Hi Microsoft professional team,

I am using Windows  8.1 pro and I keep having the BSOD problem everyday. I uploaded the memory dump file to OneDrive.

Can you give me a hand on this to find out where the problem is?

Many Thx.

Daniel

 We do need the actual log files (called a DMP files) as they contain the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.  

Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here If you have any questions about the procedure please ask

Hi,

Thank you for your quick response. I just uploaded those dump files and system info to OneDrive but the forum do not allow me to post the file link. (my account is not verified yet) Can you help?

Best Regards,

Daniel

Daniel

You can sneak it in while you are waiting by using HxxP instead of HTTP  To verify your account

If you are being told you cant post a link, or embed a picture (or any other restriction) you just need to post to this thread saying your account has not been validated Look for the verify your account thread that is stuck to the top of the page. http://social.technet.microsoft.com/Forums/en-US/home?forum=reportabug Read more here http://social.technet.microsoft.com/Forums/windows/en-US/9fe32cfb-ed1c-4b9d-93d9-7ff32b0106a3/verify-your-account-16?forum=reportabug

Hi Team Zigzag,

Below are the link of the dump zip file and system info file at OneDrive. I replaced the tt by xx.

hxxp://1drv.ms/1EbPA3D

hxxp://1drvms/1EbPIAr

Thanks.

Daniel

These crashes were related to memory corruption (probably caused by a driver). 

Please run these two tests to verify your memory and find which driver is causing the problem.  Please run verifier first.  You do not need to run memtest yet unless you want to.

If you are over-clocking anything reset to default before running these tests.
In other words STOP!!!  

If you do not know what this means you probably are not


1-Driver verifier (for complete directions see our wiki here)
2-Memtest. (You can read more about running memtest here)

I just run the Driver verifier, my PC will jump to BSOD after logon (desktop already launched).

I uploaded the new dump files which I get from safemode to OneDrive and below is the link.

hxxp://1drv.ms/1KX7az6

Thx.

Daniel

DMS

Driver verified and Related to ZoneAlarm Firewall Driver.  I would remove it and use the built in defender in its place

Microsoft (R) Windows Debugger Version 6.3.9600.17298 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ken\Desktop\New folder\031215-6609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*e:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 8 Kernel Version 9600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9600.17668.amd64fre.winblue_r8.150127-1500
Machine Name:
Kernel base = 0xfffff801`0b61a000 PsLoadedModuleList = 0xfffff801`0b8f3250
Debug session time: Wed Mar 11 13:03:15.527 2015 (UTC - 4:00)
System Uptime: 0 days 0:02:12.192
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {ffffcf8094653000, 2, 1, fffff8010b702dde}

*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
Probably caused by : vsdatant.sys ( vsdatant+13bc0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffcf8094653000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8010b702dde, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8010b97d138
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 ffffcf8094653000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MmBuildMdlForNonPagedPool+ee
fffff801`0b702dde 48890c17        mov     qword ptr [rdi+rdx],rcx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  AV

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre

TRAP_FRAME:  ffffd0014eba6290 -- (.trap 0xffffd0014eba6290)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffef8094703000 rbx=0000000000000000 rcx=00000000b8e00000
rdx=fffff6e7c04a3818 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8010b702dde rsp=ffffd0014eba6420 rbp=0000007ffffffff8
 r8=00000067c04a3818  r9=ffffcf8094652fd0 r10=0000000000000000
r11=fffff6fb73e02518 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!MmBuildMdlForNonPagedPool+0xee:
fffff801`0b702dde 48890c17        mov     qword ptr [rdi+rdx],rcx ds:fffff6e7`c04a3818=78010b8e00000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8010b7764e9 to fffff8010b76a9a0

STACK_TEXT:  
ffffd001`4eba6148 fffff801`0b7764e9 : 00000000`0000000a ffffcf80`94653000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffd001`4eba6150 fffff801`0b774d3a : 00000000`00000001 0000000f`ffffffff ffffd001`4eba4000 ffffd001`4ebaa000 : nt!KiBugCheckDispatch+0x69
ffffd001`4eba6290 fffff801`0b702dde : ffffd001`4eba6c60 ffffcf80`94416ac0 00000000`00000000 fffff800`b6936bc0 : nt!KiPageFault+0x23a
ffffd001`4eba6420 fffff800`b6936bc0 : ffffe001`2e27d580 ffffd001`4eba6600 ffffcf80`8f6bedf0 00000000`00000000 : nt!MmBuildMdlForNonPagedPool+0xee
ffffd001`4eba6440 ffffe001`2e27d580 : ffffd001`4eba6600 ffffcf80`8f6bedf0 00000000`00000000 00000000`00000000 : vsdatant+0x13bc0
ffffd001`4eba6448 ffffd001`4eba6600 : ffffcf80`8f6bedf0 00000000`00000000 00000000`00000000 00000000`00000040 : 0xffffe001`2e27d580
ffffd001`4eba6450 ffffcf80`8f6bedf0 : 00000000`00000000 00000000`00000000 00000000`00000040 ffffe001`2e27d680 : 0xffffd001`4eba6600
ffffd001`4eba6458 00000000`00000000 : 00000000`00000000 00000000`00000040 ffffe001`2e27d680 ffffd001`4eba6600 : 0xffffcf80`8f6bedf0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
vsdatant+13bc0
fffff800`b6936bc0 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  vsdatant+13bc0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: vsdatant

IMAGE_NAME:  vsdatant.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  538e623f

FAILURE_BUCKET_ID:  AV_VRF_vsdatant+13bc0

BUCKET_ID:  AV_VRF_vsdatant+13bc0

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_vrf_vsdatant+13bc0

FAILURE_ID_HASH:  {cd69ac10-8557-151b-0942-e160e96e9310}

Followup: MachineOwner
---------

0: kd> lmvm vsdatant
start             end                 module name
fffff800`b6923000 fffff800`b69b8000   vsdatant T (no symbols)           
    Loaded symbol image file: vsdatant.sys
    Image path: \SystemRoot\System32\drivers\vsdatant.sys
    Image name: vsdatant.sys
    Timestamp:        Tue Jun 03 20:03:11 2014 (538E623F)
    CheckSum:         00072B74
    ImageSize:        00095000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Hi,

I removed the Zonealarm, and 2 other drivers (Asmedia 106x sata controller and AI suite 3) which causing BSOD even I unstalled the Zonealarm.

Now, the machine can start normally and I will try few days to see if this resolved or not.

Many thanks for the support and appreciate for that.

Daniel

DMS

Thanks for letting us know

Hi,

I removed the Zonealarm, and 2 other drivers (Asmedia 106x sata controller and AI suite 3) which causing BSOD even I unstalled the Zonealarm.

Now, the machine can start normally and I will try few days to see if this resolved or not.

Many thanks for the support and appreciate for that.

Daniel

• Marked as answer by Daniel MaSir 2 hours 34 minutes ago

Hi,

I removed the Zonealarm, and 2 other drivers (Asmedia 106x sata controller and AI suite 3) which causing BSOD even I unstalled the Zonealarm.

Now, the machine can start normally and I will try few days to see if this resolved or not.

Many thanks for the support and appreciate for that.

Daniel

• Marked as answer by Daniel MaSir Saturday, March 14, 2015 4:45 AM

I run the box over 2 days and it seems ok now. Thanks for the support.

Best Regards,

Daniel