BSOD Assistance

Hello,
I have a user who had a blue screen of death. I looked in the minidump file and am not sure what is causing the issue. Can someone please give further insight?
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\mtan\Desktop\032114-10717-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`030526d0
Debug session time: Fri Mar 21 11:33:21.038 2014 (UTC - 5:00)
System Uptime: 0 days 3:51:01.107
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck 10D, {5, 0, 1024, fffffa8009ebeaf0}
Probably caused by : Wdf01000.sys ( Wdf01000!imp_WdfSpinLockAcquire+47 )
Followup: MachineOwner
1: kd> !analyze -v
* Bugcheck Analysis *
WDF_VIOLATION (10d)
The Kernel-Mode Driver Framework was notified that Windows detected an error
in a framework-based driver. In general, the dump file will yield additional
information about the driver that caused this bug check.
Arguments:
Arg1: 0000000000000005, A framework object handle of the incorrect type was passed to
a framework object method.
Arg2: 0000000000000000, The handle value passed in.
Arg3: 0000000000001024, Reserved.
Arg4: fffffa8009ebeaf0, Reserved.
Debugging Details:
BUGCHECK_STR: 0x10D_5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff88000edb903 to fffff80002e84bc0
STACK_TEXT:
fffff880`035b5448 fffff880`00edb903 : 00000000`0000010d 00000000`00000005 00000000`00000000 00000000`00001024 : nt!KeBugCheckEx
fffff880`035b5450 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Wdf01000!imp_WdfSpinLockAcquire+0x47
STACK_COMMAND: kb
FOLLOWUP_IP:
Wdf01000!imp_WdfSpinLockAcquire+47
fffff880`00edb903 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Wdf01000!imp_WdfSpinLockAcquire+47
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Wdf01000
IMAGE_NAME: Wdf01000.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 51c51641
FAILURE_BUCKET_ID: X64_0x10D_5_Wdf01000!imp_WdfSpinLockAcquire+47
BUCKET_ID: X64_0x10D_5_Wdf01000!imp_WdfSpinLockAcquire+47
Followup: MachineOwner

Hi,
Wdf01000.sys is a Windows driver, According to the WinDbg results, I couldn't find the reason of BSOD. Please upload your minidump file to your OneDrive and share the link to us.
Roger Lu
TechNet Community Support

Similar Messages

BSOD Assistance - (Computer rebooting with BugcheckCode 26) Minidump uploaded

Hello!
Would anybody be able to assist me with a BSOD / Automatic Reboot issue?
We have a computer running Windows 7 32-bit pro OEM that is randomly rebooting with a BugcheckCode 26. I have uploaded a .RAR file containing the error messages and minidump here: https://www.yousendit.com/download/UlRSSlJ6RndYSHh1a3NUQw . I
am unable to determine what is causing the issue.
Thank you so much!
Jeremy

Hi Jeremy,
MEMORY_MANAGEMENT (1a)
This indicates that a severe memory management error occurred.
BugCheck 1A, {41790, c0802066, ffff, 0}
- The 1st parameter of the bug check is 41790 which indicates a page table page has been corrupted.
We're unfortunately not going to have any luck dumping the data structure.
0: kd> dt nt!_MMPFN c0802066
+0x000 u1 : <unnamed-tag>
+0x004 u2 : <unnamed-tag>
+0x008 PteAddress : (null)
+0x008 VolatilePteAddress : (null)
+0x008 Lock : 0n0
+0x008 PteLong : 0
+0x00c u3 : <unnamed-tag>
+0x010 OriginalPte : _MMPTE
+0x010 AweReferenceCount : 0n0
+0x018 u4 : <unnamed-tag>
0: kd> k
ChildEBP RetAddr
b8551c84 82cc1fbc nt!MiDeleteVirtualAddresses+0x41a // Deleting virtual addresses.
b8551d1c 82c458e6 nt!NtFreeVirtualMemory+0x60b // Freeing virtual memory.
b8551d1c 775670f4 nt!KiSystemServicePostCall
WARNING: Frame IP not in any known module. Following frames may be wrong.
0055e970 00000000 0x775670f4
Looks like bad RAM to me. Run Memtest for no less than 8 passes:
Memtest86+:
Download Memtest86+ here:
http://www.memtest.org/
Which should I download?
You can either download the pre-compiled .ISO that you would burn to a CD and then boot from the CD, or you can download the auto-installer for the USB key. What this will do is format your USB drive, make it a bootable device, and then install the necessary
files. Both do the same job, it's just up to you which you choose, or which you have available (whether it's CD or USB).
Do note that some older generation motherboards do not support USB-based booting, therefore your only option is CD (or Floppy if you really wanted to).
How Memtest works (you don't need to read, it's only for those interested in the specifics):
Memtest uses algorithms (specifically two), namely moving inversion & what is deemed Modulo-X. Essentially, the first algorithm fills the memory with a pattern. Starting at the low address, it checks to see if the pattern was changed (it should not have
been), writes the patterns complement, increments the address, and repeats. Starting at the highest address (as opposed to the lowest), it follows the same checklist.
The reason for the second algorithm is due to a few limitations, with the first being that not all adjacent cells are being tested for interaction due to modern chips being 4 to 16 bits wide regarding data storage. With that said, patterns are used to go ahead
and ensure that all adjacent cells have at least been written with all possible one and zero combinations.
The second is that caching, buffering and out of order execution will interfere with the moving inversions algorithm. However, the second algorithm used is not affected by this. For starting offsets of 0-20, the algorithm will write every 20th location with
a pattern, write all other locations with the patterns complement, repeat the previous one (or more) times, and then check every 20th location for the previously mentioned pattern.
Now that you know how Memtest actually works, it's important to know that the tests it goes through all mean something different. It goes from Test 0 through Test 12, many of which use either one or the other algorithm discussed above, among many other things.
Any other questions, they can most likely be answered by reading this great guide here:
http://forum.canardpc.com/threads/28864-FAQ-please-read-before-posting
Regards,
Patrick
“Be kind whenever possible. It is always possible.” - Dalai Lama

Need assistance with Windows 2008 R2 server BSOD - ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)

Need assistance with Windows 2008 R2 server BSOD - ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
I have a Windows 2008 R2 server which is experiencing random BSOD during the night. This is occurring maybe once or twice a week. I have gathered two Memory crash files. This server is running Citrix XenApp 6.5 but nothing else is reporting an issue except
for the memory dump. I’m looking for assistance in reading crash file and finding the cause.
I’ve spent over a week going through articles trying to learn and trouble shoot the BSOD but no closer to understanding the WinDbg 6.3.9600 report.
This is a production server and I have verified that Windows Updates has updated the server with latest releases. I’m hoping that the crash file will show something before I have to run the Driver Verifier.
The crash zip file is located -
https://onedrive.live.com/redir?resid=9644A4E0A26873B1!2359&authkey=!AMS4Svuk-SS3-JA&ithint=file%2czip
*                        Bugcheck Analysis
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff880009eff38, Virtual address for the attempted execute.
Arg2: 8000000002cfe963, PTE contents.
Arg3: fffff8800da2eea0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: powershell.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME: fffff8800da2eea0 -- (.trap 0xfffff8800da2eea0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80070f3648 rbx=0000000000000000 rcx=fffffa80070f3648
rdx=fffff8800da2fbf8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001680b80 rsp=fffff8800da2f030 rbp=fffff8800da2fbd0
r8=fffff8a01804c680 r9=fffff8800da2fc68 r10=fffffffffffffffd
r11=fffff8800da2fa90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz na pe nc
nt!KiPageFault:
fffff800`01680b80 55              push    rbp
Resetting default scope
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+44dfc
fffff800`017008b8 cc              int     3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+44dfc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 531590fb
IMAGE_VERSION: 6.1.7601.18409
FAILURE_BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc
BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+44dfc
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xfc_nt!_??_::fnodobfm::_string_+44dfc
FAILURE_ID_HASH: {aa632d36-b0f7-67cf-89e2-1cec389c0a11}
Followup: MachineOwner

Hi Kaysel_GTG,
Just addition. Regarding to Bug Check 0xFC, please refer to following article and check if can help you.
Bug Check 0xFC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
By the way, since it is not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer
Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
if any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu

K7N2 Delta-ILSR BSOD

Hi
MSI Nforce K7N2 Delta-ILSR
Bios V1016
Antec True380SPGB True Power 380w
AMD Athlon XP2800+
2x512mb Crucial DDR
1xSATA HDD
Abit Siluro GF4 Ti4200
I've installed 1 SATA onto the onboard Raid controller, but I keep getting BSOD when either playing a game or watching avi's. The 0x00000000 message is disappearing too quickly to right down but is saying windows was shut down to prevent damage to the hardware.
Will the K7N2 Delta-ILSR Promise controller work with just one SATA hdd connected, I know that the silicon image controller on my Asus A7N8X-E will support just one SATA connected but will the promise chipset.
I've updated all the drivers but the dreaded BSOD keeps happening.
If it won't it not's a major problem as I do have a PCI sata controller card I can install.
Or are there any issues with the above graphics card and the MSI mobo?
Thanks for any help.

Yep I've created a array with the single SATA and got Windows installed.
I've also changed the memory settings so they are now 1:1 with the FSB.
I've also altered the advance settings so I'll be able to write down the full 0X00000000 string.
Just set net access up via my PC and got this error report from M$
Error Message: STOP 0x000000EA THREAD_STUCK_IN_DEVICE_DRIVER (Q293078)
Error Caused by Graphics Device Driver
Thank you for submitting an error report. Microsoft is unable to determine what specifically caused the problem you reported. To troubleshoot the problem, please see the information listed below.
Analysis
A device driver installed on your computer caused the problem, but we cannot determine the precise cause. Depending on which situation is applicable to you, please do one of the following:
* If you are running Windows Server 2003 you may experience crashes if you have adjusted the Hardware Acceleration setting. Microsoft recommends that you set the Hardware Acceleration setting to None for server systems. To check your Hardware Acceleration setting, go to the Advanced section of the display properties dialog box.
* If you know the manufacturer of the device, contact the manufacturer's product support service for assistance.
* If you don't know the driver's manufacturer and need help diagnosing and resolving this problem, contact your computer manufacturer's product support service.
* Updated drivers might be available on the Microsoft Windows Update website. At Windows Update, you can have your computer scanned and, if there are updated drivers available, Windows Update will offer a selection of drivers that you might be able to use. To learn more about updated drivers that might be available, visit Microsoft Windows Update.
* For information about Microsoft support options, visit Microsoft Product Support Services.
I've downloaded the current graphics card drivers from Abit and I'll install them and see what happens.
I've also adjusted the AGP in the bios from 64mb to 128mb.

Pavilion dv7 blue screening - HP support assistant cannot test BIOS or memory modules but BIOS can?

About a month ago my dv7 started doing something strange - during normal use (not gaming, just word processing, showing a powerpoint presentation, showing a video on youtube, etc.) the cooling fan speed would suddenly ramp up to jet-engine speed and shortly thereafter the computer would blue screen, crash dump, etc. (no, I did not write down any info from the blue screen message - I will do so next time). Having experienced a blue screen issue with a Dell laptop I thought the hard drive was going bad, because about the same time I was suddenly unable to run a backup of the hard drive. After several attempts, I was finally able to backup the hard drive, and then replaced it with a new drive, re-installed OS with my recovery flash drive, worked through all of the windows updates that were recommended, and thought everything would be good to go. Now I have no problems backing up hard drive, etc. Then on day 2, after only a few hours of use, the cooling fan speed suddenly ramped up again and the blue screen returned.
A friend who is a tech suggested running HP diagnostics on everything, so I rebooted, hit F2, and started by testing the hard drive; as expected, no problems there. I next tried to test the memory (8192 MB total in two modules), and the test failed. I also tried testing the BIOS, and that too failed. The HP diagnostics reported that it couldn't even read the BIOS. Hmmm, strange. So I re-booted, hit F10, and went into the BIOS (BIOS date 10/5/11, revision F.1B). I HAVE NOT IN ANY WAY MODIFIED THE BIOS - I'm good, but not that good. Via the BIOS test utility, I tested both memory modules independently and then together, and everything checked out fine. I also tried switching modules between slots and re-tested via the BIOS utility, and that too checked out. I then returned to the HP diagnostics utility and tried re-testing the memory (both modules together - failed, one module at a time - both failed, in both slots).
HP tech experts, can you give me any guidance? This has been a great machine for me, I have taken good care of it, and am hoping to get a few more years out of it (I'm a middle-school science teacher, can't afford another one at this point). If I can't find a fix, I may have to go back to using my antique overhead projector in my classroom...

Hi @h20roks ,
Thank you for visiting the HP Support Forums and Welcome. I have looked into your issue about your HP Pavilion dv7 and getting the BSOD and shutting down. I recommend to restore the BIOS defaults with this document selecting the reloading the BIOS default settings. Not rollback.
Here is a link to the HP Support Assistant if you need it. Just download and run the application and it will help with the software and drivers on your system that could need updating.
Hope this helps you.
Thanks.
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

Windows Server 2008 R2 SP1 BSOD 0x1a with CLFS.sys

Hello,
I've got a BSOD on a Windows Server 2008 R2 with SP1 installed. Analyzed the dump and could
see a Bug-check of 0x1a which means "MEMORY_MANAGEMENT".
Further analysis on this dump shows me, that this probably is caused by the CLFS.sys, which
is the Common Log File System Driver. This CLFS.sys is installed with date:
Tue Jul 14 01:19:57 2009
I have now searched trough MS Support pages and resources and also the Internet, but I found no
information about an update for this or a newer version. It's nearby impossible to find newer versions
for specific files in i.e. Hot-fixes.
Do you know this issue with the 0x1a BSOD and CLFS.sys and/or do you know a newer version ?
Any help would be very appreciated!
Thanks and regards plus have a nice day !
Tino

Hi Tino,
Regarding to Bug Check 0x1A, please refer to following article.
Bug Check 0x1A: MEMORY_MANAGEMENT
Did you install any third-party application in this problematic server? Would you please let me know whether
the BSOD issue occurred regularly? Or just occurred suddenly? If the BSOD issue occurred regularly, please
perform a clean boot and check if this BSOD issue still exists.
In addition, please check if necessary updates need to be installed and drivers need to be updated. Please
run sfc /scannow command to scan all protected system files and check if find errors.
As you know, troubleshoot this kind of kernel crash issue, we need to analyze the crash dump file to narrow down the root cause of the issue. Actually, it is not effective
for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
àThis CLFS.sys is installed with date: Tue Jul 14 01:19:57 2009
àor do you know a newer version?
By the way, I checked the CLFS.sys in a Windows Server 2008 R2 in my Lab environment. It also created in July
2009.
Hope this helps.
Best regards,
Justin Gu

Windows Server 2008 R2 SP1 - BSOD Stop Error 0x00000050 RDPWD.SYS

Hi all,
I have been struggling with a BSOD for the past 5 weeks and have scoured the web trying in vain to find someone else with the same issue.
Environment:
8 x 2008 R2 SP1 Windows Servers (8Gb RAM, 25Gb HDD) with Remote Desktop Services Roles installed, running as part of an RDS Farm. All Servers are VM Guests (hardware version 7) running on VMware vSphere v4.1.0-260247 Hosts (Dell
PowerEdge R710 - 128Gb RAM). Our vSphere 'farm' has 5 Hosts that connect to our EMC SAN via iSCSI with multipath routes.
Each RDS Server is load balanced via a Connection Broker, and each server has the same set of software / vm hardware installed. In a nutshell, each has Symantec Endpoint Protection v11.0.5002.333, Symantec Altiris v7.0, Microsoft Office 2007 as well as
other various software essential to these servers.
Symptoms:
Randomly throughout the day, one (or more) of the RDS Servers will crash with a BSOD more often than not with "caused by driver ntoskrnl.exe" sometimes with "cng.sys" and once with "ksecpkg.sys". So far in the 5 weeks I have had 90 crashes. Yesterday
all 8 of the RDS Servers crashed at some point throughout the day.
On a typical BSOD, it says:
The problem seems to be caused by the following file: ntoskrnl.exe
PAGE_FAULT_IN_NONPAGED_AREA
Technical Information:
*** STOP: 0x00000050 (0xfffffa800c153284, 0x0000000000000001, 0xfffff880053dc0c9, 0x0000000000000000)
*** ntoskrnl.exe - Address 0xfffff8000169ac40 base at 0xfffff8000161e000 DateStamp 0x4e02aaa3
Using BlueScreenView it says "caused by address: ntoskrnl.exe+7cc40" nearly every time.
I have analysed as best I could using Microsoft WinDbg, and this is the output of a typical mini-dump file:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [\\hqrds01\c$\Windows\Minidump\030112-19359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows (x64)\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`01609000 PsLoadedModuleList = 0xfffff800`0184e670
Debug session time: Thu Mar 1 09:14:00.921 2012 (UTC + 0:00)
System Uptime: 0 days 21:31:41.950
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                        Bugcheck Analysis
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa800be83284, 1, fffff8800576f0c9, 0}
Could not read faulting driver name
Probably caused by : RDPWD.SYS ( RDPWD!memcpy+1d9 )
Followup: MachineOwner
1: kd> !analyze -v
*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800be83284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff8800576f0c9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018b8100
fffffa800be83284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800bf70a80 -- (.trap 0xfffff8800bf70a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000023d rbx=0000000000000000 rcx=fffffa800be83284
rdx=ffffffffffe7e63b rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800576f0c9 rsp=fffff8800bf70c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0033401e8 r10=fffff8a0033401e8
r11=fffffa800be83268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax ds:0c40:fffffa80`0be83284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016319fc to fffff80001685c40
STACK_TEXT:
fffff880`0bf70918 fffff800`016319fc : 00000000`00000050 fffffa80`0be83284 00000000`00000001 fffff880`0bf70a80 : nt!KeBugCheckEx
fffff880`0bf70920 fffff800`01683d6e : 00000000`00000001 fffffa80`0be83284 00000000`00000000 fffff8a0`0be85820 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0bf70a80 fffff880`0576f0c9 : fffff880`057547cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0bf70c18 fffff880`057547cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`0576c99d : RDPWD!memcpy+0x1d9
fffff880`0bf70c20 fffff880`0576c9fc : fffff8a0`0f938010 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0bf70c60 fffff880`0576b354 : fffff880`0bf70da0 fffff8a0`033401e8 00000000`00000000 fffff880`0576abfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0bf70d10 fffff880`0576af64 : 00000000`00000031 fffffa80`0bd01895 00000006`0000001f fffff880`05739079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0bf70d50 fffff880`029ba1f8 : fffff8a0`03345000 fffffa80`0bae6e80 fffffa80`0a5c0e60 fffff880`05737e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0bf70df0 fffff880`057378d0 : 00000000`00000000 fffff880`0bf70f10 fffff880`0bf70f08 00000000`00000000 : termdd!IcaRawInput+0x50
fffff880`0bf70e20 fffff880`05736d85 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0bf70e50 fffff880`057367c2 : fffffa80`088e8a28 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0bf70ef0 fffff880`029ba1f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0bf70f60 fffff880`0572c4c5 : fffffa80`088e8a10 fffffa80`0bd01658 00000000`00000000 fffffa80`088e8a10 : termdd!IcaRawInput+0x50
fffff880`0bf70f90 fffff880`029baf3e : fffffa80`0bd01620 fffffa80`0c100420 fffffa80`0bd4b450 fffffa80`0973b9b0 : tdtcp!TdInputThread+0x465
fffff880`0bf71810 fffff880`029b9ae3 : fffffa80`09d902b0 fffffa80`0973b9b0 fffffa80`093d8520 fffffa80`0bd4b450 : termdd!IcaDriverThread+0x5a
fffff880`0bf71840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`0576f0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
The RDS servers are set to reboot automatically, and after a period of 5 minutes or so, the users can reconnect and log back in. On a typical day each server will have around 10 people RDP'd in to them.
The Users connecting to the RDS Servers included XP laptops/desktops and IGEL UD-120-LX Thin Terminals. The XPs have SP3 installed and are fully patched via Symantec Altiris.
Things I have tried:
- Analyse the dump-files (as per above).
- I have tracked each user logging on to the RDS Farm (via batch scripts) and tried to determine if this is caused by the same individual(s) but it appears random.
- Check to see if the crashing Virtual Machine is running on a specific host, but it has happened on all Hosts.
- Check to see if there was anything specific that happened on the day that the crashes started. There were about 5 new poeple introduced to the RDS Farm at that time, but there were using (a) client machines that had been used previously elsewhere with
no issues, (b) software that had been used previously, (c) in a remote location that had previous users using RDS, (d) have not been logged on to a RDS Server when it has crashed.
- Updated Windows Server 2008 R2 SP1 to the latest patches (as of Feb 2012).
- Turned on Verifier (using recommended settings), and then analysed dump-files with the same reference to rdpwd.sys.
- Fixed the Memory Resource Reservation in vSphere to the full 8Gb for all these RDS Servers (so that the memory is not shared at all).
- Ran MEMTEST on a VM Guest with the full 8Gb RAM, on a couple of the ESX Hosts.
- Changed the VMTools Video Driver to the SVGA II driver from the Standard VGA Driver.
- Ran a full AV Scan (using SEP).
- Isolated the Printer Drivers using the Printer Management MMC.
- Ran sfc /scannow of all RDS Servers and rebooted.
The mini-dump file mentioned above is here:https://skydrive.live.com/redir.aspx?cid=48f471f287af2349&resid=48F471F287AF2349!105&parid=48F471F287AF2349!103
I hope someone can help, as what hair I have left (from pulling it out) is turning grey!
Andy

*                        Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa800c153284, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880053dc0c9, If non-zero, the instruction address which referenced the bad memory
   address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800018cd100
fffffa800c153284
FAULTING_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800aa48a80 -- (.trap 0xfffff8800aa48a80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000001ff rbx=0000000000000000 rcx=fffffa800c153284
rdx=ffffffffffee6b8b rsi=0000000000000000 rdi=0000000000000000
rip=fffff880053dc0c9 rsp=fffff8800aa48c18 rbp=0000000000000001
r8=000000000000001c r9=fffff8a0123923a8 r10=fffff8a0123923a8
r11=fffffa800c153268 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
RDPWD!memcpy+0x1d9:
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax ds:8c40:fffffa80`0c153284=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800016469fc to fffff8000169ac40
STACK_TEXT:
fffff880`0aa48918 fffff800`016469fc : 00000000`00000050 fffffa80`0c153284 00000000`00000001 fffff880`0aa48a80 : nt!KeBugCheckEx
fffff880`0aa48920 fffff800`01698d6e : 00000000`00000001 fffffa80`0c153284 00000000`00000000 fffff8a0`10919830 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0aa48a80 fffff880`053dc0c9 : fffff880`053c17cf 00000000`00000000 00000000`00000022 00000000`00000002 : nt!KiPageFault+0x16e
fffff880`0aa48c18 fffff880`053c17cf : 00000000`00000000 00000000`00000022 00000000`00000002 fffff880`053d999d : RDPWD!memcpy+0x1d9
fffff880`0aa48c20 fffff880`053d99fc : fffff8a0`10cf30d0 00000000`00000022 00000000`00000019 00000000`00000002 : RDPWD!SM_MCSSendDataCallback+0x303
fffff880`0aa48c60 fffff880`053d8354 : fffff880`0aa48da0 fffff8a0`123923a8 00000000`00000000 fffff880`053d7bfd : RDPWD!HandleAllSendDataPDUs+0x188
fffff880`0aa48d10 fffff880`053d7f64 : 00000000`00000031 fffffa80`0c039de5 00000006`0000001f fffff880`053a6079 : RDPWD!RecognizeMCSFrame+0x28
fffff880`0aa48d50 fffff880`012c01f8 : fffff8a0`12393000 fffffa80`0bb7aa60 fffffa80`0b81e9c0 fffff880`053a4e00 : RDPWD!MCSIcaRawInputWorker+0x3d4
fffff880`0aa48df0 fffff880`053a48d0 : 00000000`00000000 fffff880`0aa48f10 fffff880`0aa48f08 fffffa80`0c039ba8 : termdd!IcaRawInput+0x50
fffff880`0aa48e20 fffff880`053a3d85 : fffff880`01716890 fffffa80`0c0327e8 00000000`00000000 00000000`00000000 : tssecsrv!CRawInputDM::PassDataToServer+0x2c
fffff880`0aa48e50 fffff880`053a37c2 : fffffa80`0c16e598 fffffa80`00000000 00000000`00000031 fffff800`00000000 : tssecsrv!CFilter::FilterIncomingData+0xc9
fffff880`0aa48ef0 fffff880`012c01f8 : fffff880`009b8180 00000000`00000001 00000000`00000000 00000000`00000000 : tssecsrv!ScrRawInput+0x82
fffff880`0aa48f60 fffff880`052994c5 : fffffa80`0c16e580 fffffa80`0c039ba8 00000000`00000000 fffffa80`0c16e580 : termdd!IcaRawInput+0x50
fffff880`0aa48f90 fffff880`012c0f3e : fffffa80`0c039b70 fffffa80`0acccf20 fffffa80`0a95c450 fffffa80`0abf9620 : tdtcp!TdInputThread+0x465
fffff880`0aa49810 fffff880`012bfae3 : fffffa80`0c0a6560 fffffa80`0abf9620 fffffa80`087eee80 fffffa80`0a95c450 : termdd!IcaDriverThread+0x5a
fffff880`0aa49840 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : termdd!IcaDeviceControlStack+0x827
STACK_COMMAND: kb
FOLLOWUP_IP:
RDPWD!memcpy+1d9
fffff880`053dc0c9 668901          mov     word ptr [rcx],ax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: RDPWD!memcpy+1d9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: RDPWD
IMAGE_NAME: RDPWD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7ab45
FAILURE_BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
BUCKET_ID: X64_0x50_VRF_RDPWD!memcpy+1d9
Followup: MachineOwner
Bug Check Code 0x50:http://msdn.microsoft.com/en-us/library/windows/hardware/ff559023%28v=vs.85%29.aspx
Please start by that:
Update all possible drivers
Uninstall all unused programs
Disable all security softwares you have
Run chkdsk /r /f and sfc /scannow
Run memtest86+ to check if all is okay with your RAM. If an error was detected then replace the faulty RAM or contact your manufacturer Technical Support
If this does not help then upload MEMORY.DMP file (You can zip it and divide it using 7-ZIP) using Microsoft Skydrive and post a link here.
You can also contact Microsoft CSS for assistance.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft
Student Partner 2010 / 2011
Microsoft
Certified Professional
Microsoft
Certified Systems Administrator: Security
Microsoft
Certified Systems Engineer: Security
Microsoft
Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft
Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

BSOD when starting MSMQ service as domain user Windows server 2012

Hi
We have a problem with a server getting BSOD when we start a service related to MSMQ. We get the attempted execute of noexecute memory BSOD whenever we start the service as a User on the domain. When we start the service as a system local it starts without
problem. I got the crashdump here:
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\170\120314-11828-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
Built by: 9200.16912.amd64fre.win8_gdr.140502-1507
Machine Name:
Kernel base = 0xfffff800`48476000 PsLoadedModuleList = 0xfffff800`48742aa0
Debug session time: Wed Dec 3 14:41:01.892 2014 (UTC + 1:00)
System Uptime: 0 days 0:04:09.904
Loading Kernel Symbols
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck FC, {7f982e340e0, 791000010fdb1025, fffff8800485a5e0, 80000005}
Probably caused by : mqac.sys ( mqac!ACCreateQueue+a77 )
Followup: MachineOwner
1: kd> !analyze -v
* Bugcheck Analysis *
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 000007f982e340e0, Virtual address for the attempted execute.
Arg2: 791000010fdb1025, PTE contents.
Arg3: fffff8800485a5e0, (reserved)
Arg4: 0000000080000005, (reserved)
Debugging Details:
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
BUGCHECK_STR: 0xFC
PROCESS_NAME: mqsvc.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: fffff8800485a5e0 -- (.trap 0xfffff8800485a5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000007f982e0c950 rbx=0000000000000000 rcx=0000005dff1fecd0
rdx=0000005dff34e988 rsi=0000000000000000 rdi=0000000000000000
rip=000007f982e340e0 rsp=fffff8800485a778 rbp=fffff8800485ab80
r8=fffffa800e623980 r9=0000000000000521 r10=fffffa800ec547a0
r11=0000000000000006 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
000007f9`82e340e0 ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80048661ef1 to fffff800484d0540
STACK_TEXT:
fffff880`0485a408 fffff800`48661ef1 : 00000000`000000fc 000007f9`82e340e0 79100001`0fdb1025 fffff880`0485a5e0 : nt!KeBugCheckEx
fffff880`0485a410 fffff800`48588980 : fffff880`0485a5e0 ffffd8e9`9e6056e2 fffffa80`0ec547a0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x33f2d
fffff880`0485a450 fffff800`4850aabd : fffff880`0485a500 00000000`c0000016 fffffa80`0e603b00 fffffa80`0e623980 : nt! ?? ::FNODOBFM::`string'+0x33e85
fffff880`0485a4a0 fffff800`484cdfee : 00000000`00000008 00000000`00000000 00000000`00000000 fffff880`0485a5e0 : nt!MmAccessFault+0x3ed
fffff880`0485a5e0 000007f9`82e340e0 : fffff880`00dc5297 fffffa80`0ec54770 00000000`00000000 fffff8a0`011ce7c0 : nt!KiPageFault+0x16e
fffff880`0485a778 fffff880`00dc5297 : fffffa80`0ec54770 00000000`00000000 fffff8a0`011ce7c0 fffff980`00000000 : 0x000007f9`82e340e0
fffff880`0485a780 fffff880`00dc60d7 : 00000000`00000000 0000005d`ff34e988 00000000`00000000 00000000`00000000 : mqac!ACCreateQueue+0xa77
fffff880`0485a7f0 fffff800`488ab127 : fffffa80`0e5ed520 fffffa80`0d50ecf0 00000000`00000521 00000000`00000000 : mqac!ACDeviceControl+0x62b
fffff880`0485a890 fffff800`488c02f6 : 00000000`00000000 fffff8a0`00000080 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x7e5
fffff880`0485aa20 fffff800`484cf553 : 00000000`00000000 00000000`0000000c fffff6fb`7dbed078 fffff6fb`7da0ff30 : nt!NtDeviceIoControlFile+0x56
fffff880`0485aa90 000007f9`8a702c1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000005d`ff34e928 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007f9`8a702c1a
STACK_COMMAND: kb
FOLLOWUP_IP:
mqac!ACCreateQueue+a77
fffff880`00dc5297 85c0 test eax,eax
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: mqac!ACCreateQueue+a77
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mqac
IMAGE_NAME: mqac.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5010abc2
IMAGE_VERSION: 6.2.9200.16384
BUCKET_ID_FUNC_OFFSET: a77
FAILURE_BUCKET_ID: 0xFC_mqac!ACCreateQueue
BUCKET_ID: 0xFC_mqac!ACCreateQueue
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xfc_mqac!accreatequeue
FAILURE_ID_HASH: {d1daca31-6256-358c-65b5-69af54392880}
Followup: MachineOwner

Hi,
For BugCheck FC, it indicates that an attempt was made to execute non-executable memory. For more details,
please refer to following article.
Bug Check 0xFC: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
à
whenever we start the service as a User on the domain
. When we start the service as a system local it starts without problem
Did you mean that just use a standard domain user account to start the service, then encounter the issue? If
configure Log on as Local System account, will no BSOD issue occurred? Just a confirmation, thanks for your understanding.
Please check if you install all necessary Windows Updates on the server.
In addition, as you know, troubleshoot this kind of kernel crash issue, we need to analyze the crash dump file to narrow down the root cause of the issue. However, it is
not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Hope this helps.
Best regards,
Justin Gu

HP Pavilion DV6; Black Screen & Atikmpag.sys BSOD with external Monitor

Hello Guys.
I have HP Pavilion DV6 Core i7 with ATI Mobility Radeon HD 5650 Graphics Card. Two weeks ago, I started getting continous Atikmpag,sys BSODs. The operating system also started giving me warnings about the hardrive. After a few days, the BSODs got more frequent. Then one day, I was doing normal stuff on my PC and the Display Driver crashed. Instead of recovering, the PC froze. I forced restart my PC but it got worse. The display of my laptop went black. I connected the laptop to external monitor which detected the display. When I tried to load the windows, it started giving me the Atikmpag.sys BSOD on the start up. Now the operating system works fine in the Safe Mode but with nothing on the laptop's screen. The soultions I have tried so far are.
-Reinstalled the windows thrice
-Removed the drivers and installed the updated ones a bunch of times.
-Rolled back the bios to an earlier version
-Removed the hardrive and tried to load it from an operating system installed on external flash drive
-Tried loading the PC with linux on external flash drive
-Opened the laptop and cleaned it thoroughly
-Removed all the components and plugged them one by one.
-Removed the old Atikmpag.sys in system32 folder and expanded it with the latest ones.
-Installed every thing fresh from HP website
None of these tricks have given me any luck yet. The only way, I could use the operating system in normal mode, is to delete the atikmpag.sys file in safe mode and then log on back in normal mode. I also analysed the minidump file through window debugger and it says that atikmpag.sys is causing this crash with the TDR message. I did all these with an external monitor as the display of the laptop is black since that day.
Below are the detailed specs of my laptop.
OS Name: Microsoft Windows 7 (64 bit) Home Premium
Version: 6.1.7601
System Model: HP Pavilion Dv6 Notebook PC
Processor: Intel Core i7 Q 721 @ 1.60 GHz
Bios Version/Date: Hewlett- Packard F.29, 11/7/2011
Installed Physical Memory (RAM): 6GB
Graphics Card: ATI Mobility Radeon HD 5650 1 GB
I have tried almost every solution available on these forums but still have not gotten any where. I am wondering how could the display, graphics card and hard drive stop working at the same time .
I would really appreciate if someone colud help me through this problem.
Thank you
P.S. Kindly ignore my English mistakes as it is not my first language.

Hi Goloono,
Welcome to the HP Forums!
I would like to take a moment and thank you for using the forum, it is a great place to find answers. For you to have the best experience in the HP forum, I would like to direct your attention to the HP Forums Guide First Time Here? Learn How to Post and More.
First I would like to reassure you your English was great, I had no problems understanding you.
I grasp that you are getting a black screen with the error message " Atikmpag.sys".
Here is a link to Troubleshooting Error Messages on a Black Screen that may Occur During Startup or Boot.
Have you run The HP Support Assistant to help with updates and resolving issues.
Here is a link to a Microsoft Community Page with this exact issue. There are some suggestions that may help.
Blue Screen error with atikmpag.sys in Windows 7 .
Here is a link to the HP software and driver page. You will need to input your exact model of DV6 you have and follow the prompts. This page will have the recommended drivers and it will list bios updates. if there are any applicable ones.
HP Drivers & Downloads.
How Do I Find My Model Number or Product Number?
At one point you state you had a hard drive error, to rule that out I would run a diagnostics. SMART Media Test Error Appears when Notebook is Started
Please let me know if this has helped.
Sparkles1
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom right to say “Thanks” for helping!

Windows 7 Ultimate Blue Screen of Death (BSOD)

Hello,
I have Windows 7 Ultimate and very recently I have started experiencing this BSOD with an automatic restart.
I took a photo of the BSOD but I'm not sure how to attach it to this post. I even downloaded that Nirsoft BlueScreenView program but it doesn't show up on there. Should I change some setting?
The message says:
STOP: 0x0000007E (0xFFFFFFFFC0000005, 0xFFFFF80002AC32C2, 0xFFFFFFFFFF880009A9230)
I ran the CheckDisk program and there were no errors. I ran MemTest86 (2 passes) and there were no errors with the memory. I have an NVidia GTX-295 that I downloaded drivers for and it was working fine until a couple of days ago.
I did however install my old ATi Radeon X1900XTX along with the other card and downloaded the drivers for that. It worked fine for a couple of days and then it crashed (BSOD) a couple of times. I have 2 monitors so I removed the ATi card (pulled it out) and deleted every single file related to ATi in the Program Files folder (forgot to "uninstall" the drivers before physically pulling out the card). Connected both monitors to my NVidia GPU and things were back to normal. A few days later, I got the BSOD while playing Call of Duty: Modern Warfare 2 (through Steam) and then it started happening when I was just surfing the Internet. Now it happens more often and it is extremely frustrating.
I spent several thousand dollars on a BRAND NEW custom SYSTEM BUILD and I am now faced with this BSOD problem.
PLEASE HELP ME!!
I have an ASUS P6T7 WS Supercomputer Mobo and the release version of the BIOS; have not updated it because I was told I could ruin the whole computer if I screwed something up.
Have 2 SLC SSDs (G-Skill) for my OS drive in RAID-0. This is where Windows 7 Ultimate is installed.
My mouse driver (Logitech MX20 Laser cordless) is from 2006 but I am unable to update it even through the Logitech website. Not sure why.
Every other driver is up to date (or it says 'best version currently installed').
PLEASE HELP!!
Thanks in advance.

Hello Suzerain,
First of all, upgrade BIOS to the latest version, remove all unnecessary hardware devices from the computer and try entering Windows safe mode to test whether it is a third-party software/hardware compatibility issue. If so, please download and run Windows 7 Upgrade Advisor to check the reason for the issue. If the issue is caused by some incompatible driver, you might go to Device Manager, right click your hardware device in the list and select Update Driver Software; then click Search automatically for updated driver software.
If you still get the BSOD error after installing the latest driver, please understand that Windows system uses separated user mode and kernel mode memory space, stop errors are always caused by kernel portion components, such as a hardware device, third-party drivers, backup software or anti-virus services (buggy services).
The system goes to a blue screen because there is some exceptions happened in the kernel (either the device driver errors or the service errors), and Windows implements this mechanism: When it detects some errors occur in the kernel, it will kill the box in case some more severe damage happens. Then we get a blue screen or the system reboots (it depends on what the system settings are).
To troubleshoot this kind of kernel crash issue, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. Please be advised that contacting phone support will be a charged call.
To obtain the phone numbers for specific technology request please take a look at the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS
If you are outside the US please see http://support.microsoft.com for regional support phone numbers.
I hope the problem will be resolved soon. Thanks!
Andy

Windows server 2012 R2 randomly BSOD's

Dear all,
Since recently we suffering from random BSOD's on a Windows 2012 R2 terminal server. We already checked if there has been any changes, updates, new drivers installed, etc. around the time we receive the first one, but we cannot find anything. The server
is a virtual server on Hyper-V but the Hyper-V host doesn't suffer from BSOD's and is working properly. We updated the servers with newest windows updates. Could someone please help me debugging this minidump:
Loading Dump File [C:\Users\admtem\Desktop\031915-48906-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (16 procs) Free x64
Product: Server, suite: TerminalServer
Built by: 9600.17668.amd64fre.winblue_r8.150127-1500
Machine Name:
Kernel base = 0xfffff801`f4489000 PsLoadedModuleList = 0xfffff801`f4762250
Debug session time: Thu Mar 19 01:55:51.856 2015 (UTC + 1:00)
System Uptime: 0 days 2:21:59.525
Loading Kernel Symbols
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffff90140599000, 2, 0, fffff801f45280ab}
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+3fb )
Followup: MachineOwner
6: kd> !analyze -v
* Bugcheck Analysis *
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff90140599000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff801f45280ab, address which referenced memory
Debugging Details:
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff801f47ec138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff90140599000
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeSetEvent+3fb
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: ffffd00142686900 -- (.trap 0xffffd00142686900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd001475bc4e8 rbx=0000000000000000 rcx=fffff90140599000
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801f45280ab rsp=ffffd00142686a90 rbp=0000000000000000
r8=0000000000000000 r9=fffff801f492c628 r10=fffff90140599000
r11=ffffd00142686b00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po nc
nt!KeSetEvent+0x3fb:
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx] ds:fffff901`40599000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff801f45e54e9 to fffff801f45d99a0
STACK_TEXT:
ffffd001`426867b8 fffff801`f45e54e9 : 00000000`0000000a fffff901`40599000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd001`426867c0 fffff801`f45e3d3a : 00000000`00000000 ffffd001`475bc4e0 ffffe001`26538900 ffffcf81`0df3afa0 : nt!KiBugCheckDispatch+0x69
ffffd001`42686900 fffff801`f45280ab : 00000000`00002608 00000000`00000000 00000000`00000030 00000000`00000000 : nt!KiPageFault+0x23a
ffffd001`42686a90 fffff801`f45343ac : fffff901`40599000 ffffe001`00000000 ffffe001`25f34800 fffff801`00000000 : nt!KeSetEvent+0x3fb
ffffd001`42686b50 fffff801`f4561280 : 13131313`13131313 ffffe001`25f34880 00000000`00000080 ffffe001`25f34880 : nt!ExpWorkerThread+0x28c
ffffd001`42686c00 fffff801`f45dffc6 : ffffd001`42040180 ffffe001`25f34880 ffffd001`4204c5c0 13131313`13131313 : nt!PspSystemThreadStartup+0x58
ffffd001`42686c60 00000000`00000000 : ffffd001`42687000 ffffd001`42681000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeSetEvent+3fb
fffff801`f45280ab 488b09 mov rcx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeSetEvent+3fb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54c832b2
IMAGE_VERSION: 6.3.9600.17668
BUCKET_ID_FUNC_OFFSET: 3fb
FAILURE_BUCKET_ID: AV_VRF_nt!KeSetEvent
BUCKET_ID: AV_VRF_nt!KeSetEvent
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_vrf_nt!kesetevent
FAILURE_ID_HASH: {3ff99d47-0a85-0b19-f59a-c152651b9c12}
Followup: MachineOwner
Any help would be much appriciated!
Kind Regards,
Thijs

Hi Thijs,
Just addition, please also check if all necessary windows updates were installed in this problematic server. Please check if drivers need to be updated.
Please also refer to following thread and check if can help you.
Blue Screen Error (Probably caused by : ntkrnlmp.exe)
If this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Best regards,
Justin Gu
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

MSI Z87 G45 GAMING erratic BSOD/freeze @ 2300, stable @1600. Can't solve.

Hi All,
I would welcome some advice. I am about 4 months into a new machine build:
* MSI Z87 G45 GAMING motherboard
* i7-4770K Haswell 3.5 GHz & aftermarket heatpipe cooler
* 4 x 4Gb G.Skill SNIPER DDR3-2133 PC3-1700 (F3-17000CL11D-8GBSR)
* GeForce GTX 650 Ti w/ 2 Gb Video RAM
* Samsung 840 Pro 256 Gb SSD
* Thermaltake 700W Toughpower
* Win 7 Pro 64-bit SP1
The system seems to run fine at the default 1600 MHz RAM speed, however if I implement either of the X.M.P. profiles (which kick the memory speed up to the RAM's advertised speed of 2133 MHz), the system will occasionally (every 8 to 48 hours) freeze or BSOD. The BSOD stop codes are inconsistent in number (0x00, 0x41, 0x1E, 0xC4) and driver. When the system freezes, there is no consistent behavior. I am not doing any other overclocking besides using the X.M.P. profile in the memory.
RAM timing on the 2133 X.M.P. profile is: 11-11-11-30.
I have updated the BIOS to 1.5, including the ME, and updated all drivers in the system. All irrelevant hardware and drivers are disabled. Also I have done the following:
* MemTest+ 5.01 for over 30 hours, all 4 sticks in. No errors.
* Intel BurnTest on 'Very High', 10 passes, no errors
* Prime95 for over day with 90 C CPU temps constantly being hit. No errors.
* Unigine Valley Benchmark for 30 minutes; no issues
I increased V_DRAM from 1.60V (from the XMP profile) to 1.65V, and I also added +0.10V offset to increase the CPU I/O ANALOG , CPU I/O DIGITAL and SYSTEM AGENT voltages. Didn't seem to help. All other CPU voltages are default from [auto].
I rolled the memory speed back to the default 1600 MHz, and the system seems stable as a rock.
I don't really need to have the memory run at 2133 MHz, but it irks me that the system is not stable with the rated components, and I'm befuddled why the stress tests seem to pass just fine, then the system will randomly hang with arguably a far less demanding load than the stress tests.
Note that I have not yet:
* reset the CMOS when changing to X.M.P. Perhaps I should?
* reseated the graphics card or CPU. The latter will require R/R of the thermal grease, which I will do if needed, but it's a pain. Since the system is stable at 1600 MHz, I assumed that all basic systems are working as they should.
* Tried to work my way up in memory speed step by stem from 1600 to 2133 to see where things fall apart.
* Tested the video memory
I suspect main system memory, despite the clean bill of health from MemTest, and based on many of the comments to others with similar problems from the veterans on this board. I don't want to push the CPU voltages too much above the default/auto values, for fear of damage and reduced lifetime.
Also, the power supply is a nice unit from an older high-end gaming rig. It is rated at 700W. The PS does probably have over 30,000 hours on it (24/7 use for 3-4 years), however. Strange that it would work at 1600 MHz fine, and with only slightly more power load at 2133. I suppose stranger things have happened.
I've read the suggestions to run only 2 sticks, rather than 4, but I can't justify dropping $140 on new memory (I don't really need the extra speed benefit, it's more curiosity and just not knowing at this point).
Anyway, perhaps more seasoned souls than I can share their thoughts. The system is perfectly usable at 1600, but I'd really like to know where the lockups are stemming from. Troubleshooting is maddening because of the inconsistency in the long times before failure and lack of repeatability to reproduce the issue.
Thanks in advance for your time.
-Paul

Thank you both for the prompt replies. I'm learning a lot.
Turns out I also found this from G.SKILL in going over reviews of the memory modules I have. Another user had a similar configuration as mine and was having similar problems. G.SKILL replied:
Quote
We are sorry to hear you were unable to get two kits working in the same system. It is not guaranteed two kits can operate at the rated specifications since they were not pre-matched, tested, and guaranteed at factory. With multi-channel motherboards, perfectly matching memory is necessary to achieve high frequency. This is why we must offer high capacity 32GB, 64GB kits, otherwise we can just sell one module at a time and have you purchase as many as you need. Unfortunately, memory does not work that way. If you purchase a 16GB kit rated at DDR3-2133, you should have absolutely no issues. For any further questions or concerns, please feel free to contact us directly for assistance.
Thank you
GSKILL SUPPORT
Not knowing any better, I simply purchased two "kits" of 2x4 GB each and installed them. Perhaps worse, if the modules were matched, I may well have mixed them up so the matched modules don't even sit in the same channels 1/3 or 2/4. G.SKILL seems to have a pretty responsive board, so I'll ask them what they suggest.
Also in the end, I really just want a stable machine. This is a basically an office/engineering machine. My initial thinking was that if the system was unstable at 2133 then there is something wrong with it that needs to be fixed. It sounds instead like getting to 2133 is not guaranteed, and is much more of an art than simply throwing the modules in and powering up the system.
I'm perfectly happy at 1600 knowing the system is stable. Indeed realizing now that 2133 requires overclocking, I may well have backed off to 1600 even if everything had worked just fine at 2300, just to trade extra stability for the (small) performance improvement that I would likely never notice anyway.
I'll put together a post for the G.SKILL forums, and if I get anything useful I'll post what I learn here for completeness.
Thanks again for the fast and informative replies. It's much appreciated.
Best,
-Paul

After BSOD video card does not respond, VGA not work

Hi,
This is very URGENT!
Today I was working with my pc, I have connected a monitor through VGA. Suddenly screen flicker, then some pink dots appear fallowed by BSOD: Video_TDR_FAILURE.
After this, pc boots to black screen (always).
1) Went to safe mode. Works. Removed disabled video driver and windows starts but with low resolution and crappy graphics. Notice VGA stopped working, so cannot connect monitor.
2) Whenever I turn on driver / restart - again does not startup black screen.
3) I remove driver on safemode.
4) Try to install driver - in the middle of install pc suddenly restarts and nothings changed. Driver is not installed. Tried to install Windows 7, windows 8 drivers for my video card model - same thing - restart in the middle and does not work. Dxdiag shows that i have Microsoft Basic Display Driver.
ABOUT PC:
OS: windows 8.1 pro (using for more than 3 months without any video issues)
Laptop model: HP G62
Product number: WZ685EA#B1R
Video Card: AMD Mobility Radeon HD 5000 Series (also device 1 is Intel HD graphics)
I hope its not hardware. Also, how to if its harware issues, how to test video card?
Thank you in advance!!

Hello nerijusgood,
It appears that you had a bsod error, that since this you've booted into safe mode and corrected parts of the issue, but can no longer get the display adapter to install. I will try to assist you with this.
Based on everything you have done, the first place to start would be hardware. You should be able to test it and this document can help you in doing so: Testing for Hardware Failures (Windows 8).
Start with the above and let me know the results.
Thank you for posting on the HP forums.
I worked on behalf of HP.

Help -- New Windows 7 Ultimate 64-bit BSOD - nothing new installed

I read through the suggested forum questions and found nothing helpful.
My 2-year old Dell XPS running Windows 7 Ultimate 64-bit decided three days ago to give me the BSOD (while I was away and the computer was just in idle/sleep since I rebooted just before I went away). It has had no new hardware or software recently installed.
That leads me to conclude it might be an update. Safe Mode and Safe Model with Networking seem to run fine. But even when I Restore to a known good configuration from a month ago, it still BSODs on any updates -- Windows, Firefox, System Mechanic, etc. I even
de-installed Adobe Shockwave since it appeared to have done an update while I was away, but that hasn't helped.
Suggestions?

Hi,
In order to assist you, we will need the .DMP files to analyze what exactly occurred at the time of the crash, etc.
If you don't know where .DMP files are located, here's how to get to them:
1. Navigate to the %systemroot%\Minidump folder.
2. Copy any and all DMP files in the Minidump folder to your Desktop and then zip up these files.
3. Upload the zip containing the .DMP files to Onedrive or a hosting site of your choice and paste in your reply. Prefered sites: Onedrive, Mediafire, Dropbox, etc. Nothing with wait-timers.
4 (optional): The type of .DMP files located in the Minidump folder are known as Small Memory Dumps. In %systemroot% there will be what is known as a Kernel-Dump (if your system is set to generate). It is labeled MEMORY.DMP. The difference
between Small Memory Dumps and Kernel-Dumps in the simplest definition is a Kernel-Dump contains
much more information at the time of the crash, therefore allowing further debugging of your issue. If your upload speed permits it, and you aren't going against any strict bandwidth and/or usage caps, etc, the Kernel-Dump is the best
choice. Do note that Kernel-Dumps are much larger in size due to containing much more info, which is why I mentioned upload speed, etc.
Please note that any "cleaner" programs such as TuneUp Utilities, CCleaner, etc, by default will delete .DMP files upon use.
If your computer is not generating .DMP files, please do the following:
1. Start > type %systemroot% which should show the Windows folder, click on it. Once inside that folder, ensure there is a Minidump folder created. If not, CTRL-SHIFT-N to make a New Folder and name it Minidump.
2. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Performance > Settings > Advanced > Ensure there's a check-mark for 'Automatically manage paging file size for all
drives'.
3. Windows key + Pause key. This should bring up System. Click Advanced System Settings on the left > Advanced > Startup and Recovery > Settings > System Failure > ensure there is a check mark next to 'Write an event to the system
log'.
Ensure Small Memory Dump is selected and ensure the path is %systemroot%\Minidump.
4. Double check that the WERS is ENABLED:
Start > Search > type services.msc > Under the name tab, find Windows Error Reporting Service > If the status of the service is not Started then right click it and select Start. Also ensure that under Startup Type it is set to Automatic rather than
Manual. You can do this by right clicking it, selecting properties, and under General selecting startup type to 'Automatic', and then click Apply.
If you cannot get into normal mode to do any of this, please do this via Safe Mode.
Regards,
Patrick

BSoD after installing Boot Camp 3.0 into Win 7 Pro x64

I installed Windows 7 Professional x64 into the partition created by the Boot Camp Assistent (3.0.4), the whole windows setup worked just fine and finished as usual. Then, after the final reboot to finish the windows setup I installed the Boot Camp software and drivers from my 10.6 DVD. The setup finished and promted me to restart the system - no problems so far. But just as Windows rebooted and was about to show the desktop, it crashed with with a BSoD providing no precise imfomation as to which driver could have caused it.
I have re-installed Windows and Boot Camp about ten times now, and no matter what I tried, the result always remained the same.
I booted in Safe Mode and tried to update to Boot Camp 3.1 and 3.2, but near the end of the setup it shows that Keyagent and MacHAL could not be installed (Setup said the Updates were installed successfully though).
When I rebooted Windows normally it was still the same - BSoD just when the desktop was about to be shown.
I have absolutely no idea what causes this. The BSoD only shows a hex-code, but I wasn't able to write it down since it disappears too quick and I don't know how to 'pause' using the integrated keyboard.
• Computer is a MBP mid '09 running 10.6.8 with all updates
• Boot Camp version is 3.0
• Provided drivers on the Snow Leopard DVD are for XP and Vista/Vista x64 only, but since the setup completes without any error message I assume those Vista drivers are OK
• Windows - as stated above - is a 7 Professional x64
So, does anyone have an idea what might be the problem and/or how to solve this issue?
If any possibly useful information missing please ask and I'll add them.
Thanks in advance

Well, at least my Windows won't boot after renaming them to *.sys.old.
But anyway, these two drivers aren't the cause, instead it's actually BootCamp.exe and/or the trackpad or keyboard drivers.
This guy had the exact same problem and the 'solution' was to disable BootCamp.exe.
https://discussions.apple.com/message/10301692#10301692
I finally managed to install all Boot Camp updates but still nothing has changed; as soon as I launch BootCamp.exe or change settings for the trackpad the system crashes.
It seems I have two options now: Use Windows without "Tap to click", "Secondary Tap" and modified keyboard settings, or find suitable trackpad/keyboard drivers.
Speaking of which, is there any chance to get Boot Camp drivers for Win 7? Maybe this would solve my problem since I only have Vista/x64 drivers which I used for Win 7.
Thanks!

BSOD Assistance

Similar Messages

Maybe you are looking for