Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

BSOD - tcpip.sys?


  • Please log in to reply

#16
Lhoyd1

Lhoyd1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Here the autoruns log - cant see the 2 entries - massive apologies if I'm being dumb!

Attached Files


  • 0

Advertisements


#17
rockmilk

rockmilk

    Certified monkey.

  • Member
  • PipPipPipPipPip
  • 2,773 posts
This time the crash was caused by this item in the services tab.

+ "SWUpdateService" "SW Update Agent" "Samsung Electronics CO., LTD." "c:\programdata\samsung\sw update service\swmagent.exe" "21/10/2013 19:06"

Please untick it and reboot.
  • 0

#18
Lhoyd1

Lhoyd1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Ok, I've done that and rebooted and we'll see what happens!
Thanks again
  • 0

#19
Lhoyd1

Lhoyd1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Well, been doing pretty well...but had another bsod just now with IRQL not less or equal as the message

Minidump enclosed - any ideas?

Thanks!

Attached Files


  • 0

#20
rockmilk

rockmilk

    Certified monkey.

  • Member
  • PipPipPipPipPip
  • 2,773 posts
I would like you to re-seat your ram modules at this point and also while you are in there go ahead and re seat your hdd.
  • 0

#21
Lhoyd1

Lhoyd1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Hi...sorry again for late reply - I've been in the wilds of north east cambodia with no internet!

Anyway, tried reseating the RAM but still same issues

Looking at it, it only ever happens when the computer has been in hibernation for a while - I wonder if thats the issue?
  • 0

#22
rockmilk

rockmilk

    Certified monkey.

  • Member
  • PipPipPipPipPip
  • 2,773 posts
Can you upload some fresh dumps for me please.
  • 0

#23
Lhoyd1

Lhoyd1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Hi

Here is this mornings minidump file

regards

Lhoyd

Attached Files


  • 0

#24
rockmilk

rockmilk

    Certified monkey.

  • Member
  • PipPipPipPipPip
  • 2,773 posts
I would like you to have your machine checked for malware, please start a new thread in the virus area.



*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8024bff010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002195cb6, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002310100
GetUlongFromAddress: unable to read from fffff800023101c0
 fffffa8024bff010 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8801a56ef40 -- (.trap 0xfffff8801a56ef40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8014bff010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002195cb6 rsp=fffff8801a56f0d0 rbp=0000000080000000
 r8=fffff8801a56f100  r9=00000000ffffffff r10=ffffffffffffffff
r11=0000000000000011 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`14bff010=ffffffffffffffff
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800020d8169 to fffff800020d8bc0

STACK_TEXT:  
fffff880`1a56edf8 fffff800`020d8169 : 00000000`0000000a fffffa80`24bff010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`1a56ee00 fffff800`020d6de0 : 00000000`00000008 fffff880`1a56efc0 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`1a56ef40 fffff800`02195cb6 : 00000000`00000000 00000000`00000000 fffffa80`14b6b600 fffff880`02f773e3 : nt!KiPageFault+0x260
fffff880`1a56f0d0 fffff800`0214f3bc : 80000000`00000000 fffff680`00415000 fffff680`00415440 000fffff`00000001 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`1a56f150 fffff800`020c5142 : fffffa80`00000001 00000000`00002a89 fffffa80`1501e8a0 fffffa80`1501ec38 : nt! ?? ::FNODOBFM::`string'+0x3ad16
fffff880`1a56f9e0 fffff800`020d7e53 : ffffffff`ffffffff 00000000`0199f828 00000000`0199f820 00000000`00004000 : nt!NtFreeVirtualMemory+0x382
fffff880`1a56fae0 00000000`7723149a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0199f7e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7723149a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

Followup: MachineOwner

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP