[phillpower2]

Thank you for being so understanding 

 

Crash dumps can sometimes be easy to understand and sometimes difficult, using your latest crash dump as an example I will try and give you some pointers,

 

Please see the info that I have highlighted in red + an explanation in blue;

 

* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff803794c865d, The address that the exception occurred at
Arg3: ffffd00155974398, Exception Record Address
Arg4: ffffd00155973bb0, Context Record Address

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!MiMapViewOfImageSection+61d
fffff803`794c865d f7403800000800 test dword ptr [rax+38h],80000h

EXCEPTION_RECORD: ffffd00155974398 -- (.exr 0xffffd00155974398)
ExceptionAddress: fffff803794c865d (nt!MiMapViewOfImageSection+0x000000000000061d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

CONTEXT: ffffd00155973bb0 -- (.cxr 0xffffd00155973bb0)
rax=0000000000000000 rbx=0000000000000006 rcx=ffffe001ea2bcc10
rdx=00000000001c1000 rsi=ffffe001ec2e0150 rdi=0000000000000000
rip=fffff803794c865d rsp=ffffd001559745d0 rbp=ffffd001559746d0
r8=000000004000000e r9=0000000000000000 r10=000000000000039f
r11=fffff80379077000 r12=0000000000000000 r13=00000007ffb495b0
r14=00007ffb493f0000 r15=ffffc0000a1de430
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
nt!MiMapViewOfImageSection+0x61d:
fffff803`794c865d f7403800000800 test dword ptr [rax+38h],80000h ds:002b:00000000`00000038=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

PROCESS_NAME: System This is often the most useful information as it can identify a particular driver or service etc involved in the crash, you will recall previously that RocketLeague.e and CCleaner64.exe were involved, it was PROCESS_NAME that told us this, now the down side, when it only says System it does not help at all as it could be just about anything at all, in this instance we have to look elsewhere for clues.

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000000

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
0000000000000000

FOLLOWUP_IP:
nt!MiMapViewOfImageSection+61d This regards Windows memory management, This does not always mean that there is definitely a physical problem with your RAM but could be the result of a page fault, see attachment below.

fffff803`794c865d f7403800000800 test dword ptr [rax+38h],80000h

BUGCHECK_STR: AV This suggests that your anti virus is in some way involved.

EXCEPTION_STR: 0x0

LAST_CONTROL_TRANSFER: from fffff80379508736 to fffff803794c865d

STACK_TEXT:
ffffd001`559745d0 fffff803`79508736 : ffffe001`ea2bc940 00000000`00000000 ffffe001`e801e700 ffffd001`559747e0 : nt!MiMapViewOfImageSection+0x61d
ffffd001`55974740 fffff803`79443eae : ffffe001`ea2bc901 fffff803`791331a9 ffffe001`ec371070 ffffe001`ec371070 : nt!MiMapViewOfSection+0x336
ffffd001`559748c0 fffff803`79443dd0 : ffffe001`e801e700 fffff803`7976f8d0 ffffd001`55974a30 ffffe001`e801e700 : nt!MmMapViewOfSection+0x62
ffffd001`55974930 fffff803`795ac328 : 00000000`00000000 00000000`00000000 ffffd001`55974a30 fffff803`7976f8d0 : nt!PspMapSystemDll+0x94
ffffd001`559749b0 fffff803`795ac1d4 : ffffffff`80000040 fffff803`797e6c20 ffffffff`80000030 ffffc000`0a1eb930 : nt!PspLocateSystemDll+0x128
ffffd001`55974a50 fffff803`797cbaae : 00000000`00000000 00000000`00000006 fffff803`776da530 fffff803`776da530 : nt!PsLocateSystemDlls+0x44
ffffd001`55974a90 fffff803`797d2689 : fffff803`7acbb070 fffff803`776da530 fffff803`7959708c 00000000`00000ac4 : nt!IoInitSystemPreDrivers+0xa46
ffffd001`55974bb0 fffff803`795970b6 : 00000000`00000000 fffff803`776da530 fffff803`7959708c fffff803`776da530 : nt!IoInitSystem+0x9
ffffd001`55974be0 fffff803`790bda45 : ffffe001`e8095040 00000000`00000000 00000000`00000000 00000000`00000000 : nt!Phase1Initialization+0x2a
ffffd001`55974c10 fffff803`791beae6 : fffff803`79393180 ffffe001`e8095040 fffff803`790bda04 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffd001`55974c60 00000000`00000000 : ffffd001`55975000 ffffd001`5596f000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiMapViewOfImageSection+61d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt Nt Error Codes are caused in one way or another by damaged/corrupt system files in Windows.

DEBUG_FLR_IMAGE_TIMESTAMP: 5775e2f5

STACK_COMMAND: .cxr 0xffffd00155973bb0 ; kb

IMAGE_NAME: memory_corruption This again does not always mean that there is definitely a physical problem with your RAM

FAILURE_BUCKET_ID: X64_AV_nt!MiMapViewOfImageSection+61d This again points towards your anti virus having issues.

BUCKET_ID: X64_AV_nt!MiMapViewOfImageSection+61d As above, the following explains what may be causing it.

 

When the PROCESS_NAME: System is the only info given I next look to see what if any drivers etc failed to load, your latest crash dump shows two drivers that failed to load, one or both could be the cause of your latest crash;

Unloaded modules:

fffff800`8b940000 fffff800`8b950000   WdBoot.sys This = Windows Defender Boot Driver

fffff800`8c670000 fffff800`8c67e000   hwpolicy.sys This = Microsoft Hardware Policy Driver 

 

What I suggest you try next is a Windows 10 system refresh, this will reinstall Windows 10 but keep all of your personal data, it may remove some apps but they will be placed in a folder on your desktop and you can reinstall whatever you want when ready, see the keep my files option courtesy of Brink here

 

Edit

Just gone back through your Speccy report and noticed a problem with the page file setting, will wait on your next update for now though.

[Advertisements]

I apologise for not responding sooner. I was gone another weekend like before and not near my pc going back tomorrow. I really appreciate that you took the time to show me how a dmp file works. I will do the windows 10 refresh as soon as I access pc again. The settings being incorrect I wouldn't know only thing I recognise is that it was mentioned in the dmp that you deciphered.

[MarcianoG]

I apologise for not responding sooner. I was gone another weekend like before and not near my pc going back tomorrow. I really appreciate that you took the time to show me how a dmp file works. I will do the windows 10 refresh as soon as I access pc again. The settings being incorrect I wouldn't know only thing I recognise is that it was mentioned in the dmp that you deciphered.

[phillpower2]

No problem 

[MarcianoG]

Well first attempt at reinstall failed it caused a blue screen which caused a restart with another blue screen then it booted normal. Second attempt it froze on 8%. Waited 10 minutes to be sure it wasn't just loading or whatever. Gonna restart and try and see what the dmp files say for the first 2 crashes.
The dmp files are not saved in Minidump.
Third attempt it also froze at 8% again.
I followed the method described in the link you provided.

Edited by MarcianoG, 22 July 2016 - 04:51 AM.

[phillpower2]

Hello MarcianoG  ,

 

Apologies for the delay getting back to you, my time on the forums has been limited the past couple of days as I was needed elsewhere.

 

Can you let us know what the situation is with the computer at the moment as in will it boot into Windows at all.

 

NB: A refresh can take a while and appear to hang for long periods so would be best left over night, if still frozen at a certain % the next day then something is not right and a clean install may be required.

[MarcianoG]

Hello phillpower2,

 

The delay of response is also on my side have not really had the time and not really wanting to do it. 

But I installed it again today and will probably spend some time on it coming few days.

To answer the question it will boot into windows. And with some certainty I can say it will crash within 20 minutes of first startup of the day.

I got a crash today, Kmode exception not handled. Looked into the dump file (thank you for explaining it it was really helpful.) and I found it was caused by Steam.exe.

Have no clue why it would crash, and it hasn't crashed with steam before. Have included the dmp file you might find more useful things in it than me.   DMP2407.zip   92.85KB   214 downloads

Currently I can do whatever I want and keeping with the trend it will probably run perfectly until I shut it off tonight and start it up again tomorrow.

 

I will let the windows refresh run overnight tonight and will report back tomorrow morning, or make an edit when something happens!

[phillpower2]

Hello MarcianoG,

 

Thanks for the update 

 

Nothing conclusive in the latest dmp so I suggest that you see how things go with the refresh first, if no joy with it completing or the system crashes again please refer to the following info below;

 

To see if we can identify any driver conflicts please refer to the copy/paste details below provided courtesy of jcgriff2   

 

1. Create a Windows System Restore Point -

Vista - START | type rstrui - create a restore point
Windows 7 - START | type create | select "Create a Restore Point"
Windows 8/ 8.1 - Using Microsoft System Restore (Windows*8) | HP® Support

2. Run Driver Verifier -

- Windows 7 & Vista - START | type verifier 
- Windows 10/8.1/8 - Press WIN +X keys | select "Command Prompt (Admin)" | type verifier 

Make these selections - 
1. Select 2nd option - Create custom settings (for code developers)
2. Select 2nd option - Select individual settings from a full list
3. Check these boxes -

▪ Special Pool 
▪ Pool Tracking 
▪ Force IRQL checking
▪ Deadlock Detection
▪ Security Checks (new as of Windows 7)
▪ Concurrency Stress Test (new as of Windows 8)
▪ DDI compliance checking (new as of Windows 8) 
▪ Miscellaneous Checks

4. Select last option - Select driver names from a list
5. Click on the Provider heading - sorts list by Provider
6. Check ALL boxes where "Microsoft" IS NOT the Provider
7. Click on Finish 
8. Re-boot[/HIDE]

 

 

- If the Driver Verifier (DV) finds a violation, it will result in a BSOD

 

- After re-start, you may not be able to log on to normal Windows

... • Boot into SAFEMODE - tap the F8 key repeatedly during boot-up

... • Select "System Restore"

... • Choose the restore point that you created in step #1

 

- For Driver Verifier status

--- select last option, 1st screen -or-

--- type verifier /query (in a cmd/DOS screen)

- To turn Driver Verifier off - verifier /reset then re-boot

 

- The Driver Verifier needs to run as long as possible - even if the status screen appears clear.

- All future BSOD dumps must be VERIFIER_ENABLED_MINIDUMPs - otherwise the dump(s) are of no use

 

If your system does BSOD while the Driver Verifier is running, please retrieve the dump file from c:\windows\minidump and attach it to your next reply.

 

Please note that Driver Verifier may need to be left running for up to 72hrs, you should use the computer as you normally would and DV will not affect this unless a BSOD occurs.  

[MarcianoG]

I am trying to do this driver verifier but now the computer freezes and I am unable to continue it will do this very often and is unresponsive when it happens. I tried to send my latest dmp buy before I could it froze. At least it got rid of the bsod right . It froze when I had civ 5 and steam open the other time I only had chrome open and the windows debugger to look at the dmp.

Edit: I started the pc up and did nothing I logged in at 13:33 and at 13:50 I woke it from sleep mode upon which ut immediately froze.

Edited by MarcianoG, 26 July 2016 - 06:30 AM.

[phillpower2]

Restart the computer and do the following if you are able to;

 

Open the Win+X menu, and click/tap on Command Prompt (Admin)

In the elevated command prompt, powercfg -h off 

 

See how the computer behaves after a restart please.

[MarcianoG]

It worked after I had cut the power for a longer period of time. With a freeze like this is there some way to find out what causes it like a blue screen makes a dump? Or should I just check the logs

Edit: it worked two days ago and stayed on for a long period of time today it froze after about 20 minutes. Attempting your fix

Edit2: did the thing with cmd but now it immediately froze shut down and turned back on but won't boot

Edited by MarcianoG, 29 July 2016 - 04:20 AM.

[phillpower2]

Not sure what is going on atm but what I can say for certain is that it is nothing to do with disabling hibernation.

 

Do you have access to another computer that has internet connection, I have a suggestion for you to try to see if the computer is stable outside of Windows.

[MarcianoG]

Yes I do. Does it need to be a computer on LAN or is a laptop with WiFi also okay?
Fire away with the suggestions haha

[phillpower2]

The second computer is only for downloading so LAN or wireless are both good 

 

See how the computer behaves when you run Puppy Linux, you can burn it to disk or download it to a USB thumb drive;

 

=================== 

***Required Hardware*** 

CD Burner (CDRW) Drive, 

Blank CD, 

Extra Storage Device (USB Flash Drive, External Hard Drive)

=================== 

 

1. Save these files to your Desktop/Burn Your Live CD:

• Download Latest Puppy Linux ISO (i.e.: lupu-528.iso) 
  

   

  Download BurnCDCC ISO Burning Software 

   

  There are instructions on how to boot from flash drive with puppy here; / 

   

  For computers that have UEFI as opposed to legacy BIOS, to be able to boot from your USB device you may need to disable secure boot and change UEFI to CSM Boot, not all computers and BIOS are the same, please refer to your user manual if you have one as the following steps are only one such example.

   

  Restart the computer, Windows 8 and 8.1 from the Start or desktop screen move your mouse pointer over the upper or lower right corner of the screen, when the Windows Charms appear click the Settings Charm, click on Power and then the Restart option.

   

  Windows 10, Click on Start,Power and then Restart.

   

  While the computer is re-starting,you will need to continually tap or hold down the particular key that will allow you to access the BIOS on your computer, we will use the F2 key as an example here;

   

  After restarting the computer, when the screen goes black, press and hold down the F2 key, wait for the BIOS to load.

   

  Select Security -> Secure Boot and then Disabled.

  Select Advanced -> System Configuration and then Boot Mode.

  Change UEFI Boot to CSM Boot.

  Save the changes and Exit the BIOS, commonly F10.

   

  If your computer will not boot into Windows at all, power up or restart the computer continually tap or hold down the key that will allow you to access the BIOS on your computer and then do the following;

   

  Select Security -> Secure Boot and then Disabled.

  Select Advanced -> System Configuration and then Boot Mode.

  Change UEFI Boot to CSM Boot.

  Save the changes and Exit the BIOS, commonly F10.

   

   

   



• Open BurnCDCC with Windows Explorer 
  

   

   



• Extract All files to a location you can remember 
  

   

   



• Double Click BurnCDCC 
  

   

   



• Click Browse and navigate to the Puppy Linux ISO file you just downloaded 
  

   

   



• Open/Double Click that file 
  

   

  IMPORTANT: Adjust the speed bar to CD: 4x DVD: 1x 

   



• Click Start  
  

   

   



• Your CD Burner Tray will open automatically 
  

   

   



• Insert a blank CD and close the tray 
  

   

   



• Click OK 
  

   

   

Puppy Linux Live CD will now be created

 

 

2. Set your boot priority in the BIOS to CD-ROM first, Hard Drive Second 

 

•  
  

   

   



• Start the computer/press the power button 
  

   

   



• Immediately start tapping the appropriate key to enter the BIOS, aka "Setup" 
  

   

  (Usually shown during the "Dell" screen, or "Gateway" Screen) 

   



• Once in the BIOS, under Advanced BIOS Options change boot priority to: 
  

   

  CD-ROM 1st, Hard Drive 2nd 

   



• Open your ROM drive and insert the disk 
  

   

   



• Press F10 to save and exit 
  

   

   



• Agree with "Y" to continue 
  

   

   



• Your computer will restart and boot from the Puppy Linux Live CD 
  

   

   

   

   

 

 

 

 

3.  Recover Your Data 

 

• Once Puppy Linux has loaded, it is actually running in your computer's Memory (RAM).  You will see a fully functioning Graphical User Interface similar to what you normally call "your computer".  Internet access may or may not be available depending on your machine, so it is recommended you print these instructions before beginning.  Also, double clicking is not needed in Puppy.  To expand, or open folders/icons, just click once.  Puppy is very light on resources, so you will quickly notice it is much speedier than you are used to.  This is normal.  Ready?  Let's get started. 
  

   

   

  3a. Mount Drives[list] 

   



• Click the Mount Icon located at the top left of your desktop.  
  

   

   



• A Window will open.  By default, the "drive" tab will be forward/highlighted.  Click on Mount for your hard drive. 
  

   

   



• Assuming you only have one hard drive and/or partition, there may be only one selection to mount. 
  

   

   



• USB Flash Drives usually automatically mount upon boot, but click the "usbdrv" tab and make sure it is mounted. 
  

   

   



• If using an external hard drive for the data recovery, do this under the "drive" tab.  Mount it now. 
  

   

   

 

 

3b. Transfer Files.

•  
  

   

   



• At the bottom left of your desktop a list of all hard drives/partitions, USB Drives, and Optical Drives are listed with a familiar looking hard drive icon. 
  

   

   



• Open your old hard drive i.e. sda1 
  

   

   



• Next, open your USB Flash Drive or External Drive. i.e. sdc or sdb1 
  

   

   



• If you open the wrong drive, simply X out at the top right corner of the window that opens. (Just like in Windows) 
  

   

   



• From your old hard drive, drag and drop whatever files/folders you wish to transfer to your USB Drive's Window. 
  

   

   

 

 

For The Novice:  The common path to your pictures, music, video, and documents folders for XP is: Documents and Settings >> All Users (or each individual name of each user, for Vista and above  C:\Users\$USERNAME\[...]. CHECK All Names!) >> Documents >> You will now see My Music, My Pictures, and My Videos. 

 

Remember to only click once!  No double clicking!  Once you drag and drop your first folder, you will notice a small menu will appear giving you the option to move or copy.  Choose COPY each time you drag and drop. 

 

YOU ARE DONE!!!  Simply click Menu >> Mouse Over Shutdown >> Reboot/Turn Off Computer.  Be sure to plug your USB Drive into another working windows machine to verify all data is there and transferred without corruption. Congratulations! 

 

 

 

 

[MarcianoG]

I understand. I will buy a new USB tomorrow because I feel like having an extra OS for testing and just in case is useful. Is this a 'sure' way of seeing if it is a hardware or software problem. (Given puppy Linux is free of problems). I am assuming some of the steps listed are useful for people who's OS will not boot at all because there is talk of file transfer?
Thanks for the help. I will try and get it done tomorrow as fast as possible.

Edited by MarcianoG, 31 July 2016 - 11:46 AM.

[phillpower2]

Puppy uses the RAM to boot from so if the computer runs Puppy ok it suggest that the RAM is good and that the issue lays elsewhere with Windows or another software becoming a strong contender as the cause.

 

No rush here, do it in your own time