Takin_a_Dump
Posts: 6 +0
I decrypted 5 minidumps, but I can't see what is the cause of my BSOD's.
My computer will just take a dump every now and then, and its really annoying.
Can someone tell me what's causing this?
5 Decrypted Minidumps attached.
Here's the top of one of them.
Opened log file 'c:\mini2.txt'
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804f7ba8, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for SiWinAcc.sys
*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
WRITE_ADDRESS: 00000004
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeQuerySystemTime+e
804f7ba8 894804 mov dword ptr [eax+4],ecx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
and another one
Opened log file 'c:\mini5.txt'
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffc, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: b3fd0447, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: fffffffc
FAULTING_IP:
Fastfat!FatDeferredCleanVolume+fc
b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
TRAP_FRAME: bacffca0 -- (.trap ffffffffbacffca0)
.trap ffffffffbacffca0
ErrCode = 00000002
eax=bacffd50 ebx=00000000 ecx=00000000 edx=00000000 esi=890f1d28 edi=00000000
eip=b3fd0447 esp=bacffd14 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Fastfat!FatDeferredCleanVolume+0xfc:
b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh ss:0010:fffffffc=????????
.trap
Resetting default scope
LAST_CONTROL_TRANSFER: from 8051f478 to 804f9c37
Then you can see the rest of them in the attachments.
Thanks
My computer will just take a dump every now and then, and its really annoying.
Can someone tell me what's causing this?
5 Decrypted Minidumps attached.
Here's the top of one of them.
Opened log file 'c:\mini2.txt'
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804f7ba8, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for SiWinAcc.sys
*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
WRITE_ADDRESS: 00000004
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeQuerySystemTime+e
804f7ba8 894804 mov dword ptr [eax+4],ecx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
and another one
Opened log file 'c:\mini5.txt'
3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffc, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: b3fd0447, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: fffffffc
FAULTING_IP:
Fastfat!FatDeferredCleanVolume+fc
b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
TRAP_FRAME: bacffca0 -- (.trap ffffffffbacffca0)
.trap ffffffffbacffca0
ErrCode = 00000002
eax=bacffd50 ebx=00000000 ecx=00000000 edx=00000000 esi=890f1d28 edi=00000000
eip=b3fd0447 esp=bacffd14 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
Fastfat!FatDeferredCleanVolume+0xfc:
b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh ss:0010:fffffffc=????????
.trap
Resetting default scope
LAST_CONTROL_TRANSFER: from 8051f478 to 804f9c37
Then you can see the rest of them in the attachments.
Thanks