re: BSoD: "iastorv.sys" - Vista x64 SP2
Hi,
We have two DMP files and two different bug checks:
PAGE_FAULT_IN_NONPAGED_AREA (50)
This indicates that invalid system memory has been referenced.
Bug check 0x50 usually occurs after the installation of faulty hardware or in the event of failure of installed hardware (usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM).
Another common cause is the installation of a faulty system service.
Antivirus software can also trigger this error, as can a corrupted NTFS volume.
Let's take a look at the call stack:
Code:
1: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffffa60`005a4fc8 fffff800`032d1c06 : 00000000`00000050 fffffa81`064411c0 00000000`00000000 fffffa60`005a50b0 : nt!KeBugCheckEx
fffffa60`005a4fd0 fffff800`0326ccd9 : 00000000`00000000 fffffa80`0580d000 fffffa60`00020000 00000000`00002000 : nt! ?? ::FNODOBFM::`string'+0x2c4dd
fffffa60`005a50b0 fffffa60`011bb3f0 : fffffa60`011b60fa 00000000`00002000 00000000`00001000 00000000`fffff000 : nt!KiPageFault+0x119 (TrapFrame @ fffffa60`005a50b0)
fffffa60`005a5248 fffffa60`011b60fa : 00000000`00002000 00000000`00001000 00000000`fffff000 fffffa80`051c9d30 : [COLOR=#ff0000][I][B]ecache!memcpy+0xb0[/B][/I][/COLOR]
fffffa60`005a5250 fffffa60`011b6524 : 00000000`00000000 fffffa80`061a89e0 00000000`00000000 fffffa80`72436345 : [COLOR=#ff0000][I][B]ecache!EcCacheBlockCopyCompletionData+0x31a[/B][/I][/COLOR]
fffffa60`005a5310 fffffa60`011b524f : 00000bdb`0005e600 fffffa60`00004000 fffffa60`00100000 00000054`38d8c000 : [COLOR=#ff0000][I][B]ecache!EcCacheIoDereference+0x380[/B][/I][/COLOR]
fffffa60`005a5c60 fffff800`0347a227 : 00000000`01a13ae2 fffffa80`063aebb0 00000000`00000080 fffffa60`011c3fd0 : [I][COLOR=#ff0000][B]ecache!EcCacheIoWorker+0x7db[/B][/COLOR][/I]
fffffa60`005a5d50 fffff800`032ab456 : fffffa60`019d2180 fffffa80`063aebb0 fffffa80`051e4720 00000000`00000002 : nt!PspSystemThreadStartup+0x57
fffffa60`005a5d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
We have a few
ecache.sys routines being called (Special Memory Device Cache system driver).
Code:
1: kd> .trap fffffa60`005a50b0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8008674000 rbx=0000000000000000 rcx=fffffa8008675000
rdx=00000000fddcc1c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa60011bb3f0 rsp=fffffa60005a5248 rbp=fffffa8008675000
r8=0000000000002000 r9=0000000000000100 r10=fffffa60005a5180
r11=fffffa8008675000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
[COLOR=#ff0000][I][B]ecache!memcpy+0xb0[/B][/I][/COLOR]
^^
memcpy is a function that copies the values of
num bytes from the location pointed by
source directly to the memory block pointed by
destination.
SYSTEM_SERVICE_EXCEPTION (3b)
This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.
BugCheck 3B, {c0000005, fffff8000326f6ef,
fffffa600b965ed0, 0}
Let's go ahead and run a .cxr on the 3rd parameter of the bug check:
Code:
1: kd> .cxr 0xfffffa600b965ed0
rax=fffffa800598dbb0 rbx=f7fffa8005890840 rcx=f7fffa8005890840
rdx=0000000000000101 rsi=fffffa8005afd010 rdi=fffffa800598dbb0
rip=fffff8000326f6ef rsp=fffffa600b966730 rbp=0000000000000001
r8=0000000000000801 r9=fffff800033a3160 r10=fffffa60005ecd80
r11=0000000000000002 r12=fffffa600b9668b0 r13=fffffa600a108158
r14=fffffa8005afd248 r15=0000000000000002
iopl=0 nv up di ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010086
[COLOR=#ff0000][I][B]nt!ExAcquireResourceExclusiveLite+0x1f[/B][/I][/COLOR]
Let's run ln on the address of the instruction which caused the bugcheck (2nd parameter):
Code:
1: kd> ln fffff8000326f6ef
(fffff800`0326f6d0) [COLOR=#ff0000][I][B]nt!ExAcquireResourceExclusiveLite+0x1f[/B][/I][/COLOR] | (fffff800`03272e68) nt!ExEnterPriorityRegionAndAcquireResourceExclusive
It appears the exception is consistently occurring in
nt!ExAcquireResourceExclusiveLite+0x1f, which is a routine that acquires the given resource for exclusive access by the calling thread.
(I just discovered you can add horizontal lines... neat)
1. Remove and replace avast! with Microsoft Security Essentials for temporary troubleshooting purposes:
avast! removal - avast! Uninstall Utility | Download aswClear for avast! Removal
MSE - Microsoft Security Essentials - Microsoft Windows
2. hotcore3.sys - Tue Jul 29 17:58:17 2008
^^ HotBackup by Paragon Software Group. I would go ahead and uninstall this software (at least temporarily) as it may very well be causing conflicts.
3. Uninstall SmartDefrag ASAP. You may also want to know that IObit steals intellectual property -
https://forums.malwarebytes.org/index.php?showtopic=29681
Regards,
Patrick
