Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen Error


  • Please log in to reply
1 reply to this topic

#1 jbgtenn

jbgtenn

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 17 October 2009 - 07:23 PM

Hello everyone I was hoping someone would be able to assist me and tell me why my computer keeps restarting on its on. I have tried formatting my drive several times and reinstalling different operating systems but still doesn't fix my issue. I think I have a hardware issue but don't know for sure. I have a three mini dmp files I was was wanting you guys to take a look at and see if you can make any since out of it.

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini100409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16830.x86fre.vista_gdr.090302-1506
Machine Name:
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sun Oct 4 11:51:43.942 2009 (GMT-4)
System Uptime: 0 days 0:03:00.488
Loading Kernel Symbols
...............................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {32ef0006, 1b, 1, 81ca91b0}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+19 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 32ef0006, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81ca91b0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
Unable to read MiSystemVaType memory at 81d117e0
32ef0006

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+19
81ca91b0 890a mov dword ptr [edx],ecx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: 82f94c0c -- (.trap 0xffffffff82f94c0c)
ErrCode = 00000002
eax=81cf82c0 ebx=0000499c ecx=83f5134c edx=32ef0006 esi=8481fb80 edi=00000320
eip=81ca91b0 esp=82f94c80 ebp=82f94c94 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!KiUnwaitThread+0x19:
81ca91b0 890a mov dword ptr [edx],ecx ds:0023:32ef0006=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81ca91b0 to 81c8fdc4

STACK_TEXT:
82f94c0c 81ca91b0 badb0d00 32ef0006 82f94c44 nt!KiTrap0E+0x2ac
82f94c94 81cb0457 00000000 00000001 00000000 nt!KiUnwaitThread+0x19
82f94cd8 81caff88 00000000 8481f698 00000000 nt!MmWorkingSetManager+0x462
82f94d7c 81e2553c 00000000 82f9f680 00000000 nt!KeBalanceSetManager+0x12a
82f94dc0 81c915fe 81cafe5e 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnwaitThread+19
81ca91b0 890a mov dword ptr [edx],ecx

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiUnwaitThread+19

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49ac8cd6

FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+19

BUCKET_ID: 0xA_nt!KiUnwaitThread+19

Followup: MachineOwner
---------

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini100809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16830.x86fre.vista_gdr.090302-1506
Machine Name:
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Thu Oct 8 16:03:19.805 2009 (GMT-4)
System Uptime: 0 days 9:54:47.521
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 1b, 1, 81ca91b0}

Probably caused by : ntkrpamp.exe ( nt!KiUnwaitThread+19 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 81ca91b0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
Unable to read MiSystemVaType memory at 81d117e0
00000000

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+19
81ca91b0 890a mov dword ptr [edx],ecx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

TRAP_FRAME: 81cf1b74 -- (.trap 0xffffffff81cf1b74)
ErrCode = 00000002
eax=850ec4e0 ebx=00000000 ecx=00000000 edx=00000000 esi=85105d78 edi=868e4810
eip=81ca91b0 esp=81cf1be8 ebp=81cf1bfc iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
nt!KiUnwaitThread+0x19:
81ca91b0 890a mov dword ptr [edx],ecx ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81ca91b0 to 81c8fdc4

STACK_TEXT:
81cf1b74 81ca91b0 badb0d00 00000000 8244afd4 nt!KiTrap0E+0x2ac
81cf1bfc 81ca9842 00000000 81cf4820 81cf6180 nt!KiUnwaitThread+0x19
81cf1ce8 81ca9421 00000000 00000000 0022e81e nt!KiTimerExpiration+0x20d
81cf1d50 81c9144e 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81cf1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnwaitThread+19
81ca91b0 890a mov dword ptr [edx],ecx

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiUnwaitThread+19

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49ac8cd6

FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+19

BUCKET_ID: 0xA_nt!KiUnwaitThread+19

Followup: MachineOwner
---------

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini101109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16830.x86fre.vista_gdr.090302-1506
Machine Name:
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sun Oct 11 22:23:36.326 2009 (GMT-4)
System Uptime: 0 days 7:57:31.027
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 81e7e088, 830c79b4, 0}

Probably caused by : ntkrpamp.exe ( nt!ExMapHandleToPointerEx+21 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81e7e088, The address that the exception occurred at
Arg3: 830c79b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ExMapHandleToPointerEx+21
81e7e088 8b0e mov ecx,dword ptr [esi]

TRAP_FRAME: 830c79b4 -- (.trap 0xffffffff830c79b4)
ErrCode = 00000000
eax=00000fc0 ebx=830c7b28 ecx=000007e0 edx=00000001 esi=00000fc0 edi=83200040
eip=81e7e088 esp=830c7a28 ebp=830c7a30 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExMapHandleToPointerEx+0x21:
81e7e088 8b0e mov ecx,dword ptr [esi] ds:0023:00000fc0=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 81decc23 to 81e7e088

STACK_TEXT:
830c7a30 81decc23 000007e0 830c7b00 00000000 nt!ExMapHandleToPointerEx+0x21
830c7a68 81dd54e1 000007e0 00000008 847cebf0 nt!ObReferenceObjectByHandle+0x11c
830c7b50 81c8caea 800007e0 830c7c20 00000000 nt!NtAllocateVirtualMemory+0x1e2
830c7b50 81c7de49 800007e0 830c7c20 00000000 nt!KiFastCallEntry+0x12a
830c7be0 81e77c57 800007e0 830c7c20 00000000 nt!ZwAllocateVirtualMemory+0x11
830c7c28 81e77e20 847e9d08 847e9d08 00000000 nt!EtwpRealtimeInjectEtwBuffer+0x50
830c7c48 81e772a4 847e9d08 007ea000 847ea000 nt!EtwpRealtimeDeliverBuffer+0x88
830c7c60 81e70d7b 847ea000 00000000 847ea000 nt!EtwpFlushBufferToRealtime+0x29
830c7c84 81e7110f 00000000 00000000 847e9d08 nt!EtwpFlushBuffer+0xa2
830c7d3c 81e70af7 00000001 00000000 847e9a18 nt!EtwpFlushActiveBuffers+0x25d
830c7d7c 81e2553c 847e9d08 830cc680 00000000 nt!EtwpLogger+0x233
830c7dc0 81c915fe 81e708c4 847e9d08 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExMapHandleToPointerEx+21
81e7e088 8b0e mov ecx,dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExMapHandleToPointerEx+21

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49ac8cd6

FAILURE_BUCKET_ID: 0x8E_nt!ExMapHandleToPointerEx+21

BUCKET_ID: 0x8E_nt!ExMapHandleToPointerEx+21

Followup: MachineOwner
---------

Them three was form the mini dump folder and and here is the memory.dmp file

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16901.x86fre.vista_gdr.090805-0102
Machine Name:
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sat Oct 17 14:47:44.298 2009 (GMT-4)
System Uptime: 0 days 20:46:05.999
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, 8f630000, 198a, 1994114}

PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
Probably caused by : win32k.sys ( win32k!vSolidFillRect1+107 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00005003, The subtype of the bugcheck.
Arg2: 8f630000
Arg3: 0000198a
Arg4: 01994114

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details

BUGCHECK_STR: 0x1a_5003

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: firefox.exe

CURRENT_IRQL: 0

TRAP_FRAME: 96a538b4 -- (.trap 0xffffffff96a538b4)
ErrCode = 00000002
eax=00000000 ebx=000002e7 ecx=00000481 edx=00000501 esi=fd400008 edi=fd5de000
eip=81c918c0 esp=96a53928 ebp=96a5395c iopl=0 nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212
nt!RtlFillMemoryUlong+0x10:
81c918c0 f3ab rep stos dword ptr es:[edi]
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c2aaf6 to 81cd8781

STACK_TEXT:
96a53654 81c2aaf6 0000001a 00005003 8f630000 nt!KeBugCheckEx+0x1e
96a5368c 81cae626 c07eaef0 82f083dc 00000000 nt!MiAllocateWsle+0x6c
96a536c4 81cbd68b 00000001 85c54d70 fd5de000 nt!MiCompleteProtoPteFault+0x1cd
96a53714 81cae333 00000001 fd5de000 94a4df20 nt!MiResolveDemandZeroFault+0x5b5
96a53758 81c2a40c 00000001 fd5de000 c07eaef0 nt!MiResolveProtoPteFault+0x39d
96a53820 81cab005 fd5de000 94a4df20 00000000 nt!MiDispatchFault+0x989
96a5389c 81c8fbf4 00000001 fd5de000 00000000 nt!MmAccessFault+0x1119
96a5389c 81c918c0 00000001 fd5de000 00000000 nt!KiTrap0E+0xdc
96a53928 900ec4dd fd5dde00 00001404 00000000 nt!RtlFillMemoryUlong+0x10
96a5395c 900e64ef 96a53c1c 00000001 fd400008 win32k!vSolidFillRect1+0x107
96a53afc 900e6143 900ec3d6 96a53c1c 00000000 win32k!vDIBSolidBlt+0x102
96a53b68 900e5d7e ffa4d8c0 00000000 00000000 win32k!EngBitBlt+0x18e
96a53bc8 900e5f03 fe971de8 96a53c2c 96a53c1c win32k!GrePatBltLockedDC+0x212
96a53c70 900d4c89 96a53d04 0000f0f0 0015e6ac win32k!GrePolyPatBltInternal+0x173
96a53d28 81c8caea 42010c61 00f00021 0015e6ac win32k!NtGdiPolyPatBlt+0x16d
96a53d28 77bf0f34 42010c61 00f00021 0015e6ac nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0015e688 00000000 00000000 00000000 00000000 0x77bf0f34


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!vSolidFillRect1+107
900ec4dd 8b55f4 mov edx,dword ptr [ebp-0Ch]

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: win32k!vSolidFillRect1+107

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49edb642

FAILURE_BUCKET_ID: 0x1a_5003_win32k!vSolidFillRect1+107

BUCKET_ID: 0x1a_5003_win32k!vSolidFillRect1+107

Followup: MachineOwner
---------

I am clueless on what all this means but hopefully one of you guys and can help me out and troubleshoot whats going on with my computer. Thanks in advance Joe

BC AdBot (Login to Remove)

 


#2 jbgtenn

jbgtenn
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:17 PM

Posted 22 October 2009 - 04:58 PM

No suggestions?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users