Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BlueScreen showing "KMODE_EXCEPTION_NOT_HANDLED"


  • Please log in to reply
9 replies to this topic

#1 shadow2k

shadow2k

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 15 June 2011 - 04:07 PM

Hello! I'm stumped dealing with BSOD on my father's machine. This is relatively new hardware but we have never had this machine running stable. This machine has been reloaded a couple of times and seems to blue screen immediately after login. At this point, I am unable to startup Windows 7 at all unless starting in Safe Mode. It should be noted that this machine has crashed many many times and the dump below was just the last one. Here's some information about the machine:

1. Running Windows 7 Ultimate
2. It's an x64-based PC
3. Running AMD Processor on ASUS M4A89GTD PRO/USB3 System Board
==> CPU: AMD Socket AM3; Phenom II / Athlon II / Sempron 100 Series Processors (Specifically AMD Phenom II X4 965)
==> Chipset: AMD 890GX / SB850
==> Memory: 4GB
==> Video: Integrated ATI Radeon HD 4290 GPU
==> LAN: Realtek 8111E Gigabit LAN controller (Internal)
==> Audio: ALC892 (Internal)
==> USB: Internal USB2 and USB3 Controller
==> BIOS: Running latest BIOS per ASUS website (Version/Date: 1606 8/24/2010)
==> Installed hardware: 1 internal ST31000528AS 1 TB Seagate ATA Drive, 2 internal HP DVD Writer 1260d ATA drives
4. There are also some USB devices installed (Printer: Brother DCP 8045D USB, external USB drive: iomega hdd 1TB, external USB drive: Maxtor 300GB, Mouse: Microsoft USB Mouse, Keyboard: Microsoft PS/2 Connected, WebCAM: Microsoft Cinema, Headset: USB Plantronics DSP) NOTE: Although installed, none of these devices except for the keyboard and mouse are connected at this time.

I have run Microsoft's Memory scanner and it reported RAM was fine, but would not object to running a recommended memory scan if BleepingComputer staff recommends this.

This machine seems to have phases of brief stability, but is mostly unstable (currently it gets BSOD 100% of the time immediately after login in native windows mode).

When this machine was briefly stable, I was unable to load the latest Windows 7 Service Pack (this was disappointing because I was hoping that if an update had occurred and corruption that might have occurred from multiple crashes might have been resolved.

I have this dump file which I ran WinDbg on with installed symbols, but was unable to get any information that would help me out (granted, this dump certainly had some complexity to me)

I can send the zip file to the dump below if needed:

300,896,003 MEMORY.DMP
62,431,269 MEMORY.zip

I've copied these dumps to my very similar machine (I upgraded my sound card, added 8gb of memory and have a LG Blu-ray writer instead of 2 HP DVD Writer drives.

Here is the output run on my machine against his dump file from BlueScreenView v1.32 (http://www.nirsoft.net):

************************************************************************************************

Dump File: MEMORY.DMP
Crash Time: 6/11/2011 11:30:56 PM
Bug Check String: KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code: 0x0000001e
Parameter 1: ffffffff`c0000005
Parameter 2: fffff800`02d2b2ff
Parameter 3: 00000000`00000000
Parameter 4: 00000000`00000704
Caused by Driver: {blank}
Caused by Address: {blank}
File Description: {blank}
Product Name: {blank}
Company: {blank}
File Version: {blank}
Processor: x64
Computer Name: {blank}
Full Path: C:\dad-dump\MEMORY.DMP
Processors Count: 4
Major Version: 15
Minor Version: 7600
Dump File Size: 300,896,003

************************************************************************************************

Here is the output run on my machine against his dump file from the WinDbg:

************************************************************************************************

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [c:\dad-dump\memory.dmp]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\winsxs
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16792.amd64fre.win7_gdr.110408-1633
Machine Name:
Kernel base = 0xfffff800`02a61000 PsLoadedModuleList = 0xfffff800`02c9ee50
Debug session time: Sat Jun 11 22:29:32.536 2011 (UTC - 5:00)
System Uptime: 0 days 0:01:06.222
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdc018). Type ".hh dbgerr001" for details
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002d2b2ff, 0, 704}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+12a50 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002d2b2ff, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000704, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt! ?? ::NNGAKEGL::`string'+12a50
fffff800`02d2b2ff 418b1484 mov edx,dword ptr [r12+rax*4]

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000704

READ_ADDRESS: 0000000000000704

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR: 0x1E_c0000005

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: services.exe

CURRENT_IRQL: 0

EXCEPTION_RECORD: fffff880025d72d8 -- (.exr 0xfffff880025d72d8)
ExceptionAddress: fffff80002d2b2ff (nt! ?? ::NNGAKEGL::`string'+0x0000000000012a50)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000704
Attempt to read from address 0000000000000704

TRAP_FRAME: fffff880025d7380 -- (.trap 0xfffff880025d7380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d2b2ff rsp=fffff880025d7510 rbp=0000000000000000
r8=fffff8a00004f0d8 r9=0000000000000004 r10=fffff8a000023380
r11=fffff880025d7410 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
nt! ?? ::NNGAKEGL::`string'+0x12a50:
fffff800`02d2b2ff 418b1484 mov edx,dword ptr [r12+rax*4] ds:00000000`00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80002b0bab9 to fffff80002ad1700

STACK_TEXT:
fffff880`025d6b08 fffff800`02b0bab9 : 00000000`0000001e ffffffff`c0000005 fffff800`02d2b2ff 00000000`00000000 : nt!KeBugCheckEx
fffff880`025d6b10 fffff800`02ad0d42 : fffff880`025d72d8 fffff8a0`00023380 fffff880`025d7380 fffff8a0`048a6cec : nt!KiDispatchException+0x1b9
fffff880`025d71a0 fffff800`02acf8ba : 00000000`00000000 fffff8a0`00023380 fffffa80`05cf8000 fffff800`02aa2386 : nt!KiExceptionDispatch+0xc2
fffff880`025d7380 fffff800`02d2b2ff : fffff8a0`00023380 fffff8a0`00023380 fffff8a0`0004f0d8 fffff8a0`04b9ceb4 : nt!KiPageFault+0x23a
fffff880`025d7510 fffff800`02d30162 : 00000000`00000001 fffff8a0`048159b4 fffff8a0`04814f9c fffff8a0`00023380 : nt! ?? ::NNGAKEGL::`string'+0x12a50
fffff880`025d7550 fffff800`02d2ff04 : fffff8a0`04814f9c 00000000`ffffffff fffff8a0`04814f9c fffff8a0`00023380 : nt!CmpMarkKeyValuesDirty+0x182
fffff880`025d75f0 fffff800`02d2f60a : fffff8a0`00023380 00000000`ffffffff fffff8a0`04814f9c fffff8a0`00023380 : nt!CmpFreeKeyValues+0x24
fffff880`025d7620 fffff800`02d2f338 : fffff8a0`00023380 00000000`00305eb0 fffff8a0`04814f9c fffff8a0`0068cf98 : nt!CmpSyncKeyValues+0x7a
fffff880`025d7700 fffff800`02d31bfe : fffff8a0`0278b000 00000000`003fa3b8 fffffa80`00000000 00000000`00000000 : nt!CmpCopySyncTree2+0x2a8
fffff880`025d77b0 fffff800`02d31b17 : 00000000`00000000 00000000`00000002 fffff8a0`0228ead0 fffff8a0`023326c0 : nt!CmpCopySyncTree+0x6e
fffff880`025d7800 fffff800`02d316e6 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!CmpSaveBootControlSet+0x307
fffff880`025d79e0 fffff800`02ad0953 : fffffa80`05cf8060 00000000`001482a0 fffff880`025d7ab0 00000000`00000001 : nt!NtInitializeRegistry+0xc6
fffff880`025d7a30 fffff800`02accef0 : fffff800`02d3168f 00000000`00000220 00000000`011ce998 00000000`011cecc8 : nt!KiSystemServiceCopyEnd+0x13
fffff880`025d7bc8 fffff800`02d3168f : 00000000`00000220 00000000`011ce998 00000000`011cecc8 00000000`000a001f : nt!KiServiceLinkage
fffff880`025d7bd0 fffff800`02ad0953 : fffffa80`05cf8060 fffff880`025d7ca0 fffff880`025d7ca0 00000000`00000002 : nt!NtInitializeRegistry+0x6f
fffff880`025d7c20 00000000`77af045a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`011cec48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77af045a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+12a50
fffff800`02d2b2ff 418b1484 mov edx,dword ptr [r12+rax*4]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+12a50

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4d9fdd34

FAILURE_BUCKET_ID: X64_0x1E_c0000005_nt!_??_::NNGAKEGL::_string_+12a50

BUCKET_ID: X64_0x1E_c0000005_nt!_??_::NNGAKEGL::_string_+12a50

Followup: MachineOwner
---------

0: kd> .exr 0xfffff880025d72d8
ExceptionAddress: fffff80002d2b2ff (nt! ?? ::NNGAKEGL::`string'+0x0000000000012a50)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000704
Attempt to read from address 0000000000000704
0: kd> .trap 0xfffff880025d7380
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d2b2ff rsp=fffff880025d7510 rbp=0000000000000000
r8=fffff8a00004f0d8 r9=0000000000000004 r10=fffff8a000023380
r11=fffff880025d7410 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
nt! ?? ::NNGAKEGL::`string'+0x12a50:
fffff800`02d2b2ff 418b1484 mov edx,dword ptr [r12+rax*4] ds:00000000`00000000=????????
0: kd> lmvm nt
start end module name
fffff800`02a61000 fffff800`0303d000 nt (pdb symbols) c:\symbols\ntkrnlmp.pdb\DE7B3DD8AC5343B3B4874BAB3F4599DD2\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Timestamp: Fri Apr 08 23:14:44 2011 (4D9FDD34)
CheckSum: 00547734
ImageSize: 005DC000
File version: 6.1.7600.16792
Product version: 6.1.7600.16792
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 6.1.7600.16792
FileVersion: 6.1.7600.16792 (win7_gdr.110408-1633)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

************************************************************************************************

BC AdBot (Login to Remove)

 


#2 Layback Bear

Layback Bear

  • Members
  • 1,880 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northern Ohio
  • Local time:04:11 AM

Posted 16 June 2011 - 09:31 AM

If it was my computer the first thing I would do is unplug all those little goodies, camera, head phones, printer ect. Then reboot and see what happens. If everything is okay at that point I would plug one of those items in at a time and reboot. Their is a chance that one is causing the problem. If you find that one is causing the problem the first thing I would do is update the drivers from the manufactures web site. Let us know what you find. Their can be other things that can cause the problem by IMHO it is probably hardware.

#3 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 16 June 2011 - 11:09 AM

Thanks for responding. Yes, I had done that and that was the state the machine was in when the dump was generated. At this point, all USB devices (everything external) except for the microsoft USB mouse are unplugged and were unplugged when the dump was taken. However, I'm guessing that a device driver could still load even if it is not plugged in if it was previously installed. Is this true? Everything else is internal to the machine's system board and is basically the same setup as my machine at my home which has been working fine except he has 2 HP ROM drives. I could also unplug the cables to the ROM drive(s) which is certainly a good idea, but I was hoping that someone would be able to get some information from the dump that was unable to decipher. Once again, thanks for the quick response. In the meantime, I will have the HP ROM drive cables disconnected, verify if the BSOD still occurs, and report back.

#4 Layback Bear

Layback Bear

  • Members
  • 1,880 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northern Ohio
  • Local time:04:11 AM

Posted 16 June 2011 - 12:49 PM

I see you have updated your sound card and ram. If it was my computer I would remove the sound card; I believe the sound card isn't loaded in safe mode. Make sure all ram meets the mother boards specs and is installed correctly as per motherboard manual. If that doesn't help I would remove all new ram and install all stick of old ram and see if that helps. If the old ram in all the slots work then the slots are okay and their might be a bad stick of new ram.
This test may help you.
http://www.memtest.org/

#5 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 16 June 2011 - 01:28 PM

Sorry for causing confusion on this thread... I mention 2 computers (1 mine, the other my fathers'). Both machines are very similiar in hardware and software - my machine works and his gets BSOD. We are in different states so I can't just swap things like memory chips or ROM drives.

Here's a recap of his machine and the problem at hand (BSOD - with all peripherals removed except for HP ROM drives and USB Microsoft Mouse):

1. Running Windows 7 Ultimate
2. It's an x64-based PC
3. Running AMD Processor on ASUS M4A89GTD PRO/USB3 System Board
==> CPU: AMD Socket AM3; Phenom II / Athlon II / Sempron 100 Series Processors (Specifically AMD Phenom II X4 965)
==> Chipset: AMD 890GX / SB850
==> Memory: 4GB
==> Video: Integrated ATI Radeon HD 4290 GPU
==> LAN: Realtek 8111E Gigabit LAN controller (Internal)
==> Audio: ALC892 (Internal)
==> USB: Internal USB2 and USB3 Controller
==> BIOS: Running latest BIOS per ASUS website (Version/Date: 1606 8/24/2010)
==> Installed hardware: 1 internal ST31000528AS 1 TB Seagate ATA Drive, 2 internal HP DVD Writer 1260d ATA drives

Everything here is internal to the systemboard except the 4GB of RAM (2 chips / 2 GB RAM each), seagate hard drive, and 2 HP ROM drives. None of the other peripherals are installed except for the 1 USB Microsoft Mouse.

So far the applicable things that you suggested to do are: 1) Remove all peripherals: I will have the 2 HP ROM drives unplugged. I can't unplug the USB Mouse because I don't have a Y splitter at this time to hook up both the keyboard and mouse to the PS/2 port so I will assume that the mouse is not the problem at this point. 2) Run http://www.memtest.org/ : I ran Microsoft's memory test already, but I want to rule out memory for sure so I will definitely run the memory test you suggested since this would be one of the easiest things to address. Besides the memory test, we also tried swapping the memory chips running them 1 at a time and using different slots on the systemboard. The test was inconclusive at that time because BSOD's were more random. I will have my father unplug his HP ROM devices and verify if BSOD is still present. I will post these findings his findings as soon as he does this. Then I will have him run the presumably lengthy memory test with http://www.memtest.org/ to check the memory. Any recommended directions for how to proceed with the memtest or just use the program defaults?

#6 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 17 June 2011 - 04:28 PM

We just disconnected the 2 HP ROM drives and no other peripherals besides the USB mouse are connected. Unfortunately, upon powering back up we received the same BSOD in the same spot. We are now downloading the memory tester and will hook one of the HP ROM drives back so we can run the memtest with the newly created bootable memtest CD. We'll report back when the MEMTEST has completed.

#7 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 18 June 2011 - 01:09 PM

We ran the memory test from MEMTEST.ORG from a bootable CD for 8 hours last night and it said it passed. Does this test ever end or just loops until you stop it? We actually stopped it after 8 hours so if it actually completes on its own then we'll run the test again.

#8 Layback Bear

Layback Bear

  • Members
  • 1,880 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northern Ohio
  • Local time:04:11 AM

Posted 22 June 2011 - 07:02 AM

Did you remove your sound card from your mother board? If so I would go to the manufactures of the hard drive and get and run their test. You probably done this but if not go into Device Manager and look for anything marked different from the others.

#9 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 22 June 2011 - 08:50 AM

The sound card is part of the system board so I was unable to remove that. I'll double check if there is a way to disable it via a switch or BIOS. I'll also find seagate's diagnostic tools to run the hard drive test, although I have run checks like Windows 7 checkdisk successfully. Lastly, device manager does not show note any problems with any device drivers.

#10 shadow2k

shadow2k
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:04:11 AM

Posted 25 June 2011 - 07:45 AM

I wanted to update the thread and let you know that my father has been unavailable for the past couple of days and won't be available for the next 3-4 days. I will update thread again when he's available again. Thanks for your patience.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users