-1

Recently, I started getting constant BSODs (such as BAD_POOL_HEADER, followed by DRIVER_OVERRAN_STACK_BUFFER, and now SYSTEM_SERVICE_EXCEPTION) while working on my own stuff (basic Microsoft Office programs/normal browsing/programming). There was once when there wasn't any blue screen, but a stucked screen occurred instead. The only way to resolve it was to do a force restart on my laptop.

Someone suggested me to try the Memory Diagnostic Tool provided by windows itself to see if hardware was an issue, but the report stated that the memory was fine. I tried sfc /scannow as well but there wasn't any integrity violations. Tried updating all the drivers earlier, but the error still happens.

  • I might try to do a fresh installation of Windows and see if that fixes the problem. Not too sure if that would work.

I tried analyzing the latest minidump and it shows this. (I accidentally deleted the earlier ones while doing a system check,):

Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18090.amd64fre.winblue_ltsb.151014-0600
Machine Name:
Kernel base = 0xfffff803`0f47a000 PsLoadedModuleList = 0xfffff803`0f74e630
Debug session time: Mon Nov 23 07:55:58.847 2015 (UTC - 5:00)
System Uptime: 0 days 7:20:06.694
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8030f4d4d68, Address of the instruction which caused the bugcheck
Arg3: ffffd000c144d700, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
nt!ObReferenceObjectSafeWithTag+c
fffff803`0f4d4d68 498b02          mov     rax,qword ptr [r10]

CONTEXT:  ffffd000c144d700 -- (.cxr 0xffffd000c144d700)
rax=ffffe000b7666080 rbx=790b845bb249fcc8 rcx=790b845bb249f640
rdx=000000006e457350 rsi=ffffe000b79c7700 rdi=790b845bb249f640
rip=fffff8030f4d4d68 rsp=ffffd000c144e130 rbp=ffffd000c144eb80
 r8=0000000000000000  r9=7fffe000b7af4348 r10=790b845bb249f610
r11=7ffffffffffffffc r12=ffffe000b7af44f0 r13=0000000000000011
r14=ffffe000b7af4348 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!ObReferenceObjectSafeWithTag+0xc:
fffff803`0f4d4d68 498b02          mov     rax,qword ptr [r10] ds:002b:790b845b`b249f610=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  vmware-authd.e

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8030f822892 to fffff8030f4d4d68

STACK_TEXT:  
ffffd000`c144e130 fffff803`0f822892 : ffffd000`c144eb80 00000000`00000000 ffffe000`b7af4348 00000000`00000000 : nt!ObReferenceObjectSafeWithTag+0xc
ffffd000`c144e160 fffff803`0f83f041 : 00000000`00000080 ffffd000`0002dc90 00000000`00000000 00000000`00000000 : nt!ExpGetProcessInformation+0x432
ffffd000`c144e400 fffff803`0f83e679 : 00000000`029b0090 00000000`00000004 00000000`00000005 ffffffff`fd050f80 : nt!ExpQuerySystemInformation+0x975
ffffd000`c144eac0 fffff803`0f5d40b3 : ffffe000`b79c7700 00000000`00000000 ffffd000`c144ead8 ffffe000`b79c96d0 : nt!NtQuerySystemInformation+0x49
ffffd000`c144eb00 00007fff`1c8b153a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02cae2b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fff`1c8b153a


FOLLOWUP_IP: 
nt!ObReferenceObjectSafeWithTag+c
fffff803`0f4d4d68 498b02          mov     rax,qword ptr [r10]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ObReferenceObjectSafeWithTag+c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  561e5da4

STACK_COMMAND:  .cxr 0xffffd000c144d700 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ObReferenceObjectSafeWithTag+c

BUCKET_ID:  X64_0x3B_nt!ObReferenceObjectSafeWithTag+c

Followup: MachineOwner
---------

I was wondering if someone could help to further analyze the minidump above and identify the root cause. I suspect that there are some issues with my hardware. (I'm unable to remove them though as it's an ultrabook. Might have to bring it to a shop.)

Here's the original file of the minidump: https://www.dropbox.com/s/ypdvzwma9nlztg7/112315-4468-01.dmp?dl=0

UPDATE I have uninstalled the VMWare. Just received another BSOD, DRIVER_IRQL_NOT_LESS_OR_EQUAL this time.

Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18090.amd64fre.winblue_ltsb.151014-0600
Machine Name:
Kernel base = 0xfffff802`85212000 PsLoadedModuleList = 0xfffff802`854e6630
Debug session time: Mon Nov 23 23:54:12.110 2015 (UTC - 5:00)
System Uptime: 0 days 15:24:23.957
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff802107d6340, memory referenced
Arg2: 000000000000000d, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: fffff802107d6340, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: fffff802854d4020: Unable to get special pool info
fffff802854d4020: Unable to get special pool info
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 fffff802107d6340 

CURRENT_IRQL:  d

FAULTING_IP: 
+0
fffff802`107d6340 ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  System

TRAP_FRAME:  ffffd001f8cfe930 -- (.trap 0xffffd001f8cfe930)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff802859f4e00
rdx=000027ef00000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802107d6340 rsp=ffffd001f8cfeac8 rbp=ffffd001f8cfeb50
 r8=00000000002048c6  r9=fffff80285512f80 r10=0000000000000001
r11=fffff8028556f910 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
fffff802`107d6340 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8028536c3e9 to fffff802853608a0

FAILED_INSTRUCTION_ADDRESS: 
+0
fffff802`107d6340 ??              ???

STACK_TEXT:  
ffffd001`f8cfe7e8 fffff802`8536c3e9 : 00000000`0000000a fffff802`107d6340 00000000`0000000d 00000000`00000008 : nt!KeBugCheckEx
ffffd001`f8cfe7f0 fffff802`8536ac3a : 00000000`00000008 ffffd001`f8cea180 00000000`20000000 ffffd001`f8cfeaf8 : nt!KiBugCheckDispatch+0x69
ffffd001`f8cfe930 fffff802`107d6340 : fffff802`8536211c ffffe001`3c37a000 00000000`00000001 ffffe001`3c37a000 : nt!KiPageFault+0x23a
ffffd001`f8cfeac8 fffff802`8536211c : ffffe001`3c37a000 00000000`00000001 ffffe001`3c37a000 ffffd001`f8cea180 : 0xfffff802`107d6340
ffffd001`f8cfead0 fffff802`853643c2 : ffffd001`f8cea180 ffffd001`f8cea180 ffffd001`f8cf62c0 00000000`00000001 : nt!KiInterruptDispatchLBControl+0x12c
ffffd001`f8cfec60 00000000`00000000 : ffffd001`f8cff000 ffffd001`f8cf9000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x32


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+23a
fffff802`8536ac3a 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+23a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  561e5da4

FAILURE_BUCKET_ID:  X64_AV_CODE_AV_BAD_IP_nt!KiPageFault+23a

BUCKET_ID:  X64_AV_CODE_AV_BAD_IP_nt!KiPageFault+23a

Followup: MachineOwner
---------

Minidump link: https://www.dropbox.com/s/udf9ke81gt3bkce/112415-4421-01.dmp?dl=0

My laptop has been running on battery power for hours until I decided to charge it by plugging in the adapter. After about 10 minutes, the BSOD occurred. Could this be something wrong with my adapter instead? I just recalled that few days ago there was a lightning strike and a spark could be seen from the laptop's charging hole while having the adapter plugged into it. (The socket wasn't on though.)

UPDATE (again). Just did a quick memtest86+ for about an hour plus. It had two passes with no errors on both RAM slots (2GB each). Did a disk error checking and no errors were found.

UPDATE IRQL_NOT_LESS_OR_EQUAL's minidump analyze:

Windows 8 Kernel Version 9600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9600.18090.amd64fre.winblue_ltsb.151014-0600
Machine Name:
Kernel base = 0xfffff800`30478000 PsLoadedModuleList = 0xfffff800`3074c630
Debug session time: Tue Nov 24 02:16:20.080 2015 (UTC - 5:00)
System Uptime: 0 days 0:11:11.927
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000007, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800304e5622, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: fffff8003073a020: Unable to get special pool info
fffff8003073a020: Unable to get special pool info
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 0000000000000007 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiInsertAndUnlockStandbyPages+186
fffff800`304e5622 448a4558        mov     r8b,byte ptr [rbp+58h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  ffffd001be7743f0 -- (.trap 0xffffd001be7743f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd001be774540 rbx=0000000000000000 rcx=ffffd001be774540
rdx=fffffa8002677c80 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800304e5622 rsp=ffffd001be774580 rbp=ffffd001be7745d0
 r8=000000c000000000  r9=fffffa8001ce28b0 r10=000000000009a0d9
r11=000000000000000f r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiInsertAndUnlockStandbyPages+0x186:
fffff800`304e5622 448a4558        mov     r8b,byte ptr [rbp+58h] ss:ffffd001`be774628=02
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800305d23e9 to fffff800305c68a0

STACK_TEXT:  
ffffd001`be7742a8 fffff800`305d23e9 : 00000000`0000000a 00000000`00000007 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd001`be7742b0 fffff800`305d0c3a : 00000000`00000000 00000000`00000000 ffffd001`be774400 ffffd001`00000001 : nt!KiBugCheckDispatch+0x69
ffffd001`be7743f0 fffff800`304e5622 : 00000000`00000000 ffffd001`be7746f0 00000000`00000007 fffffa80`029334f0 : nt!KiPageFault+0x23a
ffffd001`be774580 fffff800`304e4397 : 00000000`00000000 00000000`00000000 ffffe001`a9c2e760 00000168`424e6f02 : nt!MiInsertAndUnlockStandbyPages+0x186
ffffd001`be774610 fffff800`304e3d31 : 00000000`00000000 ffffd001`be7748f8 ffffe001`abc77a98 00000000`00000000 : nt!MiFinishHardFault+0x497
ffffd001`be774790 fffff800`304e5dec : 00000000`00000003 ffffd001`be7748f8 ffffe001`abc77a98 ffffd001`00000000 : nt!MiWaitForInPageComplete+0x27d
ffffd001`be774880 fffff800`304cf91a : ffffe001`abc77a98 ffffe001`ad9ee880 00000000`00000000 ffffd001`be7749f0 : nt!MiIssueHardFault+0x184
ffffd001`be774940 fffff800`305d0b2f : 00000000`00000000 00000000`00000000 00000067`da280701 00007fff`5bab4950 : nt!MmAccessFault+0x5ba
ffffd001`be774b00 00007fff`5b80ecae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x12f
00000067`da3fe940 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fff`5b80ecae


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiInsertAndUnlockStandbyPages+186
fffff800`304e5622 448a4558        mov     r8b,byte ptr [rbp+58h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiInsertAndUnlockStandbyPages+186

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  561e5da4

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_AV_nt!MiInsertAndUnlockStandbyPages+186

BUCKET_ID:  X64_AV_nt!MiInsertAndUnlockStandbyPages+186

Followup: MachineOwner
---------

My system specifications:
OS: Windows 8.1 64-bit;
Processor: Intel Core i5 4200U @ 1.60GHz;
RAM: 4.00GB Dual-Channel DDR3 @ 798MHz;
Motherboard: SAMSUNG ELECTRONICS CO., LTD. NP940X3G-K06US (SOCKET 0);
Graphics: Generic PnP Monitor (1600x900@60Hz) and Intel HD Graphics Family (Samsung);
Storage: 119GB TOSHIBA THNSNH128G8NT (SSD);
No optical drives.

Any help is greatly appreciated! Thank you.

15
  • Your problems are caused by VMWare.
    – Ramhound
    Nov 23, 2015 at 15:50
  • @Ramhound, does it mean that there're some issues with my host drivers? By the way, there wasn't any virtual machines running on my background (other than the VMWare Workstation)
    – Jay Lim
    Nov 23, 2015 at 15:55
  • You have no narrowed down the number of possible causes for us, so I can't say if its a driver problem, but the process that caused the crash was a belonged to a VMWare product.
    – Ramhound
    Nov 23, 2015 at 16:00
  • @Ramhound thanks for your feedback! I have uninstalled the VMWare, but now a different error comes out. It looks like it is related to the System process now.
    – Jay Lim
    Nov 24, 2015 at 5:05
  • run memtest86+ to detect RAM errors. Nov 24, 2015 at 5:25

1 Answer 1

-1

Make sure your drivers are all up to date, specifically your GPU driver. Failing that, I think a Windows reinstall would be your next step in resolving your BSODs. If the Windows reinstall doesn't fix it, then it's most likely some kind of hardware issue.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .