Bug Check

Hi Guys Pete here.

Any chance someone has seen this fatal bug check error before. I have attached the analysis from the debbuger run on the memory.dmp file.

Is it possibly bad memory or CPU ??

Any help would be greatly appretiated.

Pete

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 104f689e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80846088, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 104f689e

CURRENT_IRQL: 2

FAULTING_IP:
nt!CcSetActiveVacb+3c
80846088 ff837e48008b inc dword ptr [ebx-74FFB782h]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: ntbackup.exe

TRAP_FRAME: f5fb1a44 -- (.trap fffffffff5fb1a44)
ErrCode = 00000002
eax=00000000 ebx=854f2020 ecx=85595b80 edx=00000000 esi=85595b28 edi=85595c00
eip=80846088 esp=f5fb1ab8 ebp=f5fb1ac8 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!CcSetActiveVacb+0x3c:
80846088 ff837e48008b inc dword ptr [ebx-74FFB782h] ds:0023:104f689e=????????
Resetting default scope

MISALIGNED_IP:
nt!CcSetActiveVacb+3c
80846088 ff837e48008b inc dword ptr [ebx-74FFB782h]

LAST_CONTROL_TRANSFER: from 80846088 to 80837ed5

STACK_TEXT:
f5fb1a44 80846088 badb0d00 00000000 f5fb1b60 nt!KiTrap0E+0x2a7
f5fb1ac8 8090f1a9 85595b80 f5fb1b2c 00000300 nt!CcSetActiveVacb+0x3c
f5fb1b60 f6bbb8be 86286388 0033627a 00000000 nt!CcFastCopyRead+0x24b
f5fb1bb8 f6bd409e 86286388 f5fb1c84 00008000 rdbss!FsRtlCopyRead2+0x162
f5fb1c14 f732fcc0 86286388 f5fb1c84 00008000 rdbss!_NULL_IMPORT_DESCRIPTOR <PERF> (rdbss+0x2f09e)
f5fb1c48 f733c8b3 00000003 00000000 f5fb1c7c fltmgr!FltpPerformFastIoCall+0x230
f5fb1c9c 80934677 86286388 f5fb1cd8 00008000 fltmgr!FltpFastIoRead+0xa9
f5fb1d38 80834d3f 00000324 00000000 00000000 nt!NtReadFile+0x2c5
f5fb1d38 7c82ed54 00000324 00000000 00000000 nt!KiFastCallEntry+0xfc
0007f164 7c821b84 77e4189f 00000324 00000000 ntdll!KiFastSystemCallRet
0007f168 77e4189f 00000324 00000000 00000000 ntdll!NtReadFile+0xc
0007f1d0 77e8473e 00000324 00da5fe0 00008000 kernel32!ReadFile+0x16c
0007f200 77e850ea 00000000 000f4098 00008000 kernel32!BackupReadStream+0xe5
0007f224 77e859af 00000324 000f4098 0007f26c kernel32!BackupReadData+0xc2
0007f288 010ca280 00000324 00da5fe0 00008000 kernel32!BackupRead+0x171
0007f2c0 010ca402 00da0eb0 00da5fe0 00008000 ntbackup!NTFS_StartEncRead+0x433
0007f2e4 010bc710 00da0eb0 00da5fe0 00da3ee0 ntbackup!NTFS_ReadObj+0xb2
0007f564 010ae4ef 00da24e8 00da2d3c 0007f5b0 ntbackup!LP_BackupOBJ+0x423
0007f5c0 01091643 00d80c18 00da24e8 00da2d3c ntbackup!LP_BackupDLE+0x15f
0007f628 0102ffd6 00000000 00000001 00000000 ntbackup!LP_Backup_Engine+0x437
0007f66c 01030adb 010eda30 010eda30 00d7fc60 ntbackup!SetBSDTapeLabel+0x366e
0007f7e0 0105aad2 00000001 010eda30 0003e770 ntbackup!do_backup+0xaad
0007f928 0105d90c 00d7fc60 00000001 010eda30 ntbackup!CMainApp:oBackup+0x3c
0007f954 0104f4e6 00d7fc60 00000000 010eda30 ntbackup!CMainApp::ExecuteSession+0x140
0007f9e8 0104ff57 000003e9 00000001 0003e770 ntbackup!CMainApp::MUI_StartOperation+0x13a
0007fe6c 010622c4 010eda30 010eda30 ffffffff ntbackup!CMainApp:rocessCommandLine+0x991
0007ff08 4ff04cbb ffffffff 00000002 7ffd4000 ntbackup!CMainApp::InitInstance+0x5d8
0007ff1c 0107a430 01000000 00000000 00020686 MFC42u!AfxWinMain+0x4b
0007ffc0 77e523e5 00000000 00000000 7ffd4000 ntbackup!wWinMainCRTStartup+0x199
0007fff0 00000000 0107a297 00000000 78746341 kernel32!BaseProcessStart+0x23


STACK_COMMAND: kb

FOLLOWUP_IP:
rdbss!FsRtlCopyRead2+162
f6bbb8be 804e2e08 or byte ptr [esi+2Eh],8

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

SYMBOL_NAME: rdbss!FsRtlCopyRead2+162

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

 

This looks like a faulty driver/hardware. Any new software or updates on
that computer?

 

It is hardware error as I don't think "inc dword ptr [ebx-74FFB782h]" is a invalid instruction. (ie no programmer hardcode the displacement 74FFB782h at their programs). Run memtest to stress test the ram.

 

Many thanks for that analysis, I will run the test asap and return the results.

Thanks

Pete