BSOD

Question

I currently have this issue with one of my computers where it constantly bluescreens regardless of load. I used "verifier" to activate all drivers on the computer shown in this article: 

http://answers.microsoft.com/en-us/windows/wiki/windows\_10-update/driver-verifier-tracking-down-a-mis-behaving/f5cb4faf-556b-4b6d-95b3-c48669e4c983

To force the computer to bluescreen. Now that I have the bluescreen log from it here is the primary analysis as I don't understand any of this:

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.23392.amd64fre.win7sp1_ldr.160317-0600
Machine Name:
Kernel base = 0xfffff800`03063000 PsLoadedModuleList = 0xfffff800`032a5730
Debug session time: Wed May 11 07:37:26.398 2016 (UTC - 4:00)
System Uptime: 0 days 0:00:55.366
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff800034040d4, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800034040d4, address which referenced memory

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330f100
GetUlongFromAddress: unable to read from fffff8000330f1c8
 fffff800034040d4 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
nt! ?? ::NNGAKEGL::`string'+21de
fffff800`034040d4 55              push    rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880033fc6e0 -- (.trap 0xfffff880033fc6e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880033fc7b8 rbx=0000000000000000 rcx=fffff88003165180
rdx=fffff8000357788c rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030e18e8 rsp=fffff880033fc870 rbp=0000000000000000
 r8=0000000000000100  r9=0000000000000000 r10=0000000000000002
r11=fffff8000328f320 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiTryUnwaitThread+0x28:
fffff800`030e18e8 f0480fba6b4000  lock bts qword ptr [rbx+40h],0 ds:00000000`00000040=????????????????
Resetting default scope

EXCEPTION_RECORD:  fffff880033fc638 -- (.exr 0xfffff880033fc638)
ExceptionAddress: fffff800030e18e8 (nt!KiTryUnwaitThread+0x0000000000000028)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

LAST_CONTROL_TRANSFER:  from fffff800030d2929 to fffff800030d3380

FAILED_INSTRUCTION_ADDRESS: 
nt! ?? ::NNGAKEGL::`string'+21de
fffff800`034040d4 55              push    rbp

STACK_TEXT:  
fffff880`033fb3f8 fffff800`030d2929 : 00000000`0000000a fffff800`034040d4 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`033fb400 fffff800`030d15a0 : fffff880`033fb568 fffff8a0`0002209c 00000000`00000000 fffff800`03239554 : nt!KiBugCheckDispatch+0x69
fffff880`033fb540 fffff800`034040d4 : fffff800`030fecb4 fffff800`030c8dcc 00000000`00000004 00000000`00000000 : nt!KiPageFault+0x260
fffff880`033fb6d8 fffff800`030fecb4 : fffff800`030c8dcc 00000000`00000004 00000000`00000000 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x21de
fffff880`033fb6e0 fffff800`030fe72d : fffff800`03239548 fffff880`033fcc00 00000000`00000000 fffff800`03063000 : nt!_C_specific_handler+0x8c
fffff880`033fb750 fffff800`030fd505 : fffff800`03239548 fffff880`033fb7c8 fffff880`033fc638 fffff800`03063000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`033fb780 fffff800`0310ea31 : fffff880`033fc638 fffff880`033fbe90 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x415
fffff880`033fbe60 fffff800`030d2a02 : fffff880`033fc638 245c8b48`f175c085 fffff880`033fc6e0 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`033fc500 fffff800`030d130a : fffff6fc`c0032570 00000000`00000000 00000000`00000003 fffffa80`03707660 : nt!KiExceptionDispatch+0xc2
fffff880`033fc6e0 fffff800`030e18e8 : 00000000`00000001 fffffa80`03707768 fffff800`030dd2b5 fffff880`03165180 : nt!KiGeneralProtectionFault+0x10a
fffff880`033fc870 fffff800`0314c385 : fffff980`062eeee0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiTryUnwaitThread+0x28
fffff880`033fc8d0 fffff800`030c6473 : d68b480f`74db8548 00000000`00000000 fffff8a0`048c3200 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x37125
fffff880`033fc9a0 fffff800`030c8fbd : fffffa80`03707720 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1e3
fffff880`033fca20 fffff800`030daa03 : 00000000`00000001 00000000`00000000 00000000`00000000 fffff980`01732fc0 : nt!KiCommitThreadWait+0x3dd
fffff880`033fcab0 fffff800`030dc32d : fffff800`0327c200 fffff800`033cc001 fffffa80`03707600 00000000`00000001 : nt!KeRemoveQueueEx+0x323
fffff880`033fcb70 fffff800`0336c476 : 000007fe`fd1f6296 fffffa80`03707660 00000000`00000080 fffffa80`036e2040 : nt!ExpWorkerThread+0xe9
fffff880`033fcc00 fffff800`030c4726 : fffff880`03165180 fffffa80`03707660 fffff880`0316ffc0 fffff880`013c4afe : nt!PspSystemThreadStartup+0x5a
fffff880`033fcc40 00000000`00000000 : fffff880`033fd000 fffff880`033f7000 fffff880`033fc8a0 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+21de
fffff800`034040d4 55              push    rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+21de

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  56eb24e6

FAILURE_BUCKET_ID:  X64_0xA_VRF_CODE_AV_BAD_IP_nt!_??_::NNGAKEGL::_string_+21de

BUCKET_ID:  X64_0xA_VRF_CODE_AV_BAD_IP_nt!_??_::NNGAKEGL::_string_+21de

Followup: MachineOwner
---------

Thank you.

Answer 1

Possible F-secure is causing a crash. Uninstall it. It looks like it can cause a 0x3b stop error

Answer 2

I got this message:

https://onedrive.live.com/redir?resid=B61B711821A29334!110&authkey=!AILB61vTWpEGXPI&v=3&ithint=photo%2cjpg

Answer 3

**These crashes were related to memory corruption (probably caused by a driver).**Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless verifier does not find the cause, or you want to.

If you are over-clocking anything reset to default before running these tests.

In other words STOP!!!  If you do not know what this means you probably are not

---

---

1-Driver verifier (for complete directions see our wiki here)

**2-Memtest. (**You can read more about running memtest here)

Answer 4

Here are the two most recent dump files:

https://onedrive.live.com/redir?resid=B61B711821A29334!109&authkey=!AKZ6Q\_JE8a-iea8&ithint=file%2czip

The computer is a Fujitsu Esprimo e420 e85+

With the driver view and System Information i can not upload until the computer has finished with it's memtest.

Answer 5

Please upload copies of your dump files as shared files to your OneDrive with a link here. Please include only those less than 14 days old and limit the number to no more than five.

The dump file will be created at c:\windows\minidump. You may need to change your settings in Windows to be able to see the file. To show hidden files type Folder Options in the search box above the Start button and select View, Advanced Settings and verify that the box before "Show hidden files and folders" is checked and "Hide protected operating system files" is unchecked. You may need to scroll down to see the second item. You should also make certain that the box before "Hide extensions for known file types" is not checked.

What is your computer make and model? If not a branded computer what is your motherboard make and model?

Please download and run Driver View and upload a copy of the report it produces to your OneDrive. To get a report on all drivers select Edit, Select All followed by File, Save Selected Items.Text file format please. http://www.nirsoft.net/utils/driverview.html

Please provide a copy of your System Information file. Type System Information in the Search Box above the start Button and press the ENTER key (alternative is Select Start, All Programs, Accessories, System Tools, System Information). Select File, Export and give the file a name noting where it is located. Do not place the cursor within the body of the report before exporting the file. The system creates a new System Information file each time system information is accessed. You need to allow a minute or two for the file to be fully populated before exporting a copy. Please upload the file to your OneDrive, share with everyone and post a link here. Reports in normal mode preferred. Please say if the report has been obtained in safe mode. The request for a copy of this file is additional to answering the question about make and model. If the report is in a language other than English, please state the language.

For help with OneDrive see paragraph 9.3

http://www.gerryscomputertips.co.uk/MicrosoftCommunity1.htm