject+b2
fffff800`02f82c12 488b4820 mov rcx,qword ptr [rax+20h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!NtWaitForSingleObject+b2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

STACK_COMMAND: .cxr 0xfffff8800b00d090 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!NtWaitForSingleObject+b2

BUCKET_ID: X64_0x3B_nt!NtWaitForSingleObject+b2

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\020114-6162-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e946d0
Debug session time: Sat Feb 1 17:05:22.915 2014 (UTC + 1:00)
System Uptime: 0 days 0:52:15.727
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800b397998, fffff8800b3971f0, fffff80002c584a3}

Probably caused by : memory_corruption ( nt!MmLocateSubsectionNode+23 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b397998
Arg3: fffff8800b3971f0
Arg4: fffff80002c584a3

Debugging Details:
------------------


EXCEPTION_RECORD: fffff8800b397998 -- (.exr 0xfffff8800b397998)
ExceptionAddress: fffff80002c584a3 (nt!MmLocateSubsectionNode+0x0000000000000023)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000059a33
Attempt to read from address 0000000000059a33

CONTEXT: fffff8800b3971f0 -- (.cxr 0xfffff8800b3971f0)
rax=0000000000000040 rbx=0000000000000040 rcx=fffffa800f324720
rdx=0000000000000000 rsi=0000000000000000 rdi=fffffa800f324720
rip=fffff80002c584a3 rsp=fffff8800b397bd0 rbp=fffff80002f01a00
r8=0000000000000000 r9=fffff8800b397df0 r10=0000000000000000
r11=fffff8800b397e68 r12=fffffa800f324720 r13=0000000000059a03
r14=fffffa800ca42c10 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MmLocateSubsectionNode+0x23:
fffff800`02c584a3 4d8b4d30 mov r9,qword ptr [r13+30h] ds:002b:00000000`00059a33=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: avguard.exe

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000059a33

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efe100
GetUlongFromAddress: unable to read from fffff80002efe1c0
0000000000059a33 Nonpaged pool

FOLLOWUP_IP:
nt!MmLocateSubsectionNode+23
fffff800`02c584a3 4d8b4d30 mov r9,qword ptr [r13+30h]

FAULTING_IP:
nt!MmLocateSubsectionNode+23
fffff800`02c584a3 4d8b4d30 mov r9,qword ptr [r13+30h]

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from fffff80002cddf96 to fffff80002c584a3

STACK_TEXT:
fffff880`0b397bd0 fffff800`02cddf96 : fffffa80`0f324720 fffffa80`0f8c89d0 00000000`00000040 00000000`00000000 : nt!MmLocateSubsectionNode+0x23
fffff880`0b397c40 fffff800`02cdd027 : fffff8a0`03fa9c80 fffff880`02f65830 fffff880`0b397de8 fffff8a0`03436870 : nt!MmMapViewInSystemCache+0x376
fffff880`0b397db0 fffff800`02cdbf8f : 00000000`00000000 00000000`00000000 00000000`00000001 fffffa80`00000000 : nt!CcGetVacbMiss+0x177
fffff880`0b397e70 fffff800`02fb00b2 : 00000000`00000000 00000000`00000000 fffff880`0b397f40 fffff880`0b397fd0 : nt!CcGetVirtualAddress+0x2e0
fffff880`0b397f00 fffff880`0123e5d0 : fffff8a0`00000000 fffff8a0`00000005 fffffa80`0fc23e40 fffff880`01290001 : nt!CcCopyRead+0x132
fffff880`0b397fc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCachedRead+0x180


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MmLocateSubsectionNode+23

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

STACK_COMMAND: .cxr 0xfffff8800b3971f0 ; kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x24_nt!MmLocateSubsectionNode+23

BUCKET_ID: X64_0x24_nt!MmLocateSubsectionNode+23

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\012414-7285-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c05000 PsLoadedModuleList = 0xfffff800`02e486d0
Debug session time: Thu Jan 23 22:44:50.733 2014 (UTC + 1:00)
System Uptime: 0 days 5:04:02.545
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {2, fffff8a01699e240, fffff8a01499e241, 4273238c0}

*** WARNING: Unable to verify timestamp for truecrypt.sys
*** ERROR: Module load completed but symbols could not be loaded for truecrypt.sys
Probably caused by : truecrypt.sys ( truecrypt+886d )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 0000000000000002
Arg2: fffff8a01699e240
Arg3: fffff8a01499e241
Arg4: 00000004273238c0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xDE

PROCESS_NAME: TrueCrypt.exe

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff80002ce625d to fffff80002c7abc0

STACK_TEXT:
fffff880`0b090808 fffff800`02ce625d : 00000000`000000de 00000000`00000002 fffff8a0`1699e240 fffff8a0`1499e241 : nt!KeBugCheckEx
fffff880`0b090810 fffff800`02c48882 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2c8e1
fffff880`0b090900 fffff880`012837ef : fffffa80`1004df68 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcPurgeCacheSection+0x172
fffff880`0b090970 fffff880`012d570b : fffffa80`10aece40 fffffa80`0efa2180 fffffa80`0efa2101 00000000`00000001 : Ntfs!NtfsFlushVolume+0x5cf
fffff880`0b090aa0 fffff880`012d5476 : fffffa80`0efa2101 fffffa80`0efa2180 fffffa80`10aece40 00000000`00000000 : Ntfs!NtfsLockVolumeInternal+0x147
fffff880`0b090b10 fffff880`012c31ee : fffffa80`10aece40 fffffa80`0d6f2010 fffffa80`0ef8f900 fffff880`00000001 : Ntfs!NtfsLockVolume+0x1f6
fffff880`0b090bf0 fffff880`012c333d : fffffa80`10aece40 00000000`00000000 fffff880`0b090d20 00000000`00000000 : Ntfs!NtfsUserFsRequest+0x2de
fffff880`0b090c30 fffff880`010cbbcf : fffff880`0b090d80 fffffa80`0d6f2010 fffff880`0b090d01 fffffa80`10aece40 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`0b090cd0 fffff880`010eb95e : fffffa80`0ef8f9f0 fffffa80`0ef8f9f0 fffffa80`0ef8f900 fffffa80`0d6f2010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0b090d60 fffff880`02d8c86d : 00000000`00090018 fffffa80`0ef8f9f0 00000000`00000000 00000000`00000020 : fltmgr!FltpFsControl+0xee
fffff880`0b090dc0 00000000`00090018 : fffffa80`0ef8f9f0 00000000`00000000 00000000`00000020 00000000`00000000 : truecrypt+0x886d
fffff880`0b090dc8 fffffa80`0ef8f9f0 : 00000000`00000000 00000000`00000020 00000000`00000000 fffff800`00000000 : 0x90018
fffff880`0b090dd0 00000000`00000000 : 00000000`00000020 00000000`00000000 fffff800`00000000 fffffa80`0cb0f900 : 0xfffffa80`0ef8f9f0


STACK_COMMAND: kb

FOLLOWUP_IP:
truecrypt+886d
fffff880`02d8c86d ?? ???

SYMBOL_STACK_INDEX: a

SYMBOL_NAME: truecrypt+886d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: truecrypt

IMAGE_NAME: truecrypt.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4f30ea50

FAILURE_BUCKET_ID: X64_0xDE_truecrypt+886d

BUCKET_ID: X64_0xDE_truecrypt+886d

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\011614-11746-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c67000 PsLoadedModuleList = 0xfffff800`02eaa6d0
Debug session time: Thu Jan 16 21:55:40.478 2014 (UTC + 1:00)
System Uptime: 0 days 4:11:26.306
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa8010603000, 2, 1, fffff880099557c4}

*** WARNING: Unable to verify timestamp for ASUSSTU.SYS
*** ERROR: Module load completed but symbols could not be loaded for ASUSSTU.SYS
Probably caused by : ASUSSTU.SYS ( ASUSSTU+67c4 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa8010603000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880099557c4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f14100
GetUlongFromAddress: unable to read from fffff80002f141c0
fffffa8010603000 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
ASUSSTU+67c4
fffff880`099557c4 480fc351f0 movnti qword ptr [rcx-10h],rdx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: audiodg.exe

TRAP_FRAME: fffff88009e25020 -- (.trap 0xfffff88009e25020)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8010073450 rbx=0000000000000000 rcx=fffffa8010603010
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880099557c4 rsp=fffff88009e251b8 rbp=0000000000001f40
r8=0000000000000030 r9=0000000017fe9c13 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
ASUSSTU+0x67c4:
fffff880`099557c4 480fc351f0 movnti qword ptr [rcx-10h],rdx ds:fffffa80`10603000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002cdc169 to fffff80002cdcbc0

STACK_TEXT:
fffff880`09e24ed8 fffff800`02cdc169 : 00000000`0000000a fffffa80`10603000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`09e24ee0 fffff800`02cdade0 : fffffa80`0d5d3790 fffff880`09e250a0 fffffa80`0f9e5a20 fffffa80`0d5d3790 : nt!KiBugCheckDispatch+0x69
fffff880`09e25020 fffff880`099557c4 : fffff880`099534bd 00000000`00000000 fffff880`03cc1b62 00000000`00000000 : nt!KiPageFault+0x260
fffff880`09e251b8 fffff880`099534bd : 00000000`00000000 fffff880`03cc1b62 00000000`00000000 fffffa80`0d5d3790 : ASUSSTU+0x67c4
fffff880`09e251c0 00000000`00000000 : fffff880`03cc1b62 00000000`00000000 fffffa80`0d5d3790 00000000`00000003 : ASUSSTU+0x44bd


STACK_COMMAND: kb

FOLLOWUP_IP:
ASUSSTU+67c4
fffff880`099557c4 480fc351f0 movnti qword ptr [rcx-10h],rdx

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: ASUSSTU+67c4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ASUSSTU

IMAGE_NAME: ASUSSTU.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4fd83226

FAILURE_BUCKET_ID: X64_0xD1_ASUSSTU+67c4

BUCKET_ID: X64_0xD1_ASUSSTU+67c4

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\011414-9032-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c50000 PsLoadedModuleList = 0xfffff800`02e936d0
Debug session time: Tue Jan 14 19:56:34.807 2014 (UTC + 1:00)
System Uptime: 0 days 1:37:11.829
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff80003df9c10, 2, 8, fffff80003df9c10}

Probably caused by : NETIO.SYS ( NETIO!WfpAllocFromNPagedLookasideList+47 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff80003df9c10, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff80003df9c10, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efd100
GetUlongFromAddress: unable to read from fffff80002efd1c0
fffff80003df9c10 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
+0
fffff800`03df9c10 ?? ???

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: BitTorrent.exe

TRAP_FRAME: fffff8800c5dcc00 -- (.trap 0xfffff8800c5dcc00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003df9c10 rsp=fffff8800c5dcd98 rbp=fffffa800e84cc90
r8=000000004d706657 r9=0000000000000000 r10=fffffa800cd91000
r11=fffff8800c5dcd08 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
fffff800`03df9c10 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002cc5169 to fffff80002cc5bc0

FAILED_INSTRUCTION_ADDRESS:
+0
fffff800`03df9c10 ?? ???

STACK_TEXT:
fffff880`0c5dcab8 fffff800`02cc5169 : 00000000`0000000a fffff800`03df9c10 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`0c5dcac0 fffff800`02cc3de0 : fffff880`0c5dcc38 fffff880`0c5dcc30 00020000`00020001 fffff880`0c5dce10 : nt!KiBugCheckDispatch+0x69
fffff880`0c5dcc00 fffff800`03df9c10 : fffff880`01576a77 00000000`00000001 fffff880`01576f83 00000000`00000001 : nt!KiPageFault+0x260
fffff880`0c5dcd98 fffff880`01576a77 : 00000000`00000001 fffff880`01576f83 00000000`00000001 00000000`00000000 : 0xfffff800`03df9c10
fffff880`0c5dcda0 fffff880`01571636 : 00000000`00000000 00000000`00000000 fffff880`0c5dcf18 fffffa80`0eedf5b0 : NETIO!WfpAllocFromNPagedLookasideList+0x47
fffff880`0c5dcdd0 fffff880`0157711d : 00000000`00000001 fffffa80`0e84cc90 fffffa80`0eeb27a0 00000000`00000000 : NETIO!InsertFilterToMatchBuf+0xe6
fffff880`0c5dce10 fffff880`0157694a : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : NETIO!IndexListEnum+0xe3
fffff880`0c5dce80 fffff880`01576cdb : fffff880`0c5dd218 fffff880`0c5dd030 fffff880`0c000003 fffff880`014912a0 : NETIO!FeEnumLayer+0xaa
fffff880`0c5dcee0 fffff880`0157746d : fffffa80`0ccfbf10 fffffa80`0e84ac90 00000000`00000017 fffffa80`0f5a7080 : NETIO!KfdGetLayerActionFromEnumTemplate+0x8b
fffff880`0c5dcf90 fffff880`0167619d : fffff880`0c5dd218 fffff880`0c5dd218 00000000`00000000 fffffa80`1026b338 : NETIO!KfdCheckAndCacheConnectBypass+0x2d
fffff880`0c5dcfd0 fffff880`01676815 : 00000000`00000004 fffffa80`0e8c1db0 fffffa80`0e8c1db0 00000000`00000000 : tcpip!CheckConnectBypass+0x19d
fffff880`0c5dd160 fffff880`016764ff : 00000000`00000001 00000000`00000032 00000000`00007dc6 fffffa80`0ff75570 : tcpip!WfpAleAuthorizeConnect+0x1a5
fffff880`0c5dd400 fffff880`01678e9c : 00000000`00000000 00000000`00000000 fffffa80`0d46fcf0 fffffa80`0d46fcf0 : tcpip!TcpContinueCreateAndConnect+0x30f
fffff880`0c5dd500 fffff880`01678873 : fffffa80`0ff75480 fffffa80`0d46fcf0 00000000`00000002 fffffa80`0d46ff48 : tcpip!TcpCreateAndConnectTcbInspectConnectRequestComplete+0x5c
fffff880`0c5dd530 fffff880`01678db6 : 00000000`000000c0 00000000`000000c0 fffffa80`0d5a5870 00000000`00000000 : tcpip!TcpCreateAndConnectTcbWorkQueueRoutine+0x273
fffff880`0c5dd600 fffff880`02d0e3fe : fffffa80`0d875b00 fffff880`0c5ddb60 fffffa80`0dfe8010 fffffa80`0f919ca0 : tcpip!TcpCreateAndConnectTcb+0x4c6
fffff880`0c5dd6f0 fffff800`02fe23a7 : fffffa80`0f919ca0 fffffa80`0d875b00 00000000`00000000 fffffa80`0dfe8010 : afd!AfdConnect+0x6be
fffff880`0c5dd8d0 fffff800`02fe2c06 : fffff880`0c5ddab8 00000000`00000000 00000000`00000001 00000000`04e833d8 : nt!IopXxxControlFile+0x607
fffff880`0c5dda00 fffff800`02cc4e53 : fffff880`0c5ddb60 fffffa80`0f3bd060 fffff880`0c5ddab8 00000980`00000001 : nt!NtDeviceIoControlFile+0x56
fffff880`0c5dda70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!WfpAllocFromNPagedLookasideList+47
fffff880`01576a77 ebd5 jmp NETIO!WfpAllocFromNPagedLookasideList+0x1e (fffff880`01576a4e)

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: NETIO!WfpAllocFromNPagedLookasideList+47

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 5034f6a0

FAILURE_BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_NETIO!WfpAllocFromNPagedLookasideList+47

BUCKET_ID: X64_0xD1_CODE_AV_BAD_IP_NETIO!WfpAllocFromNPagedLookasideList+47

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\011214-10904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c1d000 PsLoadedModuleList = 0xfffff800`02e606d0
Debug session time: Sun Jan 12 21:50:22.505 2014 (UTC + 1:00)
System Uptime: 0 days 6:47:28.333
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {8, 2, 1, fffff88003cd0140}

Probably caused by : afd.sys ( afd!AfdFastConnectionReceive+170 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88003cd0140, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eca100
GetUlongFromAddress: unable to read from fffff80002eca1c0
0000000000000008 Nonpaged pool

CURRENT_IRQL: 2

FAULTING_IP:
afd!AfdFastConnectionReceive+170
fffff880`03cd0140 48894108 mov qword ptr [rcx+8],rax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Steam.exe

TRAP_FRAME: fffff8800caf51b0 -- (.trap 0xfffff8800caf51b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8016994058 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8013205f10 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003cd0140 rsp=fffff8800caf5340 rbp=fffff8800caf5b60
r8=0000000000010000 r9=fffffa8016994058 r10=0000000000010000
r11=000000000000ffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
afd!AfdFastConnectionReceive+0x170:
fffff880`03cd0140 48894108 mov qword ptr [rcx+8],rax ds:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002c92169 to fffff80002c92bc0

STACK_TEXT:
fffff880`0caf5068 fffff800`02c92169 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0caf5070 fffff800`02c90de0 : 00000000`00000000 fffff880`0168f036 00000000`00000000 fffff880`0caf5650 : nt!KiBugCheckDispatch+0x69
fffff880`0caf51b0 fffff880`03cd0140 : fffff880`0caf55e0 fffff880`0caf5650 00000000`0000afd2 fffff880`0caf55e0 : nt!KiPageFault+0x260
fffff880`0caf5340 fffff880`03cb87bb : 00000000`0000000e 00000000`000007ff fffff880`0caf55c0 fffffa80`0cd5a450 : afd!AfdFastConnectionReceive+0x170
fffff880`0caf5560 fffff800`02faf113 : 00000000`00010000 fffffa80`116b0ab0 00000000`0990f5f4 fffffa80`100a5b01 : afd!AfdFastIoDeviceControl+0x7ab
fffff880`0caf58d0 fffff800`02fafc06 : fffff880`0caf5ab8 00000000`00000454 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x373
fffff880`0caf5a00 fffff800`02c91e53 : fffff880`0caf5b60 fffffa80`1105cf20 fffff880`0caf5ab8 00000980`00000000 : nt!NtDeviceIoControlFile+0x56
fffff880`0caf5a70 00000000`72972e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`039feb68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x72972e09


STACK_COMMAND: kb

FOLLOWUP_IP:
afd!AfdFastConnectionReceive+170
fffff880`03cd0140 48894108 mov qword ptr [rcx+8],rax

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: afd!AfdFastConnectionReceive+170

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: afd

IMAGE_NAME: afd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 52462c33

FAILURE_BUCKET_ID: X64_0xD1_afd!AfdFastConnectionReceive+170

BUCKET_ID: X64_0xD1_afd!AfdFastConnectionReceive+170

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\011114-8502-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c18000 PsLoadedModuleList = 0xfffff800`02e5b6d0
Debug session time: Sat Jan 11 17:32:48.739 2014 (UTC + 1:00)
System Uptime: 0 days 2:03:32.566
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff80000ba9000, d, 1, fffff80002c6a6ca}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+6b74 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff80000ba9000, memory referenced
Arg2: 000000000000000d, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002c6a6ca, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec5100
GetUlongFromAddress: unable to read from fffff80002ec51c0
fffff80000ba9000 Nonpaged pool

CURRENT_IRQL: d

FAULTING_IP:
nt! ?? ::FNODOBFM::`string'+6b74
fffff800`02c6a6ca 488944cc28 mov qword ptr [rsp+rcx*8+28h],rax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TAG_NOT_DEFINED_c000000f: FFFFF80000BA2FB0

TRAP_FRAME: fffff80000b9c7f0 -- (.trap 0xfffff80000b9c7f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=8b4818558b490000 rbx=0000000000000000 rcx=00000000000018cb
rdx=fffff80002d99b0d rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c6a6ca rsp=fffff80000b9c980 rbp=0000000000000004
r8=fffff80002d93140 r9=fffff80002d93140 r10=0000000000009b0d
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt! ?? ::FNODOBFM::`string'+0x6b74:
fffff800`02c6a6ca 488944cc28 mov qword ptr [rsp+rcx*8+28h],rax ss:0018:fffff800`00ba9000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002c8d169 to fffff80002c8dbc0

STACK_TEXT:
fffff800`00b9c6a8 fffff800`02c8d169 : 00000000`0000000a fffff800`00ba9000 00000000`0000000d 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c6b0 fffff800`02c8bde0 : 00000000`00000000 fffffa80`12420e10 fffffa80`0d703310 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c7f0 fffff800`02c6a6ca : 00000000`00000000 fffff800`02e08e80 00000000`00002710 fffff880`01143821 : nt!KiPageFault+0x260
fffff800`00b9c980 90909090`90909090 : 74894808`245c8948 8b20ec83`48571024 0095870f`1ff983f9 8825048b`48650000 : nt! ?? ::FNODOBFM::`string'+0x6b74
fffff800`00b9ca80 74894808`245c8948 : 8b20ec83`48571024 0095870f`1ff983f9 8825048b`48650000 66ffcb83`48000001 : 0x90909090`90909090
fffff800`00b9ca88 8b20ec83`48571024 : 0095870f`1ff983f9 8825048b`48650000 66ffcb83`48000001 48f00000`01c49801 : 0x74894808`245c8948
fffff800`00b9ca90 0095870f`1ff983f9 : 8825048b`48650000 66ffcb83`48000001 48f00000`01c49801 0000087b`882dba0f : 0x8b20ec83`48571024
fffff800`00b9ca98 8825048b`48650000 : 66ffcb83`48000001 48f00000`01c49801 0000087b`882dba0f 087b7f0d`8d480c73 : 0x0095870f`1ff983f9
fffff800`00b9caa0 66ffcb83`48000001 : 48f00000`01c49801 0000087b`882dba0f 087b7f0d`8d480c73 8b48ffee`b95ae800 : 0x8825048b`48650000
fffff800`00b9caa8 48f00000`01c49801 : 0000087b`882dba0f 087b7f0d`8d480c73 8b48ffee`b95ae800 48f63300`087bdb0d : 0x66ffcb83`48000001
fffff800`00b9cab0 0000087b`882dba0f : 087b7f0d`8d480c73 8b48ffee`b95ae800 48f63300`087bdb0d 49e8d78b`0b74ce3b : 0x48f00000`01c49801
fffff800`00b9cab8 087b7f0d`8d480c73 : 8b48ffee`b95ae800 48f63300`087bdb0d 49e8d78b`0b74ce3b bf05ebf8`8bffee1e : 0x0000087b`882dba0f
fffff800`00b9cac0 8b48ffee`b95ae800 : 48f63300`087bdb0d 49e8d78b`0b74ce3b bf05ebf8`8bffee1e c10f48f0`00000021 : 0x087b7f0d`8d480c73
fffff800`00b9cac8 48f63300`087bdb0d : 49e8d78b`0b74ce3b bf05ebf8`8bffee1e c10f48f0`00000021 02c3f600`087b531d : 0x8b48ffee`b95ae800
fffff800`00b9cad0 49e8d78b`0b74ce3b : bf05ebf8`8bffee1e c10f48f0`00000021 02c3f600`087b531d 480c7504`c3f61174 : 0x48f63300`087bdb0d
fffff800`00b9cad8 bf05ebf8`8bffee1e : c10f48f0`00000021 02c3f600`087b531d 480c7504`c3f61174 cde80008`7b420d8d : 0x49e8d78b`0b74ce3b
fffff800`00b9cae0 c10f48f0`00000021 : 02c3f600`087b531d 480c7504`c3f61174 cde80008`7b420d8d 250c8b48`65fff33f : 0xbf05ebf8`8bffee1e
fffff800`00b9cae8 02c3f600`087b531d : 480c7504`c3f61174 cde80008`7b420d8d 250c8b48`65fff33f c4818366`00000188 : 0xc10f48f0`00000021
fffff800`00b9caf0 480c7504`c3f61174 : cde80008`7b420d8d 250c8b48`65fff33f c4818366`00000188 8d481e75`01000001 : 0x02c3f600`087b531d
fffff800`00b9caf8 cde80008`7b420d8d : 250c8b48`65fff33f c4818366`00000188 8d481e75`01000001 66157400`39485041 : 0x480c7504`c3f61174
fffff800`00b9cb00 250c8b48`65fff33f : c4818366`00000188 8d481e75`01000001 66157400`39485041 0c750000`01c6b139 : 0xcde80008`7b420d8d
fffff800`00b9cb08 c4818366`00000188 : 8d481e75`01000001 66157400`39485041 0c750000`01c6b139 bf05ebff`ea8bd7e8 : 0x250c8b48`65fff33f
fffff800`00b9cb10 8d481e75`01000001 : 66157400`39485041 0c750000`01c6b139 bf05ebff`ea8bd7e8 245c8b48`00000020 : 0xc4818366`00000188
fffff800`00b9cb18 66157400`39485041 : 0c750000`01c6b139 bf05ebff`ea8bd7e8 245c8b48`00000020 c78b3824`748b4830 : 0x8d481e75`01000001
fffff800`00b9cb20 0c750000`01c6b139 : bf05ebff`ea8bd7e8 245c8b48`00000020 c78b3824`748b4830 9090c35f`20c48348 : 0x66157400`39485041
fffff800`00b9cb28 bf05ebff`ea8bd7e8 : 245c8b48`00000020 c78b3824`748b4830 9090c35f`20c48348 90909090`90909090 : 0x0c750000`01c6b139
fffff800`00b9cb30 245c8b48`00000020 : c78b3824`748b4830 9090c35f`20c48348 90909090`90909090 74894808`245c8948 : 0xbf05ebff`ea8bd7e8
fffff800`00b9cb38 c78b3824`748b4830 : 9090c35f`20c48348 90909090`90909090 74894808`245c8948 41554154`41571824 : 0x245c8b48`00000020
fffff800`00b9cb40 9090c35f`20c48348 : 90909090`90909090 74894808`245c8948 41554154`41571824 0080ec81`48574156 : 0xc78b3824`748b4830
fffff800`00b9cb48 90909090`90909090 : 74894808`245c8948 41554154`41571824 0080ec81`48574156 f28b44f9`8b4d0000 : 0x9090c35f`20c48348
fffff800`00b9cb50 74894808`245c8948 : 41554154`41571824 0080ec81`48574156 f28b44f9`8b4d0000 e68b44f6`33e98b4c : 0x90909090`90909090
fffff800`00b9cb58 41554154`41571824 : 0080ec81`48574156 f28b44f9`8b4d0000 e68b44f6`33e98b4c 000db80a`7304fa83 : 0x74894808`245c8948
fffff800`00b9cb60 0080ec81`48574156 : f28b44f9`8b4d0000 e68b44f6`33e98b4c 000db80a`7304fa83 8b000009`40e9c000 : 0x41554154`41571824
fffff800`00b9cb68 f28b44f9`8b4d0000 : e68b44f6`33e98b4c 000db80a`7304fa83 8b000009`40e9c000 05fb8358`245c8919 : 0x0080ec81`48574156
fffff800`00b9cb70 e68b44f6`33e98b4c : 000db80a`7304fa83 8b000009`40e9c000 05fb8358`245c8919 fb830000`03358f0f : 0xf28b44f9`8b4d0000
fffff800`00b9cb78 000db80a`7304fa83 : 8b000009`40e9c000 05fb8358`245c8919 fb830000`03358f0f 3b000002`f1840f05 : 0xe68b44f6`33e98b4c
fffff800`00b9cb80 8b000009`40e9c000 : 05fb8358`245c8919 fb830000`03358f0f 3b000002`f1840f05 bf000002`c2840fde : 0x000db80a`7304fa83
fffff800`00b9cb88 05fb8358`245c8919 : fb830000`03358f0f 3b000002`f1840f05 bf000002`c2840fde 840fdf2b`00000001 : 0x8b000009`40e9c000
fffff800`00b9cb90 fb830000`03358f0f : 3b000002`f1840f05 bf000002`c2840fde 840fdf2b`00000001 840fdf2b`000001af : 0x05fb8358`245c8919
fffff800`00b9cb98 3b000002`f1840f05 : bf000002`c2840fde 840fdf2b`00000001 840fdf2b`000001af 840fdf2b`0000013a : 0xfb830000`03358f0f
fffff800`00b9cba0 bf000002`c2840fde : 840fdf2b`00000001 840fdf2b`000001af 840fdf2b`0000013a 850fdf3b`00000109 : 0x3b000002`f1840f05
fffff800`00b9cba8 840fdf2b`00000001 : 840fdf2b`000001af 840fdf2b`0000013a 850fdf3b`00000109 1801c741`000005d3 : 0xbf000002`c2840fde
fffff800`00b9cbb0 840fdf2b`000001af : 840fdf2b`0000013a 850fdf3b`00000109 1801c741`000005d3 0a7318fa`83000000 : 0x840fdf2b`00000001
fffff800`00b9cbb8 840fdf2b`0000013a : 850fdf3b`00000109 1801c741`000005d3 0a7318fa`83000000 08e5e9c0`000004b8 : 0x840fdf2b`000001af
fffff800`00b9cbc0 850fdf3b`00000109 : 1801c741`000005d3 0a7318fa`83000000 08e5e9c0`000004b8 89480849`8b480000 : 0x840fdf2b`0000013a
fffff800`00b9cbc8 1801c741`000005d3 : 0a7318fa`83000000 08e5e9c0`000004b8 89480849`8b480000 8904458b`4160244c : 0x850fdf3b`00000109
fffff800`00b9cbd0 0a7318fa`83000000 : 08e5e9c0`000004b8 89480849`8b480000 8904458b`4160244c 0000ffff`b8302444 : 0x1801c741`000005d3
fffff800`00b9cbd8 08e5e9c0`000004b8 : 89480849`8b480000 8904458b`4160244c 0000ffff`b8302444 c9b70f07`74c83b66 : 0x0a7318fa`83000000
fffff800`00b9cbe0 89480849`8b480000 : 8904458b`4160244c 0000ffff`b8302444 c9b70f07`74c83b66 ed0e0d8b`0675c83b : 0x08e5e9c0`000004b8
fffff800`00b9cbe8 8904458b`4160244c : 0000ffff`b8302444 c9b70f07`74c83b66 ed0e0d8b`0675c83b 8825048b`48650009 : 0x89480849`8b480000
fffff800`00b9cbf0 0000ffff`b8302444 : c9b70f07`74c83b66 ed0e0d8b`0675c83b 8825048b`48650009 66ffca83`48000001 : 0x8904458b`4160244c
fffff800`00b9cbf8 c9b70f07`74c83b66 : ed0e0d8b`0675c83b 8825048b`48650009 66ffca83`48000001 d2330000`01c49001 : 0x0000ffff`b8302444
fffff800`00b9cc00 ed0e0d8b`0675c83b : 8825048b`48650009 66ffca83`48000001 d2330000`01c49001 44894800`1ed67be8 : 0xc9b70f07`74c83b66
fffff800`00b9cc08 8825048b`48650009 : 66ffca83`48000001 d2330000`01c49001 44894800`1ed67be8 485974c6`3b482824 : 0xed0e0d8b`0675c83b
fffff800`00b9cc10 66ffca83`48000001 : d2330000`01c49001 44894800`1ed67be8 485974c6`3b482824 48001ac5`f1e8c88b : 0x8825048b`48650009
fffff800`00b9cc18 d2330000`01c49001 : 44894800`1ed67be8 485974c6`3b482824 48001ac5`f1e8c88b 41382444`8948d88b : 0x66ffca83`48000001
fffff800`00b9cc20 44894800`1ed67be8 : 485974c6`3b482824 48001ac5`f1e8c88b 41382444`8948d88b 49202444`89f0468d : 0xd2330000`01c49001
fffff800`00b9cc28 485974c6`3b482824 : 48001ac5`f1e8c88b 41382444`8948d88b 49202444`89f0468d 38244c8d`4c10558d : 0x44894800`1ed67be8
fffff800`00b9cc30 48001ac5`f1e8c88b : 41382444`8948d88b 49202444`89f0468d 38244c8d`4c10558d 4c8d4820`24448d4c : 0x485974c6`3b482824
fffff800`00b9cc38 41382444`8948d88b : 49202444`89f0468d 38244c8d`4c10558d 4c8d4820`24448d4c 44001d19`01e83024 : 0x48001ac5`f1e8c88b
fffff800`00b9cc40 49202444`89f0468d : 38244c8d`4c10558d 4c8d4820`24448d4c 44001d19`01e83024 c1832024`4c8be08b : 0x41382444`8948d88b
fffff800`00b9cc48 38244c8d`4c10558d : 4c8d4820`24448d4c 44001d19`01e83024 c1832024`4c8be08b 48d38b48`0f894110 : 0x49202444`89f0468d
fffff800`00b9cc50 4c8d4820`24448d4c : 44001d19`01e83024 c1832024`4c8be08b 48d38b48`0f894110 e8cb8b48`28245c8b : 0x38244c8d`4c10558d
fffff800`00b9cc58 44001d19`01e83024 : c1832024`4c8be08b 48d38b48`0f894110 e8cb8b48`28245c8b fffff800`00b97000 : 0x4c8d4820`24448d4c
fffff800`00b9cc60 c1832024`4c8be08b : 48d38b48`0f894110 e8cb8b48`28245c8b fffff800`00b97000 fffff800`00b9cc00 : 0x44001d19`01e83024
fffff800`00b9cc68 48d38b48`0f894110 : e8cb8b48`28245c8b fffff800`00b97000 fffff800`00b9cc00 4865c000`0296bc41 : 0xc1832024`4c8be08b
fffff800`00b9cc70 e8cb8b48`28245c8b : fffff800`00b97000 fffff800`00b9cc00 4865c000`0296bc41 66000001`88250c8b : 0x48d38b48`0f894110
fffff800`00b9cc78 fffff800`00b97000 : fffff800`00b9cc00 4865c000`0296bc41 66000001`88250c8b 850f0000`01c4b901 : 0xe8cb8b48`28245c8b
fffff800`00b9cc80 fffff800`00b9cc00 : 4865c000`0296bc41 66000001`88250c8b 850f0000`01c4b901 50418d48`0000081c : 0xfffff800`00b97000
fffff800`00b9cc88 4865c000`0296bc41 : 66000001`88250c8b 850f0000`01c4b901 50418d48`0000081c 00080f84`0f003948 : 0xfffff800`00b9cc00
fffff800`00b9cc90 66000001`88250c8b : 850f0000`01c4b901 50418d48`0000081c 00080f84`0f003948 000001c6`b1396600 : 0x4865c000`0296bc41
fffff800`00b9cc98 850f0000`01c4b901 : 50418d48`0000081c 00080f84`0f003948 000001c6`b1396600 41e80000`0802850f : 0x66000001`88250c8b
fffff800`00b9cca0 50418d48`0000081c : 00080f84`0f003948 000001c6`b1396600 41e80000`0802850f 000007f8`e9ffea8a : 0x850f0000`01c4b901
fffff800`00b9cca8 00080f84`0f003948 : 000001c6`b1396600 41e80000`0802850f 000007f8`e9ffea8a 01c74100`0007fae9 : 0x50418d48`0000081c
fffff800`00b9ccb0 000001c6`b1396600 : 41e80000`0802850f 000007f8`e9ffea8a 01c74100`0007fae9 7408fa83`00000008 : 0x00080f84`0f003948


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+6b74
fffff800`02c6a6ca 488944cc28 mov qword ptr [rsp+rcx*8+28h],rax

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+6b74

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 521ea035

FAILURE_BUCKET_ID: X64_0xA_nt!_??_::FNODOBFM::_string_+6b74

BUCKET_ID: X64_0xA_nt!_??_::FNODOBFM::_string_+6b74

Followup: MachineOwner
---------

Spoiler

Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\010314-8517-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\Symbole*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02c0c000 PsLoadedModuleList = 0xfffff800`02e4f6d0
Debug session time: Fri Jan 3 21:50:40.028 2014 (UTC + 1:00)
System Uptime: 0 days 5:00:05.840
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10E, {1f, fffff8a00f608b10, 4, 1196c}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+148 )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

VIDEO_MEMORY_MANAGEMENT_INTERNAL (10e)
The video memory manager encountered a condition that it can't recover from. By crashing,
the video memory manager is attempting to get enough information into the minidump such that
somebody can pinpoint what lead to this condition.
Arguments:
Arg1: 000000000000001f, The subtype of the bugcheck:
Arg2: fffff8a00f608b10
Arg3: 0000000000000004
Arg4: 000000000001196c

Debugging Details:
------------------


BUGCHECK_STR: 0x10e_1f

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff880019d022f to fffff80002c81bc0

STACK_TEXT:
fffff880`03e5b738 fffff880`019d022f : 00000000`0000010e 00000000`0000001f fffff8a0`0f608b10 00000000`00000004 : nt!KeBugCheckEx
fffff880`03e5b740 fffff880`0fdc51d0 : fffff8a0`0f608b10 fffff8a0`0f608b10 00000000`0001196c 00000000`00000004 : watchdog!WdLogEvent5+0x11b
fffff880`03e5b790 fffff880`0fdc29d3 : 00000000`00000000 fffffa80`0f98d018 00000000`00000c3a fffffa80`0fa40050 : dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+0x148
fffff880`03e5b7d0 fffff880`0fddc7d9 : 00000000`00000000 fffff8a0`05580fd0 fffffa80`00000004 fffffa80`10969330 : dxgmms1!VIDMM_GLOBAL:repareDmaBuffer+0xe1b
fffff880`03e5b9a0 fffff880`0fddc514 : fffff880`03095040 fffff880`0fddbf00 fffffa80`00000000 fffffa80`00000000 : dxgmms1!VidSchiSubmitRenderCommand+0x241
fffff880`03e5bb90 fffff880`0fddc012 : 00000000`00000000 fffffa80`1080b170 00000000`00000080 fffffa80`0ea9d410 : dxgmms1!VidSchiSubmitQueueCommand+0x50
fffff880`03e5bbc0 fffff800`02f1e2ea : 00000000`01a08ee6 fffffa80`0eb28b50 fffffa80`0cd5a9e0 fffffa80`0eb28b50 : dxgmms1!VidSchiWorkerThread+0xd6
fffff880`03e5bc00 fffff800`02c728e6 : fffff880`03090180 fffffa80`0eb28b50 fffff880`0309b0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03e5bc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+148
fffff880`0fdc51d0 c7442450c5f3ffff mov dword ptr [rsp+50h],0FFFFF3C5h

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+148

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME: dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5164dc13

FAILURE_BUCKET_ID: X64_0x10e_1f_dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+148

BUCKET_ID: X64_0x10e_1f_dxgmms1!VIDMM_GLOBAL::ReferenceAllocationForSubmission+148

Followup: MachineOwner
---------

Das waren jetzt alle von 2014. Ich hoffe du wirst daraus schlau

 

[simpel1970]

Zumindest kann man schon mal sagen, dass es kein primäres Treiberproblem ist. Aufgrund der Vielzahl der verschiedenen Absturzursachen ist von einem Problem mit dem Speichermanagement auszugehen. Dies kann insbes. durch Probleme mit RAM, VRAM, CPU-Cache, Festplatte, Motherboard, etc, etc... hervorgerufen werden.

Teste bitte zunächst, ob die Probleme bleiben, wenn nur zwei RAM Riegel eingebaut sind. Teste dabei abwechselnd beide RAM Paare (2x4GB). Hierbei soll überprüft werden, ob die Probleme durch die Vollbestückung verursacht werden.

Einiges würde aber auch auf ein Problem mit dem Dateisystem hindeuten, welches ggf. im Zusammenhang mit TrueCrypt steht. Hier würde ich -sofern das System mit zwei RAM Riegeln ebenfalls instabil läuft - als nächstes ansetzen und TrueCrypt deinstallieren.

Poste außerdem bitte noch ein paar Screenshots von CPU-Z (Reiter Mainboard, CPU, Memory und SPD), sowie ein Screenshot von CrystalDiskInfo (von jeder Festplatte ein Screenshot).

 

[Rorschachtinger]

Danke erstmal an alle die versuchen mir zu helfen !!! Vielen Dank!

Teste bitte zunächst, ob die Probleme bleiben, wenn nur zwei RAM Riegel eingebaut sind. Teste dabei abwechselnd beide RAM Paare (2x4GB). Hierbei soll überprüft werden, ob die Probleme durch die Vollbestückung verursacht werden.

Auch mit 2x4GB chrasht er mir leider, mit beiden Paaren. Ich hatte mir auch schon neue 2x4GB gekauft, das selbe Spiel!

Einiges würde aber auch auf ein Problem mit dem Dateisystem hindeuten, welches ggf. im Zusammenhang mit TrueCrypt steht. Hier würde ich -sofern das System mit zwei RAM Riegeln ebenfalls instabil läuft - als nächstes ansetzen und TrueCrypt deinstallieren.

Ja die Beführchtung hatte ich auch schon, da die Probleme ziemlich zeitgleich mit Truecrypt angefangen haben. Meine SSD und eine Festplatte sind unverschlüsselt die anderen zwei sind verschlüsselt. Bevor ich jetzt aber das große decrypten anfange, würde ich ganz gerne alles andere ausprobiert haben (Falls es noch andere Möglichkeiten/Vermutungen gibt?) Ich brauch leider auch immer eine verschlüsselte um Arbeiten zu können. Die andere könnte ich zur Not auch ausbauen bzw. nicht mit TC ansprechen.

Poste außerdem bitte noch ein paar Screenshots von CPU-Z (Reiter Mainboard, CPU, Memory und SPD), sowie ein Screenshot von CrystalDiskInfo (von jeder Festplatte ein Screenshot).

Bitteschön, hier sind die Bilder:

http://i.imgur.com/9TssLkM.jpg
http://i.imgur.com/hX7fbAf.jpg

 

[simpel1970]

Laufwerk Disk:0 (linker Screenshot bei den CrystalDiskInfo Bildern) zeigt eine hohe Anzahl von CRC UDMA Fehlern (hex Wert: 4F = Dezimal: 79 Fehler).
Dies wird regelmäßig durch lockere oder defekte SATA Kabel verursacht. Ist diese Platte mit TrueCrypt verschlüsselt?
Überprüfe hier mal das Datenkabel auf korrekten Sitz, oder tausche es besser gleich aus.

An welchen Controllern hängen die Platten/SSD? Alle am Intel Controller, oder hängt auch eine am Marvell Controller?

Ist im Bios der X.M.P. Modus aktiviert?

 

[Rorschachtinger]

Laufwerk Disk:0 (linker Screenshot bei den CrystalDiskInfo Bildern) zeigt eine hohe Anzahl von CRC UDMA Fehlern (hex Wert: 4F = Dezimal: 79 Fehler).
Dies wird regelmäßig durch lockere oder defekte SATA Kabel verursacht. Ist diese Platte mit TrueCrypt verschlüsselt?

Überprüfe hier mal das Datenkabel auf korrekten Sitz, oder tausche es besser gleich aus.

Ja das ist eine verschlüsselte. Ich habe das Kabel mal mit denen der anderen Festplatten getauscht da ich grad keine neuen da hab. Der Wert 4F bleibt aber immer bei Disk:0. Hat die Platte vielleicht einen hacker?

An welchen Controllern hängen die Platten/SSD? Alle am Intel Controller, oder hängt auch eine am Marvell Controller?

Ist im Bios der X.M.P. Modus aktiviert?

Die Platten hängen alle an den Intel Controllern, das BD Laufwerk ist an einen Marvell dran. XMP ist aus.

 

[simpel1970]

Der Wert 4F bleibt aber immer bei Disk:0. Hat die Platte vielleicht einen hacker?

Dieser Wert wird nach dem Kabeltausch (und auch sonst) nicht auf NULL zurück gesetzt. Sofern das CRC UDMA Problem mit dem anderen Kabel behoben ist, merkst du das daran, dass sich dieser Wert nicht mehr verändert. Sollte sich der Wert weiter erhöhen, kann es sein, dass die Platte einen Hacker hat.

 

[Rorschachtinger]

Dieser Wert wird nach dem Kabeltausch (und auch sonst) nicht auf NULL zurück gesetzt. Sofern das CRC UDMA Problem mit dem anderen Kabel behoben ist, merkst du das daran, dass sich dieser Wert nicht mehr verändert. Sollte sich der Wert weiter erhöhen, kann es sein, dass die Platte einen Hacker hat.

Heißt das dass bei der Platte jetzt für immer 4F oder schlechter stehen wird?
Ich bekomme morgen neue Kabel und werde die alten alle mal austauschen.
Wenn es nicht das Kabel ist, würde es eher an der Verschlüsselung Liegen oder an Truecrypt selber?

Vielen Dank nochmal für deine Hilfe!!!

 

[simpel1970]

Bitteschön

Heißt das dass bei der Platte jetzt für immer 4F oder schlechter stehen wird?

Ja.

Wenn es nicht das Kabel ist, würde es eher an der Verschlüsselung Liegen oder an Truecrypt selber?

Ob bei den Fehler ein Zusammenhang mit Truecrypt, bzw. den Bluescreens, besteht ist erst mal nur ein Verdacht.
Wenn die CRC UDMA Fehler weiter ansteigen hat das zunächst einen hardwareseitigen Grund. Neben defekten Datenkabeln können die Fehler auch von Controllerproblemen (Festplattencontroller, Mainboard-SATA-controller) hervorgerufen werden.