johnbl :
when a system locks up as you describe, it is locked up in the graphic driver code.
I have had this happen to my system many times and it was not caused by the motherboard.
to figure out the problem, you have to do the following:
1. Set your system to do a kernel dump rather than a minidump
2. enable verifie.exe debugging flags to force the system to save certain data structures
3. set a registry key to allow you to force a memory dump via the keyboard.
next time the system locks up, you hit some keys on your keyboard and a memory dump is created that contains the state of your machine. You can post the memory dump and someone can look at it with the windows debugger as to why it was locked up.
most of the time it is just a stupid driver problem.
info on force a memory dump:
http://www.sevenforums.com/bsod-help-support/174768-force-memory-dump.html
how to use verifier.exe
http://www.sevenforums.com/crash-lockup-debug-how/65331-using-driver-verifier-identify-issues-drivers.html
Ok, so I did everything you said, According to the Crash Dump, it says there is an error from ATITool64.sys and the symbol name is ATITool64+6192
*Edit: I removed the ATI Tool driver but the problem consists. Any other solutions?
Here's the crash dump file:
Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Dean Mysliwiec\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02e0a000 PsLoadedModuleList = 0xfffff800`0304d890
Debug session time: Thu Sep 18 14:31:16.736 2014 (UTC - 6:00)
System Uptime: 0 days 0:00:09.672
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
...............................................................
...............
Loading User Symbols
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmp The system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D6, {fffff98001485000, 0, fffff8800459a192, 0}
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool64.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ATITool64.sys ( ATITool64+6192 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff98001485000, memory referenced
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation
Arg3: fffff8800459a192, if non-zero, the address which referenced memory.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
FAULTING_MODULE: fffff80002e0a000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 46b9f272
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
fffff98001485000
FAULTING_IP:
ATITool64+6192
fffff880`0459a192 66833800 cmp word ptr [rax],0
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xD6
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff80002efdbf0 to fffff80002e7fbc0
STACK_TEXT:
fffff880`0317e888 fffff800`02efdbf0 : 00000000`00000050 fffff980`01485000 00000000`00000000 fffff880`0317e9f0 : nt!KeBugCheckEx
fffff880`0317e890 fffff800`02e7dcee : 00000000`00000000 fffff980`01485000 00000000`00000000 fffff980`01484ff0 : nt!wcsncat_s+0x2d7f8
fffff880`0317e9f0 fffff880`0459a192 : 00000001`0000000a 00000040`00000000 ffff0001`0000000c 00000098`00000011 : nt!KeSynchronizeExecution+0x28be
fffff880`0317eb80 fffff880`04598bf2 : 00000000`000000b0 fffff800`0331da55 fffff8a0`0072ad50 00000000`00000000 : ATITool64+0x6192
fffff880`0317f050 fffff880`04598b0b : fffff880`0317f0b0 fffff880`0317f0b0 fffff8a0`0072ae00 00000000`000000b0 : ATITool64+0x4bf2
fffff880`0317f0b0 fffff880`04595da3 : 000a541e`00000000 fffffa80`05d342e0 fffff880`045952f0 fffff980`01484ff0 : ATITool64+0x4b0b
fffff880`0317f0f0 fffff800`02f81d45 : fffff880`0317f720 fffff880`0317f6e8 00000000`00000000 fffff880`0317f5c4 : ATITool64+0x1da3
fffff880`0317f5a0 fffff800`032663f5 : 00000000`00000000 fffffa80`05d34b40 00000000`00000002 fffffa80`0461d3c0 : nt!DbgSetDebugFilterState+0x1885
fffff880`0317f5e0 fffff800`0326d941 : fffffa80`0461d3c0 fffffa80`0461d3c0 00000000`00000000 00000000`00000000 : nt!EtwEnableTrace+0x12e5
fffff880`0317f660 fffff800`0326eed2 : fffffa80`0461dd90 fffffa80`0461d3c0 00000000`00000002 fffffa80`0461d690 : nt!ExCreateCallback+0x2981
fffff880`0317f810 fffff800`0326f36c : fffff800`03081700 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExCreateCallback+0x3f12
fffff880`0317fa80 fffff800`02f82802 : 00000001`00000003 00000000`00000000 00000000`32706e50 00000000`00000084 : nt!ExCreateCallback+0x43ac
fffff880`0317fad0 fffff800`02e89261 : fffff800`02f82500 fffff800`03176c01 fffffa80`039f4000 5c8b4800`063d7c8c : nt!DbgSetDebugFilterState+0x2342
fffff880`0317fb70 fffff800`0311b73a : 05058d48`38ec8348 fffffa80`039f4040 00000000`00000080 fffffa80`039e1040 : nt!KeReleaseInStackQueuedSpinLock+0x2f1
fffff880`0317fc00 fffff800`02e708e6 : fffff880`009b3180 fffffa80`039f4040 fffff880`009be040 c5870f00`010000ff : nt!PsCreateSystemThread+0x1e6
fffff880`0317fc40 00000000`00000000 : fffff880`03180000 fffff880`0317a000 fffff880`0317e8a0 00000000`00000000 : nt!KeInitializeSemaphore+0x25a
STACK_COMMAND: kb
FOLLOWUP_IP:
ATITool64+6192
fffff880`0459a192 66833800 cmp word ptr [rax],0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ATITool64+6192
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ATITool64
IMAGE_NAME: ATITool64.sys
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:wrong_symbols
FAILURE_ID_HASH: {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner
---------