BSOD issue

m134

New Member
#1
Hello everyone,

I have some problems with BSODs and i cannot specify the cause in the crash dump. I've had these problems for some weeks and recently just learned about uploading crash dumps. I have many different chrash dumps in my minidump file and you can maybe help me.
I have uploaded the most recent dump. please analyse it and let me know what to be done next
thank you

the following is the online analysis result:
Instant Online Crash Analysis, brought to you by OSR Open Systems Resources, Inc.
Primary Analysis

Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`0385b000 PsLoadedModuleList = 0xfffff800`03a9e890
Debug session time: Sat May 31 15:26:46.593 2014 (UTC - 4:00)
System Uptime: 0 days 0:03:59.154
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88006dd015a, Address of the instruction which caused the bugcheck
Arg3: fffff8800acf7e30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ks!KspPropertyHandler+2ea
fffff880`06dd015a 4c3b08 cmp r9,qword ptr [rax]

CONTEXT: fffff8800acf7e30 -- (.cxr 0xfffff8800acf7e30)
rax=0000000000000000 rbx=fffffa8009c806c0 rcx=00000000ffffffff
rdx=fffffa8009cfc2a0 rsi=0000000000000000 rdi=0000000000000048
rip=fffff88006dd015a rsp=fffff8800acf8810 rbp=fffffa8009ca5e18
r8=0000000000000001 r9=0000000000000000 r10=0000000000000048
r11=0000000000000001 r12=0000000000000000 r13=0000000000000100
r14=fffffa80077b6a60 r15=0000000000000028
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
ks!KspPropertyHandler+0x2ea:
fffff880`06dd015a 4c3b08 cmp r9,qword ptr [rax] ds:002b:00000000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: Skype.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88006dd015a

STACK_TEXT:
fffff880`0acf8810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ks!KspPropertyHandler+0x2ea


FOLLOWUP_IP:
ks!KspPropertyHandler+2ea
fffff880`06dd015a 4c3b08 cmp r9,qword ptr [rax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ks!KspPropertyHandler+2ea

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ks

IMAGE_NAME: ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7a3f3

STACK_COMMAND: .cxr 0xfffff8800acf7e30 ; kb

FAILURE_BUCKET_ID: X64_0x3B_ks!KspPropertyHandler+2ea

BUCKET_ID: X64_0x3B_ks!KspPropertyHandler+2ea

Followup:
 


Attachments

Last edited:

kemical

Windows Forum Admin
Staff member
Premium Supporter
Microsoft MVP
#2
Hi,
you really need your own thread as they can sometimes run into some pages. I've moved your post to a new thread and will debug your dump file shortly.
 


kemical

Windows Forum Admin
Staff member
Premium Supporter
Microsoft MVP
#3
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88006dd015a, fffff8800acf7e30, 0}

Probably caused by : ks.sys ( ks!KspPropertyHandler+2ea )

Followup: MachineOwner
Hi,
the above dump file is blaming a kernel driver which could mean you have some corruption within windows. You do however have some ancient drivers along with:

{47351c22-0d6c-4658-a617-795d251145e2}Gw64.sys Fri Jan 31 00:45:30 2014: This is malware. It probably belongs to something called Wise Enhance and this page advise on how best to remove it:
http://www.411-spyware.com/remove-wiseenhance
Even after removal I'd still run a copy of Malwarebytes to make sure:
https://www.malwarebytes.org/

Run a chkdsk:
http://www.howtogeek.com/howto/windows-vista/guide-to-using-check-disk-in-windows-vista/

atikmdag.sys Fri Dec 17 20:27:20 2010: AMD GPU driver. Please update to latest version (14.4):
http://support.amd.com/en-us

igdpmd64.sys Mon Nov 29 05:23:11 2010: Intel Graphics Driver p-lease run the Intel driver update utility:
https://downloadcenter.intel.com/Default.aspx

mfehidk.sys Fri Sep 19 00:06:00 2008: McAfee Host Intrusion Detection Link Driver. Please uninstall and use MSE instead. We ask this as it creates a known stable environment:
http://www.microsoft.com/en-gb/security/pc-security/mse.aspx

Rt64win7.sys Tue Aug 23 14:55:41 2011: Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet please update:
http://www.realtek.com.tw/downloads...d=5&Level=5&Conn=4&DownTypeID=3&GetDown=false

snp2uvc.sys Tue Nov 20 03:01:44 2012: Suyin USB 2.0 Webcam driver update if ones available:
http://www.suyin.com/

Please ensure your settings are like this:

Go to Start and type in sysdm.cpl and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that Automatically restart is unchecked
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump << where your .dmp files can be
found later.
Click OK twice to exit the dialogs, then reboot for the changes to take effect.
Post any new dump files after making the above changes but please use the app found in this thread:
http://windowsforum.com/threads/how-to-ask-for-help-with-a-bsod-problem.38837/
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.
Top