My Windows Vista x64 is crashing every once in a while. Can somebody tell me what is wrong according to this crashdump?

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini102109-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`01a0c000 PsLoadedModuleList = 0xfffff800`01bd1db0
Debug session time: Wed Oct 21 10:30:41.928 2009 (GMT+2)
System Uptime: 0 days 0:00:16.021
Loading Kernel Symbols
Loading User Symbols
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80001cdd46a, fffffa6002a04328, fffffa6002a03d00}

Probably caused by : fileinfo.sys ( fileinfo!FIPfInterfaceClose+48 )

Followup: MachineOwner

0: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80001cdd46a, The address that the exception occurred at
Arg3: fffffa6002a04328, Exception Record Address
Arg4: fffffa6002a03d00, Context Record Address

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. Een lees- of schrijfbewerking op het geheugen is mislukt: %s.

fffff800`01cdd46a 418b4908        mov     ecx,dword ptr [r9+8]

EXCEPTION_RECORD:  fffffa6002a04328 -- (.exr 0xfffffa6002a04328)
Cannot read Exception record @ fffffa6002a04328

CONTEXT:  fffffa6002a03d00 -- (.cxr 0xfffffa6002a03d00)
Unable to read context, Win32 error 0n30






LAST_CONTROL_TRANSFER:  from fffff80001cdd9cd to fffff80001cdd46a

fffffa60`02a04568 fffff800`01cdd9cd : 00000000`00000000 fffffa80`07c75b20 fffff880`000033d0 00000000`00000000 : nt!ObpReleaseHandleInfo+0x4a
fffffa60`02a04570 fffff800`01cddd07 : fffff880`000033e0 fffffa80`00000000 fffffa80`06cc5690 00000000`00000000 : nt!ObpDecr
  • The error message suggest that he tried to read/write from a protected memory...maybe an application problem? I mean, does Vista also crash while you're doing nothing, or does it only crash if you're using a certain program(s)? – Bobby Oct 21 '09 at 8:52
  • Isn't this related to DEP then? – user3463 Oct 21 '09 at 8:54
  • Not related to DEP. That has to do with trying to execute code from a memory page that had the no-execute flag set. That's not the case here. This would be an attempt to write to a read-only page, or access a v.a. that isn't defined at all. Since the debugger reports "unable to read exception record" and "...context record", it is not possible from this output to see what virtual address was being accessed. – Jamie Hanrahan Nov 29 '14 at 4:47

Your clues are:

- IMAGE_NAME:  fileinfo.sys
  • I have 8 gigs of internal memory, obviously one of the 4 modules was faulty, I removed that one, and all was ok again. – Chris Dec 10 '09 at 11:26
  • Good to know. I had a similar problem with some Kingston RAM, which was replaced with cheap no-name and the machine has been fine ever since. Suppliers said original RAM is fine. Go figure. – user3463 Dec 10 '09 at 13:17
  • With ever larger amounts of memory being installed in PCs it is always a good idea to burn it in with Memtest memtest.org for a few days early on. We do this with all our VMware ESX Servers and have caught some dodgy RAM early enough before they get commissioned into production. – Sim Feb 9 '10 at 10:45
  • Sim - my situation was very odd: four slots, all populated with Kingston RAM. PC kept blue-screening ~40 seconds into boot. Replaced two of them with cheap RAM, problem went away (still going strong 3 years later, and RAM redeployed to another box and working fine too). MemTest found nothing wrong on all counts, and suppliers agreed, so I'm thinking it's one of those things that "just happen". shrug – user3463 Feb 9 '10 at 13:12
  • Well that is just plain weird Randolph, maybe a weird timing issue. At least you got a good workaround in the end. – Sim Feb 10 '10 at 0:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.