Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


BSOD ecache.sys

  • Please log in to reply
1 reply to this topic

#1 Deucalion29710


  • Members
  • 1 posts
  • Local time:02:23 AM

Posted 16 July 2011 - 08:50 PM

I have been getting an abundance of BSOD lately. I had to format my PC several times because a NVIDIA SATA driver was messing up my registry. Now my latest BSOD involves ecache.sys. Everything seems like it is pointing to a driver. Here is my analysis if anybody can make sense of it. Please help?

Microsoft ® Windows Debugger Version 6.12.0002.633 AMD64
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18327.amd64fre.vistasp2_gdr.101014-0432
Machine Name:
Kernel base = 0xfffff800`02247000 PsLoadedModuleList = 0xfffff800`0240bdd0
Debug session time: Sat Jul 16 21:13:00.639 2011 (UTC - 4:00)
System Uptime: 0 days 1:07:32.340
Loading Kernel Symbols
Loading User Symbols

Loading unloaded module list
* *
* Bugcheck Analysis *
* *

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffffa6000fb560b, fffffa60087a49b8, fffffa60087a4390}

Probably caused by : ecache.sys ( ecache!EcBlockFind+b7 )

Followup: MachineOwner

0: kd> !analyze -v
* *
* Bugcheck Analysis *
* *

This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa6000fb560b, The address that the exception occurred at
Arg3: fffffa60087a49b8, Exception Record Address
Arg4: fffffa60087a4390, Context Record Address

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

fffffa60`00fb560b 498b4108 mov rax,qword ptr [r9+8]

EXCEPTION_RECORD: fffffa60087a49b8 -- (.exr 0xfffffa60087a49b8)
ExceptionAddress: fffffa6000fb560b (ecache!EcBlockFind+0x00000000000000b7)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT: fffffa60087a4390 -- (.cxr 0xfffffa60087a4390)
rax=1a9d9ab000000000 rbx=fffffa8004b8c190 rcx=000000000006d94a
rdx=0f505a2a6ce6d94a rsi=fffffa8004f2e000 rdi=fffffa6000fc6fd0
rip=fffffa6000fb560b rsp=fffffa60087a4bf8 rbp=fffffa8004b8c190
r8=000000000b145428 r9=6364303000000120 r10=ffffffffffffffff
r11=000000000b145428 r12=fffffa8003b44c30 r13=0000000000080000
r14=0000000000080000 r15=fffffa8003aff470
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
fffffa60`00fb560b 498b4108 mov rax,qword ptr [r9+8] ds:002b:63643030`00000128=????????????????
Resetting default scope




ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: ffffffffffffffff

READ_ADDRESS: ffffffffffffffff

fffffa60`00fb560b 498b4108 mov rax,qword ptr [r9+8]


LAST_CONTROL_TRANSFER: from fffffa6000fb6f3b to fffffa6000fb560b

fffffa60`087a4bf8 fffffa60`00fb6f3b : 00000000`0b145428 00000000`0b145428 00000016`28a85000 fffffa80`04f2e000 : ecache!EcBlockFind+0xb7
fffffa60`087a4c00 fffff800`024abf77 : 00000017`9390f900 fffff800`00030000 fffffa60`0000001d 00000000`00004090 : ecache!EcCachePopulateWorker+0x523
fffffa60`087a4d50 fffff800`022de636 : fffff800`023ba680 fffffa80`04192320 fffffa80`02fa2550 00000000`00000000 : nt!PspSystemThreadStartup+0x57
fffffa60`087a4d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_NAME: ecache!EcBlockFind+b7



IMAGE_NAME: ecache.sys


STACK_COMMAND: .cxr 0xfffffa60087a4390 ; kb

FAILURE_BUCKET_ID: X64_0x7E_ecache!EcBlockFind+b7

BUCKET_ID: X64_0x7E_ecache!EcBlockFind+b7

Followup: MachineOwner

BC AdBot (Login to Remove)


#2 Allan


  • BC Advisor
  • 8,646 posts
  • Gender:Male
  • Location:New Jersey
  • Local time:02:23 AM

Posted 17 July 2011 - 05:40 AM

Download BlueScreenView:
unzip downloaded file and double click on BlueScreenView.exe to run the program.
when scanning is done, go to EDIT - Select All
Go to FILE - SAVE Selected Items, and save the report as BSOD.txt
Open BSOD.txt in Notepad, copy all of the content, and paste it into your next reply

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users