[Lhoyd1]

Here the autoruns log - cant see the 2 entries - massive apologies if I'm being dumb!

Attached Files

•  AutoRuns.zip   13.71KB   167 downloads

[Advertisements]

This time the crash was caused by this item in the services tab.

+ "SWUpdateService" "SW Update Agent" "Samsung Electronics CO., LTD." "c:\programdata\samsung\sw update service\swmagent.exe" "21/10/2013 19:06"

Please untick it and reboot.

[rockmilk]

This time the crash was caused by this item in the services tab.

+ "SWUpdateService" "SW Update Agent" "Samsung Electronics CO., LTD." "c:\programdata\samsung\sw update service\swmagent.exe" "21/10/2013 19:06"

Please untick it and reboot.

[Lhoyd1]

Ok, I've done that and rebooted and we'll see what happens!
Thanks again

[Lhoyd1]

Well, been doing pretty well...but had another bsod just now with IRQL not less or equal as the message

Minidump enclosed - any ideas?

Thanks!

Attached Files

•  123013-16551-01.zip   28.91KB   174 downloads

[rockmilk]

I would like you to re-seat your ram modules at this point and also while you are in there go ahead and re seat your hdd.

[Lhoyd1]

Hi...sorry again for late reply - I've been in the wilds of north east cambodia with no internet!

Anyway, tried reseating the RAM but still same issues

Looking at it, it only ever happens when the computer has been in hibernation for a while - I wonder if thats the issue?

[rockmilk]

Can you upload some fresh dumps for me please.

[Lhoyd1]

Hi

Here is this mornings minidump file

regards

Lhoyd

Attached Files

•  020714-29016-01.zip   29.96KB   162 downloads

[rockmilk]

I would like you to have your machine checked for malware, please start a new thread in the virus area.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8024bff010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002195cb6, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002310100
GetUlongFromAddress: unable to read from fffff800023101c0
 fffffa8024bff010 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8801a56ef40 -- (.trap 0xfffff8801a56ef40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8014bff010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002195cb6 rsp=fffff8801a56f0d0 rbp=0000000080000000
 r8=fffff8801a56f100  r9=00000000ffffffff r10=ffffffffffffffff
r11=0000000000000011 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`14bff010=ffffffffffffffff
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800020d8169 to fffff800020d8bc0

STACK_TEXT:  
fffff880`1a56edf8 fffff800`020d8169 : 00000000`0000000a fffffa80`24bff010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`1a56ee00 fffff800`020d6de0 : 00000000`00000008 fffff880`1a56efc0 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`1a56ef40 fffff800`02195cb6 : 00000000`00000000 00000000`00000000 fffffa80`14b6b600 fffff880`02f773e3 : nt!KiPageFault+0x260
fffff880`1a56f0d0 fffff800`0214f3bc : 80000000`00000000 fffff680`00415000 fffff680`00415440 000fffff`00000001 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`1a56f150 fffff800`020c5142 : fffffa80`00000001 00000000`00002a89 fffffa80`1501e8a0 fffffa80`1501ec38 : nt! ?? ::FNODOBFM::`string'+0x3ad16
fffff880`1a56f9e0 fffff800`020d7e53 : ffffffff`ffffffff 00000000`0199f828 00000000`0199f820 00000000`00004000 : nt!NtFreeVirtualMemory+0x382
fffff880`1a56fae0 00000000`7723149a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0199f7e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7723149a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`02195cb6 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+86

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+86

Followup: MachineOwner