BSOD help

By arthurduplessis
Sep 4, 2009
Topic Status:
Not open for further replies.
  1. *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {0, 2, 0, 8051b45a}

    Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+2fc )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051b45a, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 00000000

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx

    CUSTOMER_CRASH_COUNT: 7

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: System

    LAST_CONTROL_TRANSFER: from 8056a9cc to 8051b45a

    STACK_TEXT:
    ba4ebc64 8056a9cc d0328000 000a7c30 00000000 nt!MmUnmapViewInSystemCache+0x2fc
    ba4ebc7c 804e8239 8aee1308 89eba008 00000000 nt!CcUnmapVacb+0x2a
    ba4ebcb0 804e5246 00000000 00000000 89eba06c nt!CcUnmapVacbArray+0x117
    ba4ebccc 804e5501 89eba008 806e6a4c 89eba008 nt!CcUnmapAndPurge+0x20
    ba4ebcfc 804e4b03 00000001 80559690 8aa15638 nt!CcDeleteSharedCacheMap+0xc5
    ba4ebd34 804e70db 8aef7288 80564820 8aef7910 nt!CcWriteBehind+0x357
    ba4ebd7c 8053877d 8aef7288 00000000 8aef7910 nt!CcWorkerThread+0x12f
    ba4ebdac 805cff70 8aef7288 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4ebddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!MmUnmapViewInSystemCache+2fc

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc

    BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc

    Followup: MachineOwner
    ---------
  2. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    This looks like a memory fault. Try running Memtest86, and/or swapping memory modules
  3. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    I tested the memory all night with mem test and there were no errors.

    Any thing else I can do?
  4. Mikheil

    Mikheil Newcomer, in training

    reinstall OS ? is that an option you might consider ?
  5. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    Would posting some system specs be too much to ask? Did you try swapping the memory sticks around? Schedule a disk check on a Windows startup, to check for any data corruption
  6. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    Still get a bsod after like 1 moth of usage from a format.. I need to isolate this issue
    cause it will keep reoccurring in a bit of time which is causing me a lot of grief.

    I swapped out the memory in different slots all day today to test the memory controller as
    well as the sticks separately.

    I ran spinrite on my HD's and no errors were found.

    specs are...

    Computer Rig

    * Asus Maximus Formula Motherboard
    * Intel Core 2 Quad Q6600
    * Corsair Dominator Dual Channel PC8500 DDR2 1066MHz Memory (4 x 1024MB)
    * 2x ATI Radeon HD 3870X2 Crossfired together
    * Antec Quattro 1000w PSU
    * 1x 300gb Raptor HD
    * 1x Western Digital 1TB Hard Drive - 7200, 32MB
    * 32x LG DVD Burner
    * Flash Card Reader/Writer Internal Bay Drive
    * Antec 1200 Case
    * G15 Keyboard series 2
    * SteelSeries Glass Mouse pad
    * SteelSeries Ikari Laser Mouse

    Extra's to note are

    * Microsoft Headset Noise Cancellation (name eludes me)
    * Logitech Chill Stream (Xbox 360 Controller)
    * Logitech G25 USB Racing Wheel
    * Generic 5.1 Surround Sound System 505watts
  7. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    TMagic, for what it is worth, I do know that there have been serious issues with the Logitech G15 keyboards but that wouldn't explain the memory corruption as probable cause. Thought I'd just through that out there...

    @ arthurduplessis, you have an Asus motherboard and they can be very picky about the RAM used in their motherboards. Is your particular memory model recommended by Asus? You may also want to check the memory voltage in your BIOS and see if there is a descrepency between what the recommended voltage is and what your motherboard has it set at.

    Just my 2 cents...
  8. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    arthurduplessis, nice specs... Have you tried upping the memory voltage a bit. I never do anything ASUS but, the memory adjustment worked for my overclocked Q6600, with Windows 7. My system is running rock solid, with Windows 7 out preforming my dual Vista OS hands down.

    "you have an Asus motherboard and they can be very picky about the RAM used in their motherboards"...

    This may take adjusting the memory timings too
  9. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    The keyboard has been working fine as there was issues like you stated back with the original drivers but I make sure to update it then its pretty sound.

    I had contacted asus and corsair and they have assured me both are compliant.
    Even had them just the ver. of the ram to just in case.

    I will contact them tomorrow to fine tune the voltages cause I'm not to sure what there to be at.

    Thing is nothings overclocked but I will be contacting them tomorrow to fine tune the timings and voltages cause most mobo's have issues with the memory controller when all slots are occupied

    I have stayed with xp till this date as vista and me do not get along.
    I will get windows 7 when it officially releases... I have tested it though
    on another pc here and enjoyed what I have seen.

    Is there any other things that come to mind?
    Also good thing to note which eluded me was that the sound drivers may be
    the cause. I had noticed it kept trying to reconfigure the sound after it was configured however there seems to be no update to te sound drivers from asus
    since its release.

    the card is ....
    supremefx II audio card - adi 1988b hd audio codec
    whats posted at asus is ...SoundMAX AD1988B Audio Driver V5.10.01.6110 for Windows XP.(WHQL)

    If you could find drivers that released after...2007/09/24 update
    It would be greatly appreciated

    Also as a added note I flashed my bios to the latest release and assured all drivers were up to date as well as all programs.
  10. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    "Thing is nothings overclocked but I will be contacting them tomorrow to fine tune the timings and voltages cause most mobo's have issues with the memory controller when all slots are occupied"...

    I didn't mean to mislead you. I was getting BSOD's before I overclocked. Windows 7 is more sensitive to the overclocked settings. I'm running the CPU at 3.5GHz and the 667MHz memory is running at 870MHz. Vista x64 will allow my CPU to go to 4GHz, but Windows 7 x64 loses stability at 3.6GHz. I raised the RAM voltage from 1.83v to 1.86v. The RAM timings were left at nominal on my Abit IP35 Pro motherboard
  11. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    Good News!

    I spent a lot of time going over every possible thing and discovered the issue.
    It turns out it was due my MP3 player having a autorun.inf worm. Every time it
    was accessed it would try to rewrite a system file to mask itself on my main drives
    however my antivirus and OS would not allow such a task to be preformed resulting
    in a BSOD.

    I would like to thank Tmagic650 as well as Route44 for there help and advice.
    I managed to clean my MP3 player and if the BSOD reoccurs now that my system
    and all my devices are cleaned I shall return to try and figure out what may have
    contributed to the issue(or what the root cause was {god forbid there is one!}).

    -Arthur
     
  12. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Thanks for getting back to us. This is good information to know especially since the issue was something "out of left field" so to speak. What made you to even consider your MP3 and how did you discover the infection?
  13. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    I had to charge my mp3 player while I was in safe mode and my pc alerted me to
    a autorun.inf and a fake system file... once I noticed that autorun.sjl or .inf file
    I did a tad bit of research to review all known issues with said worm.

    I recall a quick dialogue box before one of the crashes stating a change to the
    registry was trying to be attempted and that BSOD was associated with this worm
    along with registry changes. once cleaned I figured it had to be the worm as to
    this point I'm BSOD free.
  14. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    SIGH!
    There back....theres 5 mini dump files below.

    *******************************************************************************
    Bugcheck Analysis
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00b80013, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051ae21, address which referenced memory

    Debugging Details:

    WRITE_ADDRESS: 00b80013
    CURRENT_IRQL: 2
    FAULTING_IP:
    nt!MmCheckCachedPageState+3b1
    8051ae21 ff4310 inc dword ptr [ebx+10h]
    CUSTOMER_CRASH_COUNT: 1
    DEFAULT_BUCKET_ID: DRIVER_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: CCC.exe
    LAST_CONTROL_TRANSFER: from 804e2480 to 8051ae21

    STACK_TEXT:
    92eeb150 804e2480 c1ace000 00000001 92eeb27c nt!MmCheckCachedPageState+0x3b1
    92eeb198 804e3f0a 8ae4ded0 92eeb1d8 00001000 nt!CcMapAndRead+0x86
    92eeb22c 8056a5ab 8ae4d028 92eeb26c 00001000 nt!CcPinFileData+0x204
    92eeb2a0 b9d63bc3 8ae4d028 92eeb2e0 00001000 nt!CcPreparePinWrite+0x93
    92eeb320 b9d63d21 e19f7a90 e1a10df8 00000098 Ntfs!LfsGetLbcb+0x5b
    92eeb334 b9d639a2 e19f7a90 000000c8 e1a10df8 Ntfs!LfsPrepareLfcbForLogRecord+0x4a
    92eeb364 b9d636d6 e19f7a90 e1a10df8 00000003 Ntfs!LfsWriteLogRecordIntoLogPage+0x5c
    92eeb440 b9d631ff e1a10df8 00000003 92eeb500 Ntfs!LfsWrite+0x2f7
    92eeb5c4 b9d6e8a6 886bf008 8ae53c40 8ad645b0 Ntfs!NtfsWriteLog+0x6a2
    92eeb75c b9d6d792 886bf008 e1fa40d0 e2026730 Ntfs!NtfsUpdateFileNameInIndex+0x20f
    92eeb858 b9d6e499 886bf008 e2026480 e20266e0 Ntfs!NtfsUpdateDuplicateInfo+0x2ab
    92eeb8bc b9d76fa8 886bf008 e2026480 e20266a0 Ntfs!NtfsUpdateFileDupInfo+0xf0
    92eeb8f0 b9d6dc33 886bf008 8a83b498 8864f008 Ntfs!NtfsSetBasicInfo+0x33f
    92eeb95c b9d45b3b 886bf008 8864f008 8864f008 Ntfs!NtfsCommonSetInformation+0x44a
    92eeb9c4 804ef19f 8adf9020 8864f008 8864f198 Ntfs!NtfsFsdSetInformation+0xa3
    92eeb9d4 b9df3f45 00000000 8ada6640 8a83d328 nt!IopfCallDriver+0x31
    92eeb9e8 804ef19f 8adf70d8 8864f008 8864f008 sr!SrSetInformation+0x179
    92eeb9f8 b9dfbe9b 00000000 8a83d384 00000000 nt!IopfCallDriver+0x31
    92eeba1c b9dfc9e5 92eeba3c 8aa72610 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
    92eeba54 b9e0b70c 8a9cf008 92eebb90 e4034558 fltmgr!FltPerformSynchronousIo+0xb9
    92eeba74 9d2b3ca4 8a9cf008 8a83b498 92eeba9c fltmgr!FltSetInformationFile+0x70
    WARNING: Stack unwind information not available. Following frames may be wrong.
    92eebae4 9d2b3fdc e13e4034 00000002 92eebb90 avgntflt+0x4ca4
    92eebb2c b9dff442 8a15c14c 92eebb90 00000000 avgntflt+0x4fdc
    92eebb4c 9d2bdfeb 8a15c14c 92eebb90 00000000 fltmgr!FltDoCompletionProcessingWhenSafe+0x78
    92eebb6c b9df8ef3 8a15c14c 92eebb90 00000000 avgntflt+0xefeb
    92eebbd4 b9dfb338 0015c0f0 00000000 8a15c0f0 fltmgr!FltpPerformPostCallbacks+0x1c5
    92eebbe8 b9dfb867 8a15c0f0 89f6b008 92eebc28 fltmgr!FltpProcessIoCompletion+0x10
    92eebbf8 b9dfbef9 8aa72610 89f6b008 8a15c0f0 fltmgr!FltpPassThroughCompletion+0x89
    92eebc28 b9dfc06b 92eebc48 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x269
    92eebc60 804ef19f 8aa72610 89f6b008 89f6b008 fltmgr!FltpDispatch+0x11f
    92eebc70 80583953 8a83b480 00000000 8af1b040 nt!IopfCallDriver+0x31
    92eebca0 805bca16 8a9b4da0 8aa72610 00120196 nt!IopCloseFile+0x26b
    92eebcd4 805bc33f 8a9b4da0 00000001 8af1b040 nt!ObpDecrementHandleCount+0xd8
    92eebcfc 805bc3dd e36f7470 8a83b498 00000a50 nt!ObpCloseHandleTableEntry+0x14d
    92eebd44 805bc515 00000a50 00000001 00000000 nt!ObpCloseHandle+0x87
    92eebd58 8054162c 00000a50 06d1e69c 7c90e514 nt!NtClose+0x1d
    92eebd58 7c90e514 00000a50 06d1e69c 7c90e514 nt!KiFastCallEntry+0xfc
    06d1e69c 00000000 00000000 00000000 00000000 0x7c90e514


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    avgntflt+4ca4
    9d2b3ca4 ?? ???

    SYMBOL_STACK_INDEX: 15
    SYMBOL_NAME: avgntflt+4ca4
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: avgntflt
    IMAGE_NAME: avgntflt.sys
    DEBUG_FLR_IMAGE_TIMESTAMP: 4a434fc9
    FAILURE_BUCKET_ID: 0xA_W_avgntflt+4ca4
    BUCKET_ID: 0xA_W_avgntflt+4ca4
    Followup: MachineOwner

    *******************************************************************************
    Bugcheck Analysis
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051b45a, address which referenced memory

    Debugging Details:
    ------------------

    READ_ADDRESS: 00000000
    CURRENT_IRQL: 2
    FAULTING_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx

    CUSTOMER_CRASH_COUNT: 2
    DEFAULT_BUCKET_ID: DRIVER_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: System
    LAST_CONTROL_TRANSFER: from 8056a9cc to 8051b45a

    STACK_TEXT:
    ba4f3c64 8056a9cc e0c2a000 00148e40 00000000 nt!MmUnmapViewInSystemCache+0x2fc
    ba4f3c7c 804e8239 8aee0bb8 8a89cad8 00000000 nt!CcUnmapVacb+0x2a
    ba4f3cb0 804e5246 00000000 00000000 8a89cb3c nt!CcUnmapVacbArray+0x117
    ba4f3ccc 804e5501 8a89cad8 806e6a4c 8a89cad8 nt!CcUnmapAndPurge+0x20
    ba4f3cfc 804e4b03 00000001 80559690 8ad2baf0 nt!CcDeleteSharedCacheMap+0xc5
    ba4f3d34 804e70db 8af42d90 80564820 8aef7698 nt!CcWriteBehind+0x357
    ba4f3d7c 8053877d 8af42d90 00000000 8aef7698 nt!CcWorkerThread+0x12f
    ba4f3dac 805cff70 8af42d90 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4f3ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: nt!MmUnmapViewInSystemCache+2fc
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
    IMAGE_NAME: memory_corruption
    FAILURE_BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    Followup: MachineOwner
    *******************************************************************************
    * Bugcheck Analysis *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {0, 2, 0, 8051b45a}

    Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+2fc )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * Bugcheck Analysis *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000000, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051b45a, address which referenced memory

    Debugging Details:
    ------------------

    READ_ADDRESS: 00000000
    CURRENT_IRQL: 2
    FAULTING_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx
    CUSTOMER_CRASH_COUNT: 3
    DEFAULT_BUCKET_ID: DRIVER_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: System
    LAST_CONTROL_TRANSFER: from 8056a9cc to 8051b45a
  15. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    STACK_TEXT:
    ba4f7a80 8056a9cc c1ccf000 00fb32f0 00000000 nt!MmUnmapViewInSystemCache+0x2fc
    ba4f7a98 804e8239 8aee1de0 8aa2eed0 00000000 nt!CcUnmapVacb+0x2a
    ba4f7acc 804e5246 00000000 00000000 8aa2ef34 nt!CcUnmapVacbArray+0x117
    ba4f7ae8 804e5501 8aa2eed0 8a8eaf90 8aa2eed0 nt!CcUnmapAndPurge+0x20
    ba4f7b18 804e5c61 00000000 e2ea0a50 8a8eaf90 nt!CcDeleteSharedCacheMap+0xc5
    ba4f7b34 b9d6be35 00000000 00000000 00000000 nt!CcUninitializeCacheMap+0x12d
    ba4f7b58 b9d69e1b e2ea0a50 00000000 00000000 Ntfs!NtfsDeleteInternalAttributeStream+0x98
    ba4f7b74 b9d447f4 8a8e8b48 e2ea0a50 00000000 Ntfs!NtfsRemoveScb+0x77
    ba4f7b90 b9d48718 8a8e8b48 e2ea0988 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
    ba4f7be0 b9d69e7c 8a8e8b48 8ae4f100 e3055008 Ntfs!NtfsTeardownFromLcb+0x2bc
    ba4f7c38 b9d447a4 8a8e8b48 e30550d0 00000000 Ntfs!NtfsTeardownStructures+0x125
    ba4f7c64 b9d676b5 8a8e8b48 010550d0 00000000 Ntfs!NtfsDecrementCloseCounts+0x9e
    ba4f7ce8 b9d6c5e3 8a8e8b48 e30550d0 e3055008 Ntfs!NtfsCommonClose+0x398
    ba4f7d7c 8053877d 00000000 00000000 8aef7420 Ntfs!NtfsFspClose+0xe3
    ba4f7dac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4f7ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: nt!MmUnmapViewInSystemCache+2fc
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
    IMAGE_NAME: memory_corruption
    FAILURE_BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    Followup: MachineOwner
    2: kd> !analyze -v
    *******************************************************************************
    * Bugcheck Analysis *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e18dc000, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 80638a0e, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000001, (reserved)

    Debugging Details:
    ------------------

    Could not read faulting driver name
    WRITE_ADDRESS: e18dc000
    FAULTING_IP:
    nt!CmpCopyCell+72
    80638a0e f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
    MM_INTERNAL_CODE: 1
    CUSTOMER_CRASH_COUNT: 4
    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
    BUGCHECK_STR: 0x50
    PROCESS_NAME: services.exe
    LAST_CONTROL_TRANSFER: from 80638d9e to 80638a0e

    STACK_TEXT:
    9ea83a70 80638d9e 00894020 0060f7f8 e1025758 nt!CmpCopyCell+0x72
    9ea83aa4 8063918e 00025758 0062f7d0 00085a00 nt!CmpCopyValue+0xc0
    9ea83ae8 806397f8 e1025758 00662b10 cdca3b14 nt!CmpSyncKeyValues+0x1fa
    9ea83b2c 8063996b e120e000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
    9ea83b5c 8062606c e1025758 004c8a98 e1025758 nt!CmpCopySyncTree+0x4f
    9ea83ccc 80621964 00010004 9ea83d64 9ea83ce8 nt!CmpSaveBootControlSet+0x2b0
    9ea83cdc 8054162c 00000006 9ea83d64 8050047d nt!NtInitializeRegistry+0x5e
    9ea83cdc 8050047d 00000006 9ea83d64 8050047d nt!KiFastCallEntry+0xfc
    9ea83d58 8054162c 00000006 0007fe8c 7c90e514 nt!ZwInitializeRegistry+0x11
    9ea83d58 7c90e514 00000006 0007fe8c 7c90e514 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0007fe8c 00000000 00000000 00000000 00000000 0x7c90e514

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!CmpCopyCell+72
    80638a0e f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: nt!CmpCopyCell+72
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME: ntkrpamp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
    FAILURE_BUCKET_ID: 0x50_W_nt!CmpCopyCell+72
    BUCKET_ID: 0x50_W_nt!CmpCopyCell+72
    Followup: MachineOwner

    *******************************************************************************
    * Bugcheck Analysis *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 412e3230, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051b45a, address which referenced memory

    Debugging Details:
    ------------------

    READ_ADDRESS: 412e3230
    CURRENT_IRQL: 2
    FAULTING_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx
    CUSTOMER_CRASH_COUNT: 5
    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
    BUGCHECK_STR: 0xA
    PROCESS_NAME: System
    LAST_CONTROL_TRANSFER: from 8056a9cc to 8051b45a

    STACK_TEXT:
    ba4f3a80 8056a9cc c1c2a000 000479e0 00000000 nt!MmUnmapViewInSystemCache+0x2fc
    ba4f3a98 804e8239 8aee1e28 8a91bcf0 00000000 nt!CcUnmapVacb+0x2a
    ba4f3acc 804e5246 00000000 00000000 8a91bd54 nt!CcUnmapVacbArray+0x117
    ba4f3ae8 804e5501 8a91bcf0 8a888f60 8a91bcf0 nt!CcUnmapAndPurge+0x20
    ba4f3b18 804e5c61 00000000 e304ed20 8a888f60 nt!CcDeleteSharedCacheMap+0xc5
    ba4f3b34 b9d6be35 00000000 00000000 00000000 nt!CcUninitializeCacheMap+0x12d
    ba4f3b58 b9d69e1b e304ed20 00000000 00000000 Ntfs!NtfsDeleteInternalAttributeStream+0x98
    ba4f3b74 b9d447f4 8a883950 e304ed20 00000000 Ntfs!NtfsRemoveScb+0x77
    ba4f3b90 b9d48718 8a883950 e304ec58 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
    ba4f3be0 b9d69e7c 8a883950 8adc8440 e2fb3840 Ntfs!NtfsTeardownFromLcb+0x2bc
    ba4f3c38 b9d447a4 8a883950 e2fb3908 00000000 Ntfs!NtfsTeardownStructures+0x125
    ba4f3c64 b9d676b5 8a883950 01fb3908 00000000 Ntfs!NtfsDecrementCloseCounts+0x9e
    ba4f3ce8 b9d6c5e3 8a883950 e2fb3908 e2fb3840 Ntfs!NtfsCommonClose+0x398
    ba4f3d7c 8053877d 00000000 00000000 8aef7698 Ntfs!NtfsFspClose+0xe3
    ba4f3dac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
    ba4f3ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

    STACK_COMMAND: kb
    FOLLOWUP_IP:
    nt!MmUnmapViewInSystemCache+2fc
    8051b45a 3908 cmp dword ptr [eax],ecx
    SYMBOL_STACK_INDEX: 0
    SYMBOL_NAME: nt!MmUnmapViewInSystemCache+2fc
    FOLLOWUP_NAME: MachineOwner
    MODULE_NAME: nt
    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3
    IMAGE_NAME: memory_corruption
    FAILURE_BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    BUCKET_ID: 0xA_nt!MmUnmapViewInSystemCache+2fc
    Followup: MachineOwner
  16. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    That's not the proper way to post dump files. Read this:
    Before Posting Minidumps

    Have you checked your system for a virus or other malware infection?
  17. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    The attach icon would not work for me so I had to do it this way.

    I'm 100% positive theres no infection on my pc.
  18. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    After 10 posts you should be able to post minidumps properly... Check your hard drive for errors by going to My Computer, and right-clicking on the C drive. Select Tools, and schedule a disk check on reboot. If the drive is ok, replace the system memory
     
  19. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    This here is my 10th post actually and
    I have done a full scan of both hard drives. I have tried swapping the memory still no change. Could it be the memory controller on the mobo? How could I test for that?
  20. Tmagic650

    Tmagic650 TS Ambassador Posts: 20,673   +152

    You might benefit from reinstalling the motherboard chipset drivers
  21. arthurduplessis

    arthurduplessis Newcomer, in training Topic Starter Posts: 32

    I just reinstall chipset drivers for the mobo and the gfx card...
    remove the logitech g15 software. along with some random apps
    I don't use any more,did a clean up of all temp files and frag both
    drives...god the terabyte drive took forever.

    I manually set all the bios voltages and settings so its all to the correct
    timings or underclocked to prevent stress to the mobo.

    did disk scans and spent 2 days cycling through diffent anti virus's,spyware
    malware,wurm removal programs. reinstalled a lot of software to insure no glitches

    I'm stable now for about a day will post again if another bsod happens
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.