Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Blue screen Windows 7 PRO x64

  • Please log in to reply
1 reply to this topic

#1 blastergod


  • Members
  • 1 posts
  • Local time:09:11 PM

Posted 28 August 2010 - 08:16 AM

Hello Guys,
New to the forum, and I know from what I read that people get helped :huh:
After a few years, I see the window BSOD ... I just purchased 2 memory sticks yesterday + a new PCI Express Graphics card, and the problem appeared. The ram memory is 2x2GB apacer, same frequency, same model etc... good for dual channel.

The problem only appears at startup, and after 2-3 restarts, everything is working fine. So I can work, play anything I want, the blue screen does not appear. It only appears at startup (while the windows logo is loading).

I have both the mini-dump and the dump file (from windows\MEMORY.DMP). When I analyzed MEMORY.DMP with the debugger. I uploaded the file with the mini-dump+MEMORY.dmp analysis here:

I will also include the analysis report from the debugger, maybe it helps:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e46e50
Debug session time: Sat Aug 28 15:19:56.247 2010 (UTC + 3:00)
System Uptime: 0 days 0:00:41.839
Loading Kernel Symbols
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd9018).  Type ".hh dbgerr001" for details
Loading unloaded module list
*																			 *
*						Bugcheck Analysis									*
*																			 *

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002c78d4d, 1, 150}

Probably caused by : hardware ( nt!KiExceptionDispatch+8d )

Followup: MachineOwner

0: kd> !analyze -v
*																			 *
*						Bugcheck Analysis									*
*																			 *

This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c78d4d, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000150, Parameter 1 of the exception

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

fffff800`02c78d4d 894808		  mov	 dword ptr [rax+8],ecx

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000150

WRITE_ADDRESS:  0000000000000150 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005


PROCESS_NAME:  WerFault.exe


EXCEPTION_RECORD:  fffff880036bafa8 -- (.exr 0xfffff880036bafa8)
ExceptionAddress: fffff80002c78d4d (nt!KiExceptionDispatch+0x000000000000008d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000150
Attempt to write to address 0000000000000150

TRAP_FRAME:  fffff880036bb050 -- (.trap 0xfffff880036bb050)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000148 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c78d4d rsp=fffff880036bb1e0 rbp=fffffa800604b210
 r8=fffffa8005fb2b30  r9=0000000000000000 r10=0000000000000001
r11=fffff80002f37600 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0		 nv up ei pl nz na po nc
fffff800`02c78d4d 894808		  mov	 dword ptr [rax+8],ecx ds:00000000`00000150=????????
Resetting default scope

fffff800`02c78d4d 894808		  mov	 dword ptr [rax+8],ecx

LAST_CONTROL_TRANSFER:  from fffff80002cb3a39 to fffff80002c79740

fffff880`036ba7d8 fffff800`02cb3a39 : 00000000`0000001e ffffffff`c0000005 fffff800`02c78d4d 00000000`00000001 : nt!KeBugCheckEx
fffff880`036ba7e0 fffff800`02c78d82 : fffff880`036bafa8 fffffa80`0604b168 fffff880`036bb050 fffffa80`0604b060 : nt!KiDispatchException+0x1b9
fffff880`036bae70 fffff800`02c778fa : 00000000`00000001 fffffa80`0604b168 00000000`00000000 00000000`00000001 : nt!KiExceptionDispatch+0xc2
fffff880`036bb050 fffff800`02c78d4d : 00000000`00000000 00000000`00001f80 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`036bb1e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x8d


fffff800`02c78d4d 894808		  mov	 dword ptr [rax+8],ecx


SYMBOL_NAME:  nt!KiExceptionDispatch+8d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware


MODULE_NAME: hardware



Followup: MachineOwner

Hope someone can help me with this.

Thanks a lot!

BC AdBot (Login to Remove)


#2 Jacee


    Bleeping around

  • Malware Response Team
  • 3,716 posts
  • Gender:Female
  • Local time:07:11 PM

Posted 28 August 2010 - 04:46 PM

I just purchased 2 memory sticks yesterday + a new PCI Express Graphics card, and the problem appeared.

Something isn't right with one of your hardware purchaces

MODULE_NAME: hardware

MS MVP Windows-Security 2006-2016
Member of UNITE, the Unified Network of Instructors and Trusted Eliminators

Admin PC Pitstop

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users