What's new

[7SP1 x64] Random BSODs when waking from sleep and other

bwv848

BSOD Kernel Dump Analyst
Joined
Dec 24, 2017
Messages
20
Location
92.96 million miles away from the sun
Hi,

Not to interrupt you guys here, but it appears to be that your disk may be the real culprit here. Here are a few excerpts of disk errors I've found in the Event Log.
Code:
Event[50040]:
  Log Name: System
  Source: Ntfs
  Date: 2017-11-19T21:10:00.251
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Pali-PC
  Description: 
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume2.
Code:
Event[54523]:
  Log Name: System
  Source: Disk
  Date: 2017-12-02T22:33:45.637
  Event ID: 51
  Task: N/A
  Level: Warning
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Pali-PC
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation.
Code:
Event[49999]:
  Log Name: System
  Source: Disk
  Date: 2017-11-19T13:25:55.716
  Event ID: 11
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Pali-PC
  Description: 
The driver detected a controller error on \Device\Harddisk2\DR2.
Do you know whether if this is your SSD or HDD? Disk Management should be able to tell you that. If it's the SSD (which I believe it is), update the firmware and see whether if the system improves. If it's the HDD, I counsel you to back up all your data on it and possibly replace it, or physically remove it from the system. It's most likely failing — remember software tests are never 100% accurate. You may consider running CHKDSK, but (in my experience) it may make things worse.
 

axe0

Forum Moderator, BSOD Kernel Dump Expert, Contributor
Staff member
Joined
May 21, 2015
Messages
756
Location
The Netherlands
Disk 2 looks to be the SSD, or the C: partition.
Code:
Description	Disk driveManufacturer	(Standard disk drives)
Model	KINGSTON SV300S37A240G SCSI Disk Device
Bytes/Sector	512
Media Loaded	Yes
Media Type	Fixed hard disk
Partitions	1
SCSI Bus	4
SCSI Logical Unit	0
SCSI Port	0
SCSI Target ID	0
Sectors/Track	63
Size	223,57 GB (240 054 796 800 bytes)
Total Cylinders	29 185
Total Sectors	468 857 025
Total Tracks	7 442 175
Tracks/Cylinder	255
Partition	Disk #1, Partition #0
Partition Size	223,37 GB (239 843 934 208 bytes)
Partition Starting Offset	210 763 776 bytes

Checking the attributes of the SSD and running chkdsk might be worth it.

To check the attributes, you could use Samsung Magician or CrystalDiskInfo and see if there are any problems or marked attributes.
 

johnymrazko

Member
Joined
Dec 3, 2017
Messages
15
Here is chkdsk result on ssd

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
347392 file records processed. File verification completed.
961 large file records processed. 0 bad file records processed. 2 EA records processed. 54 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
435156 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
347392 file SDs/SIDs processed. Cleaning up 85 unused index entries from index $SII of file 0x9.
Cleaning up 85 unused index entries from index $SDH of file 0x9.
Cleaning up 85 unused security descriptors.
Security descriptor verification completed.
43883 data files processed. CHKDSK is verifying Usn Journal...
34962240 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
347376 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
23881810 free clusters processed. Free space verification is complete.
Windows has checked the file system and found no problems.

234222591 KB total disk space.
138050776 KB in 280259 files.
188184 KB in 43884 indexes.
0 KB in bad sectors.
456391 KB in use by the system.
65536 KB occupied by the log file.
95527240 KB available on disk.

4096 bytes in each allocation unit.
58555647 total allocation units on disk.
23881810 allocation units available on disk.

Internal Info:
00 4d 05 00 3a f2 04 00 04 56 09 00 00 00 00 00 .M..:....V......
ce 01 00 00 36 00 00 00 00 00 00 00 00 00 00 00 ....6...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.
 

johnymrazko

Member
Joined
Dec 3, 2017
Messages
15
Here is dump even after ssd firmware update


Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\Windows\symbol_cache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23915.amd64fre.win7sp1_ldr.170913-0600
Machine Name:
Kernel base = 0xfffff800`0321a000 PsLoadedModuleList = 0xfffff800`0345c750
Debug session time: Fri Jan 5 16:37:12.053 2018 (UTC + 1:00)
System Uptime: 0 days 0:32:16.036
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`fffdf018). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff8a005b186a0, fffff8a005b186a0, fffff8a0059186a0}

*** ERROR: Module load completed but symbols could not be loaded for avgMonFlt.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+76b )

Followup: Pool_corruption
---------

6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a005b186a0, the pool entry being checked.
Arg3: fffff8a005b186a0, the read back flink freelist value (should be the same as 2).
Arg4: fffff8a0059186a0, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR: 0x19_3

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: AVGSvc.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff800033c071f to fffff8000328ae00

STACK_TEXT:
fffff880`0d3b84a8 fffff800`033c071f : 00000000`00000019 00000000`00000003 fffff8a0`05b186a0 fffff8a0`05b186a0 : nt!KeBugCheckEx
fffff880`0d3b84b0 fffff800`033c21b1 : 00000000`00000000 fffff8a0`067f7650 fffff8a0`019a9100 fffff800`032b8e6d : nt!ExFreePool+0x76b
fffff880`0d3b8540 fffff800`03267392 : 00000000`0207aac0 fffffa80`16ead870 fffffa80`68507641 fffff880`0144e444 : nt!ExFreePoolWithTag+0x411
fffff880`0d3b85f0 fffff880`05cb221a : 00000000`00000000 00000000`00000000 fffff8a0`067f7660 fffff8a0`019a9010 : nt!RtlDeleteElementGenericTableAvl+0x4e
fffff880`0d3b8620 fffff880`05cc3ca6 : fffff880`0d3b8778 fffffa80`1317f180 fffffa80`16e7e370 00000000`00000009 : avgMonFlt+0xd21a
fffff880`0d3b8650 fffff880`0134a987 : 00000000`00004968 fffffa80`133ab300 fffffa80`180bb110 fffffa80`15c1d170 : avgMonFlt+0x1eca6
fffff880`0d3b86c0 fffff880`0137089c : fffff880`0d3b87c0 00000000`0207aa01 fffffa80`18ffcd90 00000000`00004968 : fltmgr!FltpFilterMessage+0xc7
fffff880`0d3b8710 fffff880`01374ca2 : fffffa80`18ffcd90 00000000`0207aac0 00000000`0207aac0 fffff8a0`019a9010 : fltmgr!FltpMsgDeviceControl+0xdc
fffff880`0d3b8770 fffff880`0134999f : fffffa80`12f04310 00000000`00000000 fffffa80`16ead870 fffffa80`17d0bc30 : fltmgr!FltpMsgDispatch+0xd2
fffff880`0d3b87f0 fffff800`03599e4a : 00000000`00000002 00000000`00000000 fffffa80`16ead870 fffffa80`18ffcd90 : fltmgr! ?? ::FNODOBFM::`string'+0x2e80
fffff880`0d3b8850 fffff800`035ae35c : fffffa80`16ead870 fffffa80`16ead870 fffffa80`16ead870 fffff880`03502180 : nt!IopSynchronousServiceTail+0xfa
fffff880`0d3b88c0 fffff800`035ae3f6 : fffffa80`133ab2d0 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0xc49
fffff880`0d3b8a00 fffff800`0328a093 : fffffa80`141126a0 00000000`00000001 fffffa80`15d86600 fffff800`03587b14 : nt!NtDeviceIoControlFile+0x56
fffff880`0d3b8a70 00000000`75502e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01a7e998 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75502e09


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePool+76b
fffff800`033c071f cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePool+76b

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION: 6.1.7601.23915

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b

BUCKET_ID: X64_0x19_3_nt!ExFreePool+76b

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x19_3_nt!exfreepool+76b

FAILURE_ID_HASH: {ab733f4b-3d44-7e7f-b6aa-ca74429c9e0d}

Followup: Pool_corruption
---------
 

johnymrazko

Member
Joined
Dec 3, 2017
Messages
15
Here is the new dump . Should i buy new ssd?

Microsoft (R) Windows Debugger Version 6.3.9600.17336 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available


************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\Windows\symbol_cache*Symbol information
Symbol search path is: SRV*C:\Windows\symbol_cache*Symbol information
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.24000.amd64fre.win7sp1_ldr.171231-1547
Machine Name:
Kernel base = 0xfffff800`0324c000 PsLoadedModuleList = 0xfffff800`0348ba90
Debug session time: Sat Feb 10 19:35:47.104 2018 (UTC + 1:00)
System Uptime: 0 days 9:17:58.088
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000007ff`fffda018). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8a066f13554, 0, fffff88001457fd0, 5}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for em006_64.dll -
*** ERROR: Module load completed but symbols could not be loaded for ehdrv.sys
Probably caused by : em006_64.dll ( em006_64!module_init_entry+ac7e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


READ_ADDRESS: fffff8a066f13554 Paged pool

FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]

MM_INTERNAL_CODE: 5

IMAGE_NAME: em006_64.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660

FAULTING_MODULE: fffff88001449000 Ntfs

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: ekrn.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0

STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a


STACK_COMMAND: kb

FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: em006_64!module_init_entry+ac7e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: em006_64

IMAGE_VERSION: 0.0.1175.0

FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e

FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


READ_ADDRESS: fffff8a066f13554 Paged pool

FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]

MM_INTERNAL_CODE: 5

IMAGE_NAME: em006_64.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660

FAULTING_MODULE: fffff88001449000 Ntfs

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: ekrn.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0

STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a


STACK_COMMAND: kb

FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: em006_64!module_init_entry+ac7e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: em006_64

IMAGE_VERSION: 0.0.1175.0

FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e

FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a066f13554, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001457fd0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


READ_ADDRESS: fffff8a066f13554 Paged pool

FAULTING_IP:
Ntfs!memcmp+30
fffff880`01457fd0 8a01 mov al,byte ptr [rcx]

MM_INTERNAL_CODE: 5

IMAGE_NAME: em006_64.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 5a722660

FAULTING_MODULE: fffff88001449000 Ntfs

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: ekrn.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

TRAP_FRAME: fffff8800d05e9f0 -- (.trap 0xfffff8800d05e9f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800d05ee90 rbx=0000000000000000 rcx=fffff8a066f13554
rdx=ffffffffa21c24ba rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001457fd0 rsp=fffff8800d05eb88 rbp=00000000000000ea
r8=0000000000000004 r9=0000000000000000 r10=0000000000000017
r11=fffff8800d05ebd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
Ntfs!memcmp+0x30:
fffff880`01457fd0 8a01 mov al,byte ptr [rcx] ds:fffff8a0`66f13554=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800033c43a6 to fffff800032f23a0

STACK_TEXT:
fffff880`0d05e898 fffff800`033c43a6 : 00000000`00000050 fffff8a0`66f13554 00000000`00000000 fffff880`0d05e9f0 : nt!KeBugCheckEx
fffff880`0d05e8a0 fffff800`032ffa8a : 00000000`00000000 fffff8a0`66f13554 00000000`00000000 fffff8a0`02f1a910 : nt!MmAccessFault+0x736
fffff880`0d05e9f0 fffff880`01457fd0 : fffff880`014f11c3 fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 : nt!KiPageFault+0x44a
fffff880`0d05eb88 fffff880`014f11c3 : fffff880`0cf26960 fffff8a0`00372140 fffffa80`191bb180 fffff880`0cf26b70 : Ntfs!memcmp+0x30
fffff880`0d05eb90 fffff880`014efb72 : fffffa80`1fd710f0 fffffa80`191bc358 fffff8a0`00372140 fffff8a0`02f2fa01 : Ntfs!NtfsFindPrefixHashEntry+0x2fa
fffff880`0d05ecc0 fffff880`014ee125 : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0d05ee90 fffff880`0d05eeb0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`0d05ed90 fffff880`0145849d : fffffa80`1fd710f0 fffffa80`1eac6c60 fffff880`0cf26960 fffffa80`1da4c400 : Ntfs!NtfsCommonCreate+0x865
fffff880`0d05ef30 fffff800`032f5807 : fffff880`0cf268d0 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d05ef60 fffff800`032f57c8 : 00000000`00000000 fffff880`0d05f000 00000000`00000000 fffff800`03276207 : nt!KxSwitchKernelStackCallout+0x27
fffff880`0cf26790 fffff800`03276207 : fffff8a0`02f2fe10 00000000`00000000 80000004`db006863 fffffa80`1da4c4a1 : nt!KiSwitchKernelStackContinue
fffff880`0cf267b0 fffff880`01458c1f : fffff880`01458480 fffff880`0cf268d0 fffffa80`1e9f1d01 fffff880`014f7b00 : nt!KeExpandKernelStackAndCalloutEx+0x437
fffff880`0cf268a0 fffff880`014f053c : 00000000`00000000 00000000`00000000 fffff880`0cf26b00 fffffa80`1eac6c60 : Ntfs!NtfsCommonCreateOnNewStack+0x4f
fffff880`0cf26900 fffff880`0100283f : fffffa80`191bb030 fffffa80`1eac6c60 00000000`00000000 00000000`00000000 : Ntfs!NtfsFsdCreate+0x1ac
fffff880`0cf26ab0 fffff880`010202b9 : fffffa80`1eac6c60 fffffa80`191b7010 fffffa80`1eac6c00 fffffa80`190a7de0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0cf26b40 fffff800`037397a2 : 00000000`00000005 00000000`00000040 fffffa80`1e107600 00000000`00000000 : fltmgr!FltpCreate+0x2a9
fffff880`0cf26bf0 fffff800`03662554 : fffffa80`19060cd0 00000000`00000000 fffffa80`1de11450 00000000`00000701 : nt!IopParseDevice+0x14e2
fffff880`0cf26d50 fffff800`0354d076 : 00000000`00000000 fffff880`0cf26ed0 fffffa80`00000040 fffffa80`18babf30 : nt!ObpLookupObjectName+0x784
fffff880`0cf26e50 fffff800`03708708 : 00000000`00000001 00000000`00000000 fffffa80`656c6901 fffffa80`1eac6c60 : nt!ObOpenObjectByName+0x306
fffff880`0cf26f20 fffff800`0359973a : 00000000`068ae180 fffff800`00100001 00000000`068ae2c0 00000000`00000000 : nt!IopCreateFile+0xa08
fffff880`0cf26fd0 fffff880`041ae3ae : 00000000`068ae530 fffff880`0cf27200 00000000`00000000 00000000`068ae300 : nt!IoCreateFile+0x8a
fffff880`0cf27060 fffff880`041a71f1 : fffff880`0cf276f8 00000000`068ae180 00000000`00000000 fffff880`0cf27350 : em006_64!module_init_entry+0xac7e
fffff880`0cf27100 fffff880`041a36c3 : 00000000`068ae180 00000000`004b3064 fffffa80`190bad70 00000000`0000004c : em006_64!module_init_entry+0x3ac1
fffff880`0cf276a0 fffff880`0418589d : fffffa80`00002134 00000000`068ae180 00000000`0000004c 00000000`068ae180 : em006_64+0x16c3
fffff880`0cf276f0 fffff880`04180f7e : 00001e73`00000005 fffffa80`1e589460 00000000`068ae180 00000000`0000004c : ehdrv+0x1b89d
fffff880`0cf27740 fffff880`04180e0a : fffff880`0cf278a0 fffffa80`190bad70 fffff683`ff7a74e0 fffff800`032b1a27 : ehdrv+0x16f7e
fffff880`0cf277a0 fffff880`04180d88 : fffff880`0cf278a0 fffff880`0cf27b60 00000000`068ae180 00000000`0000004c : ehdrv+0x16e0a
fffff880`0cf27820 fffff880`041914b7 : 00000000`0000025c fffff800`0354e735 fffffa80`0e191200 000007fe`00000000 : ehdrv+0x16d88
fffff880`0cf27860 fffff800`0370a6ee : fffffa80`1bda8f20 00000000`00000000 00000000`00000000 00000000`068ae170 : ehdrv+0x274b7
fffff880`0cf278c0 fffff800`0359de26 : 00000000`00000090 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x6be
fffff880`0cf27a00 fffff800`03302283 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`068ae368 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf27a70 00000000`770a991a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`068ae118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x770a991a


STACK_COMMAND: kb

FOLLOWUP_IP:
em006_64!module_init_entry+ac7e
fffff880`041ae3ae e983010000 jmp em006_64!module_init_entry+0xae06 (fffff880`041ae536)

SYMBOL_STACK_INDEX: 14

SYMBOL_NAME: em006_64!module_init_entry+ac7e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: em006_64

IMAGE_VERSION: 0.0.1175.0

FAILURE_BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

BUCKET_ID: X64_0x50_em006_64!module_init_entry+ac7e

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:x64_0x50_em006_64!module_init_entry+ac7e

FAILURE_ID_HASH: {13fb2f1e-7c73-7eb6-410b-7a4b6f1adc2c}

Followup: MachineOwner
 

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Messages
18,379
Location
Croatia
Looks like ESET has caused it. Are you using it?
 

softwaremaniac

Moderator, BSOD Kernel Dump Expert, Windows Update Instructor
Staff member
Joined
Oct 9, 2014
Messages
18,379
Location
Croatia
What does Samsung Magician say about drive's health?
 

HyperHenry

Active member
Joined
Feb 12, 2018
Messages
40
Location
Currently Texas
I would still run Chrystal Disk Info as suggested in post #23. Looking at the SMART values is better than guessing. I'd also recommend disabling sleep as on a PC it's not needed and can cause needless problems.
 

x BlueRobot

Moderator, BSOD Kernel Dump Expert, Contributor
Joined
May 7, 2013
Messages
1,878
Location
Minkowski Space
For any subsequent crashes, could you please attach the log files using the Sysnative file collection tool?
 
Top