New
#1
BSOD When excessive, brand new RAM, lots of disk activity or NetWorx?
Hi, just re-designed home setup that another computer uses this computers disks through SMB shares, with lots of disc activity all the time, but the problem persisted when i eliminated that as a factor. No BSOD when there is NO constant disc activity though.
I also installed NetWorx bandwidth monitor & changed 12GB of ram to 32GB of brand new ram.
The analyze -v of the dumps seem promising: but I'm not prolific enough to fully understand them: so was hoping for some help.
I'm running checkdsk's now: but taking forever on about 24TB of HDs.
Pasting the analyze -v here:
Thanks!Code:Microsoft (R) Windows Debugger Version 10.0.14321.1024 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [D:\110616-12875-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Symbol Path validation summary ************** Response Time (ms) Location Deferred SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 10 Kernel Version 14393 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 14393.351.amd64fre.rs1_release_inmarket.161014-1755 Machine Name: Kernel base = 0xfffff802`8ce87000 PsLoadedModuleList = 0xfffff802`8d18bfc0 Debug session time: Sun Nov 6 22:53:24.473 2016 (UTC + 1:00) System Uptime: 0 days 0:53:42.256 Loading Kernel Symbols . Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. .............................................................. ................................................................ .................................................. Loading User Symbols Loading unloaded module list .................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 139, {3, fffff8028eb576c0, fffff8028eb57618, 0} *** ERROR: Module load completed but symbols could not be loaded for tcpip.sys *** WARNING: Unable to verify timestamp for ndis.sys *** ERROR: Module load completed but symbols could not be loaded for ndis.sys Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1067 ) Followup: Pool_corruption --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_SECURITY_CHECK_FAILURE (139) A kernel component has corrupted a critical data structure. The corruption could potentially allow a malicious user to gain control of this machine. Arguments: Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove). Arg2: fffff8028eb576c0, Address of the trap frame for the exception that caused the bugcheck Arg3: fffff8028eb57618, Address of the exception record for the exception that caused the bugcheck Arg4: 0000000000000000, Reserved Debugging Details: ------------------ DUMP_CLASS: 1 DUMP_QUALIFIER: 400 BUILD_VERSION_STRING: 10.0.14393.351 (rs1_release_inmarket.161014-1755) SYSTEM_MANUFACTURER: HP-Pavilion SYSTEM_PRODUCT_NAME: WC787AA-UUW p6370sc SYSTEM_SKU: WC787AA#UUW BIOS_VENDOR: American Megatrends Inc. BIOS_VERSION: 5.15 BIOS_DATE: 06/25/2010 BASEBOARD_MANUFACTURER: MSI BASEBOARD_PRODUCT: IONA BASEBOARD_VERSION: 1.0 DUMP_TYPE: 2 BUGCHECK_P1: 3 BUGCHECK_P2: fffff8028eb576c0 BUGCHECK_P3: fffff8028eb57618 BUGCHECK_P4: 0 TRAP_FRAME: fffff8028eb576c0 -- (.trap 0xfffff8028eb576c0) NOTE: The trap frame does not contain all registers. Some register values may be zeroed or incorrect. rax=ffffa68471f69a50 rbx=0000000000000000 rcx=0000000000000003 rdx=ffffa684723d53a0 rsi=0000000000000000 rdi=0000000000000000 rip=fffff8028d0d5807 rsp=fffff8028eb57850 rbp=0000000000000000 r8=ffffa684795d6d80 r9=ffffa68471a937a0 r10=0000000000000000 r11=ffffa6847493d790 r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000 iopl=0 nv up ei pl nz na po cy nt!ExDeferredFreePool+0x1067: fffff802`8d0d5807 cd29 int 29h Resetting default scope EXCEPTION_RECORD: fffff8028eb57618 -- (.exr 0xfffff8028eb57618) ExceptionAddress: fffff8028d0d5807 (nt!ExDeferredFreePool+0x0000000000001067) ExceptionCode: c0000409 (Security check failure or stack buffer overrun) ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 0000000000000003 Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY CPU_COUNT: 4 CPU_MHZ: a64 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: 1e CPU_STEPPING: 5 CPU_MICROCODE: 6,1e,5,0 (F,M,S,R) SIG: 7'00000000 (cache) 7'00000000 (init) CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: LIST_ENTRY_CORRUPT BUGCHECK_STR: 0x139 PROCESS_NAME: networx.exe CURRENT_IRQL: 2 ERROR_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. EXCEPTION_CODE_STR: c0000409 EXCEPTION_PARAMETER1: 0000000000000003 ANALYSIS_SESSION_HOST: ADAMBIGSCEEN ANALYSIS_SESSION_TIME: 11-07-2016 16:58:30.0999 ANALYSIS_VERSION: 10.0.14321.1024 amd64fre DPC_STACK_BASE: FFFFF8028EB58FB0 LAST_CONTROL_TRANSFER: from fffff8028cfdc529 to fffff8028cfd13b0 STACK_TEXT: fffff802`8eb57398 fffff802`8cfdc529 : 00000000`00000139 00000000`00000003 fffff802`8eb576c0 fffff802`8eb57618 : nt!KeBugCheckEx fffff802`8eb573a0 fffff802`8cfdc890 : ffffa684`79568de0 fffff808`b74b8166 ffffa684`6eedc854 fffff808`b74bab2f : nt!KiBugCheckDispatch+0x69 fffff802`8eb574e0 fffff802`8cfdb873 : 00000000`00000005 00000000`00000004 00000000`00000000 fffff802`8eb57750 : nt!KiFastFailDispatch+0xd0 fffff802`8eb576c0 fffff802`8d0d5807 : ffffa684`6e156ac0 fffff808`b66349b4 ffffa684`72cfe078 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0xf3 fffff802`8eb57850 fffff802`8d0d386d : ffffa684`6ec62380 fffff802`8d1c0440 fffff802`8d1c0440 00000000`00000000 : nt!ExDeferredFreePool+0x1067 fffff802`8eb578d0 fffff808`b6634efb : ffffa684`79506be0 00000000`00000000 ffffa684`6e168280 ffffa684`00000043 : nt!ExFreePoolWithTag+0x86d fffff802`8eb579b0 fffff808`b6634bb7 : 00000000`00012402 ffffa684`72cfe040 ffffa684`6d8918b0 fffff808`b6f28d74 : NETIO!WfpNotifyFlowContextDelete+0xa3 fffff802`8eb57a20 fffff808`b6c469e5 : ffffa684`bf00ff02 ffffa684`72eb4a80 fffff802`8eb57b80 ffffa684`734ecd00 : NETIO!KfdAleNotifyFlowDeletion+0x1a7 fffff802`8eb57a80 fffff808`b6c1ba10 : fffff808`b6501000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip+0x469e5 fffff802`8eb57c50 fffff808`b6c1e2c5 : 00000000`00000000 ffffa684`6d8819a0 ffff8e81`7118ebe2 ffffa684`00000000 : tcpip+0x1ba10 fffff802`8eb57cd0 fffff808`b6c273c3 : ffffa684`6e2d73b0 ffffa684`6e33bfbc ffffa684`6e2d509a 00000000`00000000 : tcpip+0x1e2c5 fffff802`8eb57dc0 fffff808`b6c26fa2 : fffff802`8eb57f50 00000000`40000026 00000000`00000000 00000000`00000000 : tcpip+0x273c3 fffff802`8eb57e80 fffff808`b6c26324 : fffff802`8eb57f89 00000000`00000011 ffffa684`79568de0 00000000`00000000 : tcpip+0x26fa2 fffff802`8eb57ef0 fffff808`b6c28325 : fffff808`b6dbf000 ffffa684`6e266940 00000000`00000002 00000000`00000000 : tcpip+0x26324 fffff802`8eb57ff0 fffff808`b6c2c6a1 : ffffa684`6fe38650 ffffa684`7950d030 fffff802`8eb58101 00000000`00000000 : tcpip+0x28325 fffff802`8eb58110 fffff808`b6c2c382 : ffffa684`79560002 fffff802`00000002 fffff808`b6c61200 00000000`7950d001 : tcpip+0x2c6a1 fffff802`8eb581f0 fffff802`8cf151d5 : 00000000`00000002 ffffa684`78725800 fffff808`b6c2c2c0 fffff802`8eb583a0 : tcpip+0x2c382 fffff802`8eb58320 fffff808`b6c61956 : ffffa684`6d9f3a50 00000000`00000000 ffffa684`6d9f39f0 ffffa684`7950d000 : nt!KeExpandKernelStackAndCalloutInternal+0x85 fffff802`8eb58370 fffff808`b650392e : 00000000`00000000 fffff802`8eb58470 ffffa684`00000002 00000000`00000000 : tcpip+0x61956 fffff802`8eb583f0 00000000`00000000 : fffff802`8eb58470 ffffa684`00000002 00000000`00000000 ffffa684`00000001 : ndis+0x392e STACK_COMMAND: kb THREAD_SHA1_HASH_MOD_FUNC: e7cfd1b04e833a24213fd0f50d4dbf23ac19899d THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 9d0b98df63a10b5e661ad93978f298ee33a38499 THREAD_SHA1_HASH_MOD: 57ff6bd360842e6010d0531dc63462df94529f24 FOLLOWUP_IP: nt!ExDeferredFreePool+1067 fffff802`8d0d5807 cd29 int 29h FAULT_INSTR_CODE: 8b4d29cd SYMBOL_STACK_INDEX: 4 SYMBOL_NAME: nt!ExDeferredFreePool+1067 FOLLOWUP_NAME: Pool_corruption IMAGE_NAME: Pool_Corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 IMAGE_VERSION: 10.0.14393.351 MODULE_NAME: Pool_Corruption BUCKET_ID_FUNC_OFFSET: 1067 FAILURE_BUCKET_ID: 0x139_3_nt!ExDeferredFreePool BUCKET_ID: 0x139_3_nt!ExDeferredFreePool PRIMARY_PROBLEM_CLASS: 0x139_3_nt!ExDeferredFreePool TARGET_TIME: 2016-11-06T21:53:24.000Z OSBUILD: 14393 OSSERVICEPACK: 351 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 SUITE_MASK: 272 PRODUCT_TYPE: 1 OSPLATFORM_TYPE: x64 OSNAME: Windows 10 OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2016-10-15 05:38:38 BUILDDATESTAMP_STR: 161014-1755 BUILDLAB_STR: rs1_release_inmarket BUILDOSVER_STR: 10.0.14393.351 ANALYSIS_SESSION_ELAPSED_TIME: 1439d ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:0x139_3_nt!exdeferredfreepool FAILURE_ID_HASH: {14bfade4-e1ed-98c0-40bb-116f20a8dfc3} Followup: Pool_corruption ---------