BSOD Acer Aspire 8951g - Windows 7 x64

inzo · May 17, 2015

I am terrible typist so will keep this short. BSOD's started a week or so ago. For no particular reason . Was doing various different things when it happened . Sometimes a couple of times a day. Particularly bad last Wednesday while trying to install Windows updates. Tried some online advice and was finally able to install the updates, but BSOD keeps coming back. Verifier ALWAYS get BSOD. Have a couple of minidumps but not when verifier running since it won't work.
Any help would be greatly appreciated

OS - Windows 8.1, 8, 7, Vista ? WIN 7 1
· x86 (32-bit) or x64 ? x64
· What was original installed OS on system? Win 7.1
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? OEM
· Age of system (hardware) 4 Yrs?
· Age of OS installation - have you re-installed the OS? No reinstall

· CPU
· Video Card Nvidia Geoforce
· MotherBoard - (if NOT a laptop)
· Power Supply - brand & wattage (if laptop, skip this one)

· System Manufacturer Acer
· Exact model number (if laptop, check label on bottom) Aspire 8951G- 9630

· Laptop or Desktop? Laptop

Patrick · May 17, 2015

No dumps in your output folder.

Check C:\Windows\Minidumps, are there any?

inzo · May 17, 2015

Patrick said:
No dumps in your output folder.

Check C:\Windows\Minidumps, are there any?

Looked all over and they are gone they were there earlier, but seem to have disappeared. I Looked at them with bluescreenview 64 and I think it saved them as a text file. See attached

Thank you

Patrick · May 17, 2015

Remove avast!.

inzo · May 17, 2015

Why? I've used it for many years with no problem. What is it doing?

Patrick · May 17, 2015

Causing your blue screens. Without a dump I can't tell you why, but it is.

inzo · May 17, 2015

OK, I'll try it and will post a dump next time I get the BSOD. If I don't get one I guess I'm good to go. Give it a couple of days before closing this thread out OK?

Thanks

Patrick · May 17, 2015

You got it.

inzo · May 18, 2015

Have tried verified numerous time and it always gives me a BSOD. I am attaching the mini dumps for the last tries. I tried to narrow the culprit but I don't think it worked.

When I got to the point where I was to check all the drivers except microsoft, I alphabetized them and checked only the unknown manufacturer drivers and sure enough got the BSOD. Next I just checked the drivers from the A companies (Acronis, Adobe etc.) the ones that caused the first BSOD were NOT checked this time, but still got a BSOD
I have attached them as a text file from Bluescreenview. This is Two seperate minidumps combined. I can't seem to get permission to attache them directly from the minidump folder.I am the owner it seems but they still won't let me do anything with them

x BlueRobot · May 18, 2015

Have you tried following the BSOD Posting Instructions again like you previously did in your original post?

Patrick · May 18, 2015

Have tried verified numerous time and it always gives me a BSOD.

Have tried what?

inzo · May 18, 2015

when I run verified.exe

that was a mistake was supposed to be part of the longer post with the txt minidump results. my error. Will go back to beginning and try following directions. That will be novel for me. Hope I am not too confusing. Wife says I am, guess it must be so.

Sorry and thanks for your patience

inzo · May 18, 2015

here are the mini dumps for the last 5 times. finally figured out how to take ownership Two are from crashed verified.exe attempts two from regular BSOD events and latest one a forced BSOD . Hope these help

Jared · May 19, 2015

Code:

0: kd> .bugcheck
Bugcheck code 000000D1
Arguments fffff8a0`157d5010 00000000`00000002 00000000`00000000 fffff880`1f641385

0: kd> k
Child-SP          RetAddr           Call Site
fffff880`219af448 fffff800`0447fe69 nt!KeBugCheckEx
fffff880`219af450 fffff800`0447eae0 nt!KiBugCheckDispatch+0x69
fffff880`219af590 fffff880`1f641385 nt!KiPageFault+0x260
fffff880`219af720 00000000`00000000 myfault+0x1385

NotMyFault is not a solution to any BSOD problem, it simply creates one on demand.
Don't use it unless you have a good reason.

Code:

6: kd> .bugcheck
Bugcheck code 0000000A
Arguments fffff8a0`00242068 00000000`00000002 00000000`00000001 fffff800`0388e2bc

6: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`043a79c8 fffff800`03885e69 : 00000000`0000000a fffff8a0`00242068 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`043a79d0 fffff800`03884ae0 : fffffa80`08f31e40 fffff800`039bdd1e 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`043a7b10 fffff800`0388e2bc : fffff980`0323eab0 fffff980`03b3efb0 00000000`000000ff 00000000`00000000 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`043a7b10)
fffff880`043a7ca0 fffff880`01e6b103 : fffff880`03717100 fffff800`00000000 fffffa80`0f1ab600 fffffa80`0f1ab600 : nt!KeWaitForSingleObject+0x13c
fffff880`043a7d40 fffff880`03717100 : fffff800`00000000 fffffa80`0f1ab600 fffffa80`0f1ab600 00000000`00000000 : GUBootStartup+0x1103
fffff880`043a7d48 fffff800`00000000 : fffffa80`0f1ab600 fffffa80`0f1ab600 00000000`00000000 fffffa80`0f1ab6f0 : 0xfffff880`03717100
fffff880`043a7d50 fffffa80`0f1ab600 : fffffa80`0f1ab600 00000000`00000000 fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 : 0xfffff800`00000000
fffff880`043a7d58 fffffa80`0f1ab600 : 00000000`00000000 fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 fffffa80`0f1ab1e0 : 0xfffffa80`0f1ab600
fffff880`043a7d60 00000000`00000000 : fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 fffffa80`0f1ab1e0 fffff880`043a7e40 : 0xfffffa80`0f1ab600

6: kd> .trap fffff880`043a7b10
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000024d rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000388e2bc rsp=fffff880043a7ca0 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff88003717180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x13c:
fffff800`0388e2bc f00fba2e07      lock bts dword ptr [rsi],7 ds:00000000`00000000=????????

The GlarySoft Glary Utilities Startup Manager Tool driver is referencing pageable or invalid memory at an IRQL > 2.
It performed a bit test operation while holding a lock with exclusive access, then the pointer passed was bad, which is why it performed an illegal operation.

Code:

4: kd> .bugcheck
Bugcheck code 000000C9
Arguments 00000000`00000224 fffff800`03d2e520 fffff980`063b2ab0 00000000`00000000

//IRP StatusIO field was different to what the IRP dispatch handler returned

4: kd> k
Child-SP          RetAddr           Call Site
fffff880`03962218 fffff800`03d0f4ec nt!KeBugCheckEx
fffff880`03962220 fffff800`03d195aa nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`03962260 fffff800`03d1a523 nt!ViErrorFinishReport+0xda
fffff880`039622b0 fffff800`03d25889 nt!VfErrorReport4+0x83
fffff880`039623a0 fffff800`03d25c93 nt!IovpCallDriver2+0x179
fffff880`03962400 fffff800`03d2bd5e nt!VfAfterCallDriver+0x353
fffff880`03962450 fffff880`01df26da nt!IovCallDriver+0x57e
fffff880`039624b0 fffff980`063b2f28 ambakdrv+0x16da
fffff880`039624b8 00000000`00000002 0xfffff980`063b2f28
fffff880`039624c0 fffff980`063b2ab0 0x2
fffff880`039624c8 fffffa80`095f88b0 0xfffff980`063b2ab0
fffff880`039624d0 fffff980`063b2fb8 0xfffffa80`095f88b0
fffff880`039624d8 00000000`00000000 0xfffff980`063b2fb8

4: kd> !irp fffff980063b2ab0 1
Irp is active with 16 stacks 15 is current (= 0xfffff980063b2f70)
 No Mdl: No System Buffer: Thread fffffa8007379040:  Irp stack trace.  
Flags = 40000000
ThreadListEntry.Flink = fffff980063b2ad0
ThreadListEntry.Blink = fffff980063b2ad0
IoStatus.Status = 00000001 //Status is 1, the expected status was 0
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = fffff980063b2b28
Tail.Overlay.Thread = fffffa8007379040
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = fffff980063b2f70
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0 10 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f17ccd0 00000000 fffff800038c4740-fffff88003961e70    
	      fffffa800f17ccd0: Could not read device object or _DEVICE_OBJECT not found
	nt!PnpCompletionRoutine
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f129040 00000000 fffff80003d11650-00000000    
	      fffffa800f129040: Could not read device object or _DEVICE_OBJECT not found
	nt!ViFilterStartCompletionRoutine
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f10c040 00000000 fffff88001df24d4-fffff880039624e0    
	      fffffa800f10c040: Could not read device object or _DEVICE_OBJECT not found
	ambakdrv
			Args: 00000000 00000000 00000000 00000000
>[ 1b, 0]   0 e0 fffffa800f165420 00000000 fffff80003d11650-00000000 Success Error Cancel 
	      fffffa800f165420: Could not read device object or _DEVICE_OBJECT not found
	nt!ViFilterStartCompletionRoutine //Driver verifier hooked function performing checks, which failed.
			Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 e0 fffffa800f12e040 00000000 fffff80003979320-fffffa80091f5690 Success Error Cancel 
	      fffffa800f12e040: Could not read device object or _DEVICE_OBJECT not found
	nt!PnpDeviceCompletionRoutine
			Args: 00000000 00000000 00000000 00000000

4: kd> !address fffff80003d2e520


Usage:                  
Base Address:           fffff800`03ab7278
End Address:            fffff800`03ab7277
Region Size:            ffffffff`ffffffff
VA Type:                PFNDatabase //Private address
VAD Address:            0x0
Commit Charge:          0x100000002
Protection:             0x7fee123ff88 []
Memory Usage:           Private
No Change:              yes
More info:              !vad 0xfffff80003ab7278

Aomei BackUpper driver is causing the issues, passing bad information through IRPs.
Remove it.

Code:

4: kd> .bugcheck
Bugcheck code 1000007E
Arguments ffffffff`c0000005 fffff880`0175aa1d fffff880`04293d38 fffff880`04293590

4: kd> k
Child-SP          RetAddr           Call Site
fffff880`04293f70 fffff880`017640d4 NETIO!CalloutStreamDataInit+0x1d
fffff880`04293fb0 fffff880`0176fe98 NETIO!StreamInvokeCalloutAndNormalizeAction+0x54
fffff880`04294050 fffff880`01770e91 NETIO!StreamCalloutProcessData+0x48
fffff880`042940a0 fffff880`01771ee8 NETIO!StreamCalloutProcessingLoop+0xa1
fffff880`04294130 fffff880`01752a2a NETIO!StreamProcessCallout+0x1e8
fffff880`04294220 fffff880`01739f58 NETIO! ?? ::FNODOBFM::`string'+0x71f2
fffff880`04294340 fffff880`0173b5d2 NETIO!ArbitrateAndEnforce+0x238
fffff880`04294410 fffff880`017743b3 NETIO!KfdClassify+0x934
fffff880`04294780 fffff880`0177499a NETIO!StreamInternalClassify+0xf3
fffff880`04294850 fffff880`01774d8e NETIO!StreamInject+0x1ca
fffff880`04294920 fffff880`01209df3 NETIO!FwppStreamInject+0x12e
fffff880`042949b0 fffff880`048f591f fwpkclnt!FwpsStreamInjectAsync0+0xcf
fffff880`04294a10 fffffa80`16b22010 vsdatant+0xc91f //Zone alarm driver
fffff880`04294a18 00000000`000005b4 0xfffffa80`16b22010
fffff880`04294a20 fffffa80`080d2420 0x5b4
fffff880`04294a28 00000000`00000000 0xfffffa80`080d2420

4: kd> lmvm vsdatant
start             end                 module name
fffff880`048e9000 fffff880`0497d000   vsdatant T (no symbols)           
    Loaded symbol image file: vsdatant.sys
    Image path: vsdatant.sys
    Image name: vsdatant.sys
    Timestamp:        Wed Mar 26 12:08:34 2014 (5332C342)
    CheckSum:         00078110
    ImageSize:        00094000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The Zone Alarm driver is passing null pointers, remove it.

Code:

0: kd> .bugcheck
Bugcheck code 0000007F
Arguments 00000000`00000008 00000000`80050033 00000000`000406f8 fffff880`06bcf436

0: kd> k
Child-SP          RetAddr           Call Site
fffff800`00ba2d28 fffff800`036dbe69 nt!KeBugCheckEx
fffff800`00ba2d30 fffff800`036da332 nt!KiBugCheckDispatch+0x69
fffff800`00ba2e70 fffff880`06bcf436 nt!KiDoubleFaultAbort+0xb2
fffff880`1f7c9fa0 00000000`00000000 igdkmd64+0x175436

0: kd> lmvm igdkmd64
start             end                 module name
fffff880`06a5a000 fffff880`06f77c20   igdkmd64 T (no symbols)           
    Loaded symbol image file: igdkmd64.sys
    Image path: igdkmd64.sys
    Image name: igdkmd64.sys
    Timestamp:        Mon Jan 19 22:27:59 2015 (54BD84EF)
    CheckSum:         0052A1FE
    ImageSize:        0051DC20
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

There's not much to go on regarding double fault errors because the context for the previous exception was lost during the minidump save, meaning the second exception might not have been the cause.
Either way, I recommend updating your display driver.

inzo · May 19, 2015

Jared said:

Code:

0: kd> .bugcheck
Bugcheck code 000000D1
Arguments fffff8a0`157d5010 00000000`00000002 00000000`00000000 fffff880`1f641385

0: kd> k
Child-SP          RetAddr           Call Site
fffff880`219af448 fffff800`0447fe69 nt!KeBugCheckEx
fffff880`219af450 fffff800`0447eae0 nt!KiBugCheckDispatch+0x69
fffff880`219af590 fffff880`1f641385 nt!KiPageFault+0x260
fffff880`219af720 00000000`00000000 myfault+0x1385

NotMyFault is not a solution to any BSOD problem, it simply creates one on demand.
Don't use it unless you have a good reason.

I won't use it again unless directed by competent people .

Code:

6: kd> .bugcheck
Bugcheck code 0000000A
Arguments fffff8a0`00242068 00000000`00000002 00000000`00000001 fffff800`0388e2bc

6: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`043a79c8 fffff800`03885e69 : 00000000`0000000a fffff8a0`00242068 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`043a79d0 fffff800`03884ae0 : fffffa80`08f31e40 fffff800`039bdd1e 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`043a7b10 fffff800`0388e2bc : fffff980`0323eab0 fffff980`03b3efb0 00000000`000000ff 00000000`00000000 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`043a7b10)
fffff880`043a7ca0 fffff880`01e6b103 : fffff880`03717100 fffff800`00000000 fffffa80`0f1ab600 fffffa80`0f1ab600 : nt!KeWaitForSingleObject+0x13c
fffff880`043a7d40 fffff880`03717100 : fffff800`00000000 fffffa80`0f1ab600 fffffa80`0f1ab600 00000000`00000000 : GUBootStartup+0x1103
fffff880`043a7d48 fffff800`00000000 : fffffa80`0f1ab600 fffffa80`0f1ab600 00000000`00000000 fffffa80`0f1ab6f0 : 0xfffff880`03717100
fffff880`043a7d50 fffffa80`0f1ab600 : fffffa80`0f1ab600 00000000`00000000 fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 : 0xfffff800`00000000
fffff880`043a7d58 fffffa80`0f1ab600 : 00000000`00000000 fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 fffffa80`0f1ab1e0 : 0xfffffa80`0f1ab600
fffff880`043a7d60 00000000`00000000 : fffffa80`0f1ab6f0 fffffa80`0f1ab6f0 fffffa80`0f1ab1e0 fffff880`043a7e40 : 0xfffffa80`0f1ab600

6: kd> .trap fffff880`043a7b10
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000024d rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000388e2bc rsp=fffff880043a7ca0 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff88003717180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x13c:
fffff800`0388e2bc f00fba2e07      lock bts dword ptr [rsi],7 ds:00000000`00000000=????????

The GlarySoft Glary Utilities Startup Manager Tool driver is referencing pageable or invalid memory at an IRQL > 2.
It performed a bit test operation while holding a lock with exclusive access, then the pointer passed was bad, which is why it performed an illegal operation.

GONE

Code:

4: kd> .bugcheck
Bugcheck code 000000C9
Arguments 00000000`00000224 fffff800`03d2e520 fffff980`063b2ab0 00000000`00000000

//IRP StatusIO field was different to what the IRP dispatch handler returned

4: kd> k
Child-SP          RetAddr           Call Site
fffff880`03962218 fffff800`03d0f4ec nt!KeBugCheckEx
fffff880`03962220 fffff800`03d195aa nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`03962260 fffff800`03d1a523 nt!ViErrorFinishReport+0xda
fffff880`039622b0 fffff800`03d25889 nt!VfErrorReport4+0x83
fffff880`039623a0 fffff800`03d25c93 nt!IovpCallDriver2+0x179
fffff880`03962400 fffff800`03d2bd5e nt!VfAfterCallDriver+0x353
fffff880`03962450 fffff880`01df26da nt!IovCallDriver+0x57e
fffff880`039624b0 fffff980`063b2f28 ambakdrv+0x16da
fffff880`039624b8 00000000`00000002 0xfffff980`063b2f28
fffff880`039624c0 fffff980`063b2ab0 0x2
fffff880`039624c8 fffffa80`095f88b0 0xfffff980`063b2ab0
fffff880`039624d0 fffff980`063b2fb8 0xfffffa80`095f88b0
fffff880`039624d8 00000000`00000000 0xfffff980`063b2fb8

4: kd> !irp fffff980063b2ab0 1
Irp is active with 16 stacks 15 is current (= 0xfffff980063b2f70)
 No Mdl: No System Buffer: Thread fffffa8007379040:  Irp stack trace.  
Flags = 40000000
ThreadListEntry.Flink = fffff980063b2ad0
ThreadListEntry.Blink = fffff980063b2ad0
IoStatus.Status = 00000001 //Status is 1, the expected status was 0
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = 00000000
UserEvent = 00000000
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000   
UserBuffer = 00000000
&Tail.Overlay.DeviceQueueEntry = fffff980063b2b28
Tail.Overlay.Thread = fffffa8007379040
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = fffff980063b2f70
Tail.Overlay.OriginalFileObject = 00000000
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0 10 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f17ccd0 00000000 fffff800038c4740-fffff88003961e70    
          fffffa800f17ccd0: Could not read device object or _DEVICE_OBJECT not found
    nt!PnpCompletionRoutine
            Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f129040 00000000 fffff80003d11650-00000000    
          fffffa800f129040: Could not read device object or _DEVICE_OBJECT not found
    nt!ViFilterStartCompletionRoutine
            Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 10 fffffa800f10c040 00000000 fffff88001df24d4-fffff880039624e0    
          fffffa800f10c040: Could not read device object or _DEVICE_OBJECT not found
    ambakdrv
            Args: 00000000 00000000 00000000 00000000
>[ 1b, 0]   0 e0 fffffa800f165420 00000000 fffff80003d11650-00000000 Success Error Cancel 
          fffffa800f165420: Could not read device object or _DEVICE_OBJECT not found
    nt!ViFilterStartCompletionRoutine //Driver verifier hooked function performing checks, which failed.
            Args: 00000000 00000000 00000000 00000000
 [ 1b, 0]   0 e0 fffffa800f12e040 00000000 fffff80003979320-fffffa80091f5690 Success Error Cancel 
          fffffa800f12e040: Could not read device object or _DEVICE_OBJECT not found
    nt!PnpDeviceCompletionRoutine
            Args: 00000000 00000000 00000000 00000000

4: kd> !address fffff80003d2e520


Usage:                  
Base Address:           fffff800`03ab7278
End Address:            fffff800`03ab7277
Region Size:            ffffffff`ffffffff
VA Type:                PFNDatabase //Private address
VAD Address:            0x0
Commit Charge:          0x100000002
Protection:             0x7fee123ff88 []
Memory Usage:           Private
No Change:              yes
More info:              !vad 0xfffff80003ab7278

Aomei BackUpper driver is causing the issues, passing bad information through IRPs.
Remove it.

DONE

Code:

4: kd> .bugcheck
Bugcheck code 1000007E
Arguments ffffffff`c0000005 fffff880`0175aa1d fffff880`04293d38 fffff880`04293590

4: kd> k
Child-SP          RetAddr           Call Site
fffff880`04293f70 fffff880`017640d4 NETIO!CalloutStreamDataInit+0x1d
fffff880`04293fb0 fffff880`0176fe98 NETIO!StreamInvokeCalloutAndNormalizeAction+0x54
fffff880`04294050 fffff880`01770e91 NETIO!StreamCalloutProcessData+0x48
fffff880`042940a0 fffff880`01771ee8 NETIO!StreamCalloutProcessingLoop+0xa1
fffff880`04294130 fffff880`01752a2a NETIO!StreamProcessCallout+0x1e8
fffff880`04294220 fffff880`01739f58 NETIO! ?? ::FNODOBFM::`string'+0x71f2
fffff880`04294340 fffff880`0173b5d2 NETIO!ArbitrateAndEnforce+0x238
fffff880`04294410 fffff880`017743b3 NETIO!KfdClassify+0x934
fffff880`04294780 fffff880`0177499a NETIO!StreamInternalClassify+0xf3
fffff880`04294850 fffff880`01774d8e NETIO!StreamInject+0x1ca
fffff880`04294920 fffff880`01209df3 NETIO!FwppStreamInject+0x12e
fffff880`042949b0 fffff880`048f591f fwpkclnt!FwpsStreamInjectAsync0+0xcf
fffff880`04294a10 fffffa80`16b22010 vsdatant+0xc91f //Zone alarm driver
fffff880`04294a18 00000000`000005b4 0xfffffa80`16b22010
fffff880`04294a20 fffffa80`080d2420 0x5b4
fffff880`04294a28 00000000`00000000 0xfffffa80`080d2420

4: kd> lmvm vsdatant
start             end                 module name
fffff880`048e9000 fffff880`0497d000   vsdatant T (no symbols)           
    Loaded symbol image file: vsdatant.sys
    Image path: vsdatant.sys
    Image name: vsdatant.sys
    Timestamp:        Wed Mar 26 12:08:34 2014 (5332C342)
    CheckSum:         00078110
    ImageSize:        00094000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

The Zone Alarm driver is passing null pointers, remove it.

DONE

Code:

0: kd> .bugcheck
Bugcheck code 0000007F
Arguments 00000000`00000008 00000000`80050033 00000000`000406f8 fffff880`06bcf436

0: kd> k
Child-SP          RetAddr           Call Site
fffff800`00ba2d28 fffff800`036dbe69 nt!KeBugCheckEx
fffff800`00ba2d30 fffff800`036da332 nt!KiBugCheckDispatch+0x69
fffff800`00ba2e70 fffff880`06bcf436 nt!KiDoubleFaultAbort+0xb2
fffff880`1f7c9fa0 00000000`00000000 igdkmd64+0x175436

0: kd> lmvm igdkmd64
start             end                 module name
fffff880`06a5a000 fffff880`06f77c20   igdkmd64 T (no symbols)           
    Loaded symbol image file: igdkmd64.sys
    Image path: igdkmd64.sys
    Image name: igdkmd64.sys
    Timestamp:        Mon Jan 19 22:27:59 2015 (54BD84EF)
    CheckSum:         0052A1FE
    ImageSize:        0051DC20
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

There's not much to go on regarding double fault errors because the context for the previous exception was lost during the minidump save, meaning the second exception might not have been the cause.
Either way, I recommend updating your display driver.

DONE

Will see if this keeps BSOD's in check

Thank You Jared and Thank you all.

x BlueRobot · May 19, 2015

Welcome, please keep us informed of any updates.

Search

Search

BSOD Acer Aspire 8951g - Windows 7 x64

inzo

Member

Attachments

Patrick

Sysnative Staff

inzo

Member

Attachments

Patrick

Sysnative Staff

inzo

Member

Patrick

Sysnative Staff

inzo

Member

Patrick

Sysnative Staff

inzo

Member

Attachments

x BlueRobot

Administrator

Patrick

Sysnative Staff

inzo

Member

inzo

Member

Attachments

Jared

Sysnative Staff, BSOD Kernel Dump Expert

inzo

Member

x BlueRobot

Administrator