Resolved Help reading 090615-61557-01.dmp

A friend has a problem with his computer. He has experienced screen anomalies which indicate hardware failure (graphics card). The computer crashes and restarts. He has sent the most recent dumpfile (090615-61557-01.dmp) but I neither have the tools installed nor the experience to use them.

Can someone assist?

 

Hi Christer.

Follow these instructions to post a Dump Data Log.

If you do not have a dump, ensure that your machine is configured to write out a dump by following the directions from microsoft.

Once you have posted the contents of the dump file, I will look it over and see if it shows anything.

 

Hi Evan,

the key word was "a friend" and I attached the *.dmp file from his C:\Windows\Minidump directory. At the present time, I can't make any changes to his computer.

The link in the page you linked to "http://go.microsoft.com/fwlink/?LinkID=191420" is dead.

I'll try the http://windowsbbs.com/debugwiz.zip (at the bottom of the post) route.

EDITED:

I tried the debugwiz-route with the same result, a dead link to download the tools.

The http://support.microsoft.com/default.aspx?scid=kb;EN-US;314103 is also dead.

 

I just tested both links and they work properly on my machine.

I don't have those tools downloaded on my machine so I am unable to open the dmp file so on your friends computer if you want to install those tools,
Microsoft Windows SDK for Windows 7 and .NET Framework 4 and http://windowsbbs.com/debugwiz.zip you will be able to open the dmp file and you can post the results of it here.

 

Yesterday evening, I had trouble connecting to Windows BBS and I still can't attach a textfile to the message. It's strange about the links, they still don't work for me. Maybe it's temporary or someting "lost in translation" since Microsoft in their wisdom transfer users to different pages depending on location. (I have tried to find a way to stay on en-us pages but I more often than not end up on auto-translated sv-se pages.)

Anyway, I found the download location for

Microsoft Windows SDK for Windows 7 and .NET Framework 4

and followed the instructions in

Dump Data collection tool and instructions

resulting in debuglog.txt ... ... which I'll try to understand. As I mentioned, I tried to attach it but at the moment, it's not possible. I'll try again later.

 

There's more than one way, here it is. The analysis was done on my computer, not his. Does it matter?

Opened log file 'c:debuglog.txt'

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Temp\Microsoft Update\090615-61557-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`03003000 PsLoadedModuleList = 0xfffff800`0324a730
Debug session time: Sun Sep 6 13:24:22.272 2015 (UTC + 2:00)
System Uptime: 0 days 1:30:12.179
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001fc8570, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

6: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001fc8570
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: nis.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800030e7810 to fffff800030778c0

STACK_TEXT:
fffff880`08fc08c8 fffff800`030e7810 : 00000000`0000001a 00000000`00041790 fffffa80`01fc8570 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08fc08d0 fffff800`030ab1b9 : 00000000`00000000 00000000`10a88fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`08fc0a90 fffff800`0338fb71 : fffffa80`0b3f9570 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`08fc0bb0 fffff960`0016699d : fffff900`00000001 fffffa80`09246c70 fffff900`00000001 fffff960`00258500 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08fc0c70 fffff960`0025ebd7 : 00000000`00000000 fffff900`c07506e0 fffff900`c00cb0f0 fffff880`08fc0d50 : win32k!SURFACE::Map+0x175
fffff880`08fc0cc0 fffff960`0025eca1 : fffff880`08fc0d48 fffff880`08fc1238 00000000`00000001 fffff880`08fc0ef0 : win32k!vSpPIDLockSpriteArea+0x4f
fffff880`08fc0cf0 fffff960`000fad06 : fffff900`c0134a30 fffff880`08fc1238 fffff880`08fc0f10 00000438`0000015d : win32k!PIDLOCKSPRITEAREA::vLock+0x4d
fffff880`08fc0d20 fffff960`00261e8b : 00000000`00000000 00000000`00000000 00000000`0000cccc fffff900`c4a00018 : win32k!ENUMUNDERLAYS::bEnum+0x27a
fffff880`08fc0e40 fffff960`00261ef4 : fffff900`c4a00018 00000000`00000000 00000000`00000000 fffff880`08fc10a8 : win32k!SpBitBlt+0x843
fffff880`08fc1230 fffff960`002b489c : 00000000`00000000 fffff900`c21b99b0 fffff900`c0000de0 fffff900`c21b99b0 : win32k!SpCopyBits+0x44
fffff880`08fc12a0 fffff960`0013b10b : ffffffff`80010d61 fffffa80`0a656060 fffff880`08fc15e0 00000000`02cbed98 : win32k!NtGdiBitBltInternal+0xc94
fffff880`08fc1480 fffff800`03076b53 : 00000000`00000000 fffff880`08fc15e0 00000000`00000006 00000000`00000000 : win32k!NtGdiBitBlt+0x5b
fffff880`08fc14f0 000007fe`fcfb25ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02cbed78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fcfb25ba


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::Map+175
fffff960`0016699d 8b4574 mov eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: win32k!SURFACE::Map+175

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 558bc272

FAILURE_BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175

BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175

Followup: MachineOwner
---------

rax=000000000000ffff rbx=0000000010680048 rcx=000000000000001a
rdx=0000000000041790 rsi=8000000000000000 rdi=fffff68000083408
rip=fffff800030778c0 rsp=fffff88008fc08c8 rbp=0000000010681000
r8=fffffa8001fc8570 r9=000000000000ffff r10=0000000000000000
r11=fffff68000083400 r12=fffff68000083ff8 r13=fffff70001080000
r14=fffff68000083000 r15=fffffa8001fc8570
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286
nt!KeBugCheckEx:
fffff800`030778c0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`08fc08d0=000000000000001a
Child-SP RetAddr : Args to Child : Call Site
fffff880`08fc08c8 fffff800`030e7810 : 00000000`0000001a 00000000`00041790 fffffa80`01fc8570 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08fc08d0 fffff800`030ab1b9 : 00000000`00000000 00000000`10a88fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`08fc0a90 fffff800`0338fb71 : fffffa80`0b3f9570 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`08fc0bb0 fffff960`0016699d : fffff900`00000001 fffffa80`09246c70 fffff900`00000001 fffff960`00258500 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08fc0c70 fffff960`0025ebd7 : 00000000`00000000 fffff900`c07506e0 fffff900`c00cb0f0 fffff880`08fc0d50 : win32k!SURFACE::Map+0x175
fffff880`08fc0cc0 fffff960`0025eca1 : fffff880`08fc0d48 fffff880`08fc1238 00000000`00000001 fffff880`08fc0ef0 : win32k!vSpPIDLockSpriteArea+0x4f
fffff880`08fc0cf0 fffff960`000fad06 : fffff900`c0134a30 fffff880`08fc1238 fffff880`08fc0f10 00000438`0000015d : win32k!PIDLOCKSPRITEAREA::vLock+0x4d
fffff880`08fc0d20 fffff960`00261e8b : 00000000`00000000 00000000`00000000 00000000`0000cccc fffff900`c4a00018 : win32k!ENUMUNDERLAYS::bEnum+0x27a
fffff880`08fc0e40 fffff960`00261ef4 : fffff900`c4a00018 00000000`00000000 00000000`00000000 fffff880`08fc10a8 : win32k!SpBitBlt+0x843
fffff880`08fc1230 fffff960`002b489c : 00000000`00000000 fffff900`c21b99b0 fffff900`c0000de0 fffff900`c21b99b0 : win32k!SpCopyBits+0x44
fffff880`08fc12a0 fffff960`0013b10b : ffffffff`80010d61 fffffa80`0a656060 fffff880`08fc15e0 00000000`02cbed98 : win32k!NtGdiBitBltInternal+0xc94
fffff880`08fc1480 fffff800`03076b53 : 00000000`00000000 fffff880`08fc15e0 00000000`00000006 00000000`00000000 : win32k!NtGdiBitBlt+0x5b
fffff880`08fc14f0 000007fe`fcfb25ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`08fc1560)
00000000`02cbed78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fcfb25ba
start end module name
fffff800`00bae000 fffff800`00bb8000 kdcom kdcom.dll Sat Feb 05 17:52:49 2011 (4D4D8061)
fffff800`03003000 fffff800`035ef000 nt ntkrnlmp.exe Mon May 25 19:07:52 2015 (556356E8)
fffff800`035ef000 fffff800`03638000 hal hal.dll Sat Nov 20 14:00:25 2010 (4CE7C669)
fffff880`00c00000 fffff880`00c75000 CI CI.dll Fri Jun 27 04:04:21 2014 (53ACD125)
fffff880`00c75000 fffff880`00cd1000 volmgrx volmgrx.sys Sat Nov 20 10:20:43 2010 (4CE792EB)
fffff880`00cf5000 fffff880`00d73000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat May 09 20:16:12 2015 (554E4EEC)
fffff880`00d73000 fffff880`00d87000 PSHED PSHED.dll Tue Jul 14 03:32:23 2009 (4A5BE027)
fffff880`00d87000 fffff880`00de5000 CLFS CLFS.SYS Wed Mar 04 04:21:12 2015 (54F67A28)
fffff880`00e00000 fffff880`00e0d000 vdrvroot vdrvroot.sys Tue Jul 14 02:01:31 2009 (4A5BCADB)
fffff880`00e0d000 fffff880`00e22000 partmgr partmgr.sys Sat Mar 17 06:06:09 2012 (4F641BC1)
fffff880`00e22000 fffff880`00e37000 volmgr volmgr.sys Sat Nov 20 10:19:28 2010 (4CE792A0)
fffff880`00e37000 fffff880`00e3e000 pciide pciide.sys Tue Jul 14 01:19:49 2009 (4A5BC115)
fffff880`00e3e000 fffff880`00e4e000 PCIIDEX PCIIDEX.SYS Tue Jul 14 01:19:48 2009 (4A5BC114)
fffff880`00e4e000 fffff880`00e58000 mv91cons mv91cons.sys Tue Sep 22 23:36:37 2009 (4AB94365)
fffff880`00e58000 fffff880`00e72000 mountmgr mountmgr.sys Tue Feb 03 03:14:35 2015 (54D02F0B)
fffff880`00e89000 fffff880`00f4b000 Wdf01000 Wdf01000.sys Sat Jun 22 05:13:05 2013 (51C51641)
fffff880`00f4b000 fffff880`00f5b000 WDFLDR WDFLDR.SYS Thu Jul 26 04:29:04 2012 (5010AB70)
fffff880`00f5b000 fffff880`00fb2000 ACPI ACPI.sys Sat Nov 20 10:19:16 2010 (4CE79294)
fffff880`00fb2000 fffff880`00fbb000 WMILIB WMILIB.SYS Tue Jul 14 01:19:51 2009 (4A5BC117)
fffff880`00fbb000 fffff880`00fc5000 msisadrv msisadrv.sys Tue Jul 14 01:19:26 2009 (4A5BC0FE)
fffff880`00fc5000 fffff880`00ff8000 pci pci.sys Sat Nov 20 10:19:11 2010 (4CE7928F)
fffff880`01000000 fffff880`01014000 fileinfo fileinfo.sys Tue Jul 14 01:34:25 2009 (4A5BC481)
fffff880`01014000 fffff880`01072000 msrpc msrpc.sys Sat Nov 20 10:21:56 2010 (4CE79334)
fffff880`01072000 fffff880`010bb000 fwpkclnt fwpkclnt.sys Sat Apr 05 03:23:21 2014 (533F5B09)
fffff880`010cb000 fffff880`01107000 vmbus vmbus.sys Sat Nov 20 10:57:29 2010 (4CE79B89)
fffff880`01107000 fffff880`0111b000 winhv winhv.sys Sat Nov 20 10:20:02 2010 (4CE792C2)
fffff880`0111b000 fffff880`01124000 atapi atapi.sys Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`01124000 fffff880`0114e000 ataport ataport.SYS Mon Aug 05 03:02:45 2013 (51FEF9B5)
fffff880`0114e000 fffff880`0116c000 jraid jraid.sys Thu Aug 13 10:10:27 2009 (4A83CA73)
fffff880`0116c000 fffff880`0119b000 SCSIPORT SCSIPORT.SYS Sat Nov 20 11:34:01 2010 (4CE7A419)
fffff880`0119b000 fffff880`011a6000 amdxata amdxata.sys Fri Mar 19 17:18:18 2010 (4BA3A3CA)
fffff880`011a6000 fffff880`011f2000 fltmgr fltmgr.sys Sat Nov 20 10:19:24 2010 (4CE7929C)
fffff880`0120c000 fffff880`013b5000 Ntfs Ntfs.sys Fri Jan 24 02:14:50 2014 (52E1BE8A)
fffff880`013b5000 fffff880`013d0000 ksecdd ksecdd.sys Wed Jul 01 21:25:07 2015 (55943E93)
fffff880`013d0000 fffff880`013fc000 ksecpkg ksecpkg.sys Wed Jul 01 21:41:16 2015 (5594425C)
fffff880`01400000 fffff880`01410000 vmstorfl vmstorfl.sys Sat Nov 20 10:57:30 2010 (4CE79B8A)
fffff880`0141f000 fffff880`01491000 cng cng.sys Fri Jan 30 04:17:08 2015 (54CAF7B4)
fffff880`01491000 fffff880`014a2000 pcw pcw.sys Tue Jul 14 01:19:27 2009 (4A5BC0FF)
fffff880`014a2000 fffff880`014ac000 Fs_Rec Fs_Rec.sys Thu Mar 01 04:41:06 2012 (4F4EEFD2)
fffff880`014ac000 fffff880`0159e000 ndis ndis.sys Wed Aug 22 17:11:46 2012 (5034F6B2)
fffff880`0159e000 fffff880`015fe000 NETIO NETIO.SYS Tue Nov 26 11:21:01 2013 (5294760D)
fffff880`01601000 fffff880`01800000 tcpip tcpip.sys Sat Apr 05 03:26:44 2014 (533F5BD4)
fffff880`01800000 fffff880`0182a000 cdrom cdrom.sys Sat Nov 20 10:19:20 2010 (4CE79298)
fffff880`0182a000 fffff880`01858000 ccSetx64 ccSetx64.sys Thu Aug 16 23:18:11 2012 (502D6393)
fffff880`01858000 fffff880`01884000 ccSetx64_fffff88001858000 ccSetx64.sys Mon Aug 18 21:33:11 2014 (53F254F7)
fffff880`01884000 fffff880`018c2000 1394ohci 1394ohci.sys Sat Nov 20 11:44:56 2010 (4CE7A6A8)
fffff880`018c2000 fffff880`018d8000 AgileVpn AgileVpn.sys Tue Jul 14 02:10:24 2009 (4A5BCCF0)
fffff880`018d8000 fffff880`018fc000 rasl2tp rasl2tp.sys Sat Nov 20 11:52:34 2010 (4CE7A872)
fffff880`018fc000 fffff880`01948000 volsnap volsnap.sys Sat Nov 20 10:20:08 2010 (4CE792C8)
fffff880`01948000 fffff880`01982000 fvevol fvevol.sys Thu Jan 24 04:11:24 2013 (5100A65C)
fffff880`01982000 fffff880`01998000 disk disk.sys Tue Jul 14 01:19:57 2009 (4A5BC11D)
fffff880`01998000 fffff880`019c8000 CLASSPNP CLASSPNP.SYS Sat Nov 20 10:19:23 2010 (4CE7929B)
fffff880`01a00000 fffff880`01a3a000 rdyboost rdyboost.sys Sat Nov 20 10:43:10 2010 (4CE7982E)
fffff880`01a3a000 fffff880`01a4c000 mup mup.sys Tue Jul 14 01:23:45 2009 (4A5BC201)
fffff880`01a4c000 fffff880`01a55000 hwpolicy hwpolicy.sys Sat Nov 20 10:18:54 2010 (4CE7927E)
fffff880`01a5e000 fffff880`01bef000 SYMEFASI64 SYMEFASI64.SYS Thu May 07 11:44:15 2015 (554B33EF)
fffff880`01bef000 fffff880`01bf7000 spldr spldr.sys Mon May 11 18:56:27 2009 (4A0858BB)
fffff880`02e00000 fffff880`02e48000 Ironx64 Ironx64.SYS Tue May 05 01:51:42 2015 (5548060E)
fffff880`02e48000 fffff880`02e65000 serial serial.sys Tue Jul 14 02:00:40 2009 (4A5BCAA8)
fffff880`02e65000 fffff880`02e80000 wanarp wanarp.sys Sat Nov 20 11:52:36 2010 (4CE7A874)
fffff880`02e80000 fffff880`02e94000 termdd termdd.sys Sat Nov 20 12:03:40 2010 (4CE7AB0C)
fffff880`02e94000 fffff880`02ed3000 Rt64win7 Rt64win7.sys Thu Aug 20 18:05:06 2009 (4A8D7432)
fffff880`02ed7000 fffff880`02fbc000 SRTSP64 SRTSP64.SYS Sun Jun 14 09:19:20 2015 (557D2AF8)
fffff880`02fbc000 fffff880`02fd2000 SRTSPX64 SRTSPX64.SYS Tue Aug 26 08:36:42 2014 (53FC2AFA)
fffff880`02fd2000 fffff880`02ff7000 SYMEVENT64x86 SYMEVENT64x86.SYS Mon Jan 19 23:43:56 2015 (54BD88AC)
fffff880`04400000 fffff880`04489000 afd afd.sys Fri May 30 08:45:48 2014 (5388291C)
fffff880`04489000 fffff880`044af000 pacer pacer.sys Sat Nov 20 11:52:18 2010 (4CE7A862)
fffff880`044af000 fffff880`044be000 netbios netbios.sys Tue Jul 14 02:09:26 2009 (4A5BCCB6)
fffff880`044c5000 fffff880`046d3000 EX64 EX64.SYS Sat Nov 15 10:14:03 2014 (5467195B)
fffff880`046d3000 fffff880`046f6000 ENG64 ENG64.SYS Sat Nov 15 10:15:33 2014 (546719B5)
fffff880`046f6000 fffff880`046ff000 Null Null.SYS Tue Jul 14 01:19:37 2009 (4A5BC109)
fffff880`046ff000 fffff880`04706000 Beep Beep.SYS Tue Jul 14 02:00:13 2009 (4A5BCA8D)
fffff880`04706000 fffff880`04714000 vga vga.sys Tue Jul 14 01:38:47 2009 (4A5BC587)
fffff880`04714000 fffff880`04739000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 01:38:51 2009 (4A5BC58B)
fffff880`04739000 fffff880`04749000 watchdog watchdog.sys Tue Jul 14 01:37:35 2009 (4A5BC53F)
fffff880`04749000 fffff880`04752000 RDPCDD RDPCDD.sys Tue Jul 14 02:16:34 2009 (4A5BCE62)
fffff880`04752000 fffff880`0475b000 rdpencdd rdpencdd.sys Tue Jul 14 02:16:34 2009 (4A5BCE62)
fffff880`0475b000 fffff880`04764000 rdprefmp rdprefmp.sys Tue Jul 14 02:16:35 2009 (4A5BCE63)
fffff880`04764000 fffff880`0476f000 Msfs Msfs.SYS Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`0476f000 fffff880`04780000 Npfs Npfs.SYS Tue Jul 14 01:19:48 2009 (4A5BC114)
fffff880`04780000 fffff880`047a2000 tdx tdx.sys Tue Nov 11 02:46:26 2014 (54616A72)
fffff880`047a2000 fffff880`047af000 TDI TDI.SYS Sat Nov 20 10:22:06 2010 (4CE7933E)
fffff880`047af000 fffff880`047f4000 netbt netbt.sys Sat Nov 20 10:23:18 2010 (4CE79386)
fffff880`047f4000 fffff880`047fd000 wfplwf wfplwf.sys Tue Jul 14 02:09:26 2009 (4A5BCCB6)
fffff880`04c00000 fffff880`04c56000 USBPORT USBPORT.SYS Wed Nov 27 02:41:11 2013 (52954DB7)
fffff880`04c56000 fffff880`04c73000 parport parport.sys Tue Jul 14 02:00:40 2009 (4A5BCAA8)
fffff880`04c73000 fffff880`04c83000 CompositeBus CompositeBus.sys Sat Nov 20 11:33:17 2010 (4CE7A3ED)
fffff880`04c83000 fffff880`04d12000 SYMNETS SYMNETS.SYS Sat May 09 00:20:49 2015 (554D36C1)
fffff880`04d12000 fffff880`04d63000 rdbss rdbss.sys Sat Nov 20 10:27:51 2010 (4CE79497)
fffff880`04d63000 fffff880`04d6f000 nsiproxy nsiproxy.sys Tue Jul 14 01:21:02 2009 (4A5BC15E)
fffff880`04d6f000 fffff880`04d7a000 mssmbios mssmbios.sys Tue Jul 14 01:31:10 2009 (4A5BC3BE)
fffff880`04d7a000 fffff880`04da0000 tunnel tunnel.sys Sat Nov 20 11:51:50 2010 (4CE7A846)
fffff880`04da0000 fffff880`04dc4000 HDAudBus HDAudBus.sys Sat Nov 20 11:43:42 2010 (4CE7A65E)
fffff880`04dc4000 fffff880`04df4000 nusb3xhc nusb3xhc.sys Fri Sep 25 15:58:31 2009 (4ABCCC87)
fffff880`04df4000 fffff880`04e00000 ndistapi ndistapi.sys Tue Jul 14 02:10:00 2009 (4A5BCCD8)
fffff880`04e00000 fffff880`04e0c000 serenum serenum.sys Tue Jul 14 02:00:33 2009 (4A5BCAA1)
fffff880`04e0c000 fffff880`04e15000 wmiacpi wmiacpi.sys Tue Jul 14 01:31:02 2009 (4A5BC3B6)
fffff880`04e1f000 fffff880`04edd000 IDSvia64 IDSvia64.sys Wed Aug 19 04:25:26 2015 (55D3E916)
fffff880`04edd000 fffff880`04ef3000 intelppm intelppm.sys Tue Jul 14 01:19:25 2009 (4A5BC0FD)
fffff880`04ef3000 fffff880`04f6e000 eeCtrl64 eeCtrl64.sys Thu Jul 16 03:17:05 2015 (55A70611)
fffff880`04f6e000 fffff880`04ff1000 csc csc.sys Sat Nov 20 10:27:12 2010 (4CE79470)
fffff880`04ff1000 fffff880`04ffe000 fdc fdc.sys Tue Jul 14 02:00:54 2009 (4A5BCAB6)
fffff880`05200000 fffff880`0525a000 usbhub usbhub.sys Wed Nov 27 02:41:36 2013 (52954DD0)
fffff880`0525a000 fffff880`05270000 nusb3hub nusb3hub.sys Fri Sep 25 15:58:23 2009 (4ABCCC7F)
fffff880`05270000 fffff880`0527b000 flpydisk flpydisk.sys Tue Jul 14 02:00:54 2009 (4A5BCAB6)
fffff880`0527b000 fffff880`05290000 NDProxy NDProxy.SYS Sat Nov 20 11:52:20 2010 (4CE7A864)
fffff880`05290000 fffff880`052b1000 AtiHdmi AtiHdmi.sys Wed Sep 30 15:54:46 2009 (4AC36326)
fffff880`052d5000 fffff880`05304000 ndiswan ndiswan.sys Sat Nov 20 11:52:32 2010 (4CE7A870)
fffff880`05304000 fffff880`0531f000 raspppoe raspppoe.sys Tue Jul 14 02:10:17 2009 (4A5BCCE9)
fffff880`0531f000 fffff880`05340000 raspptp raspptp.sys Sat Nov 20 11:52:31 2010 (4CE7A86F)
fffff880`05340000 fffff880`0535a000 rassstp rassstp.sys Tue Jul 14 02:10:25 2009 (4A5BCCF1)
fffff880`0535a000 fffff880`05365000 rdpbus rdpbus.sys Tue Jul 14 02:17:46 2009 (4A5BCEAA)
fffff880`05365000 fffff880`05374000 kbdclass kbdclass.sys Tue Jul 14 01:19:50 2009 (4A5BC116)
fffff880`05374000 fffff880`05383000 mouclass mouclass.sys Tue Jul 14 01:19:50 2009 (4A5BC116)
fffff880`05383000 fffff880`05384480 swenum swenum.sys Tue Jul 14 02:00:18 2009 (4A5BCA92)
fffff880`05385000 fffff880`053c8000 ks ks.sys Sat Nov 20 11:33:23 2010 (4CE7A3F3)
fffff880`053c8000 fffff880`053da000 umbus umbus.sys Sat Nov 20 11:44:37 2010 (4CE7A695)
fffff880`05800000 fffff880`05846000 dxgmms1 dxgmms1.sys Wed Apr 10 05:27:15 2013 (5164DC13)
fffff880`05846000 fffff880`05858000 usbehci usbehci.sys Wed Nov 27 02:41:11 2013 (52954DB7)
fffff880`05859000 fffff880`05e95000 atikmdag atikmdag.sys Fri Oct 02 06:05:13 2009 (4AC57BF9)
fffff880`05e95000 fffff880`05ebc000 EraserUtilRebootDrv EraserUtilRebootDrv.sys Thu Jul 16 03:17:05 2015 (55A70611)
fffff880`05ebc000 fffff880`05fb1000 dxgkrnl dxgkrnl.sys Mon Jun 16 02:58:04 2014 (539E411C)
fffff880`05fb1000 fffff880`05fc0000 discache discache.sys Tue Jul 14 01:37:18 2009 (4A5BC52E)
fffff880`05fc0000 fffff880`05fde000 dfsc dfsc.sys Sat Nov 20 10:26:31 2010 (4CE79447)
fffff880`05fde000 fffff880`05fef000 blbdrive blbdrive.sys Tue Jul 14 01:35:59 2009 (4A5BC4DF)
fffff880`05fef000 fffff880`05ffc000 usbuhci usbuhci.sys Wed Nov 27 02:41:05 2013 (52954DB1)
fffff880`05ffc000 fffff880`05ffde80 USBD USBD.SYS Wed Nov 27 02:41:03 2013 (52954DAF)
fffff880`06413000 fffff880`064dc000 HTTP HTTP.sys Wed Feb 25 04:17:55 2015 (54ED3EE3)
fffff880`064dc000 fffff880`064fa000 bowser bowser.sys Wed Feb 23 05:55:04 2011 (4D649328)
fffff880`064fa000 fffff880`06512000 mpsdrv mpsdrv.sys Tue Jul 14 02:08:25 2009 (4A5BCC79)
fffff880`06512000 fffff880`0653f000 mrxsmb mrxsmb.sys Wed Jul 01 21:27:33 2015 (55943F25)
fffff880`0653f000 fffff880`0658d000 mrxsmb10 mrxsmb10.sys Wed Jul 01 21:26:43 2015 (55943EF3)
fffff880`0658d000 fffff880`065b1000 mrxsmb20 mrxsmb20.sys Wed Jul 01 21:26:36 2015 (55943EEC)
fffff880`065b1000 fffff880`065c9000 adfs adfs.SYS Thu Jun 26 22:52:37 2008 (48640195)
fffff880`07647000 fffff880`07653000 Dxapi Dxapi.sys Tue Jul 14 01:38:28 2009 (4A5BC574)
fffff880`07653000 fffff880`07661000 monitor monitor.sys Tue Jul 14 01:38:52 2009 (4A5BC58C)
fffff880`07661000 fffff880`07684000 luafv luafv.sys Tue Jul 14 01:26:13 2009 (4A5BC295)
fffff880`07684000 fffff880`07699000 lltdio lltdio.sys Tue Jul 14 02:08:50 2009 (4A5BCC92)
fffff880`07699000 fffff880`076b1000 rspndr rspndr.sys Tue Jul 14 02:08:50 2009 (4A5BCC92)
fffff880`076c4000 fffff880`07701000 portcls portcls.sys Fri Oct 04 03:36:02 2013 (524E1B82)
fffff880`07701000 fffff880`07723000 drmk drmk.sys Fri Oct 04 04:16:30 2013 (524E24FE)
fffff880`07723000 fffff880`07728200 ksthunk ksthunk.sys Tue Jul 14 02:00:19 2009 (4A5BCA93)
fffff880`07729000 fffff880`07751000 Dot4 Dot4.sys Tue Jul 14 02:00:16 2009 (4A5BCA90)
fffff880`07751000 fffff880`0776a000 HIDCLASS HIDCLASS.SYS Wed Jul 03 06:05:05 2013 (51D3A2F1)
fffff880`0776a000 fffff880`07781000 LEqdUsb LEqdUsb.Sys Wed Jun 17 18:49:54 2009 (4A391EB2)
fffff880`07781000 fffff880`0778f000 kbdhid kbdhid.sys Sat Nov 20 11:33:25 2010 (4CE7A3F5)
fffff880`0778f000 fffff880`0779c000 mouhid mouhid.sys Tue Jul 14 02:00:20 2009 (4A5BCA94)
fffff880`0779c000 fffff880`077af000 LHidFilt LHidFilt.Sys Wed Jun 17 18:49:39 2009 (4A391EA3)
fffff880`077af000 fffff880`077c3000 LMouFilt LMouFilt.Sys Wed Jun 17 18:49:43 2009 (4A391EA7)
fffff880`077c3000 fffff880`077d1000 crashdmp crashdmp.sys Tue Jul 14 02:01:01 2009 (4A5BCABD)
fffff880`077d1000 fffff880`077dd000 dump_dumpata dump_dumpata.sys Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`077dd000 fffff880`077e6000 dump_atapi dump_atapi.sys Tue Jul 14 01:19:47 2009 (4A5BC113)
fffff880`077e6000 fffff880`077f9000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 01:21:51 2009 (4A5BC18F)
fffff880`07800000 fffff880`0780e000 hidusb hidusb.sys Sat Nov 20 11:43:49 2010 (4CE7A665)
fffff880`07810000 fffff880`079f7280 RTKVHD64 RTKVHD64.sys Tue Sep 22 15:04:41 2009 (4AB8CB69)
fffff880`079f8000 fffff880`07a00000 LHidEqd LHidEqd.Sys Wed Jun 17 18:49:56 2009 (4A391EB4)
fffff880`07a00000 fffff880`07a08080 HIDPARSE HIDPARSE.SYS Wed Jul 03 06:05:04 2013 (51D3A2F0)
fffff880`07a0d000 fffff880`07ba2000 BHDrvx64 BHDrvx64.sys Sat Jul 11 06:11:26 2015 (55A0976E)
fffff880`07ba2000 fffff880`07bbf000 usbccgp usbccgp.sys Wed Nov 27 02:41:15 2013 (52954DBB)
fffff880`07bbf000 fffff880`07bcb000 usbprint usbprint.sys Tue Jul 14 02:38:18 2009 (4A5BD37A)
fffff880`07bcb000 fffff880`07bdb000 dot4usb dot4usb.sys Tue Jul 14 02:00:20 2009 (4A5BCA94)
fffff880`07bdb000 fffff880`07bf6000 USBSTOR USBSTOR.SYS Fri Mar 11 05:37:16 2011 (4D79A6FC)
fffff880`07bf6000 fffff880`07c00000 Dot4Prt Dot4Prt.sys Sat Nov 20 11:32:44 2010 (4CE7A3CC)
fffff880`08497000 fffff880`08541000 peauth peauth.sys Tue Feb 03 04:19:12 2015 (54D03E30)
fffff880`08541000 fffff880`0854c000 secdrv secdrv.SYS Wed Sep 13 15:18:38 2006 (4508052E)
fffff880`0854c000 fffff880`0857d000 srvnet srvnet.sys Fri Apr 29 05:05:35 2011 (4DBA2AFF)
fffff880`0857d000 fffff880`0858f000 tcpipreg tcpipreg.sys Wed Oct 03 18:07:26 2012 (506C62BE)
fffff880`0858f000 fffff880`085f8000 srv2 srv2.sys Fri Apr 29 05:05:46 2011 (4DBA2B0A)
fffff880`08862000 fffff880`088fa000 srv srv.sys Fri Apr 29 05:06:06 2011 (4DBA2B1E)
fffff880`088fa000 fffff880`08913000 WudfPf WudfPf.sys Thu Jul 26 04:26:45 2012 (5010AAE5)
fffff880`08913000 fffff880`08924000 WinUsb WinUsb.sys Sat Nov 20 11:43:56 2010 (4CE7A66C)
fffff880`08924000 fffff880`0895a000 WUDFRd WUDFRd.sys Thu Jul 26 04:26:06 2012 (5010AABE)
fffff880`0895a000 fffff880`08968000 scfilter scfilter.sys Sat Nov 20 11:09:59 2010 (4CE79E77)
fffff880`089d9000 fffff880`089e4000 asyncmac asyncmac.sys Tue Jul 14 02:10:13 2009 (4A5BCCE5)
fffff960`000b0000 fffff960`003d4000 win32k win32k.sys Thu Jun 25 10:57:22 2015 (558BC272)
fffff960`00400000 fffff960`0040a000 TSDDD TSDDD.dll unavailable (00000000)
fffff960`007d0000 fffff960`007f7000 cdd cdd.dll Thu Feb 03 12:25:25 2011 (4D4A90A5)
fffff960`00910000 fffff960`00972000 ATMFD ATMFD.DLL Wed Jul 15 03:59:41 2015 (55A5BE8D)

Unloaded modules:
fffff880`08968000 fffff880`089d9000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00071000
fffff880`07600000 fffff880`07611000 WinUsb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00011000
fffff880`07611000 fffff880`07647000 WUDFRd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00036000
fffff880`019c8000 fffff880`019d6000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`019d6000 fffff880`019e2000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`01a55000 fffff880`01a5e000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
fffff880`019e2000 fffff880`019f5000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
Closing open log file c:debuglog.txt

 

It seems to me like Norton (nis.exe) is the culprit. A few weeks ago, a local network (for sharing documents) and an account were removed. That account was the one used to install Windows 7 but prior to removing it, the second account had been made administrator.

The log from Norton is in Swedish and I won't bother trying to attach the file. All entries are tagged "no action required" but still, the computer crashes.

 

NIS.exe is part of Norton Internet Security so I would try removing Norton from the system using the Norton Removal Tool.

Then see if the computer still blue screens.

 

Hi Evan,
yes, I too identified Norton. I will suggest to my friend to uninstall and reinstall Norton. I think that he will first try to find out what happened to the "broken link" between the local network and accounts.

Thanks so far!

 

I've had time to check a few dmp-files more and they all point at different culprits. Some of the dmp-files were created earlier than the first posted (included) and others were created later. I have cut and pasted some of the information in a single text-file (attached).

Culprits pointed at are:

Under Probably caused by :

win32k.sys ( win32k!SURFACE::Map+175 ) > 4 times
ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ab3 ) > once

and under Debugging Details:

csrss.exe > twice
iexplore.exe > twice
nis.exe > once

I'm totally ... ... !

 

Well, I don't know why I can't attach a text-file ... ... but here it is:

1)

Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Göran\090315-38844-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`03007000 PsLoadedModuleList = 0xfffff800`0324e730
Debug session time: Thu Sep 3 13:40:28.856 2015 (UTC + 2:00)
System Uptime: 0 days 3:04:15.761
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001fc8240, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

4: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001fc8240
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800030eb810 to fffff8000307b8c0

STACK_TEXT:
fffff880`0b57dcd8 fffff800`030eb810 : 00000000`0000001a 00000000`00041790 fffffa80`01fc8240 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0b57dce0 fffff800`030af1b9 : 00000000`00000000 00000000`04598fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`0b57dea0 fffff800`03393b71 : fffffa80`0815af80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0b57dfc0 fffff960`0016699d : 00000000`00000001 fffffa80`07f24ef0 fffff900`00000001 00000000`fffffa00 : nt!MiUnmapViewOfSection+0x1b1
fffff880`0b57e080 fffff960`00167cf7 : 00000000`00000000 fffff880`0b57e1f0 00000000`00000001 fffff900`c0000750 : win32k!SURFACE::Map+0x175
fffff880`0b57e0d0 fffff960`0025b2e1 : fffff900`c0000de0 fffff900`c0094f20 fffff900`c0000750 fffff900`c0094f20 : win32k!SURFREFVIEW::bMap+0x1b
fffff880`0b57e100 fffff960`00267908 : fffff900`c00cb070 fffff880`0b57e450 00000000`ffffffff fffff880`0b57e350 : win32k!vSpComposite+0x585
fffff880`0b57e330 fffff960`00268b59 : fffffe61`fffffaf7 00000000`00000000 fffffa80`07f24e50 fffff900`c00cb010 : win32k!bSpPtInSprite+0xdc
fffff880`0b57e450 fffff960`00294140 : fffff900`c00cb010 00000000`00000001 fffffa80`07f24e50 fffff880`0b57eb10 : win32k!GdiPtInSprite+0x105
fffff880`0b57e4b0 fffff960`0014874d : fffff900`c00cb010 00000000`000101b2 00000000`00000000 fffff900`c0c235f0 : win32k!GrePtInSprite+0x3ac
fffff880`0b57e590 fffff960`0014895d : fffff900`c0c235f0 0000019f`00000509 fffff880`0b57e7a0 00000000`00000001 : win32k!xxxWindowHitTest2+0xe5
fffff880`0b57e610 fffff960`001487f3 : fffff900`c0c00b90 0000019f`00000509 fffff880`0b57e7a0 00000000`00000001 : win32k!xxxWindowHitTest+0xa9
fffff880`0b57e660 fffff960`0014895d : fffff900`c0c00b90 0000019f`00000509 fffff880`0b57e7a0 00000000`00000001 : win32k!xxxWindowHitTest2+0x18b
fffff880`0b57e6e0 fffff960`001423a2 : 00000000`00000001 0000019f`00000509 fffff880`0b57eca0 00000000`00000509 : win32k!xxxWindowHitTest+0xa9
fffff880`0b57e730 fffff960`0017c823 : fffff900`c41c7010 fffff880`0b57ebd8 00000000`00000000 fffff800`00000000 : win32k!xxxScanSysQueue+0x113e
fffff880`0b57ea70 fffff960`0017ccb5 : 00000000`00000000 fffff800`000025ff 00000000`00000000 fffffa80`ffffffff : win32k!xxxRealInternalGetMessage+0x453
fffff880`0b57eb50 fffff960`0017e6ff : 00000000`00000000 00000000`0376fd20 00000000`735aadb0 fffff800`0307ab53 : win32k!xxxInternalGetMessage+0x35
fffff880`0b57eb90 fffff800`0307ab53 : fffffa80`0beb0450 00000000`7ef9b000 00000000`00000020 00000000`735aaeac : win32k!NtUserGetMessage+0x8b
fffff880`0b57ec20 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::Map+175
fffff960`0016699d 8b4574 mov eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: win32k!SURFACE::Map+175

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 558bc272

FAILURE_BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175

BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175





2)

Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Göran\090415-35973-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`0301d000 PsLoadedModuleList = 0xfffff800`03264730
Debug session time: Fri Sep 4 13:17:16.737 2015 (UTC + 2:00)
System Uptime: 0 days 1:53:09.642
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa8019578010, 2, 1, fffff800031510b6}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa8019578010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800031510b6, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ce100
fffffa8019578010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiReleaseConfirmedPageFileSpace+86
fffff800`031510b6 480fb328 btr qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

TRAP_FRAME: fffff880080117d0 -- (.trap 0xfffff880080117d0)
.trap 0xfffff880080117d0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8009578010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800031510b6 rsp=fffff88008011960 rbp=0000000080000000
r8=fffff88008011990 r9=fffffa800a2d3550 r10=0000000000000000
r11=fffff68000059400 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x86:
fffff800`031510b6 480fb328 btr qword ptr [rax],rbp ds:fffffa80`09578010=fff2fe4fe3ffffff
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80003090e69 to fffff800030918c0

STACK_TEXT:
fffff880`08011688 fffff800`03090e69 : 00000000`0000000a fffffa80`19578010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`08011690 fffff800`0308fae0 : 00000000`0000c018 fffff960`00143955 fffff880`08001000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`080117d0 fffff800`031510b6 : 00000000`00000000 00000000`00000000 fffffa80`09538c10 00000000`0000120b : nt!KiPageFault+0x260
fffff880`08011960 fffff800`031016aa : 00000000`0b280048 fffffa80`03e40600 00000000`0b281000 a1d00001`4c020825 : nt!MiReleaseConfirmedPageFileSpace+0x86
fffff880`080119e0 fffff800`030c51b9 : 00000000`00000000 00000000`0b908fff fffffa80`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x33736
fffff880`08011ba0 fffff800`033a9b71 : fffffa80`0bb2b810 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`08011cc0 fffff960`0011699d : fffff900`00000001 fffffa80`090ceef0 fffff900`00000001 fffff960`00208500 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08011d80 fffff960`0020ebd7 : 00000000`00000000 fffff900`c01b9410 fffff900`c00cb0f0 fffff880`08011e60 : win32k!SURFACE::Map+0x175
fffff880`08011dd0 fffff960`0020eca1 : fffff880`08011e58 fffff880`08012348 00000000`00000001 fffff880`08012000 : win32k!vSpPIDLockSpriteArea+0x4f
fffff880`08011e00 fffff960`000aad06 : fffff960`00349070 fffff880`08012348 fffff880`08012020 000000bc`0000077f : win32k!PIDLOCKSPRITEAREA::vLock+0x4d
fffff880`08011e30 fffff960`00211e8b : 00000000`00000000 00000000`00000000 00000000`0000cccc fffff900`c4600018 : win32k!ENUMUNDERLAYS::bEnum+0x27a
fffff880`08011f50 fffff960`00211ef4 : fffff900`c4600018 00000000`00000000 00000000`00000000 fffff880`080121b8 : win32k!SpBitBlt+0x843
fffff880`08012340 fffff960`0026489c : 00000000`00000000 fffff900`c0094f20 fffff900`c0000de0 fffff900`c0094f20 : win32k!SpCopyBits+0x44
fffff880`080123b0 fffff960`000eb10b : 00000000`06010ed0 fffffa80`06809540 fffff880`080126f0 00000000`0028e518 : win32k!NtGdiBitBltInternal+0xc94
fffff880`08012590 fffff800`03090b53 : 00000000`00000000 fffff880`080126f0 00000000`00000000 00000000`00000001 : win32k!NtGdiBitBlt+0x5b
fffff880`08012600 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::Map+175
fffff960`0011699d 8b4574 mov eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: win32k!SURFACE::Map+175

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 558bc272

FAILURE_BUCKET_ID: X64_0xA_win32k!SURFACE::Map+175

BUCKET_ID: X64_0xA_win32k!SURFACE::Map+175





3)

Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Göran\090415-39437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`03049000 PsLoadedModuleList = 0xfffff800`03290730
Debug session time: Fri Sep 4 14:36:41.557 2015 (UTC + 2:00)
System Uptime: 0 days 1:18:09.462
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001fc8b70, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

4: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001fc8b70
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: csrss.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff8000312d810 to fffff800030bd8c0

STACK_TEXT:
fffff880`07bd35e8 fffff800`0312d810 : 00000000`0000001a 00000000`00041790 fffffa80`01fc8b70 00000000`0000ffff : nt!KeBugCheckEx
fffff880`07bd35f0 fffff800`030f11b9 : fffff900`00000000 00000000`04e48fff fffff900`00000000 fffff960`002a2d14 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`07bd37b0 fffff800`033d5b71 : fffffa80`0a814c20 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`07bd38d0 fffff960`0012699d : 00000000`00000001 fffffa80`090d19d0 fffff900`00000001 00000000`fffffc00 : nt!MiUnmapViewOfSection+0x1b1
fffff880`07bd3990 fffff960`00127cf7 : 00000000`00000000 fffff880`07bd3b00 00000000`00000001 fffff900`c0000750 : win32k!SURFACE::Map+0x175
fffff880`07bd39e0 fffff960`0021b2e1 : fffff900`c0000de0 fffff900`c0094f20 fffff900`c0000750 fffff900`c0094f20 : win32k!SURFREFVIEW::bMap+0x1b
fffff880`07bd3a10 fffff960`00227908 : fffff900`c00cb070 fffff880`07bd3d60 00000000`ffffffff fffff880`07bd3c60 : win32k!vSpComposite+0x585
fffff880`07bd3c40 fffff960`00228b59 : fffffdec`fffffc2d 00000000`00000000 fffffa80`090d1930 fffff900`c00cb010 : win32k!bSpPtInSprite+0xdc
fffff880`07bd3d60 fffff960`00254140 : fffff900`c00cb010 00000000`00000001 fffffa80`090d1930 00000000`00000001 : win32k!GdiPtInSprite+0x105
fffff880`07bd3dc0 fffff960`00108a58 : fffff900`c00cb010 00000000`0001025c fffff880`07bd3f60 fffff900`c0c35300 : win32k!GrePtInSprite+0x3ac
fffff880`07bd3ea0 fffff960`00109197 : 00000214`000003d3 00000214`000003d3 fffff880`07bd3f60 fffff960`00329913 : win32k!SpeedHitTest+0xb8
fffff880`07bd3ee0 fffff960`001c681e : fffff900`c0c7df30 fffff900`c0c7df30 00000214`000003d3 00000000`00000001 : win32k!zzzSetFMouseMoved+0x1a7
fffff880`07bd4050 fffff960`001e9389 : fffff900`00000001 00000000`00000000 fffff880`07bd41a8 fffff900`c0c84e20 : win32k!zzzUpdateLayeredWindow+0x256
fffff880`07bd4110 fffff960`001e9779 : fffff900`c0c7df30 fffff900`c346da00 fffff900`01ff0000 000003f3`0000039a : win32k!zzzApplyShadow+0x109
fffff880`07bd4190 fffff960`0010ae8b : fffff900`c346da00 00000000`00000000 00000000`00000000 00000000`00000004 : win32k!xxxAddShadow+0x17d
fffff880`07bd4250 fffff960`0010bce0 : fffff960`00365660 fffff960`00365660 00000000`00000000 00000000`00000000 : win32k!xxxSendChangedMsgs+0xcb
fffff880`07bd42d0 fffff960`0010b8c6 : fffff900`00000001 fffff900`c0c84e20 00000000`00000001 fffffa80`00000000 : win32k!xxxEndDeferWindowPosEx+0x3d8
fffff880`07bd4390 fffff960`0014a4e5 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff960`00000000 : win32k!xxxSetWindowPos+0x156
fffff880`07bd4410 fffff800`030bcb53 : fffffa80`0a440b50 fffff880`07bd4590 00000000`0017a608 fffff880`07bd44b8 : win32k!NtUserSetWindowPos+0x1e5
fffff880`07bd44a0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::Map+175
fffff960`0012699d 8b4574 mov eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: win32k!SURFACE::Map+175

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 558bc272

FAILURE_BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175

BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175





4)

Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Göran\090615-61557-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`03003000 PsLoadedModuleList = 0xfffff800`0324a730
Debug session time: Sun Sep 6 13:24:22.272 2015 (UTC + 2:00)
System Uptime: 0 days 1:30:12.179
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa8001fc8570, ffff, 0}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

6: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8001fc8570
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: nis.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800030e7810 to fffff800030778c0

STACK_TEXT:
fffff880`08fc08c8 fffff800`030e7810 : 00000000`0000001a 00000000`00041790 fffffa80`01fc8570 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08fc08d0 fffff800`030ab1b9 : 00000000`00000000 00000000`10a88fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x338a4
fffff880`08fc0a90 fffff800`0338fb71 : fffffa80`0b3f9570 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`08fc0bb0 fffff960`0016699d : fffff900`00000001 fffffa80`09246c70 fffff900`00000001 fffff960`00258500 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08fc0c70 fffff960`0025ebd7 : 00000000`00000000 fffff900`c07506e0 fffff900`c00cb0f0 fffff880`08fc0d50 : win32k!SURFACE::Map+0x175
fffff880`08fc0cc0 fffff960`0025eca1 : fffff880`08fc0d48 fffff880`08fc1238 00000000`00000001 fffff880`08fc0ef0 : win32k!vSpPIDLockSpriteArea+0x4f
fffff880`08fc0cf0 fffff960`000fad06 : fffff900`c0134a30 fffff880`08fc1238 fffff880`08fc0f10 00000438`0000015d : win32k!PIDLOCKSPRITEAREA::vLock+0x4d
fffff880`08fc0d20 fffff960`00261e8b : 00000000`00000000 00000000`00000000 00000000`0000cccc fffff900`c4a00018 : win32k!ENUMUNDERLAYS::bEnum+0x27a
fffff880`08fc0e40 fffff960`00261ef4 : fffff900`c4a00018 00000000`00000000 00000000`00000000 fffff880`08fc10a8 : win32k!SpBitBlt+0x843
fffff880`08fc1230 fffff960`002b489c : 00000000`00000000 fffff900`c21b99b0 fffff900`c0000de0 fffff900`c21b99b0 : win32k!SpCopyBits+0x44
fffff880`08fc12a0 fffff960`0013b10b : ffffffff`80010d61 fffffa80`0a656060 fffff880`08fc15e0 00000000`02cbed98 : win32k!NtGdiBitBltInternal+0xc94
fffff880`08fc1480 fffff800`03076b53 : 00000000`00000000 fffff880`08fc15e0 00000000`00000006 00000000`00000000 : win32k!NtGdiBitBlt+0x5b
fffff880`08fc14f0 000007fe`fcfb25ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02cbed78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`fcfb25ba


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::Map+175
fffff960`0016699d 8b4574 mov eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: win32k!SURFACE::Map+175

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 558bc272

FAILURE_BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175

BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::Map+175





5)

Loading Dump File [C:\Program Files\Debugging Tools for Windows (x64)\Göran\090915-43493-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows;C:\Windows\system32;C:\Windows\system32\drivers
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18869.amd64fre.win7sp1_gdr.150525-0603
Machine Name:
Kernel base = 0xfffff800`0301a000 PsLoadedModuleList = 0xfffff800`03261730
Debug session time: Wed Sep 9 12:35:12.721 2015 (UTC + 2:00)
System Uptime: 0 days 1:50:03.627
Loading Kernel Symbols
...............................................................
................................................................
..................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 22e8d001, 155, fffff70001080000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4ab3 )

Followup: MachineOwner
---------

7: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 0000000022e8d001
Arg3: 0000000000000155
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: iexplore.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800030e64d7 to fffff8000308e8c0

STACK_TEXT:
fffff880`064e0668 fffff800`030e64d7 : 00000000`0000001a 00000000`00041284 00000000`22e8d001 00000000`00000155 : nt!KeBugCheckEx
fffff880`064e0670 fffff800`030c08d0 : fffff700`01080000 b1c00000`007ac867 00000000`00000200 fffffa80`0b231280 : nt! ?? ::FNODOBFM::`string'+0x4ab3
fffff880`064e06b0 fffff800`0305fd66 : ffffffff`00000000 00000000`22fcffff fffffa80`00000000 fffffa80`0b110b10 : nt!MiDeleteVirtualAddresses+0x4e8
fffff880`064e0870 fffff800`03362166 : fffff8a0`17291a30 fffff880`064e0c20 fffffa80`0aee5b50 fffffa80`0aee5b50 : nt!MmCleanProcessAddressSpace+0x67a
fffff880`064e08c0 fffff800`03347ecd : 00000000`000000ff fffff800`0309f201 00000000`7ef56000 fffffa80`0ae5b3d0 : nt!PspExitThread+0x56a
fffff880`064e09c0 fffff800`030820da : 00000000`00000000 00000000`00000001 00000000`406d1388 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`064e09f0 fffff800`03082420 : 00000000`00000000 fffff880`064e0a70 fffff800`03347e40 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`064e0a70 fffff800`0308dbf7 : fffffa80`0aee5b50 00000000`0433ead8 fffff880`064e0bc8 00000000`00000000 : nt!KiInitiateUserApc+0x70
fffff880`064e0bb0 00000000`73a32e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0433eab8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73a32e09


STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4ab3
fffff800`030e64d7 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4ab3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 556356e8

FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ab3

BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4ab3

 

I would get the system scanned for malware.

 

I'll talk to him this weekend and maybe even pay him a visit.

 

Just to let you know that nothing happened the past weekend but I'll be back ... ... !

 

I was at my friends home today and did some work. It turned out to be RAM failure. Running Memtest86+ v5.01 generated tons of failures. He has a kit of 4 x 2 GB to make 8 GB. I took out 2 sticks (1 pair) and reran Memtest86+ with the same result. I swapped pairs in for pairs out and reran Memtest86+ with no problems. New RAM is on order, 2 x 8 GB to make 16 GB.

 

Last weekend, I installed the new RAM and also a new graphics card. Everything was running fine for a few days ... ... until he hit the button for Microsoft to go ahead with the upgrade to Windows 10. Approximately one hour into the procedure, he was given the "error code 88982F04" followed by abortion of the upgrade.

Maybe ... ... I'll be back in another thread.