BSOD on Startup, Different Error Message Every Time

Toggle sidebar Toggle sidebar
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
Hello,

I'm using this PC: http://www.newegg.com/Product/Product.aspx?Item=N82E16834152937
This version of windows 10 home: 10.0.10586 Build 10586

I ran windows update and supposedly have the most recent versions of all drivers and windows itself. (Note, I have not installed any new software or hardware and this issue occurred both before and after I updated to the most recent version of windows).

About 5 days ago, my PC started encountering the BSOD on startup after it had been powered off. After the BSOD, the laptop restarts and seems fine. I've received 4 different error messages: irq not less or equal, Kmode exception not handled, kernal security check error, and system service exception.

I go to my event log, and around the time of the crash, I have 2 errors and a critical, as well as some warnings:

Error 1: "The description for Event ID 56 from source Application Popup cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

ACPI
5

the message resource is present but the message is not found in the string/message table"

Error 2: "The previous system shutdown at 5:12:44 PM on ‎8/‎18/‎2016 was unexpected."

Critical: "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."

I am unable to open the file that should have a dump report, in C:\WINDOWS\MEMORY.DMP I'm denied access, though I should have admin privileges, as I bought this computer and am its only user.

Request: How do I get to the bottom of this? Is my PC not shutting down properly? I always power it down through the start menu, so I don't know how it would not be shutting down properly. How can I open the dump file or figure out what's going on and resolve this?

Thank you ahead of time for your help!
 
Solution
J
the bugcheck indicates that some unnamed driver has corrupted system memory or it has attempted to free the same memory address back to the system too many times. It is a common bug, the first free works, the second free of the same memory address fails because the driver no longer owns the memory address.

you would have to provide the actual minidump file. The automated dump does not list the drivers dates, even if it did you might have to provide a kernel memory dump for this problem along with setting verifier.exe flags so that the system crashes at the point of corruption rather than when a driver crashes because of the corrupt data.

you could also try to find old drivers yourself by starting cmd.exe as an admin then...
Sort by date Sort by votes
Sam Hain

Sam Hain

Honorable
Apr 21, 2013
366
0
10,960
Just taking a wag here... Looking at your OS (Win10 HE), your rig has prob installed Win10 Anniversary Edition. I'd look at your C: drive and see if an "Old" file-folder appears anywhere that would indicate the "update" has taken place along with looking at your Windows update history that shows it as well. If so, rollback.

Unfortunately, with having Win10 HE, you have no option(s) to which updates to pick and choose to install or not install... So, it WILL eventually install again unless MS has a work-around for this.

Again, I am not saying this is your issue but is something to look at and if it is try rolling back to your previous "OS/install of Win10" and see how it goes...

The Anniversary update caused my Alienware 15 R2 to have NV driver BSOD and.dll errors and crashed after login and was driving me crazy until NV released a new driver on Aug. 15th made for the Anniversary Edition OS. However, I still have issues with Windows Defender still saying I need to scan my system even though it has been done; OS has issues evidently that need ironed out.

NOTE: The Anniversary Edition started rolling out the first week of August.
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
The memory dump is owned by the system not by any user. You can make a copy of it and put the copy in a location you have rights to. It is a binary file not a text file generally you would use a windows debugger to read it.



 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640


Thanks for the replies! To Sam, I had the issue both before and after updating windows. I tried updating to see if there was some incompatibility issue with drivers or whatever else there could be an issue with that might be resolved by updating. I had disabled windows updates by killing the windows update service. (It is pretty lame how you don't have the option easily available not to update, like you did with windows 7). I mentioned windows updates just to point out that I'm fairly confident this is not the issue.

John: To open the dump file, I was going to my file explorer and literally pasting C:\WINDOWS\MEMORY.DMP
Doing so opens notepad and simultaneously tells me "Access is denied." How do I make a copy of it when I can't even get it to pull up in file explorer?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
notepad is a text editor, it open files in read and write mode. You will only have read permissions for the file in its current directory so the open with the write mode will fail and you will get access denied error.

if you were to use file explore and right click on the file and select copy then got to a directory that you own like your downloads directory and select paste. it will make a copy of the file for you and you will have full ownership of the copy.

there is not much point trying to read the file with notepad, it is not in a readable text format. you would have to use a tool that understands the format of a memory.dmp file. Basically, the windows debugger windbg.exe which you would have to get from the windows device driver development kit. You can also try to use some simple 3rd party tools to read the .dmp file google whocrashed.exe or bluescreenview.exe These tools will try to make a automated look at the .dmp file
sometimes they can be useful but 80% of the time it will just say the fault is with the windows kernel rather than the true cause of the problem.






 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
I've opened the .dmp with windbg.exe. What am I looking for? There's a lot of text/information here. I'll paste it in a spoiler if there's no personally compromising info in it.
 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
Microsoft (R) Windows Debugger Version 10.0.14321.1024 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\User Laptop\Downloads\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 10586.545.amd64fre.th2_release.160802-1857
Machine Name:
Kernel base = 0xfffff803`5e017000 PsLoadedModuleList = 0xfffff803`5e2f4cf0
Debug session time: Fri Aug 19 10:47:29.531 2016 (UTC - 4:00)
System Uptime: 0 days 13:01:55.232
Loading Kernel Symbols
...............................................................
................................................................
...............................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000006a`0b695018). Type ".hh dbgerr001" for details
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 139, {3, fffff8036027cbd0, fffff8036027cb28, 0}

Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : ntkrnlmp.exe ( nt!KiFastFailDispatch+d0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff8036027cbd0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff8036027cb28, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details

DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING: 10586.545.amd64fre.th2_release.160802-1857

SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.

SYSTEM_PRODUCT_NAME: GT72S 6QD

SYSTEM_SKU: Default string

SYSTEM_VERSION: REV:1.0

BIOS_VENDOR: American Megatrends Inc.

BIOS_VERSION: E1782IMS.109

BIOS_DATE: 09/19/2015

BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.

BASEBOARD_PRODUCT: MS-1782

BASEBOARD_VERSION: REV:1.0

DUMP_TYPE: 1

BUGCHECK_P1: 3

BUGCHECK_P2: fffff8036027cbd0

BUGCHECK_P3: fffff8036027cb28

BUGCHECK_P4: 0

TRAP_FRAME: fffff8036027cbd0 -- (.trap 0xfffff8036027cbd0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80300000000 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe0015ff9da30 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8035e1998be rsp=fffff8036027cd60 rbp=fffff8036027ce60
r8=fffff8035e336780 r9=ffffe0015f519680 r10=0000006d3ba8535d
r11=00000000000000c7 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt! ?? ::FNODOBFM::`string'+0x315be:
fffff803`5e1998be cd29 int 29h
Resetting default scope

EXCEPTION_RECORD: fffff8036027cb28 -- (.exr 0xfffff8036027cb28)
ExceptionAddress: fffff8035e1998be (nt! ?? ::FNODOBFM::`string'+0x00000000000315be)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: 8

CPU_MHZ: a98

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 5e

CPU_STEPPING: 3

CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 39'00000000 (cache) 39'00000000 (init)

DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT

BUGCHECK_STR: 0x139

PROCESS_NAME: LogonUI.exe

CURRENT_IRQL: 2

ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application.

EXCEPTION_CODE_STR: c0000409

EXCEPTION_PARAMETER1: 0000000000000003

ANALYSIS_SESSION_HOST: LAPTOP

ANALYSIS_SESSION_TIME: 08-20-2016 09:45:23.0019

ANALYSIS_VERSION: 10.0.14321.1024 x86fre

DPC_STACK_BASE: FFFFF8036027CFB0

LAST_CONTROL_TRANSFER: from fffff8035e1644e9 to fffff8035e159940

STACK_TEXT:
fffff803`6027c8a8 fffff803`5e1644e9 : 00000000`00000139 00000000`00000003 fffff803`6027cbd0 fffff803`6027cb28 : nt!KeBugCheckEx
fffff803`6027c8b0 fffff803`5e164810 : ffffe001`5c102102 fffff801`55e6b511 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff803`6027c9f0 fffff803`5e1639f3 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffff803`6027cbd0 fffff803`5e1998be : 00000000`00000cfc 00000000`00286974 fffff803`6027ce68 00000000`001b4eea : nt!KiRaiseSecurityCheckFailure+0xf3
fffff803`6027cd60 fffff803`5e15e675 : 00000000`00000000 fffff803`5e333180 fffff803`5e82e4d0 00000000`0012020e : nt! ?? ::FNODOBFM::`string'+0x315be
fffff803`6027cfb0 fffff803`5e15e480 : 00000000`00004003 fffff803`5e06b4a0 00000000`00000102 00000000`00000000 : nt!KxRetireDpcList+0x5
ffffd000`249c89c0 fffff803`5e15cf55 : 00000000`0012020e fffff803`5e15b211 00000000`0012020e ffffe001`60a7c800 : nt!KiDispatchInterruptContinue
ffffd000`249c89f0 fffff803`5e15b211 : 00000000`0012020e ffffe001`60a7c800 ffffd000`249c8a80 000001e1`9c3431d8 : nt!KiDpcInterruptBypass+0x25
ffffd000`249c8a00 00007ffd`444e9ebf : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0xb1
0000006a`0bb7a740 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`444e9ebf


STACK_COMMAND: kb

THREAD_SHA1_HASH_MOD_FUNC: cb507cef4a9b66113d1d3b1f14b55839b9fe673e

THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 7fcd6ab23e144ad06a095b561a58d5b5cc097dc3

THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe

FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff803`5e164810 c644242000 mov byte ptr [rsp+20h],0

FAULT_INSTR_CODE: 202444c6

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!KiFastFailDispatch+d0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 57a1b615

BUCKET_ID_FUNC_OFFSET: d0

FAILURE_BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

BUCKET_ID: 0x139_3_nt!KiFastFailDispatch

PRIMARY_PROBLEM_CLASS: 0x139_3_nt!KiFastFailDispatch

TARGET_TIME: 2016-08-19T14:47:29.000Z

OSBUILD: 10586

OSSERVICEPACK: 0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 784

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2016-08-03 05:15:01

BUILDDATESTAMP_STR: 160802-1857

BUILDLAB_STR: th2_release

BUILDOSVER_STR: 10.0.10586.545.amd64fre.th2_release.160802-1857

ANALYSIS_SESSION_ELAPSED_TIME: 1004

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0x139_3_nt!kifastfaildispatch

FAILURE_ID_HASH: {36173680-6f08-995f-065a-3d368c996911}

Followup: MachineOwner
---------

That's what is shown in the .dmp after I run !analyze -v

What's wrong/how do I fix it?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
the bugcheck indicates that some unnamed driver has corrupted system memory or it has attempted to free the same memory address back to the system too many times. It is a common bug, the first free works, the second free of the same memory address fails because the driver no longer owns the memory address.

you would have to provide the actual minidump file. The automated dump does not list the drivers dates, even if it did you might have to provide a kernel memory dump for this problem along with setting verifier.exe flags so that the system crashes at the point of corruption rather than when a driver crashes because of the corrupt data.

you could also try to find old drivers yourself by starting cmd.exe as an admin then
driverquerry.exe /v >c:\mydrivers.txt
notepad c:\mydrivers.txt

and look for old/outdated drivers.

I would also run
sfc.exe /scannow
dism.exe /online /cleanup-image /restorehealth

as these will repair files corrupted by malware.

if you have the windows debugger installed, you can run the following commands
!for_each_module !chkimg @#ModuleName
(this command will check each driver for corruption, and will show a error for each 3rd party driver)

lmiftsm
this command will list the drivers in alphabetical order

generally for this type of error you would update the drivers from the motherboard/laptop vendor
then boot into BIOS and update it or reset it to defaults, This will force the system to rescan the hardware and remake the database of settings that it sends to windows.




 
Upvote 0 Downvote
Solution
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
0: kd> !for_each_module !chkimg @#ModuleName
0 errors : cmimcext
0 errors : ntosext
0 errors : CI
0 errors : msrpc
0 errors : FLTMGR
0 errors : ksecdd
Error for clipsp: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for Wdf01000: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : WDFLDR
0 errors : acpiex
0 errors : WppRecorder
0 errors : cng
0 errors : ACPI
0 errors : WMILIB
0 errors : WindowsTrustedRT
0 errors : WindowsTrustedRTProxy
0 errors : pcw
0 errors : msisadrv
0 errors : pci
0 errors : vdrvroot
0 errors : pdc
Error for CEA: Could not find module base
0 errors : partmgr
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
0 errors : spaceport
0 errors : volmgr
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
CompressedPageDataReader warning: failed to get _SM_PAGE_KEY symbol.
0 errors : volmgrx
0 errors : mountmgr
0 errors : stornvme
Error for storport: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : BasicRender
0 errors : Npfs
0 errors : mcupdate_GenuineIntel
0 errors : werkernel
0 errors : CLFS
0 errors : tm
0 errors : PSHED
0 errors : BOOTVID
0 errors : fileinfo
Error for Wof: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : NTFS
0 errors : Fs_Rec
0 errors : ndis
0 errors : NETIO
0 errors : ksecpkg
0 errors : tcpip
0 errors : fwpkclnt
0 errors : wfplwfs
Error for avgmfx64: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avguniva: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : fvevol
0 errors : volsnap
0 errors : rdyboost
0 errors : mup
0 errors : intelpep
0 errors : disk
0 errors : CLASSPNP
Error for avgrkx64: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avgloga: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avgidsha: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : crashdmp
0 errors : nwifi
0 errors : cdrom
0 errors : filecrypt
Error for tbs: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : Null
0 errors : Beep
0 errors : BasicDisplay
0 errors : watchdog
0 errors : dxgkrnl
0 errors : Msfs
Error for iaStorA: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : EhStorClass
Error for bwcW10x64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : vwififlt
0 errors : pacer
0 errors : netbios
Error for rdbss: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for SASKUTIL64: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for SASDIFSV64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : nsiproxy
0 errors : npsvctrig
0 errors : mssmbios
0 errors : gpuenergydrv
0 errors : dfsc
Error for avgldx64: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avgidsdrivera: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avgdiska: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : ahcache
Error for tap0901: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : CompositeBus
0 errors : kdnic
0 errors : umbus
0 errors : wdiwifi
Error for RtsPer: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for e2xw10x64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : i8042prt
Error for SynTP: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : kbdclass
0 errors : mouclass
0 errors : CmBatt
0 errors : BATTC
0 errors : wmiacpi
Error for Smb_driver_Intel: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : intelppm
0 errors : acpipagr
Error for XtuAcpiDriver: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : UEFI
Error for nvvad64v: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : ksthunk
0 errors : NdisVirtualBus
0 errors : swenum
Error for SteelBus64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : rdpbus
0 errors : usbccgp
0 errors : UsbHub3
0 errors : hidusb
0 errors : HIDCLASS
0 errors : HIDPARSE
Error for nvhda64v: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for avgwfpa: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : tdx
0 errors : TDI
0 errors : netbt
Error for afd: Could not find module base
Error for drmk: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : ks
0 errors : USBXHCI
0 errors : ucx01000
Error for TeeDriverW8x64: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for Qcamain10x64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : vwifibus
Error for SAlphaPS264: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : USBD
Error for nvlddmkm: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : HDAudBus
Page 23f92f not present in the dump file. Type ".hh dbgerr004" for details
Page 25ddb0 not present in the dump file. Type ".hh dbgerr004" for details
Page 2f42b1 not present in the dump file. Type ".hh dbgerr004" for details
Page 1776b2 not present in the dump file. Type ".hh dbgerr004" for details
Page 25e833 not present in the dump file. Type ".hh dbgerr004" for details
0 errors : portcls
0 errors : bthport
0 errors : usbvideo
0 errors : BthLEEnum
Error for rfcomm: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : BthEnum
0 errors : bthpan
0 errors : umpass
0 errors : WUDFRd
0 errors : fastfat
Error for dump_diskdump: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for dump_stornvme: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for dump_dumpfve: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : mshidumdf
0 errors : luafv
0 errors : storqosflt
0 errors : lltdio
0 errors : mslldp
0 errors : rspndr
0 errors : wanarp
0 errors : ndisuio
0 errors : dxgmms2
0 errors : monitor
0 errors : WudfPf
Error for RTKVHD64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : kbdhid
0 errors : mouhid
Error for btfilter: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : BTHUSB
0 errors : mrxsmb
0 errors : mrxsmb20
0 errors : mpsdrv
0 errors : srvnet
0 errors : srv2
0 errors : mmcss
0 errors : mrxsmb10
0 errors : Ndu
Error for peauth: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : tcpipreg
0 errors : srv
Error for NTIOLib_X64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : condrv
0 errors : tunnel
Error for NvStreamKms: Could not find image file for the module. Make sure binaries are included in the symbol path.
Error for winio64: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : rdpvideominiport
0 errors : HTTP
0 errors : bowser
0 errors : kd
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
5 errors : nt (fffff8035e236000-fffff8035e24a731)
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
Page 1300 not present in the dump file. Type ".hh dbgerr004" for details
0 errors : hal
1513 errors : win32k (fffff96057d6a000-fffff96057d6a62a)
Error for win32kbase: Could not find image file for the module. Make sure binaries are included in the symbol path.
0 errors : TSDDD
Error for cdd: Could not find module base
Error for win32kfull: Could not find image file for the module. Make sure binaries are included in the symbol path.

There's the result of the !for_each_module !chkimg @#ModuleName command. Quite a bit of info.

I couldn't figure out how to run sfc.exe or dism.exe. I have several applications in different folders that go by those names, yet none properly executable by me.

When trying to run driverquerry as an admin in cmd, I get "'driverquerry.exe' is not recognized as an internal or external command operable program or batch file." When trying to run it not as an admin, I get "Access denied."

Your second paragraph lost me; how do I provide a minidump or a kernal memory dump and set verifier.exe flags? Do I need to do this? Or based on what I just posted, can we isolate the problem? Should I just try updating the MOBO drivers?

(Thank you so much for your help, johnbl!)
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
the debugger shows that 1513 errors : win32k.sys

this file is often attacked by malware/viruses. the malware also might rename the sfc.exe and dism.exe commands so you can not repair the system.
I would just do a clean install. you could also boot from a clean windows image and do the dism repair and specify the source for the repair files from the image, but you will never know if the malware/virus did other damage to your system. (often malware will delete recovery files, and block antivirus software ) I would just do a clean install.


oh, I made a typo on the driver query command. it should be driverquery.exe
 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
I've been pretty careful in my browsing. I have AVG's Watchdog Service, Scanning Core Module - Server Part, E-mail Scanner, and Identity Protection Service running at all times; I scan my computer weekly with AVG and SUPERAntiSpyware, and use CCleaner to tidy things up when they're done. I haven't downloaded anything that would likely be malware / a virus, and I haven't followed any questionable links in emails. Essentially, I've not done anything that would allow a virus or malware of this severity to access my computer.

Is it possible this is not malware or a virus?

I don't know how I would go about doing a clean install. I don't have any physical media that came with the PC with me, and wouldn't be able to access them for about 2 months. It sounds like a clean install would necessitate installing/configuring everything again from scratch, which I am extremely averse to doing.

You say to "run" sfx.exe and dism.exe, yet when I hit Win+R and try to run these, nothing happens. How should I go about running sfc.exe or dism.exe? I was doing a search in my C: drive (pretty much everything is installed there) for those and pulled up 4 applications for where sfx.exe is located (dism.exe is in similar or identical locations):

C:\Windows\SysWOW64,
C:\Windows\System32,
C:\Windows\WinSxS\x86_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.10586.0_none_5ba5ca11dd3ff3c0, and
C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.10586.0_none_b7c46595959d64f6

There are also 4 .mui files. When I try to run either sfx.exe or dism.exe by double-clicking one of those, a window quickly opens up and closes. Is this an indication of malware or a virus?
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
basically the debugger detected that your win32k.sys driver has been modified. You need a new one.
you are running windows 10 and a current version you can just download the media from microsoft and do a clean install.
https://www.microsoft.com/en-us/software-download/windows10/

you can make a USB boot image or make a new DVD image from the microsoft website.

the debugger only showed 1 file as modified and that file controls the users interactions to windows. It could be random chance but it is unlikely. If it is just a bad RAM location, then you should get a different corrupted file on each boot just because windows loads the drivers in different locations on each boot. Also, you don't know if the file is being modified in memory after it is loaded or on disk before it is loaded. both the dism.exe and sfc.exe would have fixed the corrupted file on disk. (but you can not run those for some reason)


to run the programs you need to run cmd.exe as an admin (windows key+x, then type A)
then run the system file checker utilitiy SFC.exe (not sfx.exe)
otherwise if you just run the command without the command shell the command will run and just exit and you can not see what happended.



 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
C:\WINDOWS\system32>sfc.exe /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>dism.exe /online

Deployment Image Servicing and Management tool
Version: 10.0.10586.0


Error: 1639

The command-line is missing a required servicing command.
For more information, refer to the help by running DISM.exe /Online /?.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

C:\WINDOWS\system32>dism.exe /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.10586.0

Image Version: 10.0.10586.0

[==========================100.0%==========================]
The restore operation completed successfully.
The operation completed successfully.

Restarting now, will see if it is fixed.
 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
I used Win+X, then A, to run sfc.exe and dism.exe. Sadly, it happened again on startup after using the sfc.exe and dism.exe commands you recommended: Kernal_Security_Check_Error

All within a few seconds of the BSOD on startup, looking at event viewer, I have:

! Error EventLog Event ID 6008
! Error Application Popup Event ID 56
! Error BugCheck Event ID 1001
X Critical Kernal-Power Event ID 41, Task Category (63)
! Warning kernal-PnP Event ID 219, Task Category (212)

A few seconds later, there are a bunch of other TaskScheduler and Kernal-Processor-Power warnings, but I don't know if they are connected to the issue I'm having. Should I care about these warnings?

Details of the critical event, 41, are:

- EventData

BugcheckCode 313
BugcheckParameter1 0x3
BugcheckParameter2 0xfffff801cf049590
BugcheckParameter3 0xfffff801cf0494e8
BugcheckParameter4 0x0
SleepInProgress 0
PowerButtonTimestamp 0
BootAppStatus 0

The general description of Event 41 is: The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

Only the BugCheck error mentions that something was saved in a .dmp. What about the critical? Should I post this .dmp? Or will it not have anything to do with the critical? (How do I proceed?)

Thank you again for your help!
 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
the power error will be logged on the next boot after a bugcheck. This is normal logging is not going to be useful in this case.

the bugcheck 313 = 0x139=KERNEL_SECURITY_CHECK_FAILURE
this just means the windows detected that one of its files in memory has been modified. It assumes it is malware and just shut down the system.

you might put the actual memory dump file from c:\windows\minidump directory on to a server like microsoft one drive, share the file as public and I can look at it with the windows debugger.

otherwise you have to repair from a new image of the operating system.


 
Upvote 0 Downvote
J

johnbl

Polypheme
Nov 4, 2012
10,072
185
67,090
bugcheck was caused becase of some service overwrote another programs memory . it wrote data( the number 48) over the memory address this crashed the LogonUI.exe


from the memory dump link you sent:

try removing these drivers and see if you still bugcheck.

-your old drivers(2011) for your old antivirus is going to mess up your new antivirus scanner. (remove)
-your 2012 overclcock driver NTIOLib_X64.sys does not know about your new low power CPU released in sept of 2015. The old driver will be applying too high of a voltage to the CPU. remove or update it.

old drivers:
C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS Thu Jul 21 16:03:00 2011
C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS Tue Jul 12 14:00:01 2011

Nuvoton Technology Corporation PCIeBridge Part of MSI Dragoon Gaming Center also
(remove)
C:\Program Files (x86)\MSI\Dragon Gaming Center\winio64.sys Thu Jun 03 21:08:03 2010

C:\Program Files (x86)\MSI\SUPER CHARGER\NTIOLib_X64.sys Thu Oct 25 03:27:58 2012

machine info:
BIOS Version E1782IMS.109
BIOS Release Date 09/19/2015
Manufacturer Micro-Star International Co., Ltd.
Product Name GT72S 6QD
Version REV:1.0
Manufacturer Micro-Star International Co., Ltd.
Product MS-1782
Version REV:1.0
Chassis Type Notebook
Processor Version Intel(R) Core(TM) i7-6820HK CPU @ 2.70GHz
Processor Voltage 8ch - 1.2V
External Clock 100MHz
Max Speed 2700MHz
Current Speed 3200MHz


 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
Ok. I tried to reply about an hour ago and was told I had been banned. I ran AVG and superanti, cleaned things up with CCleaner (emptied trashcan, fixed registry issues), and now I can reply? wtf. I hadn't done this in 2 weeks.

I restarted the computer after doing the above and didn't get a BSOD on startup. I'll update this tomorrow once the computer has been off for a while, see if I get the BSOD again. The fact that it didn't happen just a moment ago makes me wonder if the above somehow addressed the issue.
 
Upvote 0 Downvote
R

RADD1

Distinguished
Aug 30, 2013
55
0
18,640
Well, the issue appears to have been cured by running one of: AVG (which didn't find anything), SuperAntiSPYWARE (which found a bunch of relatively benign tracking cookies), or CCleaner (which emptied my recycle bin, cleared browsing history, and fixed a few registry issues). I'd guess it was something to do with the registry cleanup. I did this exact process right after the issue began occurring, yet it didn't resolve it then. It seems to have now...

Whatever it may be, I no longer have the BSOD on startup and my laptop is running just as I want it to.

johnbl, you clearly have an excellent understanding of Windows 10's workings and are very willing to offer your expertise to help others. Thank you so much for your assistance!

Note: This issue returned! Its investigation is continued here: http://www.tomshardware.com/forum/id-3175309/windows-frustrations-return-bsod-startup.html
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom