What's new

[7SP1 x64] Random BSODs when waking from sleep and other

johnymrazko

Member
Joined
Dec 3, 2017
Posts
15
Hi

my PC is getting random BSODs , dumps and info in attached zip file. Happened few times when trying to wake computer from sleep, then randomly when browsing or playing games. All drivers should be updated to latest and I ran memtest and diskcheck with no errors.

I also ran windbg and captured some of analysis

PC Specs

i7 4770k
32gb ram
gigabyte z87pd3
gtx 1060
wd 1tb
ssd kingston 240 gb

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`03068000 PsLoadedModuleList = 0xfffff800`032aa750
Debug session time: Sat Nov 25 09:24:23.500 2017 (UTC + 1:00)
System Uptime: 0 days 0:33:56.514
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffd4018). Type ".hh dbgerr001" for details
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************


Use !analyze -v to get detailed debugging information.

BugCheck A, {1002000000, 2, 0, fffff800030e4a82}

*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by : ntkrnlmp.exe ( nt!KiProcessExpiredTimerList+72 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001002000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030e4a82, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 0000001002000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiProcessExpiredTimerList+72
fffff800`030e4a82 803818 cmp byte ptr [rax],18h

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

DPC_STACK_BASE: FFFFF8800324DFB0

TRAP_FRAME: fffff8800324d680 -- (.trap 0xfffff8800324d680)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000001002000000 rbx=0000000000000000 rcx=000000000b6e7103
rdx=fffffa800c187c80 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030e4a82 rsp=fffff8800324d810 rbp=000000000001fdef
r8=0000000000000008 r9=0000000000000000 r10=fffff80003068000
r11=fffffa800c67fe01 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiProcessExpiredTimerList+0x72:
fffff800`030e4a82 803818 cmp byte ptr [rax],18h ds:00000010`02000000=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030d83a9 to fffff800030d8e00

STACK_TEXT:
fffff880`0324d538 fffff800`030d83a9 : 00000000`0000000a 00000010`02000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0324d540 fffff800`030d7020 : 00000000`00000000 00000000`00000001 fffff880`0324d6e0 fffffa80`09dfdef0 : nt!KiBugCheckDispatch+0x69
fffff880`0324d680 fffff800`030e4a82 : fffffa80`09dfdef0 fffffa80`0dbf3888 fffffa80`0dbf3888 00000000`00000102 : nt!KiPageFault+0x260
fffff880`0324d810 fffff800`030e49be : 00000004`bddb7f69 fffff880`0324de88 00000000`0001fdef fffff880`009b7368 : nt!KiProcessExpiredTimerList+0x72
fffff880`0324de60 fffff800`030e46ec : fffff880`009b31ea 00000000`0001fdef fffff880`00f14fc0 00000000`000000e8 : nt!KiTimerExpiration+0x1be
fffff880`0324df00 fffff800`030db825 : 00000000`00000000 fffffa80`0bff9770 00000000`00000000 fffff800`03207580 : nt!KiRetireDpcList+0x1bc
fffff880`0324dfb0 fffff800`030db63c : fffffa80`0ccb7cf0 fffffa80`00000001 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`064d7f90 fffff800`0312499c : fffffa80`078f9998 fffff880`009b3180 fffff880`009b3180 00000000`00000000 : nt!KiDispatchInterruptContinue
fffff880`064d7fc0 fffff800`030dcd8a : 00000000`00000000 00000000`0000029c fffffa80`0b6b0f20 ffffffff`800009f8 : nt!KiDpcInterrupt+0xcc
fffff880`064d8150 fffff880`01004903 : fffff880`00000000 fffff880`00000000 fffffa80`0bff9700 fffff800`030e56f8 : nt!KeSetEvent+0xea
fffff880`064d81c0 fffff800`030dc0e1 : 00000000`000003f0 fffff880`02e7970f fffffa80`0cc29010 00000000`00000000 : fltmgr!FltpSynchronizedOperationCompletion+0x13
fffff880`064d81f0 fffff880`0146148c : fffffa80`0ccb7cf0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!IopfCompleteRequest+0x341
fffff880`064d82e0 fffff880`014f77b8 : fffffa80`0ccb7cf0 00000000`00000000 00000000`00000000 fffffa80`0b0ba820 : Ntfs+0x1148c
fffff880`064d8320 fffff880`01002bcf : fffffa80`07233030 fffffa80`0b0ba820 00000000`00000000 00000000`00000000 : Ntfs+0xa77b8
fffff880`064d84d0 fffff880`010222b9 : fffffa80`0b0ba820 fffffa80`0722f010 fffffa80`0b0ba800 fffffa80`0713fa30 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`064d8560 fffff800`033de2bb : 00000000`00000005 00000000`00000840 fffffa80`0b623f20 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`064d8610 fffff800`033d9dde : fffffa80`07115cd0 00000000`00000000 fffffa80`0e14ab10 fffff880`064d8801 : nt!IopParseDevice+0x14e2
fffff880`064d8770 fffff800`033da8c6 : 00000000`00000000 fffff880`064d88f0 fffff880`00000840 fffffa80`06a1fa30 : nt!ObpLookupObjectName+0x784
fffff880`064d8870 fffff800`033dc6bc : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByName+0x306
fffff880`064d8940 fffff800`033c57a8 : 00000000`0188f410 00000000`00100021 00000000`0188f498 00000000`0188f4c8 : nt!IopCreateFile+0x2bc
fffff880`064d89e0 fffff800`030d8093 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtOpenFile+0x58
fffff880`064d8a70 00000000`77adc06a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0188f3b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77adc06a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiProcessExpiredTimerList+72
fffff800`030e4a82 803818 cmp byte ptr [rax],18h

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!KiProcessExpiredTimerList+72

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 59b946d1

IMAGE_VERSION: 6.1.7601.23915

FAILURE_BUCKET_ID: X64_0xA_nt!KiProcessExpiredTimerList+72

BUCKET_ID: X64_0xA_nt!KiProcessExpiredTimerList+72

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0xa_nt!kiprocessexpiredtimerlist+72

FAILURE_ID_HASH: {7384a8b8-ab8d-15fa-8c4d-f12bcbd789b8}

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`03052000 PsLoadedModuleList = 0xfffff800`03294750
Debug session time: Sun Dec 3 15:52:59.521 2017 (UTC + 1:00)
System Uptime: 0 days 2:54:22.489
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffde018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff90000812000, 36dd, 32d10000659e}

Probably caused by : win32k.sys ( win32k!memset+80 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff90000812000
Arg3: 00000000000036dd
Arg4: 000032d10000659e

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_5003

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: E_IATIHAE.EXE

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME: fffff8800a3c4660 -- (.trap 0xfffff8800a3c4660)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff900c282a000 rbx=0000000000000000 rcx=fffff900c2830000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001570d0 rsp=fffff8800a3c47f8 rbp=fffff900c0226578
r8=0000000000000038 r9=0000000000000338 r10=0000000000000034
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
win32k!memset+0x80:
fffff960`001570d0 488911 mov qword ptr [rcx],rdx ds:fffff900`c2830000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003130a0b to fffff800030c2e00

STACK_TEXT:
fffff880`0a3c42f8 fffff800`03130a0b : 00000000`0000001a 00000000`00005003 fffff900`00812000 00000000`000036dd : nt!KeBugCheckEx
fffff880`0a3c4300 fffff800`030e0d8e : 00000000`00000001 fffff900`c2830000 fffff880`0a3c4660 fffff6fc`80614180 : nt! ?? ::FNODOBFM::`string'+0x27cef
fffff880`0a3c43f0 fffff800`030d0abb : 00000000`00000000 00000000`00000204 fffffa80`12302060 00000000`00001084 : nt!MiDispatchFault+0x8ce
fffff880`0a3c4500 fffff800`030c0f2e : 00000000`00000001 fffff900`c2830000 fffffa80`12419e00 fffff900`c282a000 : nt!MmAccessFault+0xe1b
fffff880`0a3c4660 fffff960`001570d0 : fffff960`00145e82 fffff880`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0a3c47f8 fffff960`00145e82 : fffff880`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!memset+0x80
fffff880`0a3c4800 fffff960`00147546 : fffff880`0a3c48c0 fffff880`0a3c49a0 fffff900`c0226578 00000000`00000001 : win32k!AllocateObject+0xf2
fffff880`0a3c4840 fffff960`0011db20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!SURFMEM::bCreateDIB+0x39a
fffff880`0a3c4930 fffff960`0011d68f : 00000028`000001e0 fffff900`c3576630 00000000`01080030 00000000`000001e0 : win32k!hsurfCreateCompatibleSurface+0x3c4
fffff880`0a3c4a00 fffff800`030c2093 : fffffa80`12302060 fffff880`0a3c4b60 00000000`000001e0 000007fe`db9d1be0 : win32k!GreCreateCompatibleBitmap+0x25f
fffff880`0a3c4ae0 000007fe`fef92e0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0024e1b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fef92e0a


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!memset+80
fffff960`001570d0 488911 mov qword ptr [rcx],rdx

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!memset+80

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5a0e642f

IMAGE_VERSION: 6.1.7601.23963

FAILURE_BUCKET_ID: X64_0x1a_5003_win32k!memset+80

BUCKET_ID: X64_0x1a_5003_win32k!memset+80

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x1a_5003_win32k!memset+80

FAILURE_ID_HASH: {299262f4-3598-668c-30bf-f5ee54f49842}

Followup: MachineOwner
---------
 

Attachments

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Posts
18,456
Location
Croatia
Re: Random BSODs when waking from sleep and other

Hello and welcome!

Please remove Daemon Tools from your machine.

What did you use to check your RAM and HDD?

What PSU do you have and how old is it?

Code:
intelppm.sys Tue Jul 14 01:19:25 2009 (4A5BC0FD) 
Intel Processor driver  http://downloadcenter.intel.com/Default.aspx also at 
http://www.carrona.org/drivers/driver.php?id=intelppm.sys 

RtNdPt60.sys Mon Jul 20 04:27:32  2009 (4A63D614) 
Realtek NDIS User mode I/O Driver - Ethernet  Realtek  
http://www.carrona.org/drivers/driver.php?id=RtNdPt60.sys 

whfltr2k.sys Wed Sep 16 19:48:59  2009 (4AB1250B) 
WheelMouse USB Lower Filter Driver[br]e-WheelMouse USB Lower  Filter Driver Unknown manufacturer. I'd suggest looking at the mouse itself for  identifying marks. Post in the forums for instructions to safely remove this  driver. 
http://www.carrona.org/drivers/driver.php?id=whfltr2k.sys 

amdxata.sys Fri Mar 19 17:18:18  2010 (4BA3A3CA) 
AMD storage controller driver - usually from the Windows 7  DVD Windows Update 
http://www.carrona.org/drivers/driver.php?id=amdxata.sys 

dtsoftbus01.sys  Thu Jan 13 09:27:08 2011 (4D2EB75C) 
Daemon Tools driver [br]  Possible BSOD issues in Win7  http://www.daemon-tools.cc/eng/downloads 
http://www.carrona.org/drivers/driver.php?id=dtsoftbus01.sys 

t_mouse.sys Mon Dec 3 07:19:30  2012 (50BC4472) 
iBall Advanced Mouse driver  http://www.iball.co.in/Download.aspx 
http://www.carrona.org/drivers/driver.php?id=t_mouse.sys 

gdrv.sys Thu Jul 4 06:27:55 2013  (51D4F9CB) 
Gigabyte Easy Saver - mobo power utility driver  http://www.gigabyte.com.tw/Support/Motherboard/Driver_List.aspx 
http://www.carrona.org/drivers/driver.php?id=gdrv.sys 

iaStorA.sys Fri Apr 4 01:00:05 2014  (533DE7F5) 
Intel RST (Rapid Storage Technology) driver  http://downloadcenter.intel.com/Default.aspx XP 
http://www.carrona.org/drivers/driver.php?id=iaStorA.sys 

iaStorF.sys Fri Apr 4 01:00:09  2014 (533DE7F9) 
Intel RST (Rapid Storage Technology) Filter driver  http://downloadcenter.intel.com/Default.aspx XP 
http://www.carrona.org/drivers/driver.php?id=iaStorF.sys 

IntcDAud.sys Tue Mar 31 12:56:32  2015 (551A7D60) 
Intel Graphics Media Accelerator HD Driver  http://downloadcenter.intel.com/ 
http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys 

RTKVHD64.sys Fri Jan 22 16:09:21  2016 (56A24621) 
Realtek High Definition Audio Function Driver  http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=8&PFid=14&Level=3&Conn=2  
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys 

TeeDriverx64.sys Mon Mar 28  20:59:14 2016 (56F97F02) 
Intel Management Engine Interface (MEI) driver OEM  or http://downloadcenter.intel.com[br][br]Installation instructions -  http://www.sysnative.com/forums/windows-10-a/18573-windows-10-error-0x800f081f-source-file-not-found.html#post144391  
http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys 

XtuAcpiDriver.sys Tue Jun 28  11:05:03 2016 (57723DBF) 
Intel extreme tuning BIOS interface driver  http://downloadcenter.intel.com/ 
http://www.carrona.org/drivers/driver.php?id=XtuAcpiDriver.sys 

Rt64win7.sys Thu Jul 14  10:45:29 2016 (57875129) 
Realtek RTL8168D/8111D Family PCI-E Gigabit  Ethernet NIC  http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false  
http://www.carrona.org/drivers/driver.php?id=Rt64win7.sys 

igdkmd64.sys Wed Jan 4 20:23:23  2017 (586D4BAB) 
Intel Graphics driver  http://downloadcenter.intel.com/Default.aspx 
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys 

tapwindscribe0901.sys Thu Mar 16  22:37:54 2017 (58CB05B2) 

tapwindscribe0901.sys - this driver hasn't been added to  the DRT as of this run. Please search Google/Bing for the driver if additional  information is needed. 

iusb3hub.sys Tue Mar 28 15:43:26 2017  (58DA687E) 
Intel(R) USB 3.0 Hub Driver http://downloadcenter.intel.com/  
http://www.carrona.org/drivers/driver.php?id=iusb3hub.sys 

iusb3xhc.sys Tue Mar 28 15:43:28  2017 (58DA6880) 
Intel(R) USB 3.0 eXtensible Host Controller Driver  http://downloadcenter.intel.com/ 
http://www.carrona.org/drivers/driver.php?id=iusb3xhc.sys 

iusb3hcs.sys Tue Mar 28 15:44:15  2017 (58DA68AF) 
Intel(R) USB 3.0 Host Controller Switch Driver  http://downloadcenter.intel.com/ 
http://www.carrona.org/drivers/driver.php?id=iusb3hcs.sys 

em000k_64.dll Wed Jun 21 09:44:58  2017 (594A23FA) 

em000k_64.dll - this driver hasn't been added to the DRT as  of this run. Please search Google/Bing for the driver if additional information  is needed. 

eamonm.sys Thu Sep 7 15:43:09 2017 (59B14CED) 
ESET  Amon driver Support: http://kb.eset.com/[br]Downloads:  http://www.eset.com/int/download/home/ 
http://www.carrona.org/drivers/driver.php?id=eamonm.sys 

epfwwfpr.sys Mon Sep 11 16:37:24  2017 (59B69FA4) 
ESET Antivirus/Firewall - check for a free upgrade to the  latest version Support: http://kb.eset.com/[br]Downloads:  http://www.eset.com/int/download/home/ 
http://www.carrona.org/drivers/driver.php?id=epfwwfpr.sys 

nvhda64v.sys Thu Sep 14 11:55:42  2017 (59BA521E) 
nVidia HDMI Audio Device (nForce chipset driver)  http://www.nvidia.com/Download/index.aspx 
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys 

nvvad64v.sys Tue Sep 19 10:38:04  2017 (59C0D76C) 
NVIDIA Virtual Audio Driver  http://www.nvidia.com/Download/index.aspx?lang=en-us 
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys 

ehdrv.sys Wed Oct 4 17:42:26 2017  (59D50162) 
ESET Support: http://kb.eset.com/[br]Downloads:  http://www.eset.com/int/download/home/ 
http://www.carrona.org/drivers/driver.php?id=ehdrv.sys 

em006_64.dll Wed Nov 8 15:49:22 2017  (5A031972) 

em006_64.dll -  this driver hasn't been added to the DRT as of this run. Please search  Google/Bing for the driver if additional information is needed.  

em018k_64.dll Mon Nov 27 15:33:33 2017 (5A1C223D) 

em018k_64.dll - this driver hasn't been  added to the DRT as of this run. Please search Google/Bing for the driver if  additional information is needed. 

nvlddmkm.sys Tue Nov 28  00:53:09 2017 (5A1CA565) 
nVidia Video drivers  http://www.nvidia.com/Download/index.aspx[br]Get from OEM for laptops 
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys 


Code:

Debug session time: Sun Dec  3 15:52:59.521 2017 (UTC + 1:00)

Loading Dump File [D:\SysnativeBSODApps\120317-6396-01.dmp]

Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

System Uptime: 0 days 2:54:22.489

Probably caused by : win32k.sys ( win32k!memset+80 )

BugCheck 1A, {5003, fffff90000812000, 36dd, 32d10000659e}

BugCheck Info: MEMORY_MANAGEMENT (1a)

Bugcheck code 0000001A

Arguments: 

Arg1: 0000000000005003, The subtype of the bugcheck.

Arg2: fffff90000812000

Arg3: 00000000000036dd

Arg4: 000032d10000659e

BUGCHECK_STR:  0x1a_5003

PROCESS_NAME:  E_IATIHAE.EXE

FAILURE_BUCKET_ID:  X64_0x1a_5003_win32k!memset+80

MaxSpeed:     3500

CurrentSpeed: 3491

BiosVersion = F8

BiosReleaseDate = 08/25/2014

SystemManufacturer = Gigabyte Technology Co., Ltd.

SystemProductName = Z87P-D3

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Debug session time: Sat Dec  2 14:33:18.990 2017 (UTC + 1:00)

Loading Dump File [D:\SysnativeBSODApps\120217-6411-01.dmp]

Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

System Uptime: 0 days 5:55:57.958

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefix+121 )

BugCheck 24, {1904fb, fffff8800dc8b9d8, fffff8800dc8b240, fffff880014c6851}

BugCheck Info: NTFS_FILE_SYSTEM (24)

Bugcheck code 00000024

Arguments: 

Arg1: 00000000001904fb

Arg2: fffff8800dc8b9d8

Arg3: fffff8800dc8b240

Arg4: fffff880014c6851

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFindPrefix+121

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Debug session time: Sat Dec  2 08:26:02.735 2017 (UTC + 1:00)

Loading Dump File [D:\SysnativeBSODApps\120217-6396-01.dmp]

Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

System Uptime: 0 days 0:13:24.703

Probably caused by : ntkrnlmp.exe ( nt!KiCommitThreadWait+213 )

BugCheck A, {848, 2, 0, fffff800030ca073}

BugCheck Info: IRQL_NOT_LESS_OR_EQUAL (a)

Bugcheck code 0000000A

Arguments: 

Arg1: 0000000000000848, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, bitfield :

	bit 0 : value 0 = read operation, 1 = write operation

	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: fffff800030ca073, address which referenced memory

BUGCHECK_STR:  0xA

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  SlimService.ex

FAILURE_BUCKET_ID:  X64_0xA_nt!KiCommitThreadWait+213

MaxSpeed:     3500

CurrentSpeed: 3491

BiosVersion = F8

BiosReleaseDate = 08/25/2014

SystemManufacturer = Gigabyte Technology Co., Ltd.

SystemProductName = Z87P-D3

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

Debug session time: Fri Dec  1 20:47:23.021 2017 (UTC + 1:00)

Loading Dump File [D:\SysnativeBSODApps\120117-6333-01.dmp]

Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600

System Uptime: 0 days 3:44:54.878

Probably caused by : ntkrnlmp.exe ( nt!CmpReportNotifyHelper+123 )

BugCheck 3B, {c0000005, fffff80003364d67, fffff88005684d40, 0}

BugCheck Info: SYSTEM_SERVICE_EXCEPTION (3b)

Bugcheck code 0000003B

Arguments: 

Arg1: 00000000c0000005, Exception code that caused the bugcheck

Arg2: fffff80003364d67, Address of the instruction which caused the bugcheck

Arg3: fffff88005684d40, Address of the context record for the exception that caused the bugcheck

Arg4: 0000000000000000, zero.

BUGCHECK_STR:  0x3B

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

FAILURE_BUCKET_ID:  X64_0x3B_nt!CmpReportNotifyHelper+123

MaxSpeed:     3500

CurrentSpeed: 3491

BiosVersion = F8

BiosReleaseDate = 08/25/2014

SystemManufacturer = Gigabyte Technology Co., Ltd.

SystemProductName = Z87P-D3

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``





--- E O J --- 2017 Dec 03 21:49:08 PM _88-dbug  Copyright 2017 Sysnative Forums 
--- E O J --- 2017 Dec 03 21:49:08 PM  _88-dbug Copyright 2017 Sysnative Forums 
--- E O J --- 2017 Dec 03 21:49:08  PM _88-dbug Copyright 2017 Sysnative Forums
 

johnymrazko

Member
Joined
Dec 3, 2017
Posts
15
Re: Random BSODs when waking from sleep and other

Hi

thanks for swift reply

I have already uninstalled Daemon Tools, I used memtest and diskcheck to check RAM and HDD

PSU is from Fractal Design - Tesla 500w
 

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Posts
18,456
Location
Croatia
Re: Random BSODs when waking from sleep and other

Did you test one RAM stick at a time?
 

johnymrazko

Member
Joined
Dec 3, 2017
Posts
15
Re: Random BSODs when waking from sleep and other

Yes I did test with one stick for one or two weeks
 

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Posts
18,456
Location
Croatia
Re: Random BSODs when waking from sleep and other

I meant did you test your memory one by one stick when using Memtest?
 

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Posts
18,456
Location
Croatia
Re: Random BSODs when waking from sleep and other

Please test them separately. Make sure you test for eight passes. Report back as soon as there are errors.
 

johnymrazko

Member
Joined
Dec 3, 2017
Posts
15
Here is another dump

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`0304d000 PsLoadedModuleList = 0xfffff800`0328f750
Debug session time: Sun Dec 17 22:01:56.347 2017 (UTC + 1:00)
System Uptime: 0 days 13:38:29.462
Loading Kernel Symbols
................................................Missing image name, possible paged-out or corrupt data.
.*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000
Unable to add module at 00000000`00000000
Unable to read KLDR_DATA_TABLE_ENTRY at 00000000`00000000 - NTSTATUS 0xC0000147

WARNING: .reload failed, module list may be incomplete
GetContextState failed, 0xD0000147
CS descriptor lookup failed
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get program counter
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88006d8e998, fffff88006d8e200, fffff8800143bf6d}

GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
0: kd> !analyze -v
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get program counter
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88006d8e998
Arg3: fffff88006d8e200
Arg4: fffff8800143bf6d

Debugging Details:
------------------

GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147

EXCEPTION_RECORD: fffff88006d8e998 -- (.exr 0xfffff88006d8e998)
Cannot read Exception record @ fffff88006d8e998

CONTEXT: fffff88006d8e200 -- (.cxr 0xfffff88006d8e200;r)
Unable to read context, NTSTATUS 0xC0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
Unable to get program counter
GetContextState failed, 0xD0000147
Unable to retrieve register information
nt!KeBugCheckEx:
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
fffff800`030bde00 48894c2408 mov qword ptr [rsp+8],rcx ss:00000000`00000008=????????????????
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
^ Unable to get program counter '.cxr 0xfffff88006d8e200;r'

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x24

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

STACK_TEXT:
GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147


STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION:

BUCKET_ID: ZEROED_STACK

FAILURE_BUCKET_ID: ZEROED_STACK

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:zeroed_stack

FAILURE_ID_HASH: {4af92c9d-8968-8d00-06f5-868dfba32e9a}

Followup: MachineOwner
---------

GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
GetContextState failed, 0xD0000147
 

johnymrazko

Member
Joined
Dec 3, 2017
Posts
15
latest one from today


Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`03054000 PsLoadedModuleList = 0xfffff800`03296750
Debug session time: Wed Dec 20 16:45:08.848 2017 (UTC + 1:00)
System Uptime: 0 days 0:39:25.832
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {22, 2000000, 0, 0}

Probably caused by : win32k.sys ( win32k!MsgLookupTableCleanUp+4f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000022,
Arg2: 0000000002000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x19_22

POOL_ADDRESS: 0000000002000000

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: explorer.exe

CURRENT_IRQL: 2

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff8000305c39e to fffff800030c4e00

STACK_TEXT:
fffff880`099a52b8 fffff800`0305c39e : 00000000`00000019 00000000`00000022 00000000`02000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`099a52c0 fffff800`031fc20a : 00000000`00000000 fffff880`099a5410 fffff880`099a5390 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x70c6
fffff880`099a5350 fffff960`0016fadf : 00000000`00000008 fffff960`0016b75d 00000000`6c6d7355 00000000`00000000 : nt!ExFreePoolWithTag+0x46a
fffff880`099a5400 fffff960`00131b6d : fffff900`c2554c10 00000000`00000000 00000000`00000000 fffff900`c083a440 : win32k!MsgLookupTableCleanUp+0x4f
fffff880`099a5440 fffff960`00131c7b : fffff900`c3fff9f0 fffff900`c083a440 fffff900`c2554c10 fffff900`c2554c10 : win32k!xxxFreeWindow+0x15d
fffff880`099a5540 fffff960`0013361b : 00000000`00000000 fffff900`c083a220 fffff900`c2554c10 00000000`00000000 : win32k!xxxFreeWindow+0x26b
fffff880`099a5640 fffff960`0012b65e : 00000000`00000000 00000000`00000000 fffff880`099a5af0 fffff900`c2554c10 : win32k!xxxDestroyWindow+0x713
fffff880`099a56f0 fffff960`00150b53 : fffff900`c2554c38 fffff900`c2554c10 fffff900`c2554c10 fffff900`c2554c10 : win32k!xxxDestroyThreadInfo+0x942
fffff880`099a57e0 fffff960`00127230 : fffffa80`12afb2d0 fffffa80`18ae8b50 fffffa80`18ae8b50 00000000`00000001 : win32k!UserThreadCallout+0x93
fffff880`099a5810 fffff800`0339c731 : fffffa80`12afb2d0 00000000`00000000 00000000`00000000 fffffa80`18ae8b50 : win32k!W32pThreadCallout+0x78
fffff880`099a5840 fffff800`03381645 : fffffa80`c0000005 00000000`00000000 fffff800`78457300 00000000`00000000 : nt!PspExitThread+0x541
fffff880`099a5900 fffff800`030b8c04 : fffffa80`18ae8b50 fffff800`030b8b3d 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`099a5930 fffff800`030b8f50 : 00000000`000003e8 fffff880`099a59b0 fffff800`033815b8 00000000`00000001 : nt!KiDeliverApc+0x2e4
fffff880`099a59b0 fffff800`030c4137 : 00000000`00000000 00000000`779c4954 ffffffff`ff676980 00000000`00006f7b : nt!KiInitiateUserApc+0x70
fffff880`099a5af0 00000000`77b9c07a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0384ce88 fffff800`030bc450 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b9c07a
fffff880`099a5cd0 fffffa80`18053170 : fffff800`03012b7f 00000005`7d35ad9c fffff800`030cc85f 00000000`00000000 : nt!KiCallUserMode
fffff880`099a5cd8 fffff800`03012b7f : 00000005`7d35ad9c fffff800`030cc85f 00000000`00000000 fffff880`099a6700 : 0xfffffa80`18053170
fffff880`099a5ce0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalSendSoftwareInterrupt+0x48


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!MsgLookupTableCleanUp+4f
fffff960`0016fadf 4883c508 add rbp,8

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!MsgLookupTableCleanUp+4f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 5a0e642f

IMAGE_VERSION: 6.1.7601.23963

FAILURE_BUCKET_ID: X64_0x19_22_win32k!MsgLookupTableCleanUp+4f

BUCKET_ID: X64_0x19_22_win32k!MsgLookupTableCleanUp+4f

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x19_22_win32k!msglookuptablecleanup+4f

FAILURE_ID_HASH: {2fcea476-29d6-1a1c-2527-1c226b201637}

Followup: MachineOwner
---------
 

philc43

BSOD Academy Instructor, BSOD Kernel Dump Expert
Joined
Jul 7, 2017
Posts
123
Location
Cambridge, UK
Are you able to provide a link to any of the recent dump files?

In your first post I looked at the dump provided from 1 and 2 Dec and noticed that the ESET security software was implicated:

Code:
Start memory scan  : 0xfffff8800c125528 ($csp)
End memory scan    : 0xfffff8800c126000 (Kernel Stack Base)

               rsp : 0xfffff8800c125528 : 0xfffff800030c43a9 : nt!KiBugCheckDispatch+0x69
0xfffff8800c125528 : 0xfffff800030c43a9 : nt!KiBugCheckDispatch+0x69
0xfffff8800c125550 : 0xfffff800030ca073 : nt!KiCommitThreadWait+0x213
Unable to load image \??\C:\Program Files\ESET\ESET Security\Modules\em018k_64\1515\em018k_64.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for em018k_64.dll
*** ERROR: Module load completed but symbols could not be loaded for em018k_64.dll
0xfffff8800c125668 : 0xfffff800030c3020 : nt!KiPageFault+0x260
0xfffff8800c125670 : 0xfffffa801209fe88 :  Trap @ fffff8800c125670
0xfffff8800c1256d8 : 0xfffff800030d80b5 : nt!MiUpdateWsle+0x3f5
0xfffff8800c1257d8 : 0xfffff800030ca073 : nt!KiCommitThreadWait+0x213
0xfffff8800c125888 : 0xfffff800030cd093 : nt!KeRemoveQueueEx+0x323
0xfffff8800c125948 : 0xfffff800033b120c : nt!IoRemoveIoCompletion+0x4c
0xfffff8800c1259d8 : 0xfffff800030b1366 : nt!NtWaitForWorkViaWorkerFactory+0x285
0xfffff8800c125ad8 : 0xfffff800030c4093 : nt!KiSystemServiceCopyEnd+0x13
0xfffff8800c125ae0 : 0xfffffa8013539b00 :  Trap @ fffff8800c125ae0

Code:
Start memory scan  : 0xfffff88005684478 ($csp)
End memory scan    : 0xfffff88005686000 (Kernel Stack Base)

               rsp : 0xfffff88005684478 : 0xfffff800030cd3a9 : nt!KiBugCheckDispatch+0x69
               r11 : 0xfffff88005684678 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684478 : 0xfffff800030cd3a9 : nt!KiBugCheckDispatch+0x69
0xfffff88005684490 : 0xfffff80003364d67 : nt!CmpReportNotifyHelper+0x123
Unable to load image \SystemRoot\system32\DRIVERS\ehdrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ehdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
0xfffff88005684558 : 0xfffff88005684678 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684560 : 0xfffff88005684628 : 0xfffff800030f8b65 : nt!RtlDispatchException+0x415
0xfffff88005684578 : 0xfffff800030ee8bc : nt!RtlSetBits+0x8c
0xfffff88005684590 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684598 : 0xfffff800030cd093 : nt!KiSystemServiceCopyEnd+0x13
0xfffff880056845a0 : 0xfffff800032df6a8 : "nt!BBTBuffer <PERF> (nt+0x2826a8)"
0xfffff880056845a8 : 0xfffff800030ccc80 : nt!KiSystemServiceHandler
0xfffff880056845b8 : 0xfffff800030cccfc : nt!KiSystemServiceHandler+0x7c
0xfffff880056845d8 : 0xfffff800030fa288 : nt!_C_specific_handler
0xfffff880056845e0 : 0xfffff800032f2230 : "nt!BBTBuffer <PERF> (nt+0x295230)"
0xfffff880056845e8 : 0xfffff80003382fea : nt!NtSetValueKey+0x349
0xfffff880056845f8 : 0xfffff800030f9d8d : nt!RtlpExecuteHandlerForException+0xd
0xfffff88005684600 : 0xfffff800032f2230 : "nt!BBTBuffer <PERF> (nt+0x295230)"
0xfffff88005684610 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684620 : 0xfffff880056846c0 : 0xfffff800030cd093 : nt!KiSystemServiceCopyEnd+0x13
0xfffff88005684628 : 0xfffff800030f8b65 : nt!RtlDispatchException+0x415
0xfffff88005684638 : 0xfffff88005684678 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684648 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684678 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684698 : 0xfffff800032df6a8 : "nt!BBTBuffer <PERF> (nt+0x2826a8)"
0xfffff880056846c0 : 0xfffff800030cd093 : nt!KiSystemServiceCopyEnd+0x13
0xfffff880056846c8 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff880056846d0 : 0xfffff800032df6a8 : "nt!BBTBuffer <PERF> (nt+0x2826a8)"
0xfffff880056846f0 : 0xfffff800030ccc80 : nt!KiSystemServiceHandler
0xfffff88005684768 : 0xfffff80003397a43 : nt!PsReferenceEffectiveToken+0x43
0xfffff88005684778 : 0xfffff80003204fcd : nt!ExFreePoolWithTag+0x22d
0xfffff88005684788 : 0xfffff800030b4247 : nt!EtwpReserveTraceBuffer+0x28f
0xfffff88005684818 : 0xfffff800032041ee : nt!ExAllocatePoolWithTag+0xfe
0xfffff88005684838 : 0xfffff80003119ad3 : nt!KiDpcInterruptBypass+0x13
0xfffff88005684848 : 0xfffff80003204fcd : nt!ExFreePoolWithTag+0x22d
0xfffff88005684870 : 0xfffff8000325e940 : nt!PspSystemQuotaBlock
0xfffff880056849b8 : 0xfffff80003476ccf : nt!ObpPreInterceptHandleCreate+0xaf
0xfffff880056849f8 : 0xfffff800033e5e2b : nt!SeOpenObjectAuditAlarmWithTransaction+0x11b
Unable to load image \??\C:\Program Files\ESET\ESET Security\Modules\em018k_64\1515\em018k_64.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for em018k_64.dll
*** ERROR: Module load completed but symbols could not be loaded for em018k_64.dll
0xfffff88005684a68 : 0xfffff800033b183b : nt!ObpInsertHandleCount+0xc7
0xfffff88005684ad8 : 0xfffff800033dca20 : nt!ObpLockHandleDataBaseEntry+0x104
0xfffff88005684af8 : 0xfffff800033cd6e4 : nt!ObpIncrementHandleCountEx+0x414
0xfffff88005684b08 : 0xfffff800033cd548 : nt!ObpIncrementHandleCountEx+0x278
0xfffff88005684b28 : 0xfffff88005684c28 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684b38 : 0xfffff80003476ccf : nt!ObpPreInterceptHandleCreate+0xaf
0xfffff88005684b50 : 0xfffff88005684c40 : 0xfffff800032df6a8 : "nt!BBTBuffer <PERF> (nt+0x2826a8)"
0xfffff88005684b78 : 0xfffff800033bdd24 : nt!ExpAllocateHandleTableEntry+0x60
0xfffff88005684bc8 : 0xfffff800033a92fa : nt!ObDuplicateObject+0x40a
0xfffff88005684be8 : 0xfffff800030cce00 : nt!KiSystemCall64
0xfffff88005684bf0 : 0xfffff800033830b4 : nt!CmQueryMultipleValueKey
0xfffff88005684bf8 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684c00 : 0xfffff800032f0be0 : "nt!BBTBuffer <PERF> (nt+0x293be0)"
0xfffff88005684c08 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684c10 : 0xfffff800032ef8fc : "nt!BBTBuffer <PERF> (nt+0x2928fc)"
0xfffff88005684c18 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684c20 : 0xfffff800032f2218 : "nt!BBTBuffer <PERF> (nt+0x295218)"
0xfffff88005684c28 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684c30 : 0xfffff800032f2230 : "nt!BBTBuffer <PERF> (nt+0x295230)"
0xfffff88005684c38 : 0xfffff8000305d000 : "nt!KdpReport <PERF> (nt+0x0)"
0xfffff88005684c40 : 0xfffff800032df6a8 : "nt!BBTBuffer <PERF> (nt+0x2826a8)"
0xfffff88005684c78 : 0xfffff80003109e6b : nt!KiPreprocessFault+0x53
0xfffff88005684c88 : 0xfffff88005684c00 : 0xfffff800032f0be0 : "nt!BBTBuffer <PERF> (nt+0x293be0)"
0xfffff88005684ca0 : 0xfffff80003364d67 : nt!CmpReportNotifyHelper+0x123
0xfffff88005684ca8 : 0xfffff80003364d69 : nt!CmpReportNotifyHelper+0x125
0xfffff88005684cc0 : 0xfffff80003364d68 : nt!CmpReportNotifyHelper+0x124
0xfffff88005684d08 : 0xfffff8000310a0bd : nt!KiDispatchException+0x17d
0xfffff88005684d48 : 0xfffff80003201656 : nt!MiFreePoolPages+0x356
0xfffff88005684e38 : 0xfffff80003364d67 : nt!CmpReportNotifyHelper+0x123
0xfffff88005684e48 : 0xfffff800032041ee : nt!ExAllocatePoolWithTag+0xfe
0xfffff88005684e68 : 0xfffff80003119ad3 : nt!KiDpcInterruptBypass+0x13
0xfffff88005684e78 : 0xfffff80003204fcd : nt!ExFreePoolWithTag+0x22d
0xfffff88005684ea0 : 0xfffff8000325e940 : nt!PspSystemQuotaBlock
0xfffff88005685190 : 0x004700450052005c :  !du "\REGISTR"
0xfffff880056851a0 : 0xfffff8000330cd00 : nt!MmStandbyPageListByPriority+0x80
0xfffff880056851a8 : 0xfffff800030d7b6e : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x7e
0xfffff880056851b0 : 0xfffff8000330cd68 : nt!MmStandbyPageListByPriority+0xe8
0xfffff880056851b8 : 0x0041005700540046 :  !du "FTWARE"
0xfffff880056851c8 : 0x004f005200430049 :  !du "ICROSOFT"
0xfffff880056851d8 : 0xfffff800030f68d5 : nt!RtlGetExtendedContextLength+0x19
0xfffff88005685228 : 0xfffff8000309e8ff : nt!MiAllocateWsle+0x13f
0xfffff88005685278 : 0xfffff800030ffba6 : nt!MiResolveTransitionFault+0x406
0xfffff880056852b8 : 0xfffff800030ffba6 : nt!MiResolveTransitionFault+0x406
0xfffff88005685308 : 0xfffff800030ebe1f : nt!MiDispatchFault+0x95f
0xfffff88005685328 : 0xfffff8000330c600 : nt!MmPagedPoolWs
0xfffff88005685398 : 0xfffff800030cd48e : nt!KiExceptionDispatch+0xce

Try removing this software and see if it makes a difference.
 
Top