Strange blue screens?

Hey everyone, this is my first build, and I love it! But..

I have been getting blue screens, after doing research I saw Comodo Firewall could be causing this, but I've now uninstalled that program.
I started getting these errors about a week after the build (It's just over a week old now!) and the only thing I could imagine could cause it was some audio drivers I installed.
These errors I've noticed almost always happen after the computer has been idle.. it goes to sleep then when I wake everything works and about one second later the screen blackens and goes to a blue screen error.
Notably the first time this happened I got an error about explorer.exe shortly followed by it closing! As far as I could tell it was a memory write error. This hasn't happened again yet. About 5 seconds later of getting that error Windows Aero turned off followed by another write error and the computer promptly blue screening.
This has been going on for about 3 days now, I downloaded the Microsoft SDK to try and diagnose the issues, I found a memory read error related blue screen and a "svchost.exe" which I believe is the host process for windows services, I found this could be a virus in discuise but it certainly is not as I've doublechecked it isn't. It is almost impossible it is another virus as I've installed only about 20 trusted programs, I've also checked on "What's running" for foul play and startup items.

My system:

ASUS M4A77TD MB
AMD 965 X4 3.4Ghz @ 3.4Ghz
2GB DDR3 Crucial Memory
120gb HDD (OS HDD)
160gb HDD
2tb HDD
LG Blu-ray reader/DVD rw.

I uploaded memory dumps: DL Link

Thanks everyone! :love:
8 answers Last reply
More about strange blue screens
  1. The blue screen error should have shown an error code, if you could report it to the rest of us, we could try to help!
  2. Blue screens are normally caused by either memory errors or driver problems (particularly video drivers). Try a memory test program such as memtest86 and run it over night. To see if it is a driver problem boot up in safe mode and see if you still have a problem if not then try removing the drivers one at a time (starting with the video driver) until you find the problem.
  3. Hey, thanks to both of you! I'll try running memtest soon, and marcellis22 if you mean the contents of the memory dumps (I think that's what you mean) then I've got that here..

    DUMP 1
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_DATA_INPAGE_ERROR (7a)
    The requested page of kernel data could not be read in. Typically caused by
    a bad block in the paging file or disk controller error. Also see
    KERNEL_STACK_INPAGE_ERROR.
    If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
    it means the disk subsystem has experienced a failure.
    If the error status is 0xC000009A, then it means the request failed because
    a filesystem failed to make forward progress.
    Arguments:
    Arg1: c0445df8, lock type that was held (value 1,2,3, or PTE address)
    Arg2: c00000c0, error status (normally i/o status code)
    Arg3: 16441860, current process (virtual address for lock type 3, or PTE)
    Arg4: 88bbfa76, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

    Debugging Details:
    ------------------

    GetPointerFromAddress: unable to read from 82bae700

    ERROR_CODE: (NTSTATUS) 0xc00000c0 - This device does not exist.

    BUGCHECK_STR: 0x7a_c00000c0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    PROCESS_NAME: System

    CURRENT_IRQL: 0

    TRAP_FRAME: a03d19b8 -- (.trap 0xffffffffa03d19b8)
    ErrCode = 00000010
    eax=88bbad40 ebx=854ddb20 ecx=85af7220 edx=00000017 esi=c00000bb edi=85af72d8
    eip=88bbfa76 esp=a03d1a2c ebp=a03d1a54 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    CLASSPNP!ClasspDisableTimer:
    88bbfa76 0000 add byte ptr [eax],al ds:0023:88bbad40=??
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 82afa60a to 82b22d10

    STACK_TEXT:
    a03d1814 82afa60a 0000007a c0445df8 c00000c0 nt!KeBugCheckEx+0x1e
    a03d1888 82af20d5 871706a4 a03d18e0 82b7a540 nt!MiWaitForInPageComplete+0x2fd
    a03d191c 82acde3f 82b7a540 88bbfa76 87170610 nt!MiIssueHardFault+0x3b2
    a03d19a0 82a8c5f8 00000008 88bbfa76 00000000 nt!MmAccessFault+0x2656
    a03d19a0 88bbfa76 00000008 88bbfa76 00000000 nt!KiTrap0E+0xdc
    a03d1a28 88bbc09d 85af7220 854ddbf4 854ddb20 CLASSPNP!ClasspDisableTimer
    a03d1a54 88ba93bf 85af7220 014ddb20 85af7220 CLASSPNP!ClassDispatchPnp+0x44f
    a03d1a68 82a824bc 85af7220 854ddb20 854ddc18 CLASSPNP!ClassGlobalDispatch+0x20
    a03d1a80 82bfd505 85af80d8 854ddb20 00000000 nt!IofCallDriver+0x63
    a03d1aa8 83ac327e 85af7220 854ddb20 85af80d8 nt!IoForwardIrpSynchronously+0x59
    a03d1ac4 83abf6f3 8598352c 854ddb20 854ddc20 partmgr!PmSurpriseRemoval+0x7a
    a03d1ae4 83ab92e5 85af8020 00000000 85af8020 partmgr!PmPnp+0x89
    a03d1af8 82a824bc 85af8020 854ddb20 a03d1b94 partmgr!PmGlobalDispatch+0x1d
    a03d1b10 82c22edf 859ae030 859b0b80 859ae030 nt!IofCallDriver+0x63
    a03d1b40 82bf9b3d 859ae030 00000000 859b0b80 nt!IopSynchronousCall+0xc2
    a03d1b98 82d04aae 859ae030 00000017 859b0b80 nt!IopRemoveDevice+0xd4
    a03d1bc0 82bf9945 8800c180 00000000 a03d1c04 nt!PnpSurpriseRemoveLockedDeviceNode+0x101
    a03d1bd0 82bf98b7 00000003 00000000 00000000 nt!PnpDeleteLockedDeviceNode+0x21
    a03d1c04 82bf8e76 859ae030 8800c180 00000003 nt!PnpDeleteLockedDeviceNodes+0x4c
    a03d1cc4 82bfb210 a03d1cf4 00000000 b93994e0 nt!PnpProcessQueryRemoveAndEject+0x586
    a03d1cdc 82bfcd58 00000000 85ac3100 84d3c608 nt!PnpProcessTargetDeviceEvent+0x38
    a03d1d00 82ab3f2b 85ac3100 00000000 84d3c608 nt!PnpDeviceEventWorker+0x216
    a03d1d50 82c5466d 80000001 89602485 00000000 nt!ExpWorkerThread+0x10d
    a03d1d90 82b060d9 82ab3e1e 80000001 00000000 nt!PspSystemThreadStartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


    STACK_COMMAND: kb

    CHKIMG_EXTENSION: !chkimg -lo 50 -d !CLASSPNP
    88bbf000-88bbf00a 11 bytes - CLASSPNP!ClasspAllocateReleaseRequest+6
    [ 45 08 8b 40 28 33 c9 89:34 00 46 00 2d 00 35 00 ]
    88bbf00c-88bbf010 5 bytes - CLASSPNP!ClasspAllocateReleaseRequest+12 (+0x0c)
    [ 00 88 88 d8 01:39 00 2d 00 34 ]
    88bbf012-88bbf016 5 bytes - CLASSPNP!ClasspAllocateReleaseRequest+18 (+0x06)
    [ 00 88 88 d9 01:38 00 45 00 38 ]
    88bbf018-88bbf01c 5 bytes - CLASSPNP!ClasspAllocateReleaseRequest+1e (+0x06)
    [ 00 88 88 da 01:2d 00 38 00 46 ]
    88bbf01e-88bbf022 5 bytes - CLASSPNP!ClasspAllocateReleaseRequest+24 (+0x06)
    [ 00 89 88 94 01:31 00 45 00 2d ]
    88bbf024-88bbf02c 9 bytes - CLASSPNP!ClasspAllocateReleaseRequest+2a (+0x06)
    [ 00 6a 40 59 66 89 88 98:33 00 33 00 42 00 39 00 begin_of_the_skype_highlighting              00 33 00 42 00 39 00      end_of_the_skype_highlighting ]
    88bbf02e-88bbf046 25 bytes - CLASSPNP!ClasspAllocateReleaseRequest+34 (+0x0a)
    [ 00 33 c0 5d c2 04 00 90:42 00 34 00 34 00 30 00 ]
    88bbf048-88bbf05a 19 bytes - CLASSPNP!ClasspMpdevSupportedDevice+e (+0x1a)
    [ 00 c0 33 db 33 ff 89 75:b9 91 85 8d 63 5c 00 00 ]
    88bbf05c-88bbf064 9 bytes - CLASSPNP!ClasspMpdevSupportedDevice+22 (+0x14)
    [ 89 45 f4 3b c3 0f 84 bb:4f 00 46 00 54 00 57 00 ]
    88bbf066-88bbf072 13 bytes - CLASSPNP!ClasspMpdevSupportedDevice+2c (+0x0a)
    [ 00 50 e8 96 db fe ff 84:52 00 45 00 5c 00 4d 00 ]
    88bbf074-88bbf07e 11 bytes - CLASSPNP!ClasspMpdevSupportedDevice+3a (+0x0e)
    [ 00 8d 45 f8 50 ff 75 0c:6f 00 73 00 6f 00 66 00 ]
    88bbf080-88bbf08c 13 bytes - CLASSPNP!ClasspMpdevSupportedDevice+46 (+0x0c)
    [ 00 3b c3 8b 7d f8 89 45:49 00 6e 00 74 00 65 00 ]
    88bbf08e-88bbf098 11 bytes - CLASSPNP!ClasspMpdevSupportedDevice+54 (+0x0e)
    [ 00 38 5f 08 74 08 89 75:74 00 20 00 45 00 78 00 ]
    88bbf09a - CLASSPNP!ClasspMpdevSupportedDevice+60 (+0x0c)
    [ 00:6f ]
    88bbf09c-88bbf0aa 15 bytes - CLASSPNP!ClasspMpdevSupportedDevice+62 (+0x02)
    [ 8d 45 ec 50 68 e6 b4 bb:72 00 65 00 72 00 5c 00 ]
    88bbf0ac-88bbf0b4 9 bytes - CLASSPNP!ClasspMpdevSupportedDevice+72 (+0x10)
    [ 00 3b c3 89 45 fc 7d 2f:6e 00 73 00 69 00 6f 00 ]
    88bbf0b6-88bbf104 79 bytes - CLASSPNP!ClasspMpdevSupportedDevice+7c (+0x0a)
    [ a0 bb 88 3d 00 a0 bb 88:73 00 5c 00 7b 00 35 00 ]
    88bbf106-88bbf118 19 bytes - CLASSPNP!ClasspMpdevSupportedDevice+cc (+0x50)
    [ 3a c3 75 15 8d 47 19 50:00 00 02 80 08 00 89 39 ]
    88bbf11a-88bbf122 9 bytes - CLASSPNP!ClasspMpdevSupportedDevice+e0 (+0x14)
    [ 00 3a c3 74 03 89 5d fc:4b 00 43 00 55 00 5c 00 ]
    88bbf124-88bbf138 21 bytes - CLASSPNP!ClasspMpdevSupportedDevice+ea (+0x0a)
    [ a0 bb 88 8b 35 dc 81 bb:4f 00 46 00 54 00 57 00 ]
    88bbf13a-88bbf140 7 bytes - CLASSPNP!ClasspMpdevSupportedDevice+100 (+0x16)
    [ a0 bb 88 89 5d f0 3d:72 00 6f 00 73 00 6f ]
    88bbf142-88bbf1b6 117 bytes - CLASSPNP!ClasspMpdevSupportedDevice+108 (+0x08)
    [ a0 bb 88 74 2e f6 40 20:66 00 74 00 5c 00 49 00 ]
    88bbf1b8-88bbf1d2 27 bytes - CLASSPNP!ClasspMpdevGetMpioControl+c (+0x76)
    [ 68 4c b4 bb 88 8d 45 f0:41 00 39 00 41 00 42 00 ]
    88bbf1d4-88bbf218 69 bytes - CLASSPNP!ClasspMpdevGetMpioControl+28 (+0x1c)
    [ 8d 45 f0 50 ff 15 9c 81:89 39 00 00 2c a1 91 df ]
    88bbf21a-88bbf21e 5 bytes - CLASSPNP!ClasspDisableGesn+1c (+0x46)
    [ ff 75 0c ff 15:6e 00 65 00 74 ]
    88bbf220-88bbf234 21 bytes - CLASSPNP!ClasspDisableGesn+22 (+0x06)
    [ 80 bb 88 5d c2 08 00 90:20 00 45 00 78 00 70 00 ]
    88bbf236-88bbf242 13 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+a (+0x16)
    [ 00 53 56 57 8d 45 fc 50:78 00 74 00 65 00 6e 00 ]
    88bbf244 - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+18 (+0x0e)
    [ 0f:6e ]
    88bbf246-88bbf24e 9 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+1a (+0x02)
    [ 33 db 6a 01 ff b0 00 01:73 00 5c 00 7b 00 41 00 ]
    88bbf250-88bbf264 21 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+24 (+0x0a)
    [ 89 5d fc 89 5d f8 89 5d:41 00 45 00 46 00 41 00 ]
    88bbf266-88bbf26c 7 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+3a (+0x16)
    [ a0 bb 88 7d 3d 8b 0d:2d 00 34 00 37 00 30 ]
    88bbf26e-88bbf276 9 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+42 (+0x08)
    [ a0 bb 88 3b cf 0f 84 0e:36 00 2d 00 41 00 30 00 ]
    88bbf278-88bbf27e 7 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+4c (+0x0a)
    [ 00 f7 41 20 00 10 00:45 00 2d 00 43 00 34 ]
    88bbf280-88bbf284 5 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+54 (+0x08)
    [ 0f 84 01 01 00:36 00 39 00 39 ]
    88bbf286-88bbf28c 7 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+5a (+0x06)
    [ 80 79 1d 04 0f 82 f7:30 00 43 00 43 00 32 ]
    88bbf28e - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+62 (+0x08)
    [ 00:46 ]
    88bbf290-88bbf2a5 22 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+64 (+0x02)
    [ 50 68 18 82 bb 88 6a 4c:41 00 34 00 7d 00 00 00 ]
    88bbf2a8-88bbf2cc 37 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+7c (+0x18)
    [ 68 b8 b0 bb 88 8d 45 d0:48 00 4b 00 43 00 55 00 ]
    88bbf2ce - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+a2 (+0x26)
    [ 02:73 ]
    88bbf2d0-88bbf2d8 9 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+a4 (+0x02)
    [ 8d 45 f8 50 c7 45 d8 18:6f 00 66 00 74 00 5c 00 ]
    88bbf2da-88bbf2e0 7 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+ae (+0x0a)
    [ 00 c7 45 e4 40 02 00:6e 00 74 00 65 00 72 ]
    88bbf2e2-88bbf2fc 27 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+b6 (+0x08)
    [ 89 5d e8 89 5d ec ff 15:6e 00 65 00 74 00 20 00 ]
    88bbf2fe - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+d2 (+0x1c)
    [ 00:78 ]
    88bbf300-88bbf302 3 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+d4 (+0x02)
    [ f7 41 20:74 00 65 ]
    88bbf304 - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+d8 (+0x04)
    [ 10:6e ]
    88bbf306-88bbf334 47 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+da (+0x02)
    [ 00 74 7e 80 79 1d 04 72:73 00 69 00 6f 00 6e 00 ]
    88bbf336-88bbf33a 5 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+10a (+0x30)
    [ 00 c7 45 8c 04:41 00 2d 00 42 ]
    88bbf33c - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+110 (+0x06)
    [ 00:43 ]
    88bbf33e-88bbf370 51 bytes - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+112 (+0x02)
    [ 89 5d 94 3b f3 75 0f 8d:42 00 45 00 2d 00 42 00 ]
    88bbf372 - CLASSPNP!ClasspMediaChangeDeviceInstanceOverride+146 (+0x34)
    [ 00:4b ]
    WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
    3845 errors : !CLASSPNP (88bbf000-88bbffff)

    MODULE_NAME: memory_corruption

    IMAGE_NAME: memory_corruption

    FOLLOWUP_NAME: memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MEMORY_CORRUPTOR: LARGE_4096

    FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_4096

    BUCKET_ID: MEMORY_CORRUPTION_LARGE_4096

    Followup: memory_corruption
    ______________________________________________
    DUMP 2

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    CRITICAL_OBJECT_TERMINATION (f4)
    A process or thread crucial to system operation has unexpectedly exited or been
    terminated.
    Several processes and threads are necessary for the operation of the
    system; when they are terminated (for any reason), the system can no
    longer function.
    Arguments:
    Arg1: 00000003, Process
    Arg2: 86e7d6f0, Terminating object
    Arg3: 86e7d85c, Process image file name
    Arg4: 82c30d50, Explanatory message (ascii)

    Debugging Details:
    ------------------

    *** WARNING: Unable to verify timestamp for cmdguard.sys
    *** ERROR: Module load completed but symbols could not be loaded for cmdguard.sys

    PROCESS_OBJECT: 86e7d6f0

    IMAGE_NAME: csrss.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MODULE_NAME: csrss

    FAULTING_MODULE: 00000000

    PROCESS_NAME: csrss.exe

    EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

    BUGCHECK_STR: 0xF4_IOERR

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    CURRENT_IRQL: 0

    STACK_TEXT:
    8a105c58 82ce407b 000000f4 00000003 86e7d6f0 nt!KeBugCheckEx+0x1e
    8a105c7c 82c67e44 82c30d50 86e7d85c 86e7d960 nt!PspCatchCriticalBreak+0x71
    8a105cac 82c69cdf 86e7d6f0 86f2bce8 c0000006 nt!PspTerminateAllThreads+0x2d
    8a105ce0 83b76bad ffffffff c0000006 09a9f8ab nt!NtTerminateProcess+0x1a2
    WARNING: Stack unwind information not available. Following frames may be wrong.
    8a105d24 82a4b42a ffffffff c0000006 01aaf620 cmdguard+0xbbad
    8a105d24 772864f4 ffffffff c0000006 01aaf620 nt!KiFastCallEntry+0x12a
    01aaf620 00000000 00000000 00000000 00000000 0x772864f4


    STACK_COMMAND: kb

    FOLLOWUP_NAME: MachineOwner

    FAILURE_BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

    BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

    Followup: MachineOwner
    ---------
    _________________________________

    DUMP3
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_DATA_INPAGE_ERROR (7a)
    The requested page of kernel data could not be read in. Typically caused by
    a bad block in the paging file or disk controller error. Also see
    KERNEL_STACK_INPAGE_ERROR.
    If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
    it means the disk subsystem has experienced a failure.
    If the error status is 0xC000009A, then it means the request failed because
    a filesystem failed to make forward progress.
    Arguments:
    Arg1: c0416530, lock type that was held (value 1,2,3, or PTE address)
    Arg2: c00000c0, error status (normally i/o status code)
    Arg3: 2ebd5860, current process (virtual address for lock type 3, or PTE)
    Arg4: 82ca6ff0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

    Debugging Details:
    ------------------

    GetPointerFromAddress: unable to read from 82b70700

    ERROR_CODE: (NTSTATUS) 0xc00000c0 - This device does not exist.

    BUGCHECK_STR: 0x7a_c00000c0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    PROCESS_NAME: svchost.exe

    CURRENT_IRQL: 0

    TRAP_FRAME: 9f9a7bf0 -- (.trap 0xffffffff9f9a7bf0)
    ErrCode = 00000010
    eax=c0000000 ebx=00000000 ecx=00000008 edx=8981a7c0 esi=00000100 edi=8981a418
    eip=82ca6ff0 esp=9f9a7c64 ebp=9f9a7ca4 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!CmpLogEvent:
    82ca6ff0 0000 add byte ptr [eax],al ds:0023:c0000000=00
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 82abc60a to 82ae4d10

    STACK_TEXT:
    9f9a7a4c 82abc60a 0000007a c0416530 c00000c0 nt!KeBugCheckEx+0x1e
    9f9a7ac0 82ab40d5 86ecb09c 9f9a7b18 82b3c540 nt!MiWaitForInPageComplete+0x2fd
    9f9a7b54 82a8fe3f 82b3c540 82ca6ff0 86ecb008 nt!MiIssueHardFault+0x3b2
    9f9a7bd8 82a4e5f8 00000008 82ca6ff0 00000000 nt!MmAccessFault+0x2656
    9f9a7bd8 82ca6ff0 00000008 82ca6ff0 00000000 nt!KiTrap0E+0xdc
    9f9a7ca4 82c09fff c000014d 00000000 a92c3001 nt!CmpLogEvent
    9f9a7cb8 82be67e2 a7e190f0 a123f988 00000000 nt!HvOptimizedSyncHive+0x27
    9f9a7cd8 82be644b a123f968 00000000 0000100c nt!CmFlushKey+0x22e
    9f9a7d28 82a4b42a 0000100c 008df184 76fe64f4 nt!NtFlushKey+0x17a
    9f9a7d28 76fe64f4 0000100c 008df184 76fe64f4 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    008df184 00000000 00000000 00000000 00000000 0x76fe64f4


    STACK_COMMAND: kb

    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    82ca6000-82ca6012 19 bytes - nt!CmUnRegisterCallback+2f6
    [ 05 e8 e4 b8 d8 ff 8d 4d:00 00 00 00 00 00 00 00 ]
    82ca6014-82ca6031 30 bytes - nt!CmUnRegisterCallback+30a (+0x14)
    [ 89 45 cc 8d 55 cc 89 50:00 00 00 00 00 00 00 00 ]
    82ca6033-82ca6076 68 bytes - nt!CmUnRegisterCallback+329 (+0x1f)
    [ 8d 45 b8 50 6a 28 8b 45:00 00 00 00 00 00 00 00 ]
    82ca6078-82ca6083 12 bytes - nt!CmUnRegisterCallback+36e (+0x45)
    [ 75 16 8d 77 28 eb 0d 8d:00 00 00 00 00 00 00 00 ]
    82ca6085 - nt!CmUnRegisterCallback+37b (+0x0d)
    [ 6a:00 ]
    82ca6087-82ca60a3 29 bytes - nt!CmUnRegisterCallback+37d (+0x02)
    [ e8 ab ed dc ff 39 36 75:00 00 00 00 00 00 00 00 ]
    82ca60a5-82ca60ab 7 bytes - nt!CmUnRegisterCallback+39b (+0x1e)
    [ 50 e8 5a 0f e8 ff 6a:00 00 00 00 00 00 00 ]
    82ca60ad-82ca60bc 16 bytes - nt!CmUnRegisterCallback+3a3 (+0x08)
    [ 57 e8 52 0f e8 ff 8b 45:00 00 00 00 00 00 00 00 ]
    82ca60be-82ca60d7 26 bytes - nt!CmUnRegisterCallback+3b4 (+0x11)
    [ cc cc cc cc cc cc 90 90:00 00 00 00 00 00 00 00 ]
    82ca60d9-82ca60db 3 bytes - nt!CmpCallCallBacks+10 (+0x1b)
    [ 83 65 dc:00 00 00 ]
    82ca60dd-82ca60df 3 bytes - nt!CmpCallCallBacks+14 (+0x04)
    [ c6 45 e7:00 00 00 ]
    82ca60e1-82ca60e5 5 bytes - nt!CmpCallCallBacks+18 (+0x04)
    [ 64 8b 3d 24 01:00 00 00 00 00 ]
    82ca60e8-82ca60f2 11 bytes - nt!CmpCallCallBacks+1f (+0x07)
    [ 89 7d d4 80 7d 10 01 0f:00 00 00 00 00 00 00 00 ]
    82ca60f5-82ca60f8 4 bytes - nt!CmpCallCallBacks+2c (+0x0d)
    [ 64 a1 24 01:00 00 00 00 ]
    82ca60fb-82ca60fe 4 bytes - nt!CmpCallCallBacks+32 (+0x06)
    [ 66 ff 88 84:00 00 00 00 ]
    82ca6102-82ca6120 31 bytes - nt!CmpCallCallBacks+39 (+0x07)
    [ 6a 11 59 be 1c f2 b6 82:00 00 00 00 00 00 00 00 ]
    82ca6123-82ca614c 42 bytes - nt!CmpCallCallBacks+5a (+0x21)
    [ 8b d8 89 45 d8 81 fb 10:00 00 00 00 00 00 00 00 ]
    82ca614f-82ca6168 26 bytes - nt!CmpCallCallBacks+86 (+0x2c)
    [ c0 c6 45 e7 01 88 45 10:00 00 00 00 00 00 00 00 ]
    82ca616b-82ca6170 6 bytes - nt!CmpCallCallBacks+a2 (+0x1c)
    [ 8d 41 f0 e9 8f 01:00 00 00 00 00 00 ]
    82ca6173-82ca61b7 69 bytes - nt!CmpCallCallBacks+aa (+0x08)
    [ 89 5f 0c 89 47 10 8d 4b:00 00 00 00 00 00 00 00 ]
    82ca61ba-82ca61bc 3 bytes - nt!CmpCallCallBacks+f1 (+0x47)
    [ 8d 81 84:00 00 00 ]
    82ca61c0-82ca61c1 2 bytes - nt!CmpCallCallBacks+f7 (+0x06)
    [ 66 ff:00 00 ]
    82ca61c3-82ca61c4 2 bytes - nt!CmpCallCallBacks+fa (+0x03)
    [ 0f b7:00 00 ]
    82ca61c6-82ca61ce 9 bytes - nt!CmpCallCallBacks+fd (+0x03)
    [ 66 85 c0 75 16 8d 41 40:00 00 00 00 00 00 00 00 ]
    82ca61d0-82ca61d5 6 bytes - nt!CmpCallCallBacks+107 (+0x0a)
    [ 74 0f 66 83 b9 86:00 00 00 00 00 00 ]
    82ca61da-82ca61ea 17 bytes - nt!CmpCallCallBacks+111 (+0x0a)
    [ 75 05 e8 09 b7 d8 ff 8d:00 00 00 00 00 00 00 00 ]
    82ca61ed-82ca620e 34 bytes - nt!CmpCallCallBacks+124 (+0x13)
    [ 8b 11 89 10 89 01 8b 4d:00 00 00 00 00 00 00 00 ]
    82ca6211-82ca6213 3 bytes - nt!CmpCallCallBacks+148 (+0x24)
    [ 83 65 fc:00 00 00 ]
    82ca6215-82ca6233 31 bytes - nt!CmpCallCallBacks+14c (+0x04)
    [ 56 ff 75 08 ff 73 18 ff:00 00 00 00 00 00 00 00 ]
    82ca6236-82ca6250 27 bytes - nt!CmpCallCallBacks+16d (+0x21)
    [ cc c3 8b 65 e8 c7 45 fc:00 00 00 00 00 00 00 00 ]
    82ca6252-82ca6254 3 bytes - nt!CmpCallCallBacks+188 (+0x1c)
    [ 83 7d e0:00 00 00 ]
    82ca6256-82ca6267 18 bytes - nt!CmpCallCallBacks+18c (+0x04)
    [ 7d 66 8b 07 8b 4f 04 89:00 00 00 00 00 00 00 00 ]
    82ca626a-82ca6277 14 bytes - nt!CmpCallCallBacks+1a0 (+0x14)
    [ 8b 08 85 c9 74 04 8b 09:00 00 00 00 00 00 00 00 ]
    82ca627a-82ca627d 4 bytes - nt!CmpCallCallBacks+1b0 (+0x10)
    [ 66 ff 88 84:00 00 00 00 ]
    82ca6281-82ca62a4 36 bytes - nt!CmpCallCallBacks+1b7 (+0x07)
    [ 6a 11 5a b9 1c f2 b6 82:00 00 00 00 00 00 00 00 ]
    82ca62a6-82ca62ae 9 bytes - nt!CmpCallCallBacks+1dc (+0x25)
    [ 57 e8 59 0d e8 ff c6 45:00 00 00 00 00 00 00 00 ]
    82ca62b0-82ca62c8 25 bytes - nt!CmpCallCallBacks+1e6 (+0x0a)
    [ c6 45 e7 01 be 1c f2 b6:00 00 00 00 00 00 00 00 ]
    82ca62cb-82ca62ce 4 bytes - nt!CmpCallCallBacks+201 (+0x1b)
    [ 64 a1 24 01:00 00 00 00 ]
    82ca62d1-82ca62d4 4 bytes - nt!CmpCallCallBacks+207 (+0x06)
    [ 66 ff 88 84:00 00 00 00 ]
    82ca62d8-82ca6320 73 bytes - nt!CmpCallCallBacks+20e (+0x07)
    [ 6a 11 5a b9 1c f2 b6 82:00 00 00 00 00 00 00 00 ]
    82ca6323-82ca6325 3 bytes - nt!CmpCallCallBacks+259 (+0x4b)
    [ 8d 81 84:00 00 00 ]
    82ca6329-82ca632a 2 bytes - nt!CmpCallCallBacks+25f (+0x06)
    [ 66 ff:00 00 ]
    82ca632c-82ca632d 2 bytes - nt!CmpCallCallBacks+262 (+0x03)
    [ 0f b7:00 00 ]
    82ca632f-82ca6337 9 bytes - nt!CmpCallCallBacks+265 (+0x03)
    [ 66 85 c0 75 16 8d 41 40:00 00 00 00 00 00 00 00 ]
    82ca6339-82ca633e 6 bytes - nt!CmpCallCallBacks+26f (+0x0a)
    [ 74 0f 66 83 b9 86:00 00 00 00 00 00 ]
    82ca6343-82ca634c 10 bytes - nt!CmpCallCallBacks+279 (+0x0a)
    [ 75 05 e8 a0 b5 d8 ff 80:00 00 00 00 00 00 00 00 ]
    82ca634e-82ca6351 4 bytes - nt!CmpCallCallBacks+284 (+0x0b)
    [ 0f 85 10 01:00 00 00 00 ]
    82ca6354-82ca637f 44 bytes - nt!CmpCallCallBacks+28a (+0x06)
    [ 80 7d e7 01 75 56 6a 07:00 00 00 00 00 00 00 00 ]
    82ca6381-82ca638a 10 bytes - nt!CmpCallCallBacks+2b7 (+0x2d)
    [ c0 75 0a 8b 45 0c 8b 40:00 00 00 00 00 00 00 00 ]
    82ca638c-82ca6398 13 bytes - nt!CmpCallCallBacks+2c2 (+0x0b)
    [ eb 02 33 c0 89 45 b4 8b:00 00 00 00 00 00 00 00 ]
    WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
    3777 errors : !nt (82ca6000-82ca6fff)

    MODULE_NAME: memory_corruption

    IMAGE_NAME: memory_corruption

    FOLLOWUP_NAME: memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MEMORY_CORRUPTOR: LARGE_4096

    FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_4096

    BUCKET_ID: MEMORY_CORRUPTION_LARGE_4096

    Followup: memory_corruption
    ---------

    Thanks :love:
  4. Ok, just tested memtest86 and it passed with no errors.
  5. Do you have GameGuard installed on your system? Try uninstalling it if you have. Also scan your computer with Malwarebytes Anti-Malware software (free version)
  6. Hey, thanks for your reply, I don't have gameguard installed on my PC and I did a scan with Mbam just before posting this thread. :(
  7. Have you attempted to use start up repair off of the Windows 7 DVD?

    Jessica
    Microsoft Windows Client Team
  8. Hey Jessica, I have and unfortunately it could not resolve the issue. I just got another blue screen, it seems to reference csrss.exe as one of the other error dumps did also. Here is the dump code

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    CRITICAL_OBJECT_TERMINATION (f4)
    A process or thread crucial to system operation has unexpectedly exited or been
    terminated.
    Several processes and threads are necessary for the operation of the
    system; when they are terminated (for any reason), the system can no
    longer function.
    Arguments:
    Arg1: 00000003, Process
    Arg2: 86ffb718, Terminating object
    Arg3: 86ffb884, Process image file name
    Arg4: 82e28d50, Explanatory message (ascii)

    Debugging Details:
    ------------------


    PROCESS_OBJECT: 86ffb718

    IMAGE_NAME: csrss.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MODULE_NAME: csrss

    FAULTING_MODULE: 00000000

    PROCESS_NAME: csrss.exe

    EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at 0x%p referenced memory at 0x%p. The required data was not placed into memory because of an I/O error status of 0x%x.

    BUGCHECK_STR: 0xF4_IOERR

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    CURRENT_IRQL: 0

    STACK_TEXT:
    9f897c9c 82edc07b 000000f4 00000003 86ffb718 nt!KeBugCheckEx+0x1e
    9f897cc0 82e5fe44 82e28d50 86ffb884 86ffb988 nt!PspCatchCriticalBreak+0x71
    9f897cf0 82e61cdf 86ffb718 876a2738 c0000006 nt!PspTerminateAllThreads+0x2d
    9f897d24 82c4342a ffffffff c0000006 0291f420 nt!NtTerminateProcess+0x1a2
    9f897d24 771364f4 ffffffff c0000006 0291f420 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0291f420 00000000 00000000 00000000 00000000 0x771364f4


    STACK_COMMAND: kb

    FOLLOWUP_NAME: MachineOwner

    FAILURE_BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

    BUCKET_ID: 0xF4_IOERR_IMAGE_csrss.exe

    Followup: MachineOwner
    ---------

    Thanks!
Ask a new question

Read More

Windows 7