The bugcheck 0x00000019 (0x0000000000000020, 0xfffffa801fd35710, 0xfffffa801fd357c0, 0x000000000c0b0101)
Hi,
I am running the Windows Server 2008 Service Pack 2 and it keeps restarting with this message in the Event Viewer.
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000019 (0x0000000000000020, 0xfffffa801fd35710, 0xfffffa801fd357c0, 0x000000000c0b0101). A dump was saved in: C:\Windows\MEMORY.DMP.
I followed some documents about the bugcheck and ran the WinDbg to analyze the dump file but not quite understand the output. Here is the log from WinDbg.
* Bugcheck Analysis *
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa801fd35710, The pool entry we were looking for within the page.
Arg3: fffffa801fd357c0, The next pool entry.
Arg4: 000000000c0b0101, (reserved)
Debugging Details:
Page 46f4cf not present in the dump file. Type ".hh dbgerr004" for details
Page 5bd6d not present in the dump file. Type ".hh dbgerr004" for details
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: fffffa801fd35710 Nonpaged pool
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: snmp.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff80001b5046a to fffff80001a774d0
STACK_TEXT:
fffffa60`083116f8 fffff800`01b5046a : 00000000`00000019 00000000`00000020 fffffa80`1fd35710 fffffa80`1fd357c0 : nt!KeBugCheckEx
fffffa60`08311700 fffffa60`05f2bf67 : 00000000`00000002 fffffa80`00000000 fffffa80`0000000c 00000000`6770534e : nt!ExFreePool+0x563
fffffa60`083117b0 fffffa60`05f2d8ac : fffffa80`0d950fb0 fffffa80`0d950ee0 00000000`00000000 fffffa80`0d950f18 : nsiproxy!NsippEnumerateObjectsAllParameters+0x477
fffffa60`083119a0 fffffa60`05f2d99f : 00000000`00000003 00000000`00000001 fffffa80`0fbe0520 fffffa80`1d0f6410 : nsiproxy!NsippDispatchDeviceControl+0x70
fffffa60`083119e0 fffff800`01cda70e : fffffa80`0d950f00 fffffa80`1d0f6410 00000000`00000001 00000000`00000001 : nsiproxy!NsippDispatch+0x4b
fffffa60`08311a10 fffff800`01ce3126 : 00000000`0134efb0 00000000`000003c4 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x5be
fffffa60`08311b40 fffff800`01a76f73 : fffffa80`1d0ea380 00000000`0134ef98 fffffa60`08311bc8 00000000`0134f130 : nt!NtDeviceIoControlFile+0x56
fffffa60`08311bb0 00000000`770d6d8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0134f028 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770d6d8a
STACK_COMMAND: kb
FOLLOWUP_IP:
nsiproxy!NsippEnumerateObjectsAllParameters+477
fffffa60`05f2bf67 418bc5 mov eax,r13d
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nsiproxy!NsippEnumerateObjectsAllParameters+477
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nsiproxy
IMAGE_NAME: nsiproxy.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 47919a7d
FAILURE_BUCKET_ID: X64_0x19_20_nsiproxy!NsippEnumerateObjectsAllParameters+477
BUCKET_ID: X64_0x19_20_nsiproxy!NsippEnumerateObjectsAllParameters+477
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x19_20_nsiproxy!nsippenumerateobjectsallparameters+477
FAILURE_ID_HASH: {0a912234-49e7-5eff-b78d-8bb71121ffe3}
Followup: MachineOwner
Any help would be very appreciated.
Thanks.
Hi,
For Bug Check 0x19, it indicates that a pool header is corrupt. For more details, please refer to following
article.
Bug Check 0x19: BAD_POOL_HEADER
à
IMAGE_NAME:
nsiproxy.sys
The
nsiproxy.sys should be Microsoft Windows NSI proxy driver. Would you please let me confirm whether install any third-party application before this issue occurred? In addition, please run
sfc /scannow command to scan all protected system files. Please check if some necessary windows updates and drivers need to be updated. If be possible, please perform a
clean boot and check if this issue still exists.
By the way, it may be not effective for us to debug the crash dump file here in the forum. If this issues is a state of emergency for you. Please contact Microsoft Customer
Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Hope this helps.
Best regards,
Justin Gu
Similar Messages
-
Hi All
I formatted and installed Win8.1 (64-bit) recently on my PC but have constantly had BSOD with faults like:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 27/11/2014 09:40:21
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: PC1
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff8025714c975, 0xffffd001186a85f0, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 112714-32125-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-11-27T09:40:21.000000000Z" />
<EventRecordID>8488</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>PC1</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x0000003b (0x00000000c0000005, 0xfffff8025714c975, 0xffffd001186a85f0, 0x0000000000000000)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">112714-32125-01</Data>
</EventData>
</Event>
I've had others but this is the most recent. I ran the Nvidia scanner and loaded the video drivers it recommends (340.52). I've got two GeForce 8800GTX cards connected with SLI cable. I've tried turning SLI off as well. I also removed and re-seated the cards.
I also just replaced the RAM with another 4GB brand new from a supplier (240pin DDR2 DIMM UNBUFF.PC2 - 6400 CL6).
It crashed about once a day, totally randomly, sometimes when idle.
I zipped a copy of the DUMP file and MSINFO32 file to my OneDrive but I don't know if I need / how to share it (please advise if necessary).
I would be very grateful for a solution.
Regards
MarkOk, here is what I think. The MEMORY.DMP you provided was older and basically less helpful than what was recorded in the MSIinfo file. You are on the right track in your thinking that the crashes are related to
GeForce 8800GTX cards, so I am going to suggest an uninstall and "clean" reinstall of the current driver.
If no joy, try an older driver.
btw, apologies for the voluminous post...
25/11/2014 12:31 Windows Error Reporting Fault bucket
AV_nvlddmkm!CNvLChannelNonLegacy::pipelineGPFifoBlit, type 0
Event Name:
BlueScreen
Response:
http://wer.microsoft.com/responses/resredir.aspx?sid=10&Bucket=AV_nvlddmkm!CNvLChannelNonLegacy::pipelineGPFifoBlit&State=1&ID=e2e8a1cf-86d8-4a37-806c-7d971c8a16d6
Cab Id: e2e8a1cf-86d8-4a37-806c-7d971c8a16d6

Problem
signature:
P1: d1
P2: fffffffffffffff1
P3: 2
P4: 1
P5: fffff801ca3d1440
P6: 6_3_9600
P7: 0_0
P8:
768_1
P9: 
P10: 

Attached files:
C:\Windows\Minidump\112514-33906-01.dmp
C:\Users\Mark\AppData\Local\Temp\WER-95625-0.sysdata.xml
C:\Windows\MEMORY.DMP
C:\Users\Mark\AppData\Local\Temp\WERCED4.tmp.WERInternalMetadata.xml

These
files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_d1_a7d30b578e595ab79ff817b74f971d37c1e8e_00000000_cab_10a9e058

Analysis symbol: 
Rechecking
for solution: 0
Report ID: 112514-33906-01
Report Status: 0
Hashed bucket:
24/11/2014 17:22 Windows Error Reporting Fault bucket AV_nvlddmkm!vblankCallback, type 0
Event Name: BlueScreen
Response:
http://wer.microsoft.com/responses/resredir.aspx?sid=10&Bucket=AV_nvlddmkm!vblankCallback&State=1&ID=f616ba0f-2c01-41f5-bfc4-82489997cecc
Cab Id: f616ba0f-2c01-41f5-bfc4-82489997cecc

Problem
signature:
P1: d1
P2: 5e
P3: 6
P4: 1
P5: fffff80075721912
P6: 6_3_9600
P7: 0_0
P8:
768_1
P9: 
P10: 

Attached files:
C:\Windows\Minidump\112314-37250-01.dmp
C:\Users\Mark\AppData\Local\Temp\WER-86718-0.sysdata.xml
C:\Windows\MEMORY.DMP
C:\Users\Mark\AppData\Local\Temp\WER684A.tmp.WERInternalMetadata.xml

These
files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_d1_79675c223622dece3b44f5ae297e5b3f6af5349_00000000_cab_04d8b9c0

Analysis symbol: 
Rechecking
for solution: 0
Report ID: 112314-37250-01
Report Status: 0
Hashed bucket:
23/11/2014 18:03 Windows Error Reporting Fault bucket , type 0
Event Name:
BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: d1
P2: 5e
P3:
6
P4: 1
P5: fffff80075721912
P6: 6_3_9600
P7: 0_0
P8: 768_1
P9: 
P10: 

Attached
files:
C:\Windows\Minidump\112314-37250-01.dmp
C:\Users\Mark\AppData\Local\Temp\WER-86718-0.sysdata.xml
C:\Windows\MEMORY.DMP
C:\Users\Mark\AppData\Local\Temp\WER684A.tmp.WERInternalMetadata.xml

These
files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_d1_79675c223622dece3b44f5ae297e5b3f6af5349_00000000_cab_0d89e73e

Analysis symbol: 
Rechecking
for solution: 0
Report ID: 112314-37250-01
Report Status: 100
Hashed bucket:
24/11/2014 17:22 Windows Error Reporting Fault bucket -421640870, type 5
Event Name:
PnPDeviceProblemCode
Response: Not available
Cab Id: 0

Problem signature:
P1: x64
P2:
PCI\VEN_10DE&DEV_0191&SUBSYS_22501682&REV_A2
P3: {4d36e968-e325-11ce-bfc1-08002be10318}
P4: 0000001F
P5: BasicDisplay.sys
P6: 6.3.9600.16384
P7:
08-22-2013
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Temp\DMID706.tmp.log.xml
C:\Windows\Temp\LOGD727.tmp
C:\Windows\Inf\display.inf

These
files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_24eb8c9ed87f37eac11320981cbf81446b69288_00000000_cab_0764d745

Analysis symbol: 
Rechecking
for solution: 0
Report ID: 54413262-6e57-11e4-824e-c58295c96ec1
Report Status: 8
Hashed bucket: adb5d63b7478974f8d85c5ec03d74566
Sorted by: Device ID
Device Id
Chip Description
Vendor Id
Vendor Name
0x0191
SIS191
0x1039
Silicon Integrated Systems
0x0191
NVIDIA GeForce 8800 GTX
0x10DE
NVIDIA
0x0660
HD Audio
0x10EC
Realtek Semiconductor Corp
0x0191
CMI 8738 8CH Sound Card
0x13F6
C-Media Electronics Inc. -
Hello,
A terminal server rebooted itself out of nowhere and I see the following error in the eventviewer:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date:
11-9-2014 9:25:38
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: SERVERNAME
Description:
The computer has rebooted from a bugcheck. The bugcheck was:
0x000000f4
(0x0000000000000003, 0xfffffa800a9f4130, 0xfffffa800a9f4410,
0xfffff80001be0270). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id:
091114-107781-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-09-11T07:25:38.000000000Z" />
<EventRecordID>450694</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>TERM-LYSIAS-02</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x000000f4 (0x0000000000000003, 0xfffffa800a9f4130, 0xfffffa800a9f4410, 0xfffff80001be0270)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">091114-107781-01</Data>
</EventData>
</Event>
Anyone who can help out here?
Thanks, RenseI analyzed the errors with BlueScreenViewer and noticed that the driver ntoskrnl.exe causes the server to reboot. A normal chkdsk or sfc /scannow couldn't find anything.
Using chkdsk /r /f gave me the following log:
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.
So I can't check if this solved the problem, but I hope it did.
Rense -
Hi,
I have an issue in my with my one of my Windows 2012 Failover node. One server was rebooted unexpectedly and i found the event id 1001 BugChecks
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000009e (0xfffffa8036f00980, 0x000000000000003c, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 092614-45458-01.
Any solution ?
Regards
KrisHi Lotusnotes,
Please also refer to following article and check if can help you.
Why
is my Failover Clustering node blue screening with a Stop 0x0000009E?
In addition, troubleshoot this kind of kernel crash issue, we need to analyze the crash dump file to narrow down the root cause of the issue. You can refer to following articles
and check if can help you to analyze dump files.
Analyzing a Kernel-Mode Dump File
How to read the small memory dump file that is created by Windows if a crash occurs
Meanwhile, if this issues is a state of emergency for you. Please contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional
can assist with your request.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
If any update, please feel free to let us know.
Hope this helps.
Best regards,
Justin Gu -
The computer has rebooted from a bugcheck. The bugcheck was: 0x0bad1001
I would like to know how to troubleshoot this issue.
The computer has rebooted from a bugcheck. The bugcheck was: 0x0bad1001 (0x00000000000d04fd, 0xffffd00022fb6388, 0xffffd00022fb5b90, 0xfffff803552f9916). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 070114-140796-01.
I'm not able to upload C:\WINDOWS\MEMORY.DMP because the file size is too big 1.41 GB
Any idea what is causing this proplem?
Thank in advance.Hi,
The dump file shows the message as below:
* Bugcheck Analysis
Use !analyze -v to get detailed debugging information.
BugCheck BAD1001, {d04fd, ffffd00022fb6388, ffffd00022fb5b90, fffff803552f9916}
Probably caused by : klvfs.sys ( klvfs+6044 )
Followup: MachineOwner
the klvfs.sys file is responsible for this, the file means a Kaspersky software is installed on your computer, in this case I suggest to remove this software to see the result, meanwhile I suggest to turn to Kaspersky for the compatibility with Windows 8
at:
http://support.kaspersky.com/
Regards
Wade Liu
TechNet Community Support -
I have a Virtual server that reboots several times a day with the following event:
Bugcheck Error:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000101 (0x0000000000000030, 0x0000000000000000, 0xfffff880009b8180, 0x0000000000000001). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 061714-74859-01.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck"
/>
<EventID
Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-06-17T07:05:57.000000000Z" />
<EventRecordID>53764</EventRecordID>
<Correlation
/>
<Execution
ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>CLOUDBOX17812</Computer>
<Security
/>
</System>
- <EventData>
<Data Name="param1">0x00000101 (0x0000000000000030,
0x0000000000000000, 0xfffff880009b8180, 0x0000000000000001)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">061714-74859-01</Data>
</EventData>
</Event>
Critical Kernel-Power:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated
SystemTime="2014-06-17T07:04:13.937500000Z" />
<EventRecordID>53765</EventRecordID>
<Correlation
/>
<Execution
ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>CLOUDBOX17812</Computer>
<Security
UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="BugcheckCode">257</Data>
<Data Name="BugcheckParameter1">0x30</Data>
<Data Name="BugcheckParameter2">0x0</Data>
<Data Name="BugcheckParameter3">0xfffff880009b8180</Data>
<Data Name="BugcheckParameter4">0x1</Data>
<Data Name="SleepInProgress">false</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>
I searched on Google and most answers are about a HotFix for servers with a specific Intel Processor and Hyper-V installed, but this is a Virtual Server so Hyper-V is not installed obviously.
Any help is appreciated.
Regards,
Paul Ruedisueli
A.i Automatisering B.V.
The NetherlandsHi,
Thanks for your posting.
It seems to be system crash issue and we need to analyze the crash dump file to narrow down the root cause of the issue. Unfortunately, it is not effective for us to debug the crash dump file here in the forum.
I think you have read this kb article?
http://support.microsoft.com/kb/975530/en-au
Regards.
Vivian Wang -
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000116
Every once in a while my computer will randomly hard restart its self in the middle of a game and when i check the event viewer it gives me this
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 3/18/2014 12:06:10 AM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer:
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000116 (0xfffffa800d777250, 0xfffff88006d7f694, 0xffffffffc000009a, 0x0000000000000004). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 031814-15381-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-03-18T04:06:10.000000000Z" />
<EventRecordID>131951</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>GUARDIANTC-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x00000116 (0xfffffa800d777250, 0xfffff88006d7f694, 0xffffffffc000009a, 0x0000000000000004)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">031814-15381-01</Data>
</EventData>
</Event>Unfortunately your post is off topic here, in the TechNet Site Feedback forum, because it is not Feedback about the TechNet Website or Subscription. This is a standard response I’ve written up in advance to help many people (thousands, really.)
who post their question in this forum in error, but please don’t ignore it. The links I share below I’ve collected to help you get right where you need to go with your issue.
For technical issues with Microsoft products that you would run into as an
end user of those products, one great source of info and help is
http://answers.microsoft.com, which has sections for Windows, Hotmail, Office, IE, and other products. Office related forums are also here:
http://office.microsoft.com/en-us/support/contact-us-FX103894077.aspx
For Technical issues with Microsoft products that you might have as an
IT professional (like technical installation issues, or other IT issues), you should head to the TechNet Discussion forums at
http://social.technet.microsoft.com/forums/en-us, and search for your product name.
For issues with products you might have as a Developer (like how to talk to APIs, what version of software do what, or other developer issues), you should head to the MSDN discussion forums at
http://social.msdn.microsoft.com/forums/en-us, and search for your product or issue.
If you’re asking a question particularly about one of the Microsoft Dynamics products, a great place to start is here:
http://community.dynamics.com/
If you really think your issue is related to the subscription or the TechNet Website, and I screwed up, I apologize! Please repost your question to the discussion forum and include much more detail about your problem, that could include screenshots
of the issue (do not include subscription information or product keys in your screenshots!), and/or links to the problem you’re seeing.
If you really had no idea where to post this question but you still posted it here, you still shouldn’t have because we have a forum just for you! It’s called the Where is the forum for…? forum and it’s here:
http://social.msdn.microsoft.com/forums/en-us/whatforum/
Moving to off topic.
Thanks, Mike
MSDN and TechNet Subscriptions Support <br/> Read the Subscriptions <a href="http://blogs.msdn.com/msdnsubscriptions">Blog! </a> -
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000000, 0x0000000000000002, 0x0000000000000000, 0xfffff80003cf33f7). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041715-27750-01.
https://drive.google.com/file/d/0BzDs1bdKVqlAcU9CZ3BMY2M3Wnk5eVV0WkhFWG9kYmRsaEtz/view?usp=sharingMH
This was related to the NETwbw02.sys Intel® Wireless WiFi Link Driver from Intel Corporation. I would remove the current driver and install the newest driver available
If you continue to crash I would remove Kaspersky and use the built in defender.
Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\zigza\Desktop\041715-27750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*D:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.16384.amd64fre.winblue_rtm.130821-1623
Machine Name:
Kernel base = 0xfffff800`b7871000 PsLoadedModuleList = 0xfffff800`b7b389b0
Debug session time: Fri Apr 17 16:30:22.174 2015 (UTC - 4:00)
System Uptime: 0 days 0:00:10.822
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis *
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, fffff80003cf33f7}
*** WARNING: Unable to verify timestamp for NETwbw02.sys
*** ERROR: Module load completed but symbols could not be loaded for NETwbw02.sys
Probably caused by : NETwbw02.sys ( NETwbw02+993f7 )
Followup: MachineOwner
0: kd> !analyze -v
* Bugcheck Analysis *
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff80003cf33f7, address which referenced memory
Debugging Details:
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800b7bc1150
GetUlongFromAddress: unable to read from fffff800b7bc1208
0000000000000000 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
NETwbw02+993f7
fffff800`03cf33f7 488b09 mov rcx,qword ptr [rcx]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
DPC_STACK_BASE: FFFFF800B9C46FB0
TRAP_FRAME: fffff800b9c3f6b0 -- (.trap 0xfffff800b9c3f6b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe00004f2ed70 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003cf33f7 rsp=fffff800b9c3f840 rbp=ffffe00004fd9890
r8=fffff800b9c3f890 r9=0000000000000000 r10=fffff800b7b62180
r11=fffff800b9c3f870 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
NETwbw02+0x993f7:
fffff800`03cf33f7 488b09 mov rcx,qword ptr [rcx] ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800b79ccbe9 to fffff800b79c10a0
STACK_TEXT:
fffff800`b9c3f568 fffff800`b79ccbe9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`b9c3f570 fffff800`b79cb43a : 00000000`00000000 00000000`00000000 ffff4ce4`1dc3da00 fffff800`b9c3f6b0 : nt!KiBugCheckDispatch+0x69
fffff800`b9c3f6b0 fffff800`03cf33f7 : 00000000`00000285 00000000`00000000 00000000`00000000 ffffe000`05be4ca0 : nt!KiPageFault+0x23a
fffff800`b9c3f840 00000000`00000285 : 00000000`00000000 00000000`00000000 ffffe000`05be4ca0 fffff800`03e62df0 : NETwbw02+0x993f7
fffff800`b9c3f848 00000000`00000000 : 00000000`00000000 ffffe000`05be4ca0 fffff800`03e62df0 ffffe000`04fd9540 : 0x285
STACK_COMMAND: kb
FOLLOWUP_IP:
NETwbw02+993f7
fffff800`03cf33f7 488b09 mov rcx,qword ptr [rcx]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: NETwbw02+993f7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NETwbw02
IMAGE_NAME: NETwbw02.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52a09c3a
FAILURE_BUCKET_ID: AV_NETwbw02+993f7
BUCKET_ID: AV_NETwbw02+993f7
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_netwbw02+993f7
FAILURE_ID_HASH: {1e0ec353-2360-690e-9374-7a77832276f2}
Followup: MachineOwner
Wanikiya and Dyami--Team Zigzag -
I had the following issue on Windows Server 2008 R2 Enterprise. I want to know if it's relarted with a specific driver in orider to avoid this happend again.
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffff80000003, 0xfffff80001a8d016, 0xfffff880029eb788, 0xfffff880029eafe0). A dump was saved
in: C:WindowsMEMORY.DMP. Report Id: .
The dump is uploaded to the following skydrive link:
https://skydrive.live.com/?cid=FE2E04A1A3CB9D1D&id=FE2E04A1A3CB9D1D%21150
Please Could someone help me to know to witch is related?
Regards.
Juan.thanks a lot for the answer!
the expeption code of the bugcheck is the following:
0x80000002: STATUS_DATATYPE_MISALIGNMENT indicates an unaligned data reference was encountered
I'm checking the drivers...maybe is related with some drivers installed in the system.
Is there any way to check the dump and confirm to witch driver is related?
Regards.
Juan. -
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050
I would like to know how to troubleshoot this issue.
I did the firmware/driver/patch updates for multiple Hyper-V cluster just before the Christmas break. We have all HP DL580 boxes. All went well however, in observed issues with two nodes on a cluster. These two servers are getting BSOD every seven days.
I am observing the pattern and happening almost same time every seven days.
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffff8a1227fd6a4, 0x0000000000000000, 0xfffff88001e8587a, 0x0000000000000002). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 011614-56799-01.
I am contacting HP for support, however any tips will be appreciated !
For every expert, there is an equal and opposite expert. - Becker's Law
My blog on Virtualization - InsideVirtualization.comHi Shabarinath,
Regarding to the BugCheck 0x50, please refer to the following articles. Then follow the resolution there and check if fix the issue.
Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA
http://msdn.microsoft.com/en-us/library/ff559023(v=vs.85).aspx
Based on your description, those two servers get BSOD every seven days. Would you please check if BSOD occurred at same time-point (occurred at same hour every
seven days)?
Meanwhile, I can find that you have got the Dump files. So, please refer to the following KB and use the Windows Debugger (WinDbg.exe) tool to analyze those dump
files. It will help you to narrow down this issue.
How to read the small memory dump file that is created by Windows if a crash occurs
http://support.microsoft.com/kb/315263/en-us
You also can upload those dump files to
SkyDrive,
then post the link here. We will be able to get dump files.Please note, the dump files that upload to SkyDrive will be public.
If this issues is a state of emergency for you. I suggest you should contact Microsoft Customer Service and Support (CSS) via telephone, so that a dedicated Support
Professional can assist with your request. Since, it is not effective for us to debug the crash dump file here in the forum. Thanks for your understanding.
To obtain the phone numbers for specific technology request, please refer to the web site listed below:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607
Hope this helps.
Best regards,
Justin Gu -
I have an unexpected shutdown today with the following error in Event Viewer -
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff88002b89950, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 121813-82805-01.
Looks like this is related to some bad device drivers/software drivers - but dont know which one it is?? Could anyone please help me to identify what is the culprit device/software driver here?
Few more details are below (debugchk output) -
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
+0
fffff880`02b89950 78a8 js fffff880`02b898fa
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000000
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800026c5100
GetUlongFromAddress: unable to read from fffff800026c51c0
0000000000000000 Nonpaged pool
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
Any help would be highly appreciated.
Regards,
JamiHi,
Thanks for posting in the forum.
Regarding the BSOD issue, it may be caused by the defective or mismatched RAM. At this time, I suggest we could try to run Memory Diagnostics test to check for any memory problems, or update
the chipset, video card, display and network adapter drivers to the latest to see if it could help.
Here is the similar thread as reference, hope it helps.
Getting Blue Screen stop code error 0x0000001E
http://answers.microsoft.com/en-us/windows/forum/windows_7-system/getting-blue-screen-stop-code-error-0x0000001e/61bb8396-6f66-49fc-9b8d-d103774485f4
Best Regards,
Andy Qi
Andy Qi
TechNet Community Support -
I have Windows 7 Ultimate 32bit ,and reboot several times in a day by itself .The event log show this:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 2/11/2011 19:46:03
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: V_M-PC
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x80741004, 0x00000002, 0x00000001, 0x82acc4a8). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 021111-24102-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-02-11T18:46:03.000000000Z" />
<EventRecordID>84158</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>V_M-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x0000000a (0x80741004, 0x00000002, 0x00000001, 0x82acc4a8)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">021111-24102-01</Data>
</EventData>
</Event>
what is wrong ?? what a need to do ??I'm getting a similar problem...
Number 1
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-02-11T10:03:17.000000000Z" />
<EventRecordID>66460</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>V2SATIRE</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">0x0000000a (0x80741004, 0x00000002, 0x00000001, 0x82d094a8)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">021111-28126-01</Data>
</EventData>
</Event>
Number 2
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-02-13T10:03:32.000000000Z" />
<EventRecordID>67228</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>v2Satire</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">0x0000000a (0x80741004, 0x00000002, 0x00000001, 0x82cc64a8)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">021311-21340-01</Data>
</EventData>
</Event> -
Hi,
We have Exchange server 2013 restarting issue.(15.0.847.32)
Found The bugcheck was: 0x000000ef (0xffffe00000ee8080, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000) Event in the logs.
We have performed below steps but still same issue.
1. We have removed
Global Override for
ServiceHealthMSExchangeReplForceReboot responder (Reason for this as its not getting disabled)
2. Created Local Override and set the value to "0" (Disabled)
Server still restarting.Hi,
I have followed above already the problem remain same.
I have disabled Microsoft Exchange Health
Manager Service to monitor till now issue not reported.
Is this best practice to disable the service in these kinds of issues or is there any other way?
Its a workaround that many have used yes.
However, having said that, its not something you want to leave in place.
I would suggest upgrading to at least CU6 or CU7 and if that does not resolve the issue, opening a support case with Microsoft.
Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied. -
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 6/25/2014 08:09:27
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0x0000000000000010, 0x0000000000000002, 0x0000000000000000, 0xfffff8016a71d56c). A dump was saved in: C:\windows\MEMORY.DMP. Report Id: 062514-17078-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-06-25T15:09:27.000000000Z" />
<EventRecordID>18419</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Security />
</System>
<EventData>
<Data Name="param1">0x000000d1 (0x0000000000000010, 0x0000000000000002, 0x0000000000000000, 0xfffff8016a71d56c)</Data>
<Data Name="param2">C:\windows\MEMORY.DMP</Data>
<Data Name="param3">062514-17078-01</Data>
</EventData>
</Event>Hi,
Do you need any further help regarding the BSOD here?
Besides, regarding Bugcheck ID 0xD1, please see:
Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Please follow the suggestion provided by ZigZag team, upload us the dump file for further assistance.
Here for more information:
How to read the small memory dump file that is created
by Windows if a crash occurs
Best regards
Michael Shao
TechNet Community Support -
Hello Guys,
I hope someone can help me with this error. I have been searching from forums but typically, causes and resolutions are generalized. This is the first time it happened on our Win 2008 Server and we have not installed any (hardware/Software/Drivers)
for the past 3 years.
We do install monthly security patches and that is it... This server of ours is running on VM (VMWARE).
I hope you can shed light as I do not understand crash dumps..
Thank you
===============================
Opened log file 'c:\debuglogrlo.txt'
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* Bugcheck Analysis
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e3045048, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 819c02bf, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
READ_ADDRESS: e3045048
FAULTING_IP:
nt!CmpCheckKey+61b
819c02bf 394724 cmp dword ptr [edi+24h],eax
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre
TRAP_FRAME: 8d9bf9ec -- (.trap 0xffffffff8d9bf9ec)
.trap 0xffffffff8d9bf9ec
ErrCode = 00000000
eax=00000000 ebx=cecec024 ecx=3162f75f edx=00000035 esi=b52b1940 edi=e3045024
eip=819c02bf esp=8d9bfa60 ebp=8d9bfa8c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CmpCheckKey+0x61b:
819c02bf 394724 cmp dword ptr [edi+24h],eax ds:0023:e3045048=????????
.trap
Resetting default scope
LAST_CONTROL_TRANSFER: from 81891de4 to 818dc292
STACK_TEXT:
8d9bf9d4 81891de4 00000000 e3045048 00000000 nt!MmAccessFault+0x10b
8d9bf9d4 819c02bf 00000000 e3045048 00000000 nt!KiTrap0E+0xdc
8d9bfa8c 819c681a 01000001 009c4020 009c3f70 nt!CmpCheckKey+0x61b
8d9bfabc 819c6e48 b52b1940 01000001 00000006 nt!CmpCheckRegistry2+0x8c
8d9bfb04 819c186e 01000001 8d9bfc60 80002f38 nt!CmCheckRegistry+0xf5
8d9bfb60 819c3fdd 8d9bfbb4 00000005 00000000 nt!CmpInitializeHive+0x4c1
8d9bfbd8 819c627d 8d9bfc60 00000000 8d9bfc4c nt!CmpInitHiveFromFile+0x19e
8d9bfc18 819bc4c5 8d9bfc60 00000000 8d9bfc7b nt!CmpCmdHiveOpen+0x36
8d9bfd14 819bc6fa 00000002 8193c5a0 00000002 nt!CmpFlushBackupHive+0x2fd
8d9bfd38 81a9bcbd 8194613c 84da3020 818e9d4a nt!CmpSyncBackupHives+0x90
8d9bfd44 818e9d4a 00000000 00000000 84da3020 nt!CmpPeriodicBackupFlushWorker+0x32
8d9bfd7c 81a1a01c 00000000 bcf90a9f 00000000 nt!ExpWorkerThread+0xfd
8d9bfdc0 81882eee 818e9c4d 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!CmpCheckKey+61b
819c02bf 394724 cmp dword ptr [edi+24h],eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!CmpCheckKey+61b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51da1840
IMAGE_VERSION: 6.0.6002.18881
FAILURE_BUCKET_ID: 0x50_nt!CmpCheckKey+61b
BUCKET_ID: 0x50_nt!CmpCheckKey+61b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x50_nt!cmpcheckkey+61b
FAILURE_ID_HASH: {b0c48432-dfba-c9e0-33fc-874f17d1f0e6}
Followup: MachineOwner
eax=8d948120 ebx=00000000 ecx=81944200 edx=000003f0 esi=8d94813c edi=00000000
eip=818dc292 esp=8d9bf960 ebp=8d9bf9d4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
nt!MmAccessFault+0x10b:
818dc292 8b03 mov eax,dword ptr [ebx] ds:0023:00000000=????????
ChildEBP RetAddr Args to Child
8d9bf9d4 81891de4 00000000 e3045048 00000000 nt!MmAccessFault+0x10b
8d9bf9d4 819c02bf 00000000 e3045048 00000000 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ 8d9bf9ec)
8d9bfa8c 819c681a 01000001 009c4020 009c3f70 nt!CmpCheckKey+0x61b
8d9bfabc 819c6e48 b52b1940 01000001 00000006 nt!CmpCheckRegistry2+0x8c
8d9bfb04 819c186e 01000001 8d9bfc60 80002f38 nt!CmCheckRegistry+0xf5
8d9bfb60 819c3fdd 8d9bfbb4 00000005 00000000 nt!CmpInitializeHive+0x4c1
8d9bfbd8 819c627d 8d9bfc60 00000000 8d9bfc4c nt!CmpInitHiveFromFile+0x19e
8d9bfc18 819bc4c5 8d9bfc60 00000000 8d9bfc7b nt!CmpCmdHiveOpen+0x36
8d9bfd14 819bc6fa 00000002 8193c5a0 00000002 nt!CmpFlushBackupHive+0x2fd
8d9bfd38 81a9bcbd 8194613c 84da3020 818e9d4a nt!CmpSyncBackupHives+0x90
8d9bfd44 818e9d4a 00000000 00000000 84da3020 nt!CmpPeriodicBackupFlushWorker+0x32 (FPO: [1,0,2])
8d9bfd7c 81a1a01c 00000000 bcf90a9f 00000000 nt!ExpWorkerThread+0xfd
8d9bfdc0 81882eee 818e9c4d 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
8060e000 80615000 kdcom kdcom.dll Sat Apr 11 14:25:29 2009 (49E037D9)
80615000 80685000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Apr 11 14:23:19 2009 (49E03757)
80685000 80696000 PSHED PSHED.dll Sat Apr 11 14:25:32 2009 (49E037DC)
80696000 8069e000 BOOTVID BOOTVID.dll Sat Jan 19 15:27:15 2008 (4791A653)
8069e000 806df000 CLFS CLFS.SYS Sat Apr 11 12:13:51 2009 (49E018FF)
806df000 807bf000 CI CI.dll Sat Apr 11 14:25:22 2009 (49E037D2)
807d7000 807e5000 WDFLDR WDFLDR.SYS Thu Jul 26 10:36:38 2012 (5010AD36)
807e5000 807fc000 dfsc dfsc.sys Thu Apr 14 22:59:03 2011 (4DA70BB7)
81811000 81844000 hal halmacpi.dll Sat Apr 11 12:13:13 2009 (49E018D9)
81844000 81bfe000 nt ntkrpamp.exe Mon Jul 08 09:39:12 2013 (51DA1840)
81e01000 81f0c000 NDIS NDIS.SYS Sat Apr 11 12:45:52 2009 (49E02080)
81f0c000 81f37000 msrpc msrpc.sys Sat Apr 11 12:37:32 2009 (49E01E8C)
81f37000 81f72000 NETIO NETIO.SYS Sat Apr 11 12:46:21 2009 (49E0209D)
81f72000 81ff3000 Wdf01000 Wdf01000.sys Sat Jun 22 10:29:37 2013 (51C50C11)
8c805000 8c84b000 acpi acpi.sys Sat Apr 11 12:19:03 2009 (49E01A37)
8c84b000 8c854000 WMILIB WMILIB.SYS Sat Jan 19 13:53:08 2008 (47919044)
8c854000 8c85c000 msisadrv msisadrv.sys Sat Jan 19 13:32:51 2008 (47918B83)
8c85c000 8c883000 pci pci.sys Sat Apr 11 12:19:16 2009 (49E01A44)
8c883000 8c892000 partmgr partmgr.sys Sat Apr 11 12:39:19 2009 (49E01EF7)
8c892000 8c894900 compbatt compbatt.sys Sat Jan 19 13:32:47 2008 (47918B7F)
8c895000 8c89f000 BATTC BATTC.SYS Sat Jan 19 13:32:45 2008 (47918B7D)
8c89f000 8c8ae000 volmgr volmgr.sys Sat Jan 19 13:49:51 2008 (47918F7F)
8c8ae000 8c8f8000 volmgrx volmgrx.sys Sat Apr 11 12:39:25 2009 (49E01EFD)
8c8f8000 8c8ff000 intelide intelide.sys Sat Jan 19 13:49:42 2008 (47918F76)
8c8ff000 8c90d000 PCIIDEX PCIIDEX.SYS Sat Apr 11 12:39:09 2009 (49E01EED)
8c90d000 8c91cb80 vmci vmci.sys Tue May 01 09:12:40 2012 (4F9F3888)
8c91d000 8c92d000 mountmgr mountmgr.sys Sat Jan 19 13:49:13 2008 (47918F59)
8c92d000 8c93a580 vsock vsock.sys Sat Sep 29 12:59:03 2012 (50668017)
8c93b000 8c943000 atapi atapi.sys Sat Apr 11 12:39:09 2009 (49E01EED)
8c943000 8c961000 ataport ataport.SYS Sat Apr 11 12:39:10 2009 (49E01EEE)
8c961000 8c979000 lsi_sas lsi_sas.sys Sat Jun 30 09:01:01 2007 (4685AB4D)
8c979000 8c9ba000 storport storport.sys Sat Apr 11 12:39:19 2009 (49E01EF7)
8c9ba000 8c9ec000 fltmgr fltmgr.sys Sat Apr 11 12:13:59 2009 (49E01907)
8ca0d000 8ca6c000 SYMDS SYMDS.SYS Tue Jul 24 06:57:53 2012 (500DD6F1)
8ca6c000 8ca95000 vsepflt vsepflt.sys Tue Oct 30 18:37:14 2012 (508FADDA)
8ca95000 8cb7d000 SYMEFA SYMEFA.SYS Thu Oct 04 02:59:21 2012 (506C8B09)
8cb7d000 8cbef000 ksecdd ksecdd.sys Sat Jun 02 05:56:07 2012 (4FC93A77)
8cc0a000 8ccf4000 tcpip tcpip.sys Fri Jul 05 10:08:19 2013 (51D62A93)
8ccf4000 8cd0f000 fwpkclnt fwpkclnt.sys Sat Apr 11 12:45:42 2009 (49E02076)
8cd0f000 8cd16e00 storflt storflt.sys Sun Nov 18 10:29:44 2007 (473FA398)
8cd17000 8cd2a000 i8042prt i8042prt.sys Sat Jan 19 13:49:17 2008 (47918F5D)
8cd2a000 8cd35000 mouclass mouclass.sys Sat Jan 19 13:49:14 2008 (47918F5A)
8cd35000 8cd4d000 parport parport.sys Sat Jan 19 13:49:32 2008 (47918F6C)
8cd4d000 8cd67000 serial serial.sys Sat Jan 19 13:49:34 2008 (47918F6E)
8cd67000 8cd71000 serenum serenum.sys Sat Jan 19 13:49:29 2008 (47918F69)
8cd71000 8cd7c000 fdc fdc.sys Sat Jan 19 13:49:37 2008 (47918F71)
8cd7c000 8cd94000 cdrom cdrom.sys Sat Apr 11 12:39:17 2009 (49E01EF5)
8cd94000 8cdc2000 vm3dmp vm3dmp.sys Fri Oct 19 02:55:17 2012 (50805095)
8cdc2000 8cdd8000 tdx tdx.sys Sat Apr 11 12:45:56 2009 (49E02084)
8cdd8000 8cdf6000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Oct 10 04:46:53 2013 (5255C0BD)
8ce09000 8cf19000 Ntfs Ntfs.sys Sun Mar 03 05:02:58 2013 (51326902)
8cf19000 8cf52000 volsnap volsnap.sys Thu Aug 16 21:53:34 2012 (502CFB5E)
8cf52000 8cf5a000 spldr spldr.sys Fri Jun 22 08:29:17 2007 (467B17DD)
8cf5a000 8cf69000 mup mup.sys Sat Apr 11 12:14:12 2009 (49E01914)
8cf69000 8cf7a000 disk disk.sys Sat Apr 11 12:39:14 2009 (49E01EF2)
8cf7a000 8cf9b000 CLASSPNP CLASSPNP.SYS Sat Apr 11 12:39:05 2009 (49E01EE9)
8cf9b000 8cfab000 agp440 agp440.sys Sat Jan 19 13:32:49 2008 (47918B81)
8cfab000 8cfb4000 crcdisk crcdisk.sys Sat Jan 19 13:50:29 2008 (47918FA5)
8cfe3000 8cfee000 tunnel tunnel.sys Sat Jan 19 13:55:50 2008 (479190E6)
8cfee000 8cff9000 kbdclass kbdclass.sys Sat Jan 19 13:49:14 2008 (47918F5A)
8cff9000 8cffa380 vmmouse vmmouse.sys Mon Jun 04 17:15:28 2012 (4FCC7CB0)
92404000 924a4000 dxgkrnl dxgkrnl.sys Thu Aug 01 09:31:36 2013 (51F9BA78)
924a4000 924b0000 watchdog watchdog.sys Sat Apr 11 12:22:43 2009 (49E01B13)
924b0000 924cd000 E1G60I32 E1G60I32.sys Wed Aug 08 00:14:13 2007 (46B89A55)
924cd000 924d0780 CmBatt CmBatt.sys Sat Jan 19 13:32:47 2008 (47918B7F)
924d1000 924e0000 intelppm intelppm.sys Sat Jan 19 13:27:20 2008 (47918A38)
924e0000 924e0c80 lmimirr lmimirr.sys Wed Apr 11 06:32:11 2007 (461C106B)
924e1000 92502000 VIDEOPRT VIDEOPRT.SYS Sat Jan 19 13:52:10 2008 (4791900A)
92502000 92531000 msiscsi msiscsi.sys Sat Apr 11 12:40:07 2009 (49E01F27)
92531000 9253c000 TDI TDI.SYS Sat Jan 19 13:57:10 2008 (47919136)
9253c000 92553000 rasl2tp rasl2tp.sys Sat Jan 19 13:56:33 2008 (47919111)
92553000 9255e000 ndistapi ndistapi.sys Sat Jan 19 13:56:24 2008 (47919108)
9255e000 92581000 ndiswan ndiswan.sys Sat Apr 11 12:46:31 2009 (49E020A7)
92581000 92590000 raspppoe raspppoe.sys Sat Apr 11 12:46:30 2009 (49E020A6)
92590000 925a4000 raspptp raspptp.sys Sat Jan 19 13:56:34 2008 (47919112)
925a4000 925b9000 rassstp rassstp.sys Sat Apr 11 12:46:40 2009 (49E020B0)
925b9000 925e3000 SYMEVENT SYMEVENT.SYS Wed Aug 22 13:32:47 2012 (50346EFF)
925e3000 925f1000 Npfs Npfs.SYS Sat Apr 11 12:14:01 2009 (49E01909)
92a0a000 92a93000 rdpdr rdpdr.sys Sat Apr 11 12:52:32 2009 (49E02210)
92a93000 92aa3000 termdd termdd.sys Sat Apr 11 12:51:14 2009 (49E021C2)
92aa3000 92aa4380 swenum swenum.sys Sat Jan 19 13:49:20 2008 (47918F60)
92aa5000 92acf000 ks ks.sys Sat Apr 11 12:38:47 2009 (49E01ED7)
92acf000 92ad9000 mssmbios mssmbios.sys Sat Jan 19 13:32:55 2008 (47918B87)
92ad9000 92ae6000 umbus umbus.sys Sat Jan 19 13:53:40 2008 (47919064)
92ae6000 92af0000 flpydisk flpydisk.sys Sat Jan 19 13:49:37 2008 (47918F71)
92af0000 92b01000 NDProxy NDProxy.SYS Sat Jan 19 13:56:28 2008 (4791910C)
92b01000 92b25000 ccSetx86 ccSetx86.sys Fri Aug 17 05:15:38 2012 (502D62FA)
92b25000 92bb8000 SRTSP SRTSP.SYS Fri Nov 02 04:14:38 2012 (5092D82E)
92bb8000 92bc8000 SRTSPX SRTSPX.SYS Wed Nov 16 06:27:18 2011 (4EC2E746)
92bc8000 92bf5000 Ironx86 Ironx86.SYS Tue Jul 24 08:34:17 2012 (500DED89)
93600000 93609000 rasacd rasacd.sys Sat Jan 19 13:56:31 2008 (4791910F)
93609000 93790e00 NAVEX15 NAVEX15.SYS Fri Aug 23 03:57:57 2013 (52166D45)
937a9000 937b7000 SymEPSecFlt SymEPSecFlt.sys Wed Mar 14 22:36:50 2012 (4F60AD02)
937b7000 937c0000 Fs_Rec Fs_Rec.SYS Wed Feb 29 21:32:36 2012 (4F4E28F4)
937c0000 937c7000 Null Null.SYS Sat Jan 19 13:49:12 2008 (47918F58)
937c7000 937ce000 Beep Beep.SYS Sat Jan 19 13:49:10 2008 (47918F56)
937ce000 937d5980 vmrawdsk vmrawdsk.sys Sat Mar 23 22:24:00 2013 (514DBB00)
937d6000 937e2000 vga vga.sys Sat Jan 19 13:52:06 2008 (47919006)
937e2000 937ea000 RDPCDD RDPCDD.sys Sat Jan 19 14:01:08 2008 (47919224)
937ea000 937f2000 rdpencdd rdpencdd.sys Sat Jan 19 14:01:09 2008 (47919225)
937f2000 937fd000 Msfs Msfs.SYS Sat Jan 19 13:28:08 2008 (47918A68)
97c0d000 97c69000 SYMTDIV SYMTDIV.SYS Sat Jul 21 10:01:00 2012 (500A0D5C)
97c69000 97c7d000 smb smb.sys Sat Apr 11 12:45:22 2009 (49E02062)
97c7d000 97cc5000 afd afd.sys Thu Apr 21 21:58:25 2011 (4DB03801)
97cc5000 97cf7000 netbt netbt.sys Sat Apr 11 12:45:35 2009 (49E0206F)
97cf7000 97d00000 ws2ifsl ws2ifsl.sys Sat Jan 19 13:56:49 2008 (47919121)
97d00000 97d16000 pacer pacer.sys Sat Apr 11 12:45:51 2009 (49E0207F)
97d16000 97d24000 netbios netbios.sys Sat Jan 19 13:55:45 2008 (479190E1)
97d24000 97d46700 vmhgfs vmhgfs.sys Sat Mar 23 22:17:43 2013 (514DB987)
97d47000 97d5a000 wanarp wanarp.sys Sat Jan 19 13:56:31 2008 (4791910F)
97d5a000 97d96000 rdbss rdbss.sys Sat Apr 11 12:14:26 2009 (49E01922)
97d96000 97da0000 nsiproxy nsiproxy.sys Sat Jan 19 13:55:50 2008 (479190E6)
97da0000 97dff000 eeCtrl eeCtrl.sys Thu Oct 10 04:46:53 2013 (5255C0BD)
9800e000 9811d000 BHDrvx86 BHDrvx86.sys Fri Mar 14 10:34:18 2014 (53226AAA)
9811d000 9812a000 crashdmp crashdmp.sys Sat Apr 11 12:39:12 2009 (49E01EF0)
9812a000 98134000 dump_diskdump dump_diskdump.sys Sat Apr 11 12:39:11 2009 (49E01EEF)
98134000 9814c000 dump_LSI_SAS dump_LSI_SAS.sys Sat Jun 30 09:01:01 2007 (4685AB4D)
9814c000 98156000 Dxapi Dxapi.sys Sat Jan 19 13:36:12 2008 (47918C4C)
98156000 98165000 monitor monitor.sys Sat Jan 19 13:52:19 2008 (47919013)
98165000 98180000 luafv luafv.sys Sat Jan 19 13:30:35 2008 (47918AFB)
98180000 981ab000 ofant ofant.sys Tue Nov 22 03:55:32 2011 (4ECAACB4)
981ab000 981b5000 LMIRfsDriver LMIRfsDriver.sys Tue Jul 15 00:26:22 2008 (487B7E2E)
9d440000 9d646000 win32k win32k.sys Fri Feb 07 18:38:29 2014 (52F4B7A5)
9d660000 9d669000 TSDDD TSDDD.dll Sat Jan 19 14:01:09 2008 (47919225)
9d680000 9d68e000 cdd cdd.dll Thu Aug 01 10:49:32 2013 (51F9CCBC)
a0606000 a06b6000 spsys spsys.sys Wed Mar 11 01:10:28 2009 (49B69F04)
a06b6000 a06c6000 lltdio lltdio.sys Sat Jan 19 13:55:03 2008 (479190B7)
a06c6000 a06d9000 rspndr rspndr.sys Sat Jan 19 13:55:03 2008 (479190B7)
a06d9000 a06f2000 bowser bowser.sys Tue Feb 22 21:23:54 2011 (4D63B8EA)
a06f2000 a0713000 mrxdav mrxdav.sys Sat Apr 11 12:14:39 2009 (49E0192F)
a0713000 a0732000 mrxsmb mrxsmb.sys Fri Apr 29 21:24:39 2011 (4DBABC17)
a0732000 a076b000 mrxsmb10 mrxsmb10.sys Wed Jul 06 23:31:46 2011 (4E147FE2)
a076b000 a0783000 mrxsmb20 mrxsmb20.sys Fri Apr 29 21:24:41 2011 (4DBABC19)
a0783000 a07f0000 HTTP HTTP.sys Sun Feb 21 04:53:31 2010 (4B804BCB)
a07f0000 a07f7000 parvdm parvdm.sys Sat Jan 19 13:49:28 2008 (47918F68)
a07f7000 a07f9080 vmmemctl vmmemctl.sys Sat Mar 23 22:23:46 2013 (514DBAF2)
a07fa000 a07fb800 RaInfo RaInfo.sys Sat Jan 05 02:57:12 2008 (477E8188)
a4808000 a48e6000 peauth peauth.sys Mon Oct 23 16:55:32 2006 (453C8384)
a48e6000 a48f0000 secdrv secdrv.SYS Wed Sep 13 21:18:32 2006 (45080528)
a48f0000 a490d000 srvnet srvnet.sys Fri Apr 29 21:25:08 2011 (4DBABC34)
a490d000 a4919000 tcpipreg tcpipreg.sys Wed Dec 09 01:26:18 2009 (4B1E8C3A)
a4919000 a491ce80 vstor2_mntapi10_shared vstor2-mntapi10-shared.sys Fri Nov 05 02:33:35 2010 (4CD2FC7F)
a491d000 a4945000 srv2 srv2.sys Fri Apr 29 21:25:09 2011 (4DBABC35)
a4945000 a4994000 srv srv.sys Fri Feb 18 22:03:28 2011 (4D5E7C30)
a4994000 a49aa000 cdfs cdfs.sys Sat Jan 19 13:28:02 2008 (47918A62)
a49aa000 a49b3000 asyncmac asyncmac.sys Sat Jan 19 13:56:29 2008 (4791910D)
a49b3000 a49c3000 fileinfo fileinfo.sys Sat Jan 19 13:34:27 2008 (47918BE3)
a49dd000 a49f2000 NAVENG NAVENG.SYS Fri Aug 23 03:59:23 2013 (52166D9B)
Unloaded modules:
a49c8000 a49dd000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49b3000 a49c8000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49dd000 a49f2000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49c8000 a49dd000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49b3000 a49c8000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49dd000 a49f2000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49c8000 a49dd000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
a49b3000 a49c8000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
93609000 93791000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
93794000 937a9000 NAVENG.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00015000
9360c000 93794000 NAVEX15.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00188000
8cfb4000 8cfc1000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
8cfc1000 8cfcb000 dump_storport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000A000
8cfcb000 8cfe3000 dump_LSI_SAS.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00018000
807bf000 807d7000 sacdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00018000
Closing open log file c:\debuglogrlo.txtHi,
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM
cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Try the solution provided in this article:
Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA
http://msdn.microsoft.com/en-us/library/windows/hardware/ff559023(v=vs.85).aspx
And this one:
Stop error message in Windows 7 or Windows Server 2008 R2: "Stop error code 0x0000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)" or "Stop error code 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)"
http://support.microsoft.com/kb/979538
Hope this helps.
Maybe you are looking for
-
Error Message when burning CD-R
For the past week I have been trying to burn cds from itunes on my macbook and a "medium write error" keeps appearing. Does anyone know why or how to fix this?
-
Simple Questions regarding temperatures for MacBook Pro
Hey, I just bought a brand new Macbook Pro Mid-2012 2.9 Ghz, i7 Processor, 8 GB of ram, and 750 HDD. It's my first Mac I've bought I'm switching over from an overheating windows laptop. Now my Mac gets extremely hot under light usage. First thing I d
-
My web cam is too dark i cant see myself
dear my webcamp is too dark i don`t know why before its work very good my laptop model Pavilion dv6
-
For my next project I'm supposed to read in a text file and then compute the legibility index. How do I go about reading in a text file?
-
Hi all, I have a problem in attaching two programs to a single application form in ISU module, i have done it in FI module but in ISU i cann't find any transcsaction code, like FBZP. could any body tell me the tcode for this issue. Regards, sre.