Interpreting Win 7 BSOD mini-dump file

Topic

New Reply

My OS is Win 7 Pro 32 bit.

My computer crashed recently. I attach the minidump file and if anyone knows how to interpret this and can tell me what caused the crash, and how I can prevent it recurring, I would be very grateful.

I managed to restore my system using a system repair disc and system restore.

Thanks and regards,
Roy Whitethread

PS The file is not attached as apparently I am not permitted to upload this type of file.

Reply | Quote

Replies

Can you open the file locally and ‘Copy-n-Paste’ into Notepad, then save as a .txt file, or ‘Copy’ into the post?

Reply | Quote

Hi Roy,

Just by way of information, Nirsoft has a utility called BlueScreenView that will open your minidump to reveal the file or driver that caused the blue screen. It greatly simplifies tracking down the culprit in BSODs.

Reply | Quote

Thank you Gerald and RussB.

I have the BlueScreenView program, and it shows the cause as the driver ntoskrnl.exe.Can I do something to correct the problem?

I was able to open the minidump file and copy and paste it into Notepad, but the result looked like total “gobbledygook” to me. Should I upload it anyway?

Please advise.

Thanks and regards,
Roy

Reply | Quote

Roy,

It would be best to upload the .txt file containing your minidump. Output from BlueScreenView could be useful as well. Ntoskrnl.exe is the core kernel of Windows. It may be corrupt. Details of the minidump could give a specific stop error.

Reply | Quote

Gerald,

The lower pane output from BlueScreenView is as follows:

ACPI.sys 0x8c605000 0x8c64d000 0x00048000 0x4a5bbf0f 14/07/2009 1:11:11 Microsoft® Windows® Operating System ACPI Driver for NT 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversACPI.sys
afd.sys 0x8cb13000 0x8cb6d000 0x0005a000 0x4a5bbf62 14/07/2009 1:12:34 Microsoft® Windows® Operating System Ancillary Function Driver for WinSock 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversafd.sys
amdxata.sys 0x8c756000 0x8c75f000 0x00009000 0x4a12f30f 19/05/2009 19:57:35 Storage Filter Driver Storage Filter Driver 1.1.2.4 (NT.080820-1745) Advanced Micro Devices C:Windowssystem32driversamdxata.sys
aswRdr.SYS 0x8cfaa000 0x8cfae100 0x00004100 0x4c865090 07/09/2010 16:47:44 avast! Antivirus System avast! TDI RDR Driver 5.0.677.0 built by: WinDDK AVAST Software C:Windowssystem32driversaswRdr.SYS
aswSP.SYS 0x938c2000 0x938e8c80 0x00026c80 0x4c865191 07/09/2010 16:52:01 avast! Antivirus System avast! self protection module 5.0.677.0 AVAST Software C:Windowssystem32driversaswSP.SYS
aswTdi.SYS 0x8cfa0000 0x8cfa9c00 0x00009c00 0x4c8651a7 07/09/2010 16:52:23 avast! Antivirus System avast! TDI Filter Driver 5.0.677.0 built by: WinDDK AVAST Software C:Windowssystem32driversaswTdi.SYS
atapi.sys 0x8c72a000 0x8c733000 0x00009000 0x4a5bbf13 14/07/2009 1:11:15 Microsoft® Windows® Operating System ATAPI IDE Miniport Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversatapi.sys
ataport.SYS 0x8c733000 0x8c756000 0x00023000 0x4a5bbf16 14/07/2009 1:11:18 Microsoft® Windows® Operating System ATAPI Driver Extension 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversataport.SYS
Beep.SYS 0x8cf0c000 0x8cf13000 0x00007000 0x4a5bc6fc 14/07/2009 1:45:00 Microsoft® Windows® Operating System BEEP Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversBeep.SYS
blbdrive.sys 0x938b4000 0x938c2000 0x0000e000 0x4a5bc1d8 14/07/2009 1:23:04 Microsoft® Windows® Operating System BLB Drive Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversblbdrive.sys
BOOTVID.dll 0x8c491000 0x8c499000 0x00008000 0x4a5bd9a2 14/07/2009 3:04:34 Microsoft® Windows® Operating System VGA Boot Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32BOOTVID.dll
cdrom.sys 0x8cee6000 0x8cf05000 0x0001f000 0x4a5bbf1c 14/07/2009 1:11:24 Microsoft® Windows® Operating System SCSI CD-ROM Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverscdrom.sys
CI.dll 0x8c4db000 0x8c586000 0x000ab000 0x4a5bdac8 14/07/2009 3:09:28 Microsoft® Windows® Operating System Code Integrity Module 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32CI.dll
CLASSPNP.SYS 0x8ce8f000 0x8ceb4000 0x00025000 0x4a5bbf18 14/07/2009 1:11:20 Microsoft® Windows® Operating System SCSI Class System Dll 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversCLASSPNP.SYS
CLFS.SYS 0x8c499000 0x8c4db000 0x00042000 0x4a5bbf0e 14/07/2009 1:11:10 Microsoft® Windows® Operating System Common Log File System Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32CLFS.SYS
cng.sys 0x8c985000 0x8c9e2000 0x0005d000 0x4a5bc427 14/07/2009 1:32:55 Microsoft® Windows® Operating System Kernel Cryptography, Next Generation 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverscng.sys
crashdmp.sys 0x8ceb4000 0x8cec1000 0x0000d000 0x4a5bc72e 14/07/2009 1:45:50 Microsoft® Windows® Operating System Crash Dump Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverscrashdmp.sys
csc.sys 0x93838000 0x9389c000 0x00064000 0x4a5bbffc 14/07/2009 1:15:08 Microsoft® Windows® Operating System Windows Client Side Caching Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverscsc.sys
dfsc.sys 0x9389c000 0x938b4000 0x00018000 0x4a5bbfc8 14/07/2009 1:14:16 Microsoft® Windows® Operating System DFS Namespace Client Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversdfsc.sys
discache.sys 0x8c7ae000 0x8c7ba000 0x0000c000 0x4a5bc214 14/07/2009 1:24:04 Microsoft® Windows® Operating System System Indexer/Cache Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversdiscache.sys
disk.sys 0x8ce7e000 0x8ce8f000 0x00011000 0x4a5bbf20 14/07/2009 1:11:28 Microsoft® Windows® Operating System PnP Disk Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversdisk.sys
dump_atapi.sys 0x8cecc000 0x8ced5000 0x00009000 0x4a5bbf13 14/07/2009 1:11:15
dump_ataport.sys 0x8cec1000 0x8cecc000 0x0000b000 0x4a5bbf14 14/07/2009 1:11:16
dump_dumpfve.sys 0x8ced5000 0x8cee6000 0x00011000 0x4a5bbf6f 14/07/2009 1:12:47
ElbyCDIO.sys 0x8c7a4000 0x8c7ae000 0x0000a000 0x4ca5003a 30/09/2010 23:25:14 CDRTools ElbyCD Windows NT/2000/XP I/O driver 6, 0, 5, 9 Elaborate Bytes AG C:Windowssystem32driversElbyCDIO.sys
fileinfo.sys 0x8c793000 0x8c7a4000 0x00011000 0x4a5bc18f 14/07/2009 1:21:51 Microsoft® Windows® Operating System FileInfo Filter Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversfileinfo.sys
fltmgr.sys 0x8c75f000 0x8c793000 0x00034000 0x4a5bbf11 14/07/2009 1:11:13 Microsoft® Windows® Operating System Microsoft Filesystem Filter Manager 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversfltmgr.sys
Fs_Rec.sys 0x8c9f0000 0x8c9f9000 0x00009000 0x4a5bbf12 14/07/2009 1:11:14 Microsoft® Windows® Operating System File System Recognizer Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversFs_Rec.sys
fvevol.sys 0x8ce4c000 0x8ce7e000 0x00032000 0x4abd7b55 26/09/2009 4:24:21 Microsoft® Windows® Operating System BitLocker Drive Encryption Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversfvevol.sys
fwpkclnt.sys 0x8cd86000 0x8cdb7000 0x00031000 0x4a5bbf43 14/07/2009 1:12:03 Microsoft® Windows® Operating System FWP/IPsec Kernel-Mode API 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversfwpkclnt.sys
hal.dll 0x83013000 0x8304a000 0x00037000 0x4a5bbf07 14/07/2009 1:11:03 Microsoft® Windows® Operating System Hardware Abstraction Layer DLL 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32hal.dll
hwpolicy.sys 0x8ce44000 0x8ce4c000 0x00008000 0x4a5bbf05 14/07/2009 1:11:01 Microsoft® Windows® Operating System Hardware Policy Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32drivershwpolicy.sys
intelppm.sys 0x9390a000 0x9391c000 0x00012000 0x4a5bbf07 14/07/2009 1:11:03 Microsoft® Windows® Operating System Processor Device Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversintelppm.sys
kdcom.dll 0x80ba6000 0x80bae000 0x00008000 0x4a5bdaaa 14/07/2009 3:08:58 Microsoft® Windows® Operating System Serial Kernel Debugger 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32kdcom.dll
ksecdd.sys 0x8c972000 0x8c985000 0x00013000 0x4a5bbf3c 14/07/2009 1:11:56 Microsoft® Windows® Operating System Kernel Security Support Provider Interface 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversksecdd.sys
ksecpkg.sys 0x8caee000 0x8cb13000 0x00025000 0x4b21c4c6 11/12/2009 6:04:22 Microsoft® Windows® Operating System Kernel Security Support Provider Interface Packages 6.1.7600.16484 (win7_gdr.091210-1534) Microsoft Corporation C:Windowssystem32driversksecpkg.sys
mcupdate.dll 0x8c408000 0x8c480000 0x00078000 0x4a5bda21 14/07/2009 3:06:41
mountmgr.sys 0x8c714000 0x8c72a000 0x00016000 0x4a5bbf1f 14/07/2009 1:11:27 Microsoft® Windows® Operating System Mount Point Manager 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversmountmgr.sys
Msfs.SYS 0x8cf65000 0x8cf70000 0x0000b000 0x4a5bbf1e 14/07/2009 1:11:26 Microsoft® Windows® Operating System Mailslot driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversMsfs.SYS
msisadrv.sys 0x8c656000 0x8c65e000 0x00008000 0x4a5bbf0d 14/07/2009 1:11:09 Microsoft® Windows® Operating System ISA Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversmsisadrv.sys
msrpc.sys 0x8c947000 0x8c972000 0x0002b000 0x4a5bbf3f 14/07/2009 1:11:59 Microsoft® Windows® Operating System Kernel Remote Procedure Call Provider 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversmsrpc.sys
mssmbios.sys 0x8c80a000 0x8c814000 0x0000a000 0x4a5bc0fd 14/07/2009 1:19:25 Microsoft® Windows® Operating System System Management BIOS Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversmssmbios.sys
mup.sys 0x8ce34000 0x8ce44000 0x00010000 0x4a5bbfc6 14/07/2009 1:14:14 Microsoft® Windows® Operating System Multiple UNC Provider Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversmup.sys
ndis.sys 0x8c9f9000 0x8cab0000 0x000b7000 0x4a5bbf58 14/07/2009 1:12:24 Microsoft® Windows® Operating System NDIS 6.20 driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversndis.sys
netbios.sys 0x8cc1f000 0x8cc2d000 0x0000e000 0x4a5bc912 14/07/2009 1:53:54 Microsoft® Windows® Operating System NetBIOS interface driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversnetbios.sys
netbt.sys 0x8cfaf000 0x8cfe1000 0x00032000 0x4a5bbf52 14/07/2009 1:12:18 Microsoft® Windows® Operating System MBT Transport driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversnetbt.sys
NETIO.SYS 0x8cab0000 0x8caee000 0x0003e000 0x4a5bbf63 14/07/2009 1:12:35 Microsoft® Windows® Operating System Network I/O Subsystem 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversNETIO.SYS
Npfs.SYS 0x8cf70000 0x8cf7e000 0x0000e000 0x4a5bbf23 14/07/2009 1:11:31 Microsoft® Windows® Operating System NPFS Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversNpfs.SYS
nsiproxy.sys 0x8c800000 0x8c80a000 0x0000a000 0x4a5bbf48 14/07/2009 1:12:08 Microsoft® Windows® Operating System NSI Proxy 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversnsiproxy.sys
Ntfs.sys 0x8c818000 0x8c947000 0x0012f000 0x4a5bbf45 14/07/2009 1:12:05 Microsoft® Windows® Operating System NT File System Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversNtfs.sys
ntoskrnl.exe ntoskrnl.exe+3a3cd8 0x8304a000 0x8344a000 0x00400000 0x4c1c3f9b 19/06/2010 5:55:07 Microsoft® Windows® Operating System NT Kernel & System 6.1.7600.16617 (win7_gdr.100618-1621) Microsoft Corporation C:Windowssystem32ntoskrnl.exe
Null.SYS 0x8cf05000 0x8cf0c000 0x00007000 0x4a5bbf10 14/07/2009 1:11:12 Microsoft® Windows® Operating System NULL Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversNull.SYS
pacer.sys 0x8cc00000 0x8cc1f000 0x0001f000 0x4a5bc916 14/07/2009 1:53:58 Microsoft® Windows® Operating System QoS Packet Scheduler 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverspacer.sys
partmgr.sys 0x8c693000 0x8c6a4000 0x00011000 0x4a5bbf27 14/07/2009 1:11:35 Microsoft® Windows® Operating System Partition Management Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverspartmgr.sys
pci.sys 0x8c65e000 0x8c688000 0x0002a000 0x4a5bbf14 14/07/2009 1:11:16 Microsoft® Windows® Operating System NT Plug and Play PCI Enumerator 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverspci.sys
pciide.sys 0x8c6ff000 0x8c706000 0x00007000 0x4a5bbf17 14/07/2009 1:11:19 Microsoft® Windows® Operating System Generic PCI IDE Bus Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverspciide.sys
PCIIDEX.SYS 0x8c706000 0x8c714000 0x0000e000 0x4a5bbf13 14/07/2009 1:11:15 Microsoft® Windows® Operating System PCI IDE Bus Driver Extension 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversPCIIDEX.SYS
pcw.sys 0x8c9e2000 0x8c9f0000 0x0000e000 0x4a5bbf0e 14/07/2009 1:11:10 Microsoft® Windows® Operating System Performance Counters for Windows Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverspcw.sys
PSHED.dll 0x8c480000 0x8c491000 0x00011000 0x4a5bdad0 14/07/2009 3:09:36 Microsoft® Windows® Operating System Platform Specific Hardware Error Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32PSHED.dll
RapportCerberus_19917.sys 0x8cbf1000 0x8cbf8300 0x00007300 0x4c989bab 21/09/2010 13:48:59
RapportPG.sys 0x8cbc8000 0x8cbf0080 0x00028080 0x4ca8f81c 03/10/2010 23:39:40
rdbss.sys 0x8cb87000 0x8cbc8000 0x00041000 0x4a5bbfd2 14/07/2009 1:14:26 Microsoft® Windows® Operating System Redirected Drive Buffering SubSystem Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversrdbss.sys
RDPCDD.sys 0x8cf4d000 0x8cf55000 0x00008000 0x4a5bcae4 14/07/2009 2:01:40 Microsoft® Windows® Operating System RDP Miniport 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversRDPCDD.sys
rdpencdd.sys 0x8cf55000 0x8cf5d000 0x00008000 0x4a5bcae3 14/07/2009 2:01:39 Microsoft® Windows® Operating System RDP Encoder Miniport 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversrdpencdd.sys
rdprefmp.sys 0x8cf5d000 0x8cf65000 0x00008000 0x4a5bcae5 14/07/2009 2:01:41 Microsoft® Windows® Operating System RDP Reflector Driver Miniport 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversrdprefmp.sys
rdyboost.sys 0x8ce07000 0x8ce34000 0x0002d000 0x4a5bc19a 14/07/2009 1:22:02 Microsoft® Windows® Operating System ReadyBoost Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversrdyboost.sys
serial.sys 0x8cb6d000 0x8cb87000 0x0001a000 0x4a5bc71d 14/07/2009 1:45:33 Microsoft® Windows® Operating System Serial Device Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversserial.sys
spldr.sys 0x8cdff000 0x8ce07000 0x00008000 0x4a084ebb 11/05/2009 18:13:47 Microsoft® Windows® Operating System loader for security processor 6.1.7127.0 (fbl_security_bugfix(sepbld-s).090511-0900) Microsoft Corporation C:Windowssystem32driversspldr.sys
tcpip.sys 0x8cc3d000 0x8cd86000 0x00149000 0x4c15a3db 14/06/2010 5:36:59 Microsoft® Windows® Operating System TCP/IP Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverstcpip.sys
TDI.SYS 0x8cf95000 0x8cfa0000 0x0000b000 0x4a5bbf4c 14/07/2009 1:12:12 Microsoft® Windows® Operating System TDI Wrapper 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversTDI.SYS
tdx.sys 0x8cf7e000 0x8cf95000 0x00017000 0x4a5bbf4a 14/07/2009 1:12:10 Microsoft® Windows® Operating System TDI Translation Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverstdx.sys
termdd.sys 0x8cc2d000 0x8cc3d000 0x00010000 0x4a5bcadf 14/07/2009 2:01:35 Microsoft® Windows® Operating System Remote Desktop Server Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverstermdd.sys
tunnel.sys 0x938e9000 0x9390a000 0x00021000 0x4a5bc91b 14/07/2009 1:54:03 Microsoft® Windows® Operating System Microsoft Tunnel Interface Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverstunnel.sys
vdrvroot.sys 0x8c688000 0x8c693000 0x0000b000 0x4a5bc74b 14/07/2009 1:46:19 Microsoft® Windows® Operating System Virtual Drive Root Enumerator 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvdrvroot.sys
vga.sys 0x8cf13000 0x8cf1f000 0x0000c000 0x4a5bc27e 14/07/2009 1:25:50 Microsoft® Windows® Operating System VGA/Super VGA Video Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvga.sys
VIDEOPRT.SYS 0x8cf1f000 0x8cf40000 0x00021000 0x4a5bc27d 14/07/2009 1:25:49 Microsoft® Windows® Operating System Video Port Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversVIDEOPRT.SYS
vmstorfl.sys 0x8cdb7000 0x8cdbf380 0x00008380 0x4a5bc32c 14/07/2009 1:28:44 Microsoft® Windows® Operating System Virtual Storage Filter Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvmstorfl.sys
volmgr.sys 0x8c6a4000 0x8c6b4000 0x00010000 0x4a5bbf1d 14/07/2009 1:11:25 Microsoft® Windows® Operating System Volume Manager Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvolmgr.sys
volmgrx.sys 0x8c6b4000 0x8c6ff000 0x0004b000 0x4a5bbf2d 14/07/2009 1:11:41 Microsoft® Windows® Operating System Volume Manager Extension Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvolmgrx.sys
volsnap.sys 0x8cdc0000 0x8cdff000 0x0003f000 0x4a5bbf26 14/07/2009 1:11:34 Microsoft® Windows® Operating System Volume Shadow Copy Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversvolsnap.sys
wanarp.sys 0x8cfe8000 0x8cffb000 0x00013000 0x4a5bc956 14/07/2009 1:55:02 Microsoft® Windows® Operating System MS Remote Access and Routing ARP Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverswanarp.sys
watchdog.sys 0x8cf40000 0x8cf4d000 0x0000d000 0x4a5bc21a 14/07/2009 1:24:10 Microsoft® Windows® Operating System Watchdog Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverswatchdog.sys
Wdf01000.sys 0x8c586000 0x8c5f7000 0x00071000 0x4a5bbf28 14/07/2009 1:11:36 Microsoft® Windows® Operating System Kernel Mode Driver Framework Runtime 1.9.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversWdf01000.sys
WDFLDR.SYS 0x8c5f7000 0x8c605000 0x0000e000 0x4a5bbf1d 14/07/2009 1:11:25 Microsoft® Windows® Operating System Kernel Mode Driver Framework Loader 1.9.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversWDFLDR.SYS
wfplwf.sys 0x8cfe1000 0x8cfe8000 0x00007000 0x4a5bc90f 14/07/2009 1:53:51 Microsoft® Windows® Operating System WFP NDIS 6.20 Lightweight Filter Driver 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driverswfplwf.sys
WMILIB.SYS 0x8c64d000 0x8c656000 0x00009000 0x4a5bbf1a 14/07/2009 1:11:22 Microsoft® Windows® Operating System WMILIB WMI support library Dll 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:Windowssystem32driversWMILIB.SYS

I hope this helps, and await your further advice.

Regards,
Roy

Reply | Quote

Roy,

The above contents looks like a listing of the drivers and libraries active at the time of the BSOD. I cannot see anything that stands out. If you post the contents of your minidump, someone who has experience in analyzing it may see something significant in the contents. Also, if you can check the software and system logs under event viewer for any error codes associated with the time of the BSOD and the Ntoskrnl.exe error, that could be helpful as well.

Reply | Quote

Hello Gerald,

I found the following under System in Event viewer:

Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 23/10/2010 16:27:47
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Roy-PC
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000006b (0x00000000, 0x00000000, 0x00000000, 0x00000000). A dump was saved in: C:WindowsMinidump102310-25000-01.dmp. Report Id: 102310-25000-01.
Event Xml:

1001
0
2
0
0
0x80000000000000

38559

System
Roy-PC

0x0000006b (0x00000000, 0x00000000, 0x00000000, 0x00000000)
C:WindowsMinidump102310-25000-01.dmp
102310-25000-01

Where do I find the software logs in Event Viewer?

The minidump file, as copied and pasted into Notepad, is attached.

I await your further help and sincerely appreciate your assistance.

Regards,
Roy

Reply | Quote

Where do I find the software logs in Event Viewer?

My apologies, Roy. Rather than “software” log, it is called “Application” log, and it is the first log listed under Windows Logs.

Reply | Quote

Did you happen to install Zone Alarm Security Suite? It does not play well with Win7 64 bit and I would suspect it to be true for the 32bit version as well. It took a few years them to get to work well with EX.

Reply | Quote

Hi Randy, no I haven’t installed any Zone Alarm products, but thanks for the thought.

I await further help.

Regards,
Roy

Reply | Quote

Hi Gerald,

I looked at the Application log but there were no entries around the time of the crash associated with the BSOD or the Ntoskrnl.exe error, unfortunately.

I await your further advice.

Thanks and regards,
Roy

Reply | Quote

Roy, your Hardware Log error report shows a bug check 0x0000006b. Did your BSOD occur when booting Windows 7?

In any case, this bug check error can be generated by a bad driver or failing hardware (which covers a lot of territory) affecting the Windows kernel. . You might try some of the recommendations in this Microsoft Social Answers thread. Maybe something mentioned here will help.

Try running chkdsk by starting the Windows Recovery Environment to check your files on your hard drive – see this Windows 7 article on starting the Recovery Environment. You would choose the Command Prompt to issue the chkdsk command by entering chkdsk /r noting the space. This will take some time to finish. I would also run the System File Checker by entering sfc /scannow noting the space in the command. This will check your protected system files and replace them with fresh copies if needed. You may be prompted to insert your Windows 7 DVD.

You can also download hard drive test software from the disk manufacturer’s support site to thoroughly test your hard drive.

Faulty drivers are a risk for this error. If you updated any driver on your system before this BSOD appeared, I would start with that one, and replace it with the previous driver. Replace all major drivers with new ones, especially video and sound, and your motherboard chipset drivers.

Reply | Quote

Hello Gerald,

The BSOD did appear when booting Windows 7.

I ran the sfc /scannow command and chkdsk /r in Safe Mode. No file integrity violations were found by sfc /scannow. With regard to chkdsk /r 0 bad files were processed, 2 EA records were processed, and 44 reparse records. (What are EA records and reparse records?). Apart from this I noticed the number of files referred to in Stages 1 and 3 of chkdsk is always 16 more than the number referred to in Stage 4. Why is this?

Unfortunately I was called away from my computer and when I returned chkdsk had completed and the computer had restarted normally. Is there any way I can retrieve whatever information may have been given at the end of the process?

Is there any way to copy the ntoskrnl.exe file from my Win 7 installation DVD and replace the file on my system with that copy?

I have not yet had a chance to try any of the other things you mentioned but will do so shortly. Meanwhile I would appreciate your reply to the foregoing.

Thanks and regards,
Roy

Reply | Quote

Hello Gerald,

The BSOD did appear when booting Windows 7.

I ran the sfc /scannow command and chkdsk /r in Safe Mode. No file integrity violations were found by sfc /scannow. With regard to chkdsk /r 0 bad files were processed, 2 EA records were processed, and 44 reparse records. (What are EA records and reparse records?). Apart from this I noticed the number of files referred to in Stages 1 and 3 of chkdsk is always 16 more than the number referred to in Stage 4. Why is this?

Unfortunately I was called away from my computer and when I returned chkdsk had completed and the computer had restarted normally. Is there any way I can retrieve whatever information may have been given at the end of the process?

Is there any way to copy the ntoskrnl.exe file from my Win 7 installation DVD and replace the file on my system with that copy?

I have not yet had a chance to try any of the other things you mentioned but will do so shortly. Meanwhile I would appreciate your reply to the foregoing.

Thanks and regards,
Roy

DO NOT try to copy the ntoskrnl file from your installation DVD. It won’t help. In earlier versions of Windows, ntoskrnl.exe could actually be one of several different versions depending on the system it is run on and copying the wrong kernel would leave you dead in the water.

Generally, even if Windows reports that the cause of a bluescreen is at some specific file, it could well be caused by a problem somewhere else. It usually is.

I am certain that nothing is wrong with the kernel as long as SFC reports no errors.

You’ve ruled out disk corruption with your chkdsk. EA records and reparse records are a normal part of NTFS. Nothing is wrong with your disk structure.

I’ll reiterate what I said before: Check the drivers and the SATA cable. If you are running your C: disk in AHCI mode you may need to switch it to IDE to work around a bug in Windows.

Reply | Quote

OK, I looked it up–I am certified in Windows Internals. The error is caused by a failure at some point during Windows startup, after the boot but before the logon screen. Here is the help text from Windows Debugger:

Bug Check 0x6B: PROCESS1_INITIALIZATION_FAILED
The PROCESS1_INITIALIZATION_FAILED bug check has a value of 0x0000006B. This bug check indicates that the initialization of the Microsoft Windows operating system failed.

Parameters
The following parameters appear on the blue screen.

Parameter Description
1 The NT status code that caused the failure
2 Reserved
3 Reserved
4 Reserved

Cause
Any part of the disk subsystem can cause the PROCESS1_INITIALIZATION_FAILED bug check, including bad disks, bad or incorrect cables, mixing different ATA-type devices on the same chain, or drives that are not available becuase of hardware regeneration.

This bug check can also be caused by a missing file from the boot partition or by a driver file that a user accidentally disabled in the Drivers tab.

In the event log entry you gave, there doesn’t seem to be a parameter 1–all the bug check parameters are zero.

I would look very closely at the disk, the cable, the drivers and the BIOS. There is a known problem with Windows 7 and its ACPI driver; if it occurs during startup it could cause this error. I have been fighting with my ACPI drive to not bluescreen on wakeup so I can sympathize.

Reply | Quote

Ray,

I also had a BSOD (bugcheck 9), consulted many websites, and found the best information and advice at:

General Technical Support for Windows 7
http://www.techsupportforum.com/microsoft-support/windows-vista-windows-7-support/

and

Discussion of BSOD kernel dump analysis
http://www.techsupportforum.com/microsoft-support/windows-vista-windows-7-support/452622-bsod-kernel-dump-analysis-discussion.html

My BSOD turned out to be caused by an intermittently failing DVD drive. Dell replaced the DVD drive (under warranty) and my BSOD’s disappeared.

Good luck !

Reply | Quote

Hello David,

Thanks for your help.

Regarding your comment ” If you are running your C: disk in AHCI mode you may need to switch it to IDE”, please excuse my lack of computer expertise but how do I find out what mode I am running my C:disk in, and if it is in AHCI mode how do I switch it to IDE?

Please advise.

Thanks and regards,
Roy

Reply | Quote

Regarding your comment ” If you are running your C: disk in AHCI mode you may need to switch it to IDE”, please excuse my lack of computer expertise but how do I find out what mode I am running my C:disk in, and if it is in AHCI mode how do I switch it to IDE?

It depends on the specific BIOS on your computer. Depending on your brand of PC, you can access the BIOS by pressing F2 or Del (or possibly F1) as soon as you power up your PC. Your should see one of those keys referenced when you power up.

Look for something like System Configuration, Advanced, and SATA Controller Mode. It will either show as AHCI or Compatibility (aka IDE). If you see AHCI, move with your arrow key to highlight it and press the Enter key. You should see both the AHCI and Compatibility as choices. Select Compatibility to see if that makes a difference. Exit the BIOS with Save changes and Exit.

BTW, have you identified your hard drive brand to download utility software from the HD manufacturer’s support site? Chkdsk checks the condition of files in the NTFS partition, but cannot actually advise as to the actual mechanical condition of the hard disk itself. If the manufacturer’s utility software gives your hard disk a clean bill of health, you can probably rule it out as a factor in the BSOD.

I think David Moisan’s input to be excellent and worth pursuing. I would definitely not copy over Ntoskrnl.exe. If it was corrupt, SFC should have detected and replaced it. I have also seen a faulty SATA cable prevent Windows from booting up. Replaced the cable and the problem was gone.

Reply | Quote

Hello David,

Thanks for your help.

Regarding your comment ” If you are running your C: disk in AHCI mode you may need to switch it to IDE”, please excuse my lack of computer expertise but how do I find out what mode I am running my C:disk in, and if it is in AHCI mode how do I switch it to IDE?

First, try the Windows 7 hotfix that another poster has suggested. It’s possible that may be the more likely cause.

If your crashes persist, change the disk mode by restarting the computer and hitting a key–usually DEL, but sometimes F2 or F10–to enter the bios. There may be a menu item named “Peripherals” or “Advanced Peripheral Settings”. If you have a SATA drive (thin cable; older IDE cables are ribbons), there’ll be something named “Disk Controller 0 Mode” which will have a choice of IDE, AHCI [or possibly, RAID]. If it is set to AHCI, try setting it to IDE (if it is set to IDE or RAID, leave it alone). This is as specific as I can get; many BIOSes have this setting but there is no standardization whatsoever with the user interface. There will be a key to save and exit setup; do so, and restart.

Reply | Quote

You can try something like SkyDrive or Google to share the dump file.

The best way to view a Windows dump file is in the Windows debugger. The debuggers are in the SDK and you can use the online symbols for most dump files.

How to read the small memory dump files that Windows creates for debugging
http://support.microsoft.com/kb/315263

Microsoft WDK and Developer Tools: Debubbing Tools for Windows
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Use the Microsoft Symbol Server to obtain debug symbol files
http://support.microsoft.com/kb/311503

Demystifying the ‘Blue Screen of Death’
http://technet.microsoft.com/en-us/library/cc750081.aspx

An oldie but goodie on STOP errors (many of the MSDN links are out of date *sigh* )
http://aumha.org/a/stop.htm

Search of MSDN for STOP 6b
http://social.msdn.microsoft.com/Search/en-us/?query=0x0000006b

Interesting articles on STOP 6b:

“STOP: 0x0000006B” Stop error message during startup on a computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/981833

STOP: 0x0000006B “Process1_ Initialization_Failed” error message when you try to upgrade to Windows XP
http://support.microsoft.com/kb/330134

Reply | Quote

Hello Peter,

Thanks a lot for your post.

The penultimate link you gave me seemed to my inexpert eye to fit the bill. I downloaded and installed the hotfix referred to, having first created a new system image, but the size, or apparent size, of the system image folder puzzles me. The space left on my backup drive decreased substantially after creating the image, but if I open the system image folder properties the size is only shown as 16 bytes. Does a system image involve some form of super compression?

I would greatly appreciate your further comments on this.

Thanks and regards,
Roy Whitethread

Reply | Quote

Hello Gerald,

I will check the BIOS and use the relevant utility software to check the condition of the hard disk.

Assuming the hard disk is given a clean bill of health, if I amend the BIOS settings as you suggest, and then find the change causes problems, can I use the system image I created today to get back where I was before the changes, or would it be better to just reverse the BIOS changes?

Thanks for your help and I await your reply.

Best regards,
Roy

Reply | Quote

Assuming the hard disk is given a clean bill of health, if I amend the BIOS settings as you suggest, and then find the change causes problems, can I use the system image I created today to get back where I was before the changes, or would it be better to just reverse the BIOS changes?

Best regards,
Roy

If you change the BIOS setting from AHCI to IDE, you can return to the BIOS to reverse the change back to the original setting should you need to do so.

Reply | Quote

Thanks to everyone who has contributed to this thread.

To summarise what I have tried so far:

I ran chkdsk /r and sfc /scannow in safe mode and no problems were found.

I installed the hotfix referred to in the penultimate link given by Peter Boyles, having first created a new system image. (Previously I said I was puzzled by the apparent size of the system image folder. The properties of this image at first showed the folder size as 0 bytes, but when I opened the properties page again, a few minutes later, the size was shown as a little over 27 gigabytes, about right for my C drive).

I installed the Debugging Tools (I selected the Debugging Tools option under the common utilities,and cleared the check boxes for the other options), and Symbol Packages referred to in the second link given by Peter Boyles, having first created a restore point.

I ran WinDbg but the process stalled. Please see the attached screenshot.

In my Start Menu/All Programs list, Microsoft Windows SDK v 7.1 , there are references to Command Prompt and Visual Studio Integration. When I click Command Prompt I get the message shown in the attached screenshot. When I click Visual Studio Integration/Windows SDK Configuration Tool a window opens saying no Windows SDKs are installed!

When installing the Debugging Tools there was a reference to .Net Framework 4. (See attached screenshot). I chose not to install .Net Framework 4. Is this why I had trouble running WinDbg? If not, is there any reason for me to install it?

Thanks again to all those assisting me, and I would appreciate further advice as soon as possible.

Regards,
Roy Whitethread

Reply | Quote

Have you tried the hotfix suggested earlier? I’d gladly explain how to configure WinDbg but this is getting really deep for a regular user, especially when there are some other leads we can pursue.

There is another hotfix available for the AHCI Problem. Try that with the other hotfix, or just install Service Pack 1 RC. In fact, if you can run the computer long enough to install the service pack, why not try it?

Reply | Quote

Hello David,

I have already installed the hotfix referred to in the penultimate link to post no.19, KB981833.

Regarding the other hotfix you mention, KB971778, I do have a 1 terabyte SATA hard disk, but do not use sleep state or hibernation, so it would seem from the Microsoft article that this hotfix is inapplicable for my computer. Do you agree?

I am prepared to try Service Pack 1 RC, do you have the link to it?

My computer is running without any problems now, and has been ever since I took the initial steps referred to in this thread. I have not had any other BSOD. I just hate the thought that I was unable to complete the debugging operation to get more information about the possible cause of the BSOD, and perhaps then be able to take further action to avoid it happening again.

Thank you, sincerely, and I await your further advice.

Regards,
Roy

Reply | Quote