Jump to content

Windows 10 BSOD

STRMfrmXMN
By STRMfrmXMN
in Troubleshooting
 Share
Posted

@ionbasa has helped me out previously.

 

Intel Core i3 4360

8GB DDR3 RAM (2*4)

Gigabyte B85M DS3H

7770GHz w/latest drivers (pretty sure)

One OCZ Arc 100 SSD + 1 TB laptop HDD

 

Was browsing the web and decided I liked the sound of my Cherry MX greens a lot so I opened the start menu about 10 times in rapid succession. It then BSOD'd. I did all the required steps from ionbasa's guide to get the required files and somehow managed to retrieve only one of the two required files he said we needed. Not sure what happened here but I hope I didn't do anything wrong.

 

https://drive.google.com/folderview?id=0B-TxRWLaRpmMfjlHazVwQmpmbmF3YmtOZ09lSDZjMlFjaXZWNWl5N2U1Z2t4c2V0LXZEeGc&usp=sharing

 

Thanks. Any help is appreciated :)

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/
Share on other sites
Link to post
Share on other sites
Posted

Imma try it real quick, though I doubt it'l happen

 

EDIT- nope, just the pleasing feel of my mx blacks.

Star Citizen referral codes, to help support your fellow comrades!
UOLTT Discord server, come on over and chat!

i7 4790k/ Bequiet Pure Rock/Asrock h97 PRO4/ 8 GB Crucial TT/ Corsair RM 750/ H-440 Custom/  PNY GT 610

Damn you're like a modular human being. -ThatCoolBlueKidd

 
Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805638
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Imma try it real quick, though I doubt it'l happen

 

EDIT- nope, just the pleasing feel of my mx blacks.

Watch a Vessel video in the background :P

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805645
Share on other sites
Link to post
Share on other sites
Posted

Watch a Vessel video in the background :P

alright, whilst tabbed into  vessel or desktop?

Star Citizen referral codes, to help support your fellow comrades!
UOLTT Discord server, come on over and chat!

i7 4790k/ Bequiet Pure Rock/Asrock h97 PRO4/ 8 GB Crucial TT/ Corsair RM 750/ H-440 Custom/  PNY GT 610

Damn you're like a modular human being. -ThatCoolBlueKidd

 
Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805647
Share on other sites
Link to post
Share on other sites
Posted
  • Author

alright, whilst tabbed into  vessel or desktop?

Had Vessel running in Google Chrome in a tab (not full screen)

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805650
Share on other sites
Link to post
Share on other sites
Posted

Had Vessel running in Google Chrome in a tab (not full screen)

Nope, nothing except slick waving a sword around :lol:

Star Citizen referral codes, to help support your fellow comrades!
UOLTT Discord server, come on over and chat!

i7 4790k/ Bequiet Pure Rock/Asrock h97 PRO4/ 8 GB Crucial TT/ Corsair RM 750/ H-440 Custom/  PNY GT 610

Damn you're like a modular human being. -ThatCoolBlueKidd

 
Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805657
Share on other sites
Link to post
Share on other sites
Posted

@ionbasa has helped me out previously.

 

Intel Core i3 4360

8GB DDR3 RAM (2*4)

Gigabyte B85M DS3H

7770GHz w/latest drivers (pretty sure)

One OCZ Arc 100 SSD + 1 TB laptop HDD

 

Was browsing the web and decided I liked the sound of my Cherry MX greens a lot so I opened the start menu about 10 times in rapid succession. It then BSOD'd. I did all the required steps from ionbasa's guide to get the required files and somehow managed to retrieve only one of the two required files he said we needed. Not sure what happened here but I hope I didn't do anything wrong.

 

https://drive.google.com/folderview?id=0B-TxRWLaRpmMfjlHazVwQmpmbmF3YmtOZ09lSDZjMlFjaXZWNWl5N2U1Z2t4c2V0LXZEeGc&usp=sharing

 

Thanks. Any help is appreciated :)

 

So, I saw the perfmon report file. Nothing looked out of the ordinary, and yes, the dump file(s) were not found. 

 

What keyboard do you have? USB or PS/2? What polling rate is the keyboard set at?

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805817
Share on other sites
Link to post
Share on other sites
Posted
  • Author

So, I saw the perfmon report file. Nothing looked out of the ordinary, and yes, the dump file(s) were not found. 

 

What keyboard do you have? USB or PS/2? What polling rate is the keyboard set at?

It's in USB and it's whatever the default polling rate is for a Cooler Master Quickfire Rapid Limited Edition w/Greens ;)

The dump files didn't create themselves when I followed the instructions on your awesome thread. It worked for me previously so not sure what is up.

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805826
Share on other sites
Link to post
Share on other sites
Posted

It's in USB and it's whatever the default polling rate is for a Cooler Master Quickfire Rapid Limited Edition w/Greens ;)

The dump files didn't create themselves when I followed the instructions on your awesome thread. It worked for me previously so not sure what is up.

Mind following method B in the guide and see if the dump files even exist? You only need to go up to step 4, as i've seen the perfmon output already.

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805834
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Mind following method B in the guide and see if the dump files even exist? You only need to go up to step 4, as i've seen the perfmon output already.

Alrighty it was a C and D drive mixup as I've got two doc locations :)

I uploaded them to drive (slowly but surely) though I have to sleep so I'm sorry that I cannot continue this tonight. I will get back to you tomorrow when I can though it will be much later :)

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805842
Share on other sites
Link to post
Share on other sites
Posted

Alrighty it was a C and D drive mixup as I've got two doc locations :)

I uploaded them to drive (slowly but surely) though I have to sleep so I'm sorry that I cannot continue this tonight. I will get back to you tomorrow when I can though it will be much later :)

I dont need all of the dump files, only the last two or three.

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805847
Share on other sites
Link to post
Share on other sites
Posted
  • Author

I dont need all of the dump files, only the last two or three.

K I reuploaded I think I did it right? g'Night man :)

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805856
Share on other sites
Link to post
Share on other sites
Posted

K I reuploaded I think I did it right? g'Night man :)

Perfect. I'll take a look at these and let you know what's to blame by the monrnin'.

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5805880
Share on other sites
Link to post
Share on other sites
Posted

So, it seems there were two crashes this past week; The first on August 16th and the second on August 18th.

 

 

So on the 16th, it seems Chrome.EXE managed to have a memory leak (or performed a bad operation), and in turn made caused memory corruption.

On the 18th, it seems that Tiworker.EXE managed to crash. Tiworker is a Windows component related to Windows Updates and Installation services.

 

Hypothesis on what I think may have happened:

 

Your BSOD on the 16th was likely due to Chrome. Chrome has been having memory leaks as of late, and many are reporting similar scenarios. Chrome also just implemented a new memory management system not to long ago, so bugs like these are bound to show up. I'd just make sure that you have the latest version of Chrome installed, and aren't using any questionable extensions or plugins. 

 

As for why Windows' kernel panicked on the 18th when you repeatedly struck the Windows (super) key: This may have been a coincidence, but I suspect the rapid keystrokes may have interrupted whatever Tiworker.EXE was doing in the background if the USB controller polled the CPU fast enough for sequence of interrupts, but this seems unlikely.

 

Did you upgrade to Windows 10 from a previous install, or was this an clean install?

 

A more likely conclusion would be that during the upgrade a windows component was corrupted leading to a crash when the start menu is brought up.

 

So try this:

  1. Open an elevated PowerShell.
  2. In the elevated PowerShell, copy and run this: 
    Repair-WindowsImage /Cleanup-Image /ScanHealth
  3. Restart your PC

 

Now try to run an SFC SCANNOW: http://www.tenforums.com/tutorials/2895-sfc-command-run-windows-10-a.html#option3

 

Are any integrity violations found?

Windows 8 Kernel Version 10240 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 10240.16430.amd64fre.th1.150807-2049Machine Name:Kernel base = 0xfffff803`7b48e000 PsLoadedModuleList = 0xfffff803`7b7b3030Debug session time: Sun Aug 16 15:54:16.604 2015 (UTC - 4:00)System Uptime: 1 days 2:21:02.277********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************KMODE_EXCEPTION_NOT_HANDLED (1e)This is a very common bugcheck.  Usually the exception address pinpointsthe driver/function that caused the problem.  Always note this addressas well as the link date of the driver/image that contains this address.Arguments:Arg1: ffffffffc0000005, The exception code that was not handledArg2: fffff8037b566603, The address that the exception occurred atArg3: 0000000000000000, Parameter 0 of the exceptionArg4: ffffffffffffffff, Parameter 1 of the exceptionDebugging Details:------------------TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".FAULTING_IP: nt!MiFindLastSubsection+27fffff803`7b566603 488b4008        mov     rax,qword ptr [rax+8]EXCEPTION_PARAMETER1:  0000000000000000EXCEPTION_PARAMETER2:  ffffffffffffffffREAD_ADDRESS: unable to get nt!MmSpecialPoolStartunable to get nt!MmSpecialPoolEndunable to get nt!MmPagedPoolEndunable to get nt!MmNonPagedPoolStartunable to get nt!MmSizeOfNonPagedPoolInBytes ffffffffffffffff ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".BUGCHECK_STR:  0x1e_c0000005CUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULTPROCESS_NAME:  chrome.exeCURRENT_IRQL:  2LAST_CONTROL_TRANSFER:  from fffff8037b615408 to fffff8037b5dbd00CONTEXT:  11fb80c8718d48f4 -- (.cxr 0x11fb80c8718d48f4)Unable to read context, Win32 error 0n30STACK_TEXT:  ffffd000`278dec28 fffff803`7b615408 : 00000000`0000001e ffffffff`c0000005 fffff803`7b566603 00000000`00000000 : nt!KeBugCheckExffffd000`278dec30 fffff803`7b5e6782 : ffffe001`76e62801 fffff803`7b7f1180 ffff7c56`78164432 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2ab08ffffd000`278df310 fffff803`7b5e4c7e : ffffe001`77f30f70 ffffe001`77f30bd0 00000000`00000000 ffffe001`72b2d180 : nt!KiExceptionDispatch+0xc2ffffd000`278df4f0 fffff803`7b566603 : 00000001`ffffffff 00000000`00000000 ffffc000`3da60378 ffffe001`7442fcb8 : nt!KiGeneralProtectionFault+0xfeffffd000`278df680 fffff803`7b4bfa3e : ffffe001`754c9e08 ffffe001`754c9d90 ffffc000`3da60378 ffffd000`215a4570 : nt!MiFindLastSubsection+0x27ffffd000`278df6b0 fffff803`7b4f7d9e : 00000000`00000000 00000000`00000001 00000000`00000000 ffffc000`495188a0 : nt!MiComputeDataFlushRange+0x19effffd000`278df700 fffff803`7b4f89a0 : 00000000`00000000 ffffe001`78003750 00000000`00000000 00000000`00000001 : nt!MmPurgeSection+0xaeffffd000`278df7c0 fffff800`696c663d : ffffc000`49518cb0 ffffc000`495189e0 ffffe001`78420840 ffffc000`495188a0 : nt!CcPurgeCacheSection+0xc8ffffd000`278df830 fffff800`69703d5a : ffffc000`495188a0 ffffe001`78420840 00000000`00000705 ffffc000`495189e0 : NTFS!NtfsDeleteFile+0x701ffffd000`278dfb00 fffff800`69702589 : ffffe001`74048758 ffffe001`733b2010 ffffd000`215a4508 ffffe001`78420840 : NTFS!NtfsCommonCleanup+0x17aaffffd000`278dff50 fffff803`7b5de867 : ffffd000`215a4508 00000000`00000000 00000000`00000000 00000000`00000000 : NTFS!NtfsCommonCleanupCallout+0x19ffffd000`278dff80 fffff803`7b5de82d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27ffffd000`215a4370 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinueFOLLOWUP_IP: nt!MiFindLastSubsection+27fffff803`7b566603 488b4008        mov     rax,qword ptr [rax+8]SYMBOL_STACK_INDEX:  4SYMBOL_NAME:  nt!MiFindLastSubsection+27FOLLOWUP_NAME:  MachineOwnerMODULE_NAME: ntDEBUG_FLR_IMAGE_TIMESTAMP:  55c5a3b2STACK_COMMAND:  .cxr 0x11fb80c8718d48f4 ; kbIMAGE_NAME:  memory_corruptionFAILURE_BUCKET_ID:  X64_0x1e_c0000005_nt!MiFindLastSubsection+27BUCKET_ID:  X64_0x1e_c0000005_nt!MiFindLastSubsection+27Followup: MachineOwner 
Windows 8 Kernel Version 10240 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 10240.16430.amd64fre.th1.150807-2049Machine Name:Kernel base = 0xfffff802`a6690000 PsLoadedModuleList = 0xfffff802`a69b5030Debug session time: Tue Aug 18 23:51:31.714 2015 (UTC - 4:00)System Uptime: 1 days 2:24:06.387********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************SYSTEM_SERVICE_EXCEPTION (3b)An exception happened while executing a system service routine.Arguments:Arg1: 00000000c0000005, Exception code that caused the bugcheckArg2: fffff802a66dff0f, Address of the instruction which caused the bugcheckArg3: ffffd001ff32cc40, Address of the context record for the exception that caused the bugcheckArg4: 0000000000000000, zero.Debugging Details:------------------TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".FAULTING_IP: nt!HvpMapEntryGetBlockAddress+ffffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h]CONTEXT:  ffffd001ff32cc40 -- (.cxr 0xffffd001ff32cc40)rax=0000000000000000 rbx=00000000046dccf8 rcx=000000000000044crdx=0000000000002260 rsi=ffffd001ff32d740 rdi=00000000046dccf8rip=fffff802a66dff0f rsp=ffffd001ff32d660 rbp=ffffd001ff32d920 r8=ffffd001ff32d6e8  r9=ffffd001ff32d6b0 r10=00000000044c7140r11=00000000044c7140 r12=ffffd001ff32d77c r13=ffffd001ff32da00r14=ffffc0014c767a7c r15=ffffd001ff32d770iopl=0         nv up ei ng nz na po nccs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286nt!HvpMapEntryGetBlockAddress+0xf:fffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h] ds:002b:00000000`00002278=????????????????Resetting default scopeCUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULTBUGCHECK_STR:  0x3BPROCESS_NAME:  TiWorker.exeCURRENT_IRQL:  0LAST_CONTROL_TRANSFER:  from fffff802a6ac1671 to fffff802a66dff0fSTACK_TEXT:  ffffd001`ff32d660 fffff802`a6ac1671 : 00000000`00000000 00000000`046dccf8 ffffd001`ff32d740 ffffc001`4c767a7c : nt!HvpMapEntryGetBlockAddress+0xfffffd001`ff32d690 fffff802`a6aa2f74 : 00000000`00000005 00000000`00000000 ffffc001`54df54a8 ffffd001`ff32d900 : nt!HvpGetCellPaged+0x71ffffd001`ff32d6d0 fffff802`a6aa2d5e : 00000000`ffffffff ffffc001`54df54a8 00000000`00000000 ffffc001`5537f580 : nt!CmpFindValueByNameFromCache+0x84ffffd001`ff32d740 fffff802`a6aa1c09 : 00000000`00000000 01d0da32`55d5ef65 00000000`00000001 ffffc001`54df54a8 : nt!CmpCompareNewValueDataAgainstKCBCache+0x5effffd001`ff32d7b0 fffff802`a6aa298e : ffffc001`5537f580 ffffd001`ff32d920 ffffc001`00000004 ffffd001`ff32da00 : nt!CmSetValueKey+0x1a9ffffd001`ff32d8d0 fffff802`a67e8363 : ffffc001`504a5d00 fffff802`a6ab105d 0000008f`111f2dd8 00000000`00000000 : nt!NtSetValueKey+0x5eeffffd001`ff32da90 00007ff8`8d0a3afa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x130000008f`0fb5f6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff8`8d0a3afaFOLLOWUP_IP: nt!HvpMapEntryGetBlockAddress+ffffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h]SYMBOL_STACK_INDEX:  0SYMBOL_NAME:  nt!HvpMapEntryGetBlockAddress+fFOLLOWUP_NAME:  MachineOwnerMODULE_NAME: ntIMAGE_NAME:  ntkrnlmp.exeDEBUG_FLR_IMAGE_TIMESTAMP:  55c5a3b2STACK_COMMAND:  .cxr 0xffffd001ff32cc40 ; kbFAILURE_BUCKET_ID:  X64_0x3B_nt!HvpMapEntryGetBlockAddress+fBUCKET_ID:  X64_0x3B_nt!HvpMapEntryGetBlockAddress+fFollowup: MachineOwner 

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5806240
Share on other sites
Link to post
Share on other sites
Posted
  • Author

So, it seems there were two crashes this past week; The first on August 16th and the second on August 18th.

 

 

So on the 16th, it seems Chrome.EXE managed to have a memory leak (or performed a bad operation), and in turn made caused memory corruption.

On the 18th, it seems that Tiworker.EXE managed to crash. Tiworker is a Windows component related to Windows Updates and Installation services.

 

Hypothesis on what I think may have happened:

 

Your BSOD on the 16th was likely due to Chrome. Chrome has been having memory leaks as of late, and many are reporting similar scenarios. Chrome also just implemented a new memory management system not to long ago, so bugs like these are bound to show up. I'd just make sure that you have the latest version of Chrome installed, and aren't using any questionable extensions or plugins. 

 

As for why Windows' kernel panicked on the 18th when you repeatedly struck the Windows (super) key: This may have been a coincidence, but I suspect the rapid keystrokes may have interrupted whatever Tiworker.EXE was doing in the background if the USB controller polled the CPU fast enough for sequence of interrupts, but this seems unlikely.

 

Did you upgrade to Windows 10 from a previous install, or was this an clean install?

 

A more likely conclusion would be that during the upgrade a windows component was corrupted leading to a crash when the start menu is brought up.

 

So try this:

  1. Open an elevated PowerShell.
  2. In the elevated PowerShell, copy and run this: 
    Repair-WindowsImage /Cleanup-Image /ScanHealth
  3. Restart your PC

 

Now try to run an SFC SCANNOW: http://www.tenforums.com/tutorials/2895-sfc-command-run-windows-10-a.html#option3

 

Are any integrity violations found?

Windows 10 was an upgrade from pretty much a totally clean install of Windows 7 SP1 with only Chrome installed (had to reinstall to get my product key recognized by Windows 10). No updates had been installed bar SP1. And yes, I did have a BSOD 2 days prior to the latest one so I'm glad that was picked up.

 

I ran your PowerShell thing and I got this. Haven't restarted yet. I can run SFC and upload the files later when I'm not tethered to my (limited data plan) phone if that's necessary:P

powershell.png

Windows 8 Kernel Version 10240 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 10240.16430.amd64fre.th1.150807-2049Machine Name:Kernel base = 0xfffff803`7b48e000 PsLoadedModuleList = 0xfffff803`7b7b3030Debug session time: Sun Aug 16 15:54:16.604 2015 (UTC - 4:00)System Uptime: 1 days 2:21:02.277********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************KMODE_EXCEPTION_NOT_HANDLED (1e)This is a very common bugcheck.  Usually the exception address pinpointsthe driver/function that caused the problem.  Always note this addressas well as the link date of the driver/image that contains this address.Arguments:Arg1: ffffffffc0000005, The exception code that was not handledArg2: fffff8037b566603, The address that the exception occurred atArg3: 0000000000000000, Parameter 0 of the exceptionArg4: ffffffffffffffff, Parameter 1 of the exceptionDebugging Details:------------------TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".FAULTING_IP: nt!MiFindLastSubsection+27fffff803`7b566603 488b4008        mov     rax,qword ptr [rax+8]EXCEPTION_PARAMETER1:  0000000000000000EXCEPTION_PARAMETER2:  ffffffffffffffffREAD_ADDRESS: unable to get nt!MmSpecialPoolStartunable to get nt!MmSpecialPoolEndunable to get nt!MmPagedPoolEndunable to get nt!MmNonPagedPoolStartunable to get nt!MmSizeOfNonPagedPoolInBytes ffffffffffffffff ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".BUGCHECK_STR:  0x1e_c0000005CUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULTPROCESS_NAME:  chrome.exeCURRENT_IRQL:  2LAST_CONTROL_TRANSFER:  from fffff8037b615408 to fffff8037b5dbd00CONTEXT:  11fb80c8718d48f4 -- (.cxr 0x11fb80c8718d48f4)Unable to read context, Win32 error 0n30STACK_TEXT:  ffffd000`278dec28 fffff803`7b615408 : 00000000`0000001e ffffffff`c0000005 fffff803`7b566603 00000000`00000000 : nt!KeBugCheckExffffd000`278dec30 fffff803`7b5e6782 : ffffe001`76e62801 fffff803`7b7f1180 ffff7c56`78164432 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x2ab08ffffd000`278df310 fffff803`7b5e4c7e : ffffe001`77f30f70 ffffe001`77f30bd0 00000000`00000000 ffffe001`72b2d180 : nt!KiExceptionDispatch+0xc2ffffd000`278df4f0 fffff803`7b566603 : 00000001`ffffffff 00000000`00000000 ffffc000`3da60378 ffffe001`7442fcb8 : nt!KiGeneralProtectionFault+0xfeffffd000`278df680 fffff803`7b4bfa3e : ffffe001`754c9e08 ffffe001`754c9d90 ffffc000`3da60378 ffffd000`215a4570 : nt!MiFindLastSubsection+0x27ffffd000`278df6b0 fffff803`7b4f7d9e : 00000000`00000000 00000000`00000001 00000000`00000000 ffffc000`495188a0 : nt!MiComputeDataFlushRange+0x19effffd000`278df700 fffff803`7b4f89a0 : 00000000`00000000 ffffe001`78003750 00000000`00000000 00000000`00000001 : nt!MmPurgeSection+0xaeffffd000`278df7c0 fffff800`696c663d : ffffc000`49518cb0 ffffc000`495189e0 ffffe001`78420840 ffffc000`495188a0 : nt!CcPurgeCacheSection+0xc8ffffd000`278df830 fffff800`69703d5a : ffffc000`495188a0 ffffe001`78420840 00000000`00000705 ffffc000`495189e0 : NTFS!NtfsDeleteFile+0x701ffffd000`278dfb00 fffff800`69702589 : ffffe001`74048758 ffffe001`733b2010 ffffd000`215a4508 ffffe001`78420840 : NTFS!NtfsCommonCleanup+0x17aaffffd000`278dff50 fffff803`7b5de867 : ffffd000`215a4508 00000000`00000000 00000000`00000000 00000000`00000000 : NTFS!NtfsCommonCleanupCallout+0x19ffffd000`278dff80 fffff803`7b5de82d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27ffffd000`215a4370 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinueFOLLOWUP_IP: nt!MiFindLastSubsection+27fffff803`7b566603 488b4008        mov     rax,qword ptr [rax+8]SYMBOL_STACK_INDEX:  4SYMBOL_NAME:  nt!MiFindLastSubsection+27FOLLOWUP_NAME:  MachineOwnerMODULE_NAME: ntDEBUG_FLR_IMAGE_TIMESTAMP:  55c5a3b2STACK_COMMAND:  .cxr 0x11fb80c8718d48f4 ; kbIMAGE_NAME:  memory_corruptionFAILURE_BUCKET_ID:  X64_0x1e_c0000005_nt!MiFindLastSubsection+27BUCKET_ID:  X64_0x1e_c0000005_nt!MiFindLastSubsection+27Followup: MachineOwner 
Windows 8 Kernel Version 10240 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 10240.16430.amd64fre.th1.150807-2049Machine Name:Kernel base = 0xfffff802`a6690000 PsLoadedModuleList = 0xfffff802`a69b5030Debug session time: Tue Aug 18 23:51:31.714 2015 (UTC - 4:00)System Uptime: 1 days 2:24:06.387********************************************************************************                                                                             **                        Bugcheck Analysis                                    **                                                                             ********************************************************************************SYSTEM_SERVICE_EXCEPTION (3b)An exception happened while executing a system service routine.Arguments:Arg1: 00000000c0000005, Exception code that caused the bugcheckArg2: fffff802a66dff0f, Address of the instruction which caused the bugcheckArg3: ffffd001ff32cc40, Address of the context record for the exception that caused the bugcheckArg4: 0000000000000000, zero.Debugging Details:------------------TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".FAULTING_IP: nt!HvpMapEntryGetBlockAddress+ffffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h]CONTEXT:  ffffd001ff32cc40 -- (.cxr 0xffffd001ff32cc40)rax=0000000000000000 rbx=00000000046dccf8 rcx=000000000000044crdx=0000000000002260 rsi=ffffd001ff32d740 rdi=00000000046dccf8rip=fffff802a66dff0f rsp=ffffd001ff32d660 rbp=ffffd001ff32d920 r8=ffffd001ff32d6e8  r9=ffffd001ff32d6b0 r10=00000000044c7140r11=00000000044c7140 r12=ffffd001ff32d77c r13=ffffd001ff32da00r14=ffffc0014c767a7c r15=ffffd001ff32d770iopl=0         nv up ei ng nz na po nccs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286nt!HvpMapEntryGetBlockAddress+0xf:fffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h] ds:002b:00000000`00002278=????????????????Resetting default scopeCUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULTBUGCHECK_STR:  0x3BPROCESS_NAME:  TiWorker.exeCURRENT_IRQL:  0LAST_CONTROL_TRANSFER:  from fffff802a6ac1671 to fffff802a66dff0fSTACK_TEXT:  ffffd001`ff32d660 fffff802`a6ac1671 : 00000000`00000000 00000000`046dccf8 ffffd001`ff32d740 ffffc001`4c767a7c : nt!HvpMapEntryGetBlockAddress+0xfffffd001`ff32d690 fffff802`a6aa2f74 : 00000000`00000005 00000000`00000000 ffffc001`54df54a8 ffffd001`ff32d900 : nt!HvpGetCellPaged+0x71ffffd001`ff32d6d0 fffff802`a6aa2d5e : 00000000`ffffffff ffffc001`54df54a8 00000000`00000000 ffffc001`5537f580 : nt!CmpFindValueByNameFromCache+0x84ffffd001`ff32d740 fffff802`a6aa1c09 : 00000000`00000000 01d0da32`55d5ef65 00000000`00000001 ffffc001`54df54a8 : nt!CmpCompareNewValueDataAgainstKCBCache+0x5effffd001`ff32d7b0 fffff802`a6aa298e : ffffc001`5537f580 ffffd001`ff32d920 ffffc001`00000004 ffffd001`ff32da00 : nt!CmSetValueKey+0x1a9ffffd001`ff32d8d0 fffff802`a67e8363 : ffffc001`504a5d00 fffff802`a6ab105d 0000008f`111f2dd8 00000000`00000000 : nt!NtSetValueKey+0x5eeffffd001`ff32da90 00007ff8`8d0a3afa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x130000008f`0fb5f6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff8`8d0a3afaFOLLOWUP_IP: nt!HvpMapEntryGetBlockAddress+ffffff802`a66dff0f 488b4218        mov     rax,qword ptr [rdx+18h]SYMBOL_STACK_INDEX:  0SYMBOL_NAME:  nt!HvpMapEntryGetBlockAddress+fFOLLOWUP_NAME:  MachineOwnerMODULE_NAME: ntIMAGE_NAME:  ntkrnlmp.exeDEBUG_FLR_IMAGE_TIMESTAMP:  55c5a3b2STACK_COMMAND:  .cxr 0xffffd001ff32cc40 ; kbFAILURE_BUCKET_ID:  X64_0x3B_nt!HvpMapEntryGetBlockAddress+fBUCKET_ID:  X64_0x3B_nt!HvpMapEntryGetBlockAddress+fFollowup: MachineOwner 

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5809193
Share on other sites
Link to post
Share on other sites
Posted

Windows 10 was an upgrade from pretty much a totally clean install of Windows 7 SP1 with only Chrome installed (had to reinstall to get my product key recognized by Windows 10). No updates had been installed bar SP1. And yes, I did have a BSOD 2 days prior to the latest one so I'm glad that was picked up.

 

I ran your PowerShell thing and I got this. Haven't restarted yet. I can run SFC and upload the files later when I'm not tethered to my (limited data plan) phone if that's necessary:P

powershell.png

 

My bad, try:

Repair-WindowsImage -Online -RestoreHealth

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5813440
Share on other sites
Link to post
Share on other sites
Posted
  • Author

 

My bad, try:

Repair-WindowsImage -Online -RestoreHealth

This happened after about 4-6 minutes of it doing its thing.

ionbasa.png

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5814204
Share on other sites
Link to post
Share on other sites
Posted

This happened after about 4-6 minutes of it doing its thing.

ionbasa.png

Sigh. Well, can you please provide the log file from the sfc scannow? If anything, you can repair install windows 10: http://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

 

This method keeps programs and documents, but resets Windows' assets, preferences, etc.

 

 

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5814620
Share on other sites
Link to post
Share on other sites
Posted
  • Author

Sigh. Well, can you please provide the log file from the sfc scannow? If anything, you can repair install windows 10: http://www.tenforums.com/tutorials/16397-repair-install-windows-10-place-upgrade.html

 

This method keeps programs and documents, but resets Windows' assets, preferences, etc.

OK, log is now in Google Drive link https://drive.google.com/folderview?id=0B-TxRWLaRpmMfjlHazVwQmpmbmF3YmtOZ09lSDZjMlFjaXZWNWl5N2U1Z2t4c2V0LXZEeGc&usp=sharing

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5823252
Share on other sites
Link to post
Share on other sites
Posted

After looking at the file, it seems there were duplicate ownerships for some directories in the System32 folder, but nothing that could have possibly pertained to the BSOD. I also saw that there was  a restart pending for installing updates, and that the windows store (not the app store, but another term for a database that keeps track of updates and system changes applied through WU) may have had a file mismatch.

 

By any chance was your system unexpectedly powered off while an updating was installing, downloading, or pending an install?

▶ Learn from yesterday, live for today, hope for tomorrow. The important thing is not to stop questioning. - Einstein◀

Please remember to mark a thread as solved if your issue has been fixed, it helps other who may stumble across the thread at a later point in time.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5823383
Share on other sites
Link to post
Share on other sites
Posted
  • Author

After looking at the file, it seems there were duplicate ownerships for some directories in the System32 folder, but nothing that could have possibly pertained to the BSOD. I also saw that there was  a restart pending for installing updates, and that the windows store (not the app store, but another term for a database that keeps track of updates and system changes applied through WU) may have had a file mismatch.

 

By any chance was your system unexpectedly powered off while an updating was installing, downloading, or pending an install?

It may have BSOD'd before I restarted to do updates but it has all closed down naturally as far as I know. I do have a restart to do for updates currently, yes. The duplicates were the documents folders likely as I've swapped around a few hard drives (some were clones of other drives in the system) so a lot of the default locations just got messed around with.

 

Anything I should do as a follow up?

My account is almost entirely dormant. Hope you all are having a grand time. Many years of fun were had here.

Link to comment
https://linustechtips.com/topic/433148-windows-10-bsod/#findComment-5823442
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Troubleshooting

×