Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer Restarting by it self!


  • Please log in to reply
12 replies to this topic

#1 Delta16

Delta16

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 12 March 2009 - 05:03 PM

Hi, when I am doing something on the computer, the computer just re start by it self when ever it wants.

I cleaned the gold parts on all the hardware with contact cleaner, but it kept doing it. The last time that it happened, a blue screen with white words came and gone, it doesn't let you read it. When it restarted the following error popped up.

Posted Image
Then I clicked on 'click here' and another window popped out, which the below image

Posted Image
Again I click 'click here', output:

Posted Image

Any ideas what should I do, so i wont lose any more of my work.
Thanks for reading.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,721 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:03 PM

Posted 12 March 2009 - 05:36 PM

Hi :thumbsup:.

One of the things you can do is to Disable Auto Reboot On System Crash - http://www.theeldergeek.com/auto_reboot_on_system_crash.htm

The screens you posted just indicate that there was a file prepared for whatever happened. That file is known as a dump file and is on your system.

There is a procedure which you can go through to analyze the dump file, Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/

If you can do that and then post the results, someone here can try to make suggestions that are informative and will help to eliminate/diagnose the problem.

Louis

#3 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 12 March 2009 - 06:04 PM

Make- i guess it doesnt have a make because I built it. Im writing the specs.
CPU : AMD Athlon x64 3.1GHZ, dual core
RAM : 2x 2GB Corsair ( 4GB in all)
Mobo : Gigabyte GA-MA78G-DS3H
HDD : Maxtor 320gb
GPU : Nvidia bliss 8800gt 1GB

Ok thats all done, on one of the minidump. i found another two minidumps. If you want to see the others just let me know.

I'm using the 64bit xp

Below is the result that i got from windbg.

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini031209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 3) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_qfe.080813-1204
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d71a0
Debug session time: Thu Mar 12 22:46:53.328 2009 (GMT+1)
System Uptime: 0 days 0:50:01.210
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80051b5000, 0, fffff97fff1801a4, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!NtUserfnINDEVICECHANGE+1bb )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa80051b5000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
 r8=0000000000000000  r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

Is it long enough!? :thumbsup:

Edited by Delta16, 12 March 2009 - 06:11 PM.


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,721 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:03 PM

Posted 12 March 2009 - 06:22 PM

LOL...the system makes these messages long, no problem :thumbsup:.

I see a number of posts with the same error...all have WinAmp installed.

Do you have WinAmp installed? Ignore that, I see that you do :flowers:.

If so, I suggest uninstalling it via Add/Remove Programs...and then reinstalling same (possible file corruption in WinAmp drivers is my rationale).

Louis

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:03 PM

Posted 12 March 2009 - 07:00 PM

Just to verify this, reload the debugger and run one of the dump files.
At the bottom of the window is a small box where you can type.

Type "lm" (without the quotes) and press Enter.
This will give a list of loaded modules.

It seems that all of the instructions that caused this error came from the fffff97fff1801a4 location. Check the lm output to see what module is running in that address space. (FWIW - it's Argument 3 in the listing after the error code).

Chances are that it's WinAmp - but it could also be win32k.sys or nt.dll
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 13 March 2009 - 08:18 AM

I removed Winamp and downloaded and installed a new copy. I'll keep you informed if it happens again.

After i removed and installed Winamp, the debugger output was :

Microsoft Windows Debugger Version 6.11.0001.404 AMD64
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini031209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 3) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_qfe.080813-1204
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d71a0
Debug session time: Thu Mar 12 22:46:53.328 2009 (GMT+1)
System Uptime: 0 days 0:50:01.210
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa80051b5000, 0, fffff97fff1801a4, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!NtUserfnINDEVICECHANGE+1bb )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa80051b5000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: fffffa80051b5000

FAULTING_IP:
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630 mov eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: winamp.exe

CURRENT_IRQL: 1

TRAP_FRAME: fffffadf8d2ccbb0 -- (.trap 0xfffffadf8d2ccbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80051b4fd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8d2ccd40 rbp=0000000000155388
r8=0000000000000000 r9=fffffa80051b4fd0 r10=0000036c00000000
r11=fffffa80051b4fd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630 mov eax,dword ptr [rsi+30h] ds:975e:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:
fffffadf`8d2ccad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`051b5000 00000000`00000000 fffffadf`8d2ccbb0 : nt!KeBugCheckEx
fffffadf`8d2ccae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8d2ccbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`00155388 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8d2ccd40 fffff97f`ff0a5961 : fffff97f`f5e16d60 00000000`0001049e 00000000`0000002c fffffa80`051b4fd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8d2ccde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8d2cce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0619d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8d2cd280 00000000`7ef80000 : 00000000`00b66f90 00000000`0000c1f9 00000000`00000000 00000000`00000000 : nt!KiCallUserMode
fffffadf`8d2cd288 00000000`00b66f90 : 00000000`0000c1f9 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 : 0x7ef80000
fffffadf`8d2cd290 00000000`0000c1f9 : 00000000`00000000 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 : 0xb66f90
fffffadf`8d2cd298 00000000`00000000 : 00000000`00000000 fffffadf`8d2cde00 00000000`00000000 00000000`00000000 : 0xc1f9


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630 mov eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48ce5473

FAILURE_BUCKET_ID: X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID: X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------


Again Winamp and win32k.sys

Thanks for helping.

Edited by Delta16, 13 March 2009 - 08:23 AM.


#7 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 14 March 2009 - 01:40 PM

The pc crashed again, the error was with the 'win32k.sys' as shown on the blue screen and on the debugger.

The debugger output of a minidump is shown below :

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini031409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Windows Server 2003 Kernel Version 3790 (Service Pack 3) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_sp2_qfe.080813-1204
Machine Name:
Kernel base = 0xfffff800`01000000 PsLoadedModuleList = 0xfffff800`011d71a0
Debug session time: Sat Mar 14 14:58:40.468 2009 (GMT+1)
System Uptime: 0 days 5:53:54.205
*** WARNING: Unable to verify checksum for ntkrnlmp.exe
Loading Kernel Symbols
...............................................................
...............................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa800854c000, 0, fffff97fff1801a4, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!NtUserfnINDEVICECHANGE+1bb )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800854c000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff97fff1801a4, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  fffffa800854c000 

FAULTING_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  winamp.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffffadf8bfdcbb0 -- (.trap 0xfffffadf8bfdcbb0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800854bfd0
rdx=0000000000000016 rsi=0000000000000000 rdi=0000000000000000
rip=fffff97fff1801a4 rsp=fffffadf8bfdcd40 rbp=000000000015ddd8
 r8=0000000000000000  r9=fffffa800854bfd0 r10=0000033000000000
r11=fffffa800854bfd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl zr na po nc
win32k!NtUserfnINDEVICECHANGE+0x1bb:
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h] ds:ffff:00000000`00000030=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800010a64c9 to fffff8000102e950

STACK_TEXT:  
fffffadf`8bfdcad8 fffff800`010a64c9 : 00000000`00000050 fffffa80`0854c000 00000000`00000000 fffffadf`8bfdcbb0 : nt!KeBugCheckEx
fffffadf`8bfdcae0 fffff800`0102d519 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0xa1f
fffffadf`8bfdcbb0 fffff97f`ff1801a4 : 00000000`00000000 00000000`0015ddd8 00000000`00000000 00000000`0000002c : nt!KiPageFault+0x119
fffffadf`8bfdcd40 fffff97f`ff0a5961 : fffff97f`f5e30dc0 00000000`00030474 00000000`0000002c fffffa80`0854bfd0 : win32k!NtUserfnINDEVICECHANGE+0x1bb
fffffadf`8bfdcde0 fffff800`0102e3fd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserMessageCall+0x142
fffffadf`8bfdce80 00000000`6b2b5e8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`05f3d6d8 fffff800`010265d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6b2b5e8a
fffffadf`8bfdd280 00000000`00000000 : fffff800`01037c89 00000000`00000000 00000000`00000000 00000000`00000001 : nt!KiCallUserMode


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!NtUserfnINDEVICECHANGE+1bb
fffff97f`ff1801a4 8b4630		  mov	 eax,dword ptr [rsi+30h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!NtUserfnINDEVICECHANGE+1bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce5473

FAILURE_BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

BUCKET_ID:  X64_0x50_win32k!NtUserfnINDEVICECHANGE+1bb

Followup: MachineOwner
---------

How can I fix the module win32k?

Thanks for reading

#8 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 15 March 2009 - 09:39 AM

Yesterday, the computer crashed again, ( I disabled the Auto Reboot On System Crash!) and on the blue screen, it said that the error was coming from win32k.sys

Any ideas how can I fix that.

Thanks

#9 eastonch

eastonch

  • Members
  • 110 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:03 PM

Posted 15 March 2009 - 10:57 AM

The behavior may occur if the win32k.sys is corrupted. Go to
C:\WINDOWS\System32 and rename the Win32k.sys file to Win32k.old and then
close the window. Now go back to the system32 folder and you will have a
new and non-corrupt Win32k.sys file. <Advanced>

The behavior also may be caused by that the virtual memory of the Windows XP
is corrupted. Disable and then enable the Virtual Memory to see whether it
solved the problem.

To disable Virtual memory:

1. Right click My Computer and choose properties
2. Click the Advanced tab
3. Under Performance click settings.
4. Click the Advanced tab.
5. Under Virtual memory click change
6. Click no paging file
7. Click OK
8. Restart the computer

To enable Virtual memory:

1. Right click My Computer and choose properties
2. Click the Advanced tab
3. Under Performance click settings.
4. Click the Advanced tab.
5. Under Virtual memory click change
6. Click System Managed Size
7. Click OK
8. Restart the computer


i hope i have helped, also searching on google could prove to be helpful with other people having the same BSOD you have had.

Also with that BSOD it could be due to a OC you have done. run Memtest86+ overnight and check you're ram, as this error could be due to Either,
1) Faulty Ram
2) Faullty WIndows installation or corruption

If you have enough storage try backing up all you'r eessentials and have a think about a format. this could prove its worth.

thanks ,
@@ Chris @@

#10 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 17 March 2009 - 09:07 AM

Nothing worked, did a memory test, no errors.

Also disabled and re-enabled virtual memory, keeps crashing.

Removed also Winamp without re-installing it, again , it keeps crashing and now it's very annoying!

Before making a format could I try something else, maybe repairing the windows; could that help ?

Thanks for those who tried to help me.
Delta

Edited by Delta16, 17 March 2009 - 09:09 AM.


#11 eastonch

eastonch

  • Members
  • 110 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:03 PM

Posted 17 March 2009 - 12:22 PM

Repairing windows is simple as long as you have the disk.

also if winamp is the cause of the issue try not using it?
there are plenty of other similar software. but this does not explain why its killing you're system when using it. ;|

#12 Delta16

Delta16
  • Topic Starter

  • Members
  • 417 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Malta
  • Local time:10:03 PM

Posted 17 March 2009 - 03:29 PM

I know how to repair the windows and I am going to try that. :thumbsup:

The system is crashing due to winamp and the corrupted file win32k.sys.

I uninstalled winamp, as I said and I am not using it.

I'll make the windows repair and we'll keep in touch.

Thanks a lot for helping me.

#13 eastonch

eastonch

  • Members
  • 110 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:03 PM

Posted 17 March 2009 - 04:26 PM

Also the system repair should rewrite and repair the win32k.sys ..

another way is to boot up using the disk and run MS-DOS and do a command ithink called sys.com which rewrites all system files.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users