Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

bendsha · Oct 24, 2015

OS - Windows Server 2008 R2
· Age of OS installation - 2015-04-08

· CPU
[01]: Intel64 Family 6 Model 62 Stepping 4 GenuineIntel ~2600Mhz
[02]: Intel64 Family 6 Model 62 Stepping 4 GenuineIntel ~2600Mhz

· System Manufacturer -Dell Inc.
· Exact model number (if laptop, check label on bottom) PowerEdge R720

Getting this bsod while run a disk filter driver (named kefence.sys) after 4 hour, but I do not think case by kefence.sys.

Here some information show by windbg after I load dump file:

BugCheck 7A, {fffff6fc4002c5d8, ffffffffc000003c, 6a227f860, fffff880058bb930}

add: NTSTATUS Code: 0xc000003c means STATUS_DATA_OVERRUN

Code:

0: kd> kb RetAddr : Args to Child : Call Site fffff800`018f2438 : 00000000`0000007a fffff6fc`4002c5d8 ffffffff`c000003c 00000006`a227f860 : nt!KeBugCheckEx fffff800`01870d8b : fffffa80`1b9cc8f0 fffff880`0526f120 fffff800`01a0a440 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x34cde fffff800`01899da4 : 00000000`00000000 00000000`00000008 ffffffff`ffffffff fffffa80`252fa940 : nt!MiIssueHardFault+0x28b fffff800`0187cfee : 00000000`00000008 fffffa80`1bbf1c80 fffffa80`252fac00 fffffa80`252fa940 : nt!MmAccessFault+0x11c4 fffff880`058bb930 : fffff880`0584520e fffffa80`1be9c860 00000000`00000000 00000000`37c8d300 : nt!KiPageFault+0x16e fffff880`0584520e : fffffa80`1be9c860 00000000`00000000 00000000`37c8d300 00000000`00000002 : HTTP!UxpTlDisassociateListenEndpoints fffff880`058453dd : fffffa80`1be8e470 fffffa80`37c8eb40 00000000`00000000 fffff800`01812df1 : HTTP!UxpTlCloseAddressEndpoint+0xe fffff880`05845ed2 : fffff8a0`0143ccf0 fffffa80`1be8e470 fffffa80`1be9c670 fffff800`01881fbb : HTTP!UxTlCloseEndpointRequest+0x3d fffff880`058bc23e : fffff8a0`0143ccf0 00000000`00000001 00000000`00000000 fffffa80`1ba36a40 : HTTP!UlRemoveSiteFromEndpointList+0x12 fffff880`058bc675 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`1be8e470 : HTTP!UlpTreeDeleteRegistration+0x5e fffff880`05845f83 : fffff8a0`0b95a010 00000000`000001b0 fffff8a0`030a31b0 00000000`00000000 : HTTP!UlpCleanAllUrls+0x25 fffff880`058bd08f : fffffa80`1ba36a78 fffffa80`37eee860 00000000`00000001 fffffa80`37c8db30 : HTTP!UlDeleteConfigGroup+0x33 fffff880`058bd112 : fffffa80`1ba36a40 fffff880`05840d61 00000000`64536553 fffffa80`37eee860 : HTTP!UlpDeleteAllConfigGroups+0x1f fffff880`058bd1af : 00000000`00000000 fffffa80`37c8d340 00000000`00000000 fffffa80`37eee860 : HTTP!UlpDeleteServerSession+0x62 fffff880`05847f2b : fffffa80`37c8d340 fffffa80`37c8db30 fffffa80`37c8d340 00000000`00000001 : HTTP!UlDeleteAutoServerSession+0x5f fffff880`058c056f : fffff8a0`c0000120 fffffa80`21af2d20 fffffa80`37c8db30 00000000`00000000 : HTTP!UlDetachProcessFromAppPool+0x1cb fffff800`01b9268f : 00000000`00000000 fffffa80`37c8db30 00000000`00000000 fffffa80`1be8e470 : HTTP!UlCleanup+0x2f fffff800`01b78304 : 00000000`00000000 fffff8a0`010ac010 00000000`00000000 fffff800`018840bc : nt!IopCloseFile+0x11f fffff800`01b92181 : fffff8a0`010ac010 fffff8a0`00000001 fffff8a0`010ac010 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4 fffff800`01b3b870 : 00000000`0000067c fffff8a0`010ac010 fffff8a0`0139d9f0 00000000`0000067c : nt!ObpCloseHandleTableEntry+0xb1 fffff800`01b3b7e4 : 00000000`00000404 00000000`00000000 fffffa80`37c8db30 fffff800`01b24f21 : nt!ObpCloseHandleProcedure+0x30 fffff800`01b3a6ae : fffff8a0`0131a901 fffff880`0526fbe0 fffffa80`37c8db30 fffffa80`37c8dc01 : nt!ExSweepHandleTable+0x74 fffff800`01b61724 : fffff8a0`0131a940 00000000`00000000 00000000`00000000 fffffa80`194c2510 : nt!ObKillProcess+0x62 fffff800`01b3bb3d : 00000000`c0000005 fffff800`01886001 000007ff`fffd8000 fffffa80`1bf3a400 : nt!PspExitThread+0x3f4 fffff800`0185ba43 : 00000000`00000000 fffffa80`37c8e9f0 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d fffff800`0185be80 : 00000000`76e94298 fffff880`0526faa0 fffff800`01b3c710 00000000`00000001 : nt!KiDeliverApc+0x2eb fffff800`0187e1f7 : fffffa80`37c902b0 00000000`76e94270 00000000`000000c0 fffffa80`37d44060 : nt!KiInitiateUserApc+0x70 00000000`76de17ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de17ba

Code:

0: kd> !pte fffff6fc4002c5d8 VA fffff880058bb000 PXE at FFFFF6FB7DBEDF88 PPE at FFFFF6FB7DBF1000 PDE at FFFFF6FB7E200160 PTE at FFFFF6FC4002C5D8 contains 000000040CF04863 contains 000000040CF03863 contains 0000000407548863 contains 00000006A227F860 pfn 40cf04 ---DA--KWEV pfn 40cf03 ---DA--KWEV pfn 407548 ---DA--KWEV not valid Transition: 6a227f Protect: 3 - ExecuteRead

could you give me some suggest?

Thanks.

bendsha · Oct 24, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Here is SysnativeFileCollectionApp file.

bendsha · Oct 24, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Memory dump file is too larger, It's 250MB after comperssed to zip.
I try upload many times but all failed, Do you have any good idea?

bendsha · Oct 24, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Memory Dump File sliced：0-7

bendsha · Oct 24, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

I'm suspect this problem case by large disk load.

I upload memory dump file to my network disk: ????? - ???

if you can not down load these file, you can contact with me[FONT=Tahoma, Arial].[/FONT]

bendsha · Oct 25, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

I will use verifier to catch it if necessary.

bendsha · Oct 28, 2015

Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR

OS - Windows Server 2008 R2
· Age of OS installation - 2015-04-08

· CPU
[01]: Intel64 Family 6 Model 62 Stepping 4 GenuineIntel ~2600Mhz
[02]: Intel64 Family 6 Model 62 Stepping 4 GenuineIntel ~2600Mhz

· System Manufacturer -Dell Inc.
· Exact model number (if laptop, check label on bottom) PowerEdge R720

I have check disk and memory, but find nothing.

Could you give me some suggest?

Thanks.

bendsha · Oct 28, 2015

Re: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR

There is a minidump file in package, you can contact with me if you need memory dump file.

e-mail: bendsha@outlook.com

Thanks.

bendsha · Oct 29, 2015

Re: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR

perfmon report file

blueelvis · Oct 30, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Greetings Bendsha ^_^,

I have merged the threads. Please do not create multiple threads.

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

Code:

**************************Wed Oct 28 12:27:17.496 2015 (UTC + 5:30)**************************
Loading Dump File [C:\SysnativeBSODApps\102815-19032-01.dmp]
 
Windows 7 Kernel Version 7600 MP (32 procs) Free x64
 
Missing Windows 7 Service Pack 1
 
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
 
System Uptime: 1 days 3:39:08.074
 
*** WARNING: Unable to verify timestamp for win32k.sys
 
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
 
Probably caused by : memory_corruption
 
BugCheck 7A, {fffff6fc40031ed0, ffffffffc000003c, 3eab3f860, fffff880063daef0}
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x0000007A]KERNEL_DATA_INPAGE_ERROR (7a)[/url]
 
Arguments: 
Arg1: fffff6fc40031ed0, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000003c, error status (normally i/o status code)
Arg3: 00000003eab3f860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff880063daef0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
BUGCHECK_STR:  0x7a_c000003c
 
PROCESS_NAME:  eefprocess.exe
 
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096
 
CPUID:        "Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz"
 
MaxSpeed:     2600
 
CurrentSpeed: 2600
 
  BIOS Version                  2.4.3
 
  BIOS Release Date             07/09/2014
 
  Manufacturer                  Dell Inc.
 
  Product Name                  PowerEdge R720
 
  Baseboard Product             068CDY
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

When I opened the dump file in WinDBG, I saw the below corruptions in fileinfo.sys -

Code:

CHKIMG_EXTENSION: !chkimg -lo 50 -d !fileinfo    fffff880063da000-fffff880063da008  9 bytes - fileinfo!FIPfInterfaceOpen+228
	[ 00 bf 08 07 00 c0 e9 0b:20 00 42 00 6f 00 6c 00 ]
    fffff880063da00a-fffff880063da00f  6 bytes - fileinfo!FIPfInterfaceOpen+232 (+0x0a)
	[ 00 0f ba 65 48 0d:20 00 28 00 54 00 ]
    fffff880063da011-fffff880063da022  18 bytes - fileinfo!FIPfInterfaceOpen+239 (+0x07)
	[ 27 48 8b 4d 20 48 8d 15:00 75 00 65 00 54 00 79 ]
    fffff880063da024-fffff880063da02c  9 bytes - fileinfo!FIPfInterfaceOpen+24c (+0x13)
	[ 00 48 3b c6 74 0f bb 02:72 00 6f 00 77 00 61 00 ]
    fffff880063da02e-fffff880063da030  3 bytes - fileinfo!FIPfInterfaceOpen+256 (+0x0a)
	[ 00 bf bb:6c 00 69 ]
    fffff880063da032-fffff880063da042  17 bytes - fileinfo!FIPfInterfaceOpen+25a (+0x04)
	[ 00 c0 e9 03 ff ff ff 48:61 00 55 00 50 00 43 00 ]
    fffff880063da044-fffff880063da04a  7 bytes - fileinfo!FIPfInterfaceOpen+26c (+0x12)
	[ 00 4c 8d 84 24 a8 00:20 00 49 00 74 00 61 ]
    fffff880063da04c-fffff880063da052  7 bytes - fileinfo!FIPfInterfaceOpen+274 (+0x08)
	[ 00 48 8d 94 24 98 01:6c 00 69 00 63 00 20 ]
    fffff880063da054-fffff880063da05c  9 bytes - fileinfo!FIPfInterfaceOpen+27c (+0x08)
	[ 00 48 89 74 24 20 e8 cd:28 00 54 00 72 00 75 00 ]
    fffff880063da05e-fffff880063da066  9 bytes - fileinfo!FIPfInterfaceOpen+286 (+0x0a)
	[ 00 3b c6 8b f8 7d 0a bb:54 00 79 00 70 00 65 00 ]
    fffff880063da06a-fffff880063da074  11 bytes - fileinfo!FIPfInterfaceOpen+292 (+0x0c)
	[ e9 cd fe ff ff 48 8b 84:43 00 6f 00 72 00 64 00 ]
    fffff880063da076-fffff880063da07c  7 bytes - fileinfo!FIPfInterfaceOpen+29e (+0x0c)
	[ 00 f0 01 98 10 01 00:55 00 50 00 43 00 20 ]
    fffff880063da07e-fffff880063da084  7 bytes - fileinfo!FIPfInterfaceOpen+2a6 (+0x08)
	[ 48 8b b4 24 98 01 00:28 00 54 00 72 00 75 ]
    fffff880063da086-fffff880063da08e  9 bytes - fileinfo!FIPfInterfaceOpen+2ae (+0x08)
	[ 4c 39 66 60 75 0f bf bb:65 00 54 00 79 00 70 00 ]
    fffff880063da090-fffff880063da092  3 bytes - fileinfo!FIPfInterfaceOpen+2b8 (+0x0a)
	[ c0 bb 07:29 00 00 ]
    fffff880063da094 - fileinfo!FIPfInterfaceOpen+2bc (+0x04)
	[ 00:43 ]
    fffff880063da096-fffff880063da098  3 bytes - fileinfo!FIPfInterfaceOpen+2be (+0x02)
	[ e9 f6 03:6f 00 72 ]
    fffff880063da09a-fffff880063da0ac  19 bytes - fileinfo!FIPfInterfaceOpen+2c2 (+0x04)
	[ 00 45 33 e4 f0 44 09 24:64 00 69 00 61 00 55 00 ]
    fffff880063da0ae-fffff880063da0b4  7 bytes - fileinfo!FIPfInterfaceOpen+2d6 (+0x14)
	[ 84 5e 7c 75 0f bf bb:64 00 20 00 28 00 54 ]
    fffff880063da0b6-fffff880063da0ba  5 bytes - fileinfo!FIPfInterfaceOpen+2de (+0x08)
	[ 00 c0 bb 08 00:72 00 75 00 65 ]
    fffff880063da0bc-fffff880063da0c0  5 bytes - fileinfo!FIPfInterfaceOpen+2e4 (+0x06)
	[ 00 e9 cf 03 00:54 00 79 00 70 ]
    fffff880063da0c2-fffff880063da0c6  5 bytes - fileinfo!FIPfInterfaceOpen+2ea (+0x06)
	[ 48 8d 8e 08 01:65 00 29 00 00 ]
    fffff880063da0c8-fffff880063da0cc  5 bytes - fileinfo!FIPfInterfaceOpen+2f0 (+0x06)
	[ 00 4c 8d ae d8:43 00 6f 00 72 ]
    fffff880063da0ce - fileinfo!FIPfInterfaceOpen+2f6 (+0x06)
	[ 00:64 ]
    fffff880063da0d0-fffff880063da0d4  5 bytes - fileinfo!FIPfInterfaceOpen+2f8 (+0x02)
	[ 4c 8d b6 80 00:69 00 61 00 55 ]
    fffff880063da0d6-fffff880063da0e6  17 bytes - fileinfo!FIPfInterfaceOpen+2fe (+0x06)
	[ 00 4c 39 21 0f 84 0f ff:50 00 43 00 20 00 42 00 ]
    fffff880063da0e8-fffff880063da0ee  7 bytes - fileinfo!FIPfInterfaceOpen+310 (+0x12)
	[ 49 8b d6 e8 bc 0c 00:74 00 61 00 6c 00 69 ]
    fffff880063da0f0-fffff880063da100  17 bytes - fileinfo!FIPfInterfaceOpen+318 (+0x08)
	[ 41 3b c4 8b f8 0f 8d f4:63 00 20 00 28 00 54 00 ]
    fffff880063da102-fffff880063da107  6 bytes - fileinfo!FIPfInterfaceOpen+32a (+0x12)
	[ 44 8a a4 24 80 01:70 00 65 00 29 00 ]
    fffff880063da10a-fffff880063da10c  3 bytes - fileinfo!FIPfInterfaceOpen+332 (+0x08)
	[ e9 91 03:43 00 6f ]
    fffff880063da10e-fffff880063da13a  45 bytes - fileinfo!FIPfInterfaceOpen+336 (+0x04)
	[ 00 41 01 5d 28 41 8b fc:72 00 64 00 69 00 61 00 ]
    fffff880063da13c-fffff880063da142  7 bytes - fileinfo!FIPfInterfaceOpen+364 (+0x2e)
	[ 00 48 8d 8c 24 e0 00:65 00 29 00 00 00 44 ]
    fffff880063da144-fffff880063da14a  7 bytes - fileinfo!FIPfInterfaceOpen+36c (+0x08)
	[ 00 44 8a fb e8 97 2e:69 00 6c 00 6c 00 65 ]
    fffff880063da14c-fffff880063da156  11 bytes - fileinfo!FIPfInterfaceOpen+374 (+0x08)
	[ 00 41 3b c4 8b f8 7d 0a:6e 00 69 00 61 00 55 00 ]
    fffff880063da158-fffff880063da15c  5 bytes - fileinfo!FIPfInterfaceOpen+380 (+0x0c)
	[ 00 e9 33 03 00:20 00 28 00 54 ]
    fffff880063da15e-fffff880063da16a  13 bytes - fileinfo!FIPfInterfaceOpen+386 (+0x06)
	[ 8b 45 48 0f ba 6d 28 09:72 00 75 00 65 00 54 00 ]
    fffff880063da16c - fileinfo!FIPfInterfaceOpen+394 (+0x0e)
	[ 00:29 ]
    fffff880063da16e-fffff880063da178  11 bytes - fileinfo!FIPfInterfaceOpen+396 (+0x02)
	[ 48 89 54 24 78 c7 44 24:00 00 44 00 69 00 6c 00 ]
    fffff880063da17a-fffff880063da19a  33 bytes - fileinfo!FIPfInterfaceOpen+3a2 (+0x0c)
	[ 00 44 89 64 24 68 4c 89:6e 00 69 00 61 00 55 00 ]
    fffff880063da19c-fffff880063da1a2  7 bytes - fileinfo!FIPfInterfaceOpen+3c4 (+0x22)
	[ 00 4c 8d 8c 24 88 00:75 00 65 00 54 00 79 ]
    fffff880063da1a4-fffff880063da1a9  6 bytes - fileinfo!FIPfInterfaceOpen+3cc (+0x08)
	[ 00 4c 8d 84 24 98:70 00 65 00 29 00 ]
    fffff880063da1ac-fffff880063da1ba  15 bytes - fileinfo!FIPfInterfaceOpen+3d4 (+0x08)
	[ 00 89 5c 24 48 89 44 24:44 00 69 00 6c 00 6c 00 ]
    fffff880063da1bc-fffff880063da1cd  18 bytes - fileinfo!FIPfInterfaceOpen+3e4 (+0x10)
	[ 00 4c 89 64 24 38 48 89:55 00 50 00 43 00 20 00 ]
    fffff880063da1cf-fffff880063da1ea  28 bytes - fileinfo!FIPfInterfaceOpen+3f7 (+0x13)
	[ 48 8b 0d 2a a1 ff ff 33:00 54 00 72 00 75 00 65 ]
    fffff880063da1ec-fffff880063da1f4  9 bytes - fileinfo!FIPfInterfaceOpen+414 (+0x1d)
	[ 80 75 15 48 8b 8c 24 d8:65 00 6e 00 69 00 61 00 ]
    fffff880063da1f6-fffff880063da206  17 bytes - fileinfo!FIPfInterfaceOpen+41e (+0x0a)
	[ 00 49 3b cc 74 08 33 d2:50 00 43 00 20 00 42 00 ]
    fffff880063da208-fffff880063da20c  5 bytes - fileinfo!FIPfInterfaceOpen+430 (+0x12)
	[ 00 e9 83 02 00:74 00 61 00 6c ]
    fffff880063da20e-fffff880063da210  3 bytes - fileinfo!FIPfInterfaceOpen+436 (+0x06)
	[ 3d 08 01:69 00 63 ]
    fffff880063da212-fffff880063da216  5 bytes - fileinfo!FIPfInterfaceOpen+43a (+0x04)
	[ 00 75 0f bf ae:20 00 28 00 54 ]
    fffff880063da218-fffff880063da21c  5 bytes - fileinfo!FIPfInterfaceOpen+440 (+0x06)
	[ 00 c0 bb 03 00:72 00 75 00 65 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
3785 errors : !fileinfo (fffff880063da000-fffff880063dafff)

Below is a list of 3rd party drivers present on the system -

Code:

**************************Wed Oct 28 12:27:17.496 2015 (UTC + 5:30)**************************
amdxata.sys                 Tue May 19 23:26:59 2009 (4A12F2EB)
intelppm.sys                Tue Jul 14 04:49:25 2009 (4A5BC0FD)
percsas2.sys                Tue Jun 19 02:40:03 2012 (4FDF992B)
b57nd60a.sys                Wed Sep  5 02:59:46 2012 (504672CA)
TsDefenseBT64.sys           Fri May  9 13:39:37 2014 (536C8D41)
kefence.sys                 Mon Apr 27 20:19:06 2015 (553E4C62)
TAOKernel64.sys             Tue Jun  9 11:42:51 2015 (557683E3)
tscpm64.sys                 Tue Jun  9 11:43:30 2015 (5576840A)
TSSysKit64.sys              Tue Jun  9 11:43:31 2015 (5576840B)
TFsFltX64.sys               Tue Jun  9 11:43:36 2015 (55768410)
QQSysMonX64.sys             Tue Jun  9 11:43:49 2015 (5576841D)
QMUdisk64.sys               Tue Sep 29 07:36:24 2015 (5609F220)

http://www.carrona.org/drivers/driver.php?id=amdxata.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=percsas2.sys
http://www.carrona.org/drivers/driver.php?id=b57nd60a.sys
TsDefenseBT64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
kefence.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TAOKernel64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
tscpm64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TSSysKit64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TFsFltX64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
QQSysMonX64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
QMUdisk64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.

I would suggest you to follow the below steps -

Kindly update your installation of WINDOWS since I don't see any updates installed on the system. Please make sure that you perform this step before proceeding ahead.
I would uninstall the AnyBackup software since as you saw that Kefence.sys was involved and this driver is associated with that program.
Kindly run the below instructions (Thanks usasma! ) -
Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt). Press Enter after each one:
Code:

Code:

Dism /Online /Cleanup-Image /ScanHealth
Code:

Code:

Dism /Online /Cleanup-Image /CheckHealth
If the problem is fixable, you can use this command to repair it (from an elevated (Run as administrator) Command Prompt). Press Enter after typing it:
Code:

Code:

Dism /Online /Cleanup-Image /RestoreHealth
From this article: Repair a Windows Image

Once you are done, also run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption.
Click to expand...

Let me know how this goes ^_^

-Pranav

bendsha · Nov 1, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

It return error code 87 after I enter Dism conmand runas administrator.

Get log form dism.log as follow:

Code:

[I][FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   PID=2972 Scratch directory set to 'C:\Users\ADMINI~1\AppData\Local\Temp\2\'. - CDISMManager::put_ScratchDir[/FONT][FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   PID=2972 Successfully loaded the ImageSession at "C:\Windows\System32\Dism" - CDISMManager::LoadImageSession[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Failed to get and initialize the PE Provider.  Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Getting Provider DISMLogger - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Getting Provider DISMLogger - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Manager: PID=2972 Successfully created the local image session and provider store. - CDISMManager::CreateLocalImageSession[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Getting Provider DISMLogger - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM.EXE: [/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM.EXE: <----- Starting Dism.exe session ----->[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM.EXE: [/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM.EXE: Host machine information: OS Version=6.1.7600, Running architecture=amd64, Number of processors=32[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM.EXE: Executing command line: dism  /online /cleanup-image /scanhealth[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Getting Provider FolderManager - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Loading Provider from location C:\Windows\System32\Dism\FolderProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Connecting to the provider located at C:\Windows\System32\Dism\FolderProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Getting Provider FolderManager - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:34, Info                  DISM   DISM Provider Store: PID=2972 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Manager: PID=2972 Successfully loaded the ImageSession at "C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A" - CDISMManager::LoadImageSession[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Image Session: PID=5552 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Initializing a provider store for the IMAGE session type. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\OSProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\OSProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM OS Provider: PID=5552 Defaulting SystemPath to C:\ - CDISMOSServiceManager::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM OS Provider: PID=5552 Defaulting Windows folder to C:\Windows - CDISMOSServiceManager::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\LogProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\LogProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider OSServices - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\PEProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Warning               DISM   DISM Provider Store: PID=5552 Failed to Load the provider: C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\PEProvider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x8007007e)[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Failed to get and initialize the PE Provider.  Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider DISMLogger - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Manager: PID=2972 Image session successfully loaded from the temporary location: C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A - CDISMManager::CreateImageSession[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider OSServices - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000001 Shim considered [l:256{128}]"\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000002 Shim considered [l:250{125}]"\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_SUCCESS[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Target image information: OS Version=6.1.7600.16385, Image architecture=amd64[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting the collection of providers from an image provider store type. - CDISMProviderStore::GetProviderCollection[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\CbsProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\CbsProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000001 Shim considered [l:256{128}]"\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000002 Shim considered [l:250{125}]"\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_SUCCESS[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 Finished initializing the CbsConUI Handler. - CCbsConUIHandler::Initialize[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000001 Shim considered [l:256{128}]"\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000002 Shim considered [l:250{125}]"\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_SUCCESS[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 CBS is being initialized for online use. More information about CBS actions can be located at: %windir%\logs\cbs\cbs.log - CDISMPackageManager::Initialize[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 Loaded servicing stack for online use only. - CDISMPackageManager::RefreshInstanceAndLock[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\MsiProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\MsiProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\IntlProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\IntlProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\DmiProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\DmiProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000001 Shim considered [l:256{128}]"\??\C:\Windows\Servicing\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  CSI    00000002 Shim considered [l:250{125}]"\??\C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\pkgmgr.exe" : got STATUS_SUCCESS[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM OS Provider: PID=5552 Successfully loaded the hive. - CDISMOSServiceManager::DetermineBootDrive[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Driver Manager: PID=5552 Further logs for driver related operations can be found in the target operating system at %WINDIR%\inf\setupapi.offline.log - CDriverManager::Initialize[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\UnattendProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\UnattendProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\SmiProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\SmiProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Loading Provider from location C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\TransmogProvider.dll - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Connecting to the provider located at C:\Users\ADMINI~1\AppData\Local\Temp\2\398F2C06-869D-4D83-B577-CE216F88030A\TransmogProvider.dll. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider DISM Package Manager - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider DISM Unattend Manager - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Got the collection of providers. Now enumerating them to build the command table.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Package Manager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DISM Package Manager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: OSServices[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: MsiManager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: MsiManager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: IntlManager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: IntlManager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DriverManager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DriverManager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Unattend Manager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DISM Unattend Manager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Log Provider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: SmiManager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: Edition Manager[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Transmog Provider: PID=5552 Current image session is [ONLINE] - CTransmogManager::GetMode[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: Edition Manager.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Getting Provider DISM Package Manager - CDISMProviderStore::GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 Processing the top level command token(cleanup-image). - CPackageManagerCLIHandler::Private_ValidateCmdLine[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 The option(scanhealth) is not recognized in this context. - CPackageManagerCLIHandler::Private_ValidateCmdLine[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 Further logs for online package and feature related operations can be found at %WINDIR%\logs\CBS\cbs.log - CPackageManagerCLIHandler::ExecuteCmdLine[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Image Session: PID=5552 Disconnecting the provider store - CDISMImageSession::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(DISM Package Manager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Package Manager: PID=5552 Finalizing CBS core. - CDISMPackageManager::Finalize[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: DISM Package Manager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Found the OSServices.  Waiting to finalize it until all other providers are unloaded. - CDISMProviderStore::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(MsiManager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: MsiManager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(IntlManager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: IntlManager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Found the PE Provider.  Waiting to finalize it until all other providers are unloaded. - CDISMProviderStore::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(DriverManager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: DriverManager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(DISM Unattend Manager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: DISM Unattend Manager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Found the OSServices.  Waiting to finalize it until all other providers are unloaded. - CDISMProviderStore::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(SmiManager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: SmiManager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Finalizing the servicing provider(Edition Manager) - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: Edition Manager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Releasing the local reference to OSServices. - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Disconnecting Provider: OSServices - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=5552 Releasing the local reference to DISMLogger.  Stop logging. - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: Image session has been closed. Reboot required=no.[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: [/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: <----- Ending Dism.exe session ----->[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM.EXE: [/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Image Session: PID=2972 Disconnecting the provider store - CDISMImageSession::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=2972 Disconnecting Provider: FolderManager - CDISMProviderStore::Internal_DisconnectProvider[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=2972 Found the OSServices.  Waiting to finalize it until all other providers are unloaded. - CDISMProviderStore::Final_OnDisconnect[/FONT]
[FONT=Verdana]2015-11-02 00:15:35, Info                  DISM   DISM Provider Store: PID=2972 Releasing the local reference to DISMLogger.  Stop logging. - CDISMProviderStore::Internal_DisconnectProvider[/FONT]

[/I]

I kown kefence.sys as well, may be It's suspect but I do not kown why this BSoD could be happen.

bendsha · Nov 1, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

blueelvis said:

Greetings Bendsha ^_^,

I have merged the threads. Please do not create multiple threads.

I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-

Code:

**************************Wed Oct 28 12:27:17.496 2015 (UTC + 5:30)**************************
Loading Dump File [C:\SysnativeBSODApps\102815-19032-01.dmp]
 
Windows 7 Kernel Version 7600 MP (32 procs) Free x64
 
Missing Windows 7 Service Pack 1
 
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
 
System Uptime: 1 days 3:39:08.074
 
*** WARNING: Unable to verify timestamp for win32k.sys
 
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
 
Probably caused by : memory_corruption
 
BugCheck 7A, {fffff6fc40031ed0, ffffffffc000003c, 3eab3f860, fffff880063daef0}
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#0x0000007A"]KERNEL_DATA_INPAGE_ERROR (7a)[/URL]
 
Arguments: 
Arg1: fffff6fc40031ed0, lock type that was held (value 1,2,3, or PTE address)
Arg2: ffffffffc000003c, error status (normally i/o status code)
Arg3: 00000003eab3f860, current process (virtual address for lock type 3, or PTE)
Arg4: fffff880063daef0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)
BUGCHECK_STR:  0x7a_c000003c
 
PROCESS_NAME:  eefprocess.exe
 
FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_LARGE_4096
 
CPUID:        "Intel(R) Xeon(R) CPU E5-2650 v2 @ 2.60GHz"
 
MaxSpeed:     2600
 
CurrentSpeed: 2600
 
  BIOS Version                  2.4.3
 
  BIOS Release Date             07/09/2014
 
  Manufacturer                  Dell Inc.
 
  Product Name                  PowerEdge R720
 
  Baseboard Product             068CDY
 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``

When I opened the dump file in WinDBG, I saw the below corruptions in fileinfo.sys -

Code:

CHKIMG_EXTENSION: !chkimg -lo 50 -d !fileinfo    fffff880063da000-fffff880063da008  9 bytes - fileinfo!FIPfInterfaceOpen+228
    [ 00 bf 08 07 00 c0 e9 0b:20 00 42 00 6f 00 6c 00 ]
    fffff880063da00a-fffff880063da00f  6 bytes - fileinfo!FIPfInterfaceOpen+232 (+0x0a)
    [ 00 0f ba 65 48 0d:20 00 28 00 54 00 ]
    fffff880063da011-fffff880063da022  18 bytes - fileinfo!FIPfInterfaceOpen+239 (+0x07)
    [ 27 48 8b 4d 20 48 8d 15:00 75 00 65 00 54 00 79 ]
    fffff880063da024-fffff880063da02c  9 bytes - fileinfo!FIPfInterfaceOpen+24c (+0x13)
    [ 00 48 3b c6 74 0f bb 02:72 00 6f 00 77 00 61 00 ]
    fffff880063da02e-fffff880063da030  3 bytes - fileinfo!FIPfInterfaceOpen+256 (+0x0a)
    [ 00 bf bb:6c 00 69 ]
    fffff880063da032-fffff880063da042  17 bytes - fileinfo!FIPfInterfaceOpen+25a (+0x04)
    [ 00 c0 e9 03 ff ff ff 48:61 00 55 00 50 00 43 00 ]
    fffff880063da044-fffff880063da04a  7 bytes - fileinfo!FIPfInterfaceOpen+26c (+0x12)
    [ 00 4c 8d 84 24 a8 00:20 00 49 00 74 00 61 ]
    fffff880063da04c-fffff880063da052  7 bytes - fileinfo!FIPfInterfaceOpen+274 (+0x08)
    [ 00 48 8d 94 24 98 01:6c 00 69 00 63 00 20 ]
    fffff880063da054-fffff880063da05c  9 bytes - fileinfo!FIPfInterfaceOpen+27c (+0x08)
    [ 00 48 89 74 24 20 e8 cd:28 00 54 00 72 00 75 00 ]
    fffff880063da05e-fffff880063da066  9 bytes - fileinfo!FIPfInterfaceOpen+286 (+0x0a)
    [ 00 3b c6 8b f8 7d 0a bb:54 00 79 00 70 00 65 00 ]
    fffff880063da06a-fffff880063da074  11 bytes - fileinfo!FIPfInterfaceOpen+292 (+0x0c)
    [ e9 cd fe ff ff 48 8b 84:43 00 6f 00 72 00 64 00 ]
    fffff880063da076-fffff880063da07c  7 bytes - fileinfo!FIPfInterfaceOpen+29e (+0x0c)
    [ 00 f0 01 98 10 01 00:55 00 50 00 43 00 20 ]
    fffff880063da07e-fffff880063da084  7 bytes - fileinfo!FIPfInterfaceOpen+2a6 (+0x08)
    [ 48 8b b4 24 98 01 00:28 00 54 00 72 00 75 ]
    fffff880063da086-fffff880063da08e  9 bytes - fileinfo!FIPfInterfaceOpen+2ae (+0x08)
    [ 4c 39 66 60 75 0f bf bb:65 00 54 00 79 00 70 00 ]
    fffff880063da090-fffff880063da092  3 bytes - fileinfo!FIPfInterfaceOpen+2b8 (+0x0a)
    [ c0 bb 07:29 00 00 ]
    fffff880063da094 - fileinfo!FIPfInterfaceOpen+2bc (+0x04)
    [ 00:43 ]
    fffff880063da096-fffff880063da098  3 bytes - fileinfo!FIPfInterfaceOpen+2be (+0x02)
    [ e9 f6 03:6f 00 72 ]
    fffff880063da09a-fffff880063da0ac  19 bytes - fileinfo!FIPfInterfaceOpen+2c2 (+0x04)
    [ 00 45 33 e4 f0 44 09 24:64 00 69 00 61 00 55 00 ]
    fffff880063da0ae-fffff880063da0b4  7 bytes - fileinfo!FIPfInterfaceOpen+2d6 (+0x14)
    [ 84 5e 7c 75 0f bf bb:64 00 20 00 28 00 54 ]
    fffff880063da0b6-fffff880063da0ba  5 bytes - fileinfo!FIPfInterfaceOpen+2de (+0x08)
    [ 00 c0 bb 08 00:72 00 75 00 65 ]
    fffff880063da0bc-fffff880063da0c0  5 bytes - fileinfo!FIPfInterfaceOpen+2e4 (+0x06)
    [ 00 e9 cf 03 00:54 00 79 00 70 ]
    fffff880063da0c2-fffff880063da0c6  5 bytes - fileinfo!FIPfInterfaceOpen+2ea (+0x06)
    [ 48 8d 8e 08 01:65 00 29 00 00 ]
    fffff880063da0c8-fffff880063da0cc  5 bytes - fileinfo!FIPfInterfaceOpen+2f0 (+0x06)
    [ 00 4c 8d ae d8:43 00 6f 00 72 ]
    fffff880063da0ce - fileinfo!FIPfInterfaceOpen+2f6 (+0x06)
    [ 00:64 ]
    fffff880063da0d0-fffff880063da0d4  5 bytes - fileinfo!FIPfInterfaceOpen+2f8 (+0x02)
    [ 4c 8d b6 80 00:69 00 61 00 55 ]
    fffff880063da0d6-fffff880063da0e6  17 bytes - fileinfo!FIPfInterfaceOpen+2fe (+0x06)
    [ 00 4c 39 21 0f 84 0f ff:50 00 43 00 20 00 42 00 ]
    fffff880063da0e8-fffff880063da0ee  7 bytes - fileinfo!FIPfInterfaceOpen+310 (+0x12)
    [ 49 8b d6 e8 bc 0c 00:74 00 61 00 6c 00 69 ]
    fffff880063da0f0-fffff880063da100  17 bytes - fileinfo!FIPfInterfaceOpen+318 (+0x08)
    [ 41 3b c4 8b f8 0f 8d f4:63 00 20 00 28 00 54 00 ]
    fffff880063da102-fffff880063da107  6 bytes - fileinfo!FIPfInterfaceOpen+32a (+0x12)
    [ 44 8a a4 24 80 01:70 00 65 00 29 00 ]
    fffff880063da10a-fffff880063da10c  3 bytes - fileinfo!FIPfInterfaceOpen+332 (+0x08)
    [ e9 91 03:43 00 6f ]
    fffff880063da10e-fffff880063da13a  45 bytes - fileinfo!FIPfInterfaceOpen+336 (+0x04)
    [ 00 41 01 5d 28 41 8b fc:72 00 64 00 69 00 61 00 ]
    fffff880063da13c-fffff880063da142  7 bytes - fileinfo!FIPfInterfaceOpen+364 (+0x2e)
    [ 00 48 8d 8c 24 e0 00:65 00 29 00 00 00 44 ]
    fffff880063da144-fffff880063da14a  7 bytes - fileinfo!FIPfInterfaceOpen+36c (+0x08)
    [ 00 44 8a fb e8 97 2e:69 00 6c 00 6c 00 65 ]
    fffff880063da14c-fffff880063da156  11 bytes - fileinfo!FIPfInterfaceOpen+374 (+0x08)
    [ 00 41 3b c4 8b f8 7d 0a:6e 00 69 00 61 00 55 00 ]
    fffff880063da158-fffff880063da15c  5 bytes - fileinfo!FIPfInterfaceOpen+380 (+0x0c)
    [ 00 e9 33 03 00:20 00 28 00 54 ]
    fffff880063da15e-fffff880063da16a  13 bytes - fileinfo!FIPfInterfaceOpen+386 (+0x06)
    [ 8b 45 48 0f ba 6d 28 09:72 00 75 00 65 00 54 00 ]
    fffff880063da16c - fileinfo!FIPfInterfaceOpen+394 (+0x0e)
    [ 00:29 ]
    fffff880063da16e-fffff880063da178  11 bytes - fileinfo!FIPfInterfaceOpen+396 (+0x02)
    [ 48 89 54 24 78 c7 44 24:00 00 44 00 69 00 6c 00 ]
    fffff880063da17a-fffff880063da19a  33 bytes - fileinfo!FIPfInterfaceOpen+3a2 (+0x0c)
    [ 00 44 89 64 24 68 4c 89:6e 00 69 00 61 00 55 00 ]
    fffff880063da19c-fffff880063da1a2  7 bytes - fileinfo!FIPfInterfaceOpen+3c4 (+0x22)
    [ 00 4c 8d 8c 24 88 00:75 00 65 00 54 00 79 ]
    fffff880063da1a4-fffff880063da1a9  6 bytes - fileinfo!FIPfInterfaceOpen+3cc (+0x08)
    [ 00 4c 8d 84 24 98:70 00 65 00 29 00 ]
    fffff880063da1ac-fffff880063da1ba  15 bytes - fileinfo!FIPfInterfaceOpen+3d4 (+0x08)
    [ 00 89 5c 24 48 89 44 24:44 00 69 00 6c 00 6c 00 ]
    fffff880063da1bc-fffff880063da1cd  18 bytes - fileinfo!FIPfInterfaceOpen+3e4 (+0x10)
    [ 00 4c 89 64 24 38 48 89:55 00 50 00 43 00 20 00 ]
    fffff880063da1cf-fffff880063da1ea  28 bytes - fileinfo!FIPfInterfaceOpen+3f7 (+0x13)
    [ 48 8b 0d 2a a1 ff ff 33:00 54 00 72 00 75 00 65 ]
    fffff880063da1ec-fffff880063da1f4  9 bytes - fileinfo!FIPfInterfaceOpen+414 (+0x1d)
    [ 80 75 15 48 8b 8c 24 d8:65 00 6e 00 69 00 61 00 ]
    fffff880063da1f6-fffff880063da206  17 bytes - fileinfo!FIPfInterfaceOpen+41e (+0x0a)
    [ 00 49 3b cc 74 08 33 d2:50 00 43 00 20 00 42 00 ]
    fffff880063da208-fffff880063da20c  5 bytes - fileinfo!FIPfInterfaceOpen+430 (+0x12)
    [ 00 e9 83 02 00:74 00 61 00 6c ]
    fffff880063da20e-fffff880063da210  3 bytes - fileinfo!FIPfInterfaceOpen+436 (+0x06)
    [ 3d 08 01:69 00 63 ]
    fffff880063da212-fffff880063da216  5 bytes - fileinfo!FIPfInterfaceOpen+43a (+0x04)
    [ 00 75 0f bf ae:20 00 28 00 54 ]
    fffff880063da218-fffff880063da21c  5 bytes - fileinfo!FIPfInterfaceOpen+440 (+0x06)
    [ 00 c0 bb 03 00:72 00 75 00 65 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view  entire output.
3785 errors : !fileinfo (fffff880063da000-fffff880063dafff)

Below is a list of 3rd party drivers present on the system -

Code:

**************************Wed Oct 28 12:27:17.496 2015 (UTC + 5:30)**************************
amdxata.sys                 Tue May 19 23:26:59 2009 (4A12F2EB)
intelppm.sys                Tue Jul 14 04:49:25 2009 (4A5BC0FD)
percsas2.sys                Tue Jun 19 02:40:03 2012 (4FDF992B)
b57nd60a.sys                Wed Sep  5 02:59:46 2012 (504672CA)
TsDefenseBT64.sys           Fri May  9 13:39:37 2014 (536C8D41)
kefence.sys                 Mon Apr 27 20:19:06 2015 (553E4C62)
TAOKernel64.sys             Tue Jun  9 11:42:51 2015 (557683E3)
tscpm64.sys                 Tue Jun  9 11:43:30 2015 (5576840A)
TSSysKit64.sys              Tue Jun  9 11:43:31 2015 (5576840B)
TFsFltX64.sys               Tue Jun  9 11:43:36 2015 (55768410)
QQSysMonX64.sys             Tue Jun  9 11:43:49 2015 (5576841D)
QMUdisk64.sys               Tue Sep 29 07:36:24 2015 (5609F220)

http://www.carrona.org/drivers/driver.php?id=amdxata.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=percsas2.sys
http://www.carrona.org/drivers/driver.php?id=b57nd60a.sys
TsDefenseBT64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
kefence.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TAOKernel64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
tscpm64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TSSysKit64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
TFsFltX64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
QQSysMonX64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.
QMUdisk64.sys - this driver hasn't been added to the DRT as of this run. Please search Google/Bing for the driver if additional information is needed.

I would suggest you to follow the below steps -

Kindly update your installation of WINDOWS since I don't see any updates installed on the system. Please make sure that you perform this step before proceeding ahead.
I would uninstall the AnyBackup software since as you saw that Kefence.sys was involved and this driver is associated with that program.
Kindly run the below instructions (Thanks usasma! ) -
Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt). Press Enter after each one:
Code:

Code:

Dism /Online /Cleanup-Image /ScanHealth
Code:

Code:

Dism /Online /Cleanup-Image /CheckHealth
If the problem is fixable, you can use this command to repair it (from an elevated (Run as administrator) Command Prompt). Press Enter after typing it:
Code:

Code:

Dism /Online /Cleanup-Image /RestoreHealth
From this article: Repair a Windows Image

Once you are done, also run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption.
Click to expand...

Let me know how this goes ^_^

-Pranav

Thanks.

blueelvis · Nov 6, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

The BSOD is happening because the driver it is using is the requested page of kernel data from the paging file could not be read into memory.

If you are still experiencing the BSOD, could you please type in the below code in an Administrator Command Prompt -

Code:

chkdsk /f /r

Have you removed AnyBackup now?

-Pranav

bendsha · Nov 6, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

blueelvis said:
The BSOD is happening because the driver it is using is the requested page of kernel data from the paging file could not be read into memory.

If you are still experiencing the BSOD, could you please type in the below code in an Administrator Command Prompt -

Code:

chkdsk /f /r

Have you removed AnyBackup now?

-Pranav

I have run chkdsk command at the first time I experiencing the BSOD, but find nothing.

AnyBackup is a good backup product, It running well in other machines.

kefence.sys is a disk filter driver work for AnyBackup. Do not running a Oracle CDP task can solve this problem but not my purpose.

I have check every pool alloc/free and IRP handle, and use verifier try to catch this bug, but no useless.

And I have not find trigger condition yet.

I will try other way.

bendsha · Nov 7, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

".../CheckHealth, /ScanHealth, /RestoreHealth, /Source, and /LimitAccess can’t be used when servicing a version of Windows that is earlier than Windows 8 or Windows Server 2012 images"

blueelvis · Nov 8, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Any chance you could just uninstall AnyBackup? It would help me in detecting whether it is really causing the problem or not?

-Pranav

bendsha · Nov 18, 2015

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

blueelvis said:
Any chance you could just uninstall AnyBackup? It would help me in detecting whether it is really causing the problem or not?

-Pranav

I'm sorry for reply so late.

Yes, It's looks do not running a CDP(Continuous Data Protection) task provided by AnyBackup can solve this BSoD problem，but not my expect.

I'm enable driver verifier, and attempt to debug kefence.sys (a volume filter driver attached at volmgr.sys to achieve system I/O catch)

but there is no harvest.

this driver running normal in many other system, and during debug, I get a new BSoD,

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck F4, {3, fffffa801bab0910, fffffa801bab0bf0, fffff80001b88240}


Page 2d79c8 not present in the dump file. Type ".hh dbgerr004" for details
Page 2a5085 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : csrss.exe


Followup: MachineOwner
---------


8: kd> !error 0xC000003C
Error code: (NTSTATUS) 0xc000003c (3221225532) - {
8: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************


CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa801bab0910, Terminating object
Arg3: fffffa801bab0bf0, Process image file name
Arg4: fffff80001b88240, Explanatory message (ascii)


Debugging Details:
------------------


Page 2d79c8 not present in the dump file. Type ".hh dbgerr004" for details
Page 2a5085 not present in the dump file. Type ".hh dbgerr004" for details


PROCESS_OBJECT: fffffa801bab0910


IMAGE_NAME:  csrss.exe


DEBUG_FLR_IMAGE_TIMESTAMP:  0


MODULE_NAME: csrss


FAULTING_MODULE: 0000000000000000 


PROCESS_NAME:  csrss.exe


EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - 0x%p


BUGCHECK_STR:  0xF4_IOERR


DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT


CURRENT_IRQL:  0


ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre


STACK_TEXT:  
fffff880`087970a8 fffff800`01c0b142 : 00000000`000000f4 00000000`00000003 fffffa80`1bab0910 fffffa80`1bab0bf0 : nt!KeBugCheckEx
fffff880`087970b0 fffff800`01bb7269 : ffffffff`ffffffff fffffa80`1bcd7960 fffffa80`1bab0910 fffffa80`1bab0910 : nt!PspCatchCriticalBreak+0x92
fffff880`087970f0 fffff800`01b3bc74 : ffffffff`ffffffff 00000000`00000001 fffffa80`1bab0910 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17a06
fffff880`08797140 fffff800`0187f153 : fffffa80`1bab0910 fffff800`c0000006 fffffa80`1bcd7960 00000000`80010001 : nt!NtTerminateProcess+0xf4
fffff880`087971c0 fffff800`0187b6f0 : fffff800`018bfada fffff880`08797b38 fffff880`08797890 fffff880`08797be0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08797358 fffff800`018bfada : fffff880`08797b38 fffff880`08797890 fffff880`08797be0 00000000`0afc1820 : nt!KiServiceLinkage
fffff880`08797360 fffff800`0187f542 : fffff880`08797b38 00000000`00071288 fffff880`08797be0 00000000`0afc12f8 : nt! ?? ::FNODOBFM::`string'+0x4619d
fffff880`08797a00 fffff800`0187e0ba : 00000000`00000000 00000000`00071288 00000000`00000001 00000000`77409224 : nt!KiExceptionDispatch+0xc2
fffff880`08797be0 00000000`7731548f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
00000000`0afc1240 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7731548f




STACK_COMMAND:  kb


FOLLOWUP_NAME:  MachineOwner


IMAGE_VERSION:  


FAILURE_BUCKET_ID:  X64_0xF4_IOERR_VRF_IMAGE_csrss.exe


BUCKET_ID:  X64_0xF4_IOERR_VRF_IMAGE_csrss.exe


ANALYSIS_SOURCE:  KM


FAILURE_ID_HASH_STRING:  km:x64_0xf4_ioerr_vrf_image_csrss.exe


FAILURE_ID_HASH:  {618860ac-a535-d1ff-74a3-3bd67f7fb396}


Followup: MachineOwner
---------

8: kd> kn
 # Child-SP          RetAddr           Call Site
00 fffff880`087970a8 fffff800`01c0b142 nt!KeBugCheckEx
01 fffff880`087970b0 fffff800`01bb7269 nt!PspCatchCriticalBreak+0x92
02 fffff880`087970f0 fffff800`01b3bc74 nt! ?? ::NNGAKEGL::`string'+0x17a06
03 fffff880`08797140 fffff800`0187f153 nt!NtTerminateProcess+0xf4
04 fffff880`087971c0 fffff800`0187b6f0 nt!KiSystemServiceCopyEnd+0x13
05 fffff880`08797358 fffff800`018bfada nt!KiServiceLinkage
06 fffff880`08797360 fffff800`0187f542 nt! ?? ::FNODOBFM::`string'+0x4619d
07 fffff880`08797a00 fffff800`0187e0ba nt!KiExceptionDispatch+0xc2
08 fffff880`08797be0 00000000`7731548f nt!KiPageFault+0x23a
09 00000000`0afc1240 00000000`00000000 0x7731548f

8: kd> x nt!KiPageFault
fffff800`0187de80 nt!KiPageFault (<no parameter info>)

8: kd> !chkimg nt -d
    fffff80001de5d61-fffff80001de5d62  2 bytes - nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x5d7d61)
	[ 0d 0a:00 00 ]
    fffff80001de74ab-fffff80001de74ac  2 bytes - nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x5d94ab) (+0x174a)
	[ 0d 0a:00 00 ]
    fffff80001de757c-fffff80001de757f  4 bytes - nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x5d957c) (+0xd1)
	[ 0d 0a 0d 0a:00 00 00 00 ]
    fffff80001de7772-fffff80001de7773  2 bytes - nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x5d9772) (+0x1f6)
	[ 0d 0a:00 00 ]
    fffff80001de7792-fffff80001de7793  2 bytes - nt!_NULL_IMPORT_DESCRIPTOR <PERF> (nt+0x5d9792) (+0x20)
	[ 0d 0a:00 00 ]
12 errors : nt (fffff80001de5d61-fffff80001de7793)

and I find CDP task progress has crash before system check.

I see the last scene before system check:

I do not upload Memory Dump because It so larger, If you need it I will seed you.

Thanks for you reply.

bendsha · Jan 16, 2016

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Problem has been solved after update windows patch.

jcgriff2 · Jan 16, 2016

re: Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Hi -

That's great news.

Thank you very much for posting back - much appreciated.

Regards. . .

jcgriff2

Need Help: Bug Check 0x7A: KERNEL_DATA_INPAGE_ERROR http.sys - Server 2008 R2 x64

Member

Member

Attachments

Member

Member

Member

Member

Member

Attachments

Member

Member

Attachments

BSOD Kernel Dump Senior Analyst

Member

Member

BSOD Kernel Dump Senior Analyst

Member

Member

BSOD Kernel Dump Senior Analyst

Member

Member

Co-Founder / AdminBSOD Instructor/ExpertMicrosoft MVP (Ret.)

Co-Founder / Admin
BSOD Instructor/Expert
Microsoft MVP (Ret.)