Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple BSOD


  • Please log in to reply
4 replies to this topic

#1 takeru27

takeru27

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:53 PM

Posted 19 October 2015 - 09:44 AM

Hello, I am having periodic BSOD.  The most recent was because of "kernel security check failure" and then "memory management".  I only have a log for the most recent:
 

 
 
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
 
Microsoft ® Windows Debugger Version 10.0.10240.9 AMD64
Copyright © Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
 
 
************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
Windows 10 Kernel Version 10240 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 10240.16545.amd64fre.th1.150930-1750
Machine Name:
Kernel base = 0xfffff801`7f87f000 PsLoadedModuleList = 0xfffff801`7fba4070
Debug session time: Mon Oct 19 10:19:35.691 2015 (UTC - 4:00)
System Uptime: 0 days 0:51:10.386
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`fe6e4018).  Type ".hh dbgerr001" for details
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck 1A, {5003, fffff58010804000, 5886, 641a000910c}
 
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+f6ef )
 
Followup:     MachineOwner
---------
 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff58010804000
Arg3: 0000000000005886
Arg4: 00000641a000910c
 
Debugging Details:
------------------
 
 
SYSTEM_SKU:  SKU
 
SYSTEM_VERSION:  System Version
 
BIOS_DATE:  10/31/2012
 
BASEBOARD_PRODUCT:  P8P67 DELUXE
 
BASEBOARD_VERSION:  Rev 1.xx
 
BUGCHECK_P1: 5003
 
BUGCHECK_P2: fffff58010804000
 
BUGCHECK_P3: 5886
 
BUGCHECK_P4: 641a000910c
 
BUGCHECK_STR:  0x1a_5003
 
CPU_COUNT: 8
 
CPU_MHZ: daf
 
CPU_VENDOR:  GenuineIntel
 
CPU_FAMILY: 6
 
CPU_MODEL: 2a
 
CPU_STEPPING: 7
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  chrome.exe
 
CURRENT_IRQL:  2
 
ANALYSIS_VERSION: 10.0.10240.9 amd64fre
 
LAST_CONTROL_TRANSFER:  from fffff8017f9eb5ef to fffff8017f9cd2e0
 
STACK_TEXT:  
ffffd000`20fc9568 fffff801`7f9eb5ef : 00000000`0000001a 00000000`00005003 fffff580`10804000 00000000`00005886 : nt!KeBugCheckEx
ffffd000`20fc9570 fffff801`7f89b288 : 00000000`0702e000 00000000`00000040 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0xf6ef
ffffd000`20fc95d0 fffff801`7f89d00f : ffffe001`183a9678 fffffa80`05b42300 00000000`0702f000 00000000`00000000 : nt!MiCompleteProtoPteFault+0x2d8
ffffd000`20fc96a0 fffff801`7f8a4ea5 : 00000000`00000002 00000000`0702f000 ffffd000`20fc9b00 ffffc001`200a4f00 : nt!MiResolveDemandZeroFault+0xf1f
ffffd000`20fc97c0 fffff801`7f8a2153 : ffffd000`20fc9a50 00000000`0702f000 fffff680`00038178 ffffe001`183a9678 : nt!MiResolveProtoPteFault+0x6e5
ffffd000`20fc9860 fffff801`7f89f8d6 : 00000000`00000000 00000000`0702f000 ffffd000`20fc9a80 00000000`00000000 : nt!MiDispatchFault+0x3b3
ffffd000`20fc99b0 fffff801`7f9d63bd : ffffe001`12440440 00000000`00000000 ffffe001`12440440 ffffd000`20fc9b80 : nt!MmAccessFault+0x336
ffffd000`20fc9b00 00000000`6a336db5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x13d
00000000`03aee584 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6a336db5
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+f6ef
fffff801`7f9eb5ef cc              int     3
 
SYMBOL_STACK_INDEX:  1
 
SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+f6ef
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: nt
 
IMAGE_NAME:  ntkrnlmp.exe
 
DEBUG_FLR_IMAGE_TIMESTAMP:  560ca418
 
BUCKET_ID_FUNC_OFFSET:  f6ef
 
FAILURE_BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
 
BUCKET_ID:  0x1a_5003_nt!_??_::FNODOBFM::_string_
 
PRIMARY_PROBLEM_CLASS:  0x1a_5003_nt!_??_::FNODOBFM::_string_
 
ANALYSIS_SOURCE:  KM
 
FAILURE_ID_HASH_STRING:  km:0x1a_5003_nt!_??_::fnodobfm::_string_
 
FAILURE_ID_HASH:  {35a6b5c7-1964-1f7c-f371-954a004ad508}
 
Followup:     MachineOwner
---------
 
 
 
Any help would be greatly appreciated.  I've ran a couple of virus scans and nothing has been found.  I also checked the memory using the windows memory diagnostic and everything seemed fine.  

Edited by takeru27, 19 October 2015 - 09:50 AM.


BC AdBot (Login to Remove)

 


#2 takeru27

takeru27
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:53 PM

Posted 19 October 2015 - 11:33 AM

Just had another BSOD: Driver_Corrupted_Expool

~


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
 
Microsoft ® Windows Debugger Version 10.0.10240.9 AMD64
Copyright © Microsoft Corporation. All rights reserved.
 

Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
 

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
No .natvis files found at C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\Visualizers.
Windows 10 Kernel Version 10240 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 10240.16545.amd64fre.th1.150930-1750
Machine Name:
Kernel base = 0xfffff801`81c10000 PsLoadedModuleList = 0xfffff801`81f35070
Debug session time: Mon Oct 19 12:27:38.938 2015 (UTC - 4:00)
System Uptime: 0 days 2:06:48.633
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols
 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck C5, {7000000008, 2, 0, fffff80181e83a4e}
 
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1fe )
 
Followup:     Pool_corruption
---------
 
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0000007000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80181e83a4e, address which referenced memory
 
Debugging Details:
------------------
 

SYSTEM_SKU:  SKU
 
SYSTEM_VERSION:  System Version
 
BIOS_DATE:  10/31/2012
 
BASEBOARD_PRODUCT:  P8P67 DELUXE
 
BASEBOARD_VERSION:  Rev 1.xx
 
BUGCHECK_P1: 7000000008
 
BUGCHECK_P2: 2
 
BUGCHECK_P3: 0
 
BUGCHECK_P4: fffff80181e83a4e
 
BUGCHECK_STR:  0xC5_2
 
CURRENT_IRQL:  2
 
FAULTING_IP:
nt!ExDeferredFreePool+1fe
fffff801`81e83a4e 49394208        cmp     qword ptr [r10+8],rax
 
CPU_COUNT: 8
 
CPU_MHZ: daf
 
CPU_VENDOR:  GenuineIntel
 
CPU_FAMILY: 6
 
CPU_MODEL: 2a
 
CPU_STEPPING: 7
 
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
 
PROCESS_NAME:  System
 
ANALYSIS_VERSION: 10.0.10240.9 amd64fre
 
TRAP_FRAME:  ffffd0002329f650 -- (.trap 0xffffd0002329f650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe0000ec5de50 rbx=0000000000000000 rcx=ffffe0000ec5de40
rdx=ffffe000086fc3a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80181e83a4e rsp=ffffd0002329f7e0 rbp=0000000000000012
 r8=ffffe0000ec5dec0  r9=fffff80100000000 r10=0000007000000000
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!ExDeferredFreePool+0x1fe:
fffff801`81e83a4e 49394208        cmp     qword ptr [r10+8],rax ds:00000070`00000008=????????????????
Resetting default scope
 
LAST_CONTROL_TRANSFER:  from fffff80181d68ca9 to fffff80181d5e2e0
 
STACK_TEXT: 
ffffd000`2329f508 fffff801`81d68ca9 : 00000000`0000000a 00000070`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd000`2329f510 fffff801`81d674c8 : ffffe000`00000000 ffffe000`0ee28738 ffffc000`aa441150 ffffe000`02141480 : nt!KiBugCheckDispatch+0x69
ffffd000`2329f650 fffff801`81e83a4e : 00000000`00000180 00000000`00000400 00ffffe0`00027bee fffff801`8204b1ad : nt!KiPageFault+0x248
ffffd000`2329f7e0 fffff801`81e82772 : ffffe000`00000000 ffffe000`09441b60 00000000`00000000 fffff801`81f6ad40 : nt!ExDeferredFreePool+0x1fe
ffffd000`2329f860 fffff801`81c4d9ac : ffffd000`2329fad8 ffffe000`09441b70 00000000`00000001 ffffe000`00000000 : nt!ExFreePoolWithTag+0x772
ffffd000`2329f940 fffff801`81cf52bf : ffffe000`0e0bfc00 00000000`00000000 ffffe000`09700600 ffffe000`09700600 : nt!CcWriteBehindInternal+0x38c
ffffd000`2329f9d0 fffff801`81c4bfd2 : 00000000`00000000 fffff801`81c4bdc0 fffff801`81f50d00 ffffe000`0501c480 : nt!CcWriteBehind+0x8f
ffffd000`2329fa90 fffff801`81c89dd9 : fffff801`81fe9340 ffffe000`09700540 ffffe000`01853ba0 fffff801`81fe9340 : nt!CcWorkerThread+0x212
ffffd000`2329fb70 fffff801`81cf6558 : ffffe000`0f1f9510 00000000`00000080 fffff801`81fe9340 ffffe000`09700540 : nt!ExpWorkerThread+0xe9
ffffd000`2329fc00 fffff801`81d633c6 : ffffd000`f39d5180 ffffe000`09700540 ffffe000`0805f840 fffff800`d91959b6 : nt!PspSystemThreadStartup+0x58
ffffd000`2329fc60 00000000`00000000 : ffffd000`232a0000 ffffd000`2329a000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
 

STACK_COMMAND:  kb
 
FOLLOWUP_IP:
nt!ExDeferredFreePool+1fe
fffff801`81e83a4e 49394208        cmp     qword ptr [r10+8],rax
 
SYMBOL_STACK_INDEX:  3
 
SYMBOL_NAME:  nt!ExDeferredFreePool+1fe
 
FOLLOWUP_NAME:  Pool_corruption
 
IMAGE_NAME:  Pool_Corruption
 
DEBUG_FLR_IMAGE_TIMESTAMP:  0
 
MODULE_NAME: Pool_Corruption
 
BUCKET_ID_FUNC_OFFSET:  1fe
 
FAILURE_BUCKET_ID:  0xC5_2_nt!ExDeferredFreePool
 
BUCKET_ID:  0xC5_2_nt!ExDeferredFreePool
 
PRIMARY_PROBLEM_CLASS:  0xC5_2_nt!ExDeferredFreePool
 
ANALYSIS_SOURCE:  KM
 
FAILURE_ID_HASH_STRING:  km:0xc5_2_nt!exdeferredfreepool
 
FAILURE_ID_HASH:  {0e971f5b-bd0d-a80e-a2c0-cd331176cf49}
 
Followup:     Pool_corruption
---------
 
 



#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:08:53 PM

Posted 20 October 2015 - 06:38 AM

Nice work with the memory dumps!

We'll need a bit more info though, please provide this information so we can provide a complete analysis (from the Pinned Topic at the top of the forum):  http://www.bleepingcomputer.com/forums/t/576314/blue-screen-of-death-bsod-posting-instructions-windows-10-81-8-7-vista/

Beyond this, I have these 4 suggestions:
1.  Get ALL available Windows Updates.  It may take several trips to get them all
2.  Get ALL available, compatible updates for your OS from the manufacturer's website (to include BIOS/UEFI).
3.  Start with these free hardware diagnostics:  http://www.carrona.org/hwdiag.html
4.  If all of the hardware tests pass, then run Driver Verifier according to these instructions:  http://www.carrona.org/verifier.html

 


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 takeru27

takeru27
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:07:53 PM

Posted 21 October 2015 - 03:05 PM

I had my system overclocked (ram and CPU).  I disabled the overclocking and it seems the issues were fixed. 



#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:08:53 PM

Posted 22 October 2015 - 05:01 AM

This happens quite easily with overclocked systems.

I'd suggest posting over on one of the overclocking forums for instructions on how to make a stable overclock (and how to test it for stability when using it).

Good luck!


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users