Hi IhateBSOD & welcome to the forums ^_^,
I am sorry for the delayed response. Too much workload and there are very few analysts over here who are active
I have analysed your dump files and below has been provided an analysis of the same for informative purposes :-
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace.
Code:
Arguments:
Arg1: ffffe04017aaaa20, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 000000000000000[COLOR=#FF0000][B][U]0[/U][/B][/COLOR], bitfield :
bit 0 : value 0 = [U][B]read operation,[/B][/U] 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff803f4ed5a0c, address which referenced memory
Fortunately, we have the kernel debugger with us (WinDBG ^_^ ), so let's check the stack backtrace -
Code:
0: kd> knL
# Child-SP RetAddr Call Site
00 ffffd000`23171b88 fffff803`f4f684e9 nt!KeBugCheckEx
01 ffffd000`23171b90 fffff803`f4f66d3a nt!KiBugCheckDispatch+0x69
02 ffffd000`23171cd0 fffff803`f4ed5a0c nt!KiPageFault+0x23a
03 ffffd000`23171e60 fffff803`f4f24b9b nt!MiRestoreTransitionPte+0x204
04 ffffd000`23171fa0 fffff803`f4f7b115 nt!MiRemoveLowestPriorityStandbyPage+0x1b7
05 ffffd000`23172030 fffff803`f4e5da45 nt!MiRemoveLowestPriorityStandbyPage+0xe265
06 ffffd000`231720a0 fffff803`f4e5d41f nt!MmCopyToCachedPage+0x225
07 ffffd000`23172410 fffff803`f4ef7084 nt!CcMapAndCopyInToCache+0x21f
08 ffffd000`23172500 fffff800`eb5106cc nt!CcCopyWriteEx+0x260
09 ffffd000`231725a0 fffff800`eb005610 Ntfs+0xeb6cc
0a ffffd000`23172820 fffff800`eb005cbd fltmgr!FltpPerformFastIoCall+0x1f0
0b ffffd000`23172880 fffff800`eb02baa0 fltmgr!FltpPassThroughFastIo+0xbd
0c ffffd000`231728e0 fffff803`f5229570 fltmgr!FltpFastIoWrite+0x150
0d ffffd000`23172990 fffff803`f4f681b3 nt!NtWriteFile+0x410
0e ffffd000`23172a90 00007ffd`89f80e0a nt!KiSystemServiceCopyEnd+0x13
0f 00000000`04a8faf8 00000000`00000000 0x00007ffd`89f80e0a
So, we see that the kernel was removing the pages (Chunks of data on hard disk stored for later use) but then it encountered a page fault and the system crashed
. We also see NTFS.sys doing copy and write operation to the cache.
In other dump files, disk operations were being performed although Memory Corruption has been blamed as well. Now, in your latest dump file, I found that you have been stress testing the system -
Code:
PROCESS_NAME: HeavyLoad.exe
Code:
0: kd> !pte ffffe04017aaaa20
VA ffffe04017aaaa20
PXE at FFFFF6FB7DBEDE00 PPE at FFFFF6FB7DBC0800 PDE at FFFFF6FB781005E8 PTE at FFFFF6F0200BD550
contains 0000000000F66863 contains 0000000000000000
GetUlongFromAddress: unable to read from fffff803f516f104
pfn f66 ---DA--KWEV [COLOR=#FF0000][U][B]not valid[/B][/U][/COLOR]
So, the address was completely invalid as well.
Below is a list of 3rd party drivers present on your system -
Code:
**************************Thu Mar 26 23:52:29.684 2015 (UTC + 5:30)**************************
[COLOR=#FF0000][B][U]gdrv.sys Fri Mar 13 08:52:29 2009 (49B9D175)
truecrypt.sys Tue Feb 7 14:39:36 2012 (4F30EA50)
[/U][/B][/COLOR]speedfan.sys Sun Dec 30 02:29:35 2012 (50DF59B7)
npf.sys Fri Mar 1 07:01:24 2013 (513004EC)
intelppm.sys Thu Aug 22 14:16:35 2013 (5215CFEB)
TeeDriverx64.sys Thu Sep 5 23:32:18 2013 (5228C72A)
AppleCharger.sys Mon Oct 28 07:29:21 2013 (526DC4F9)
xhcdrv.sys Wed Dec 11 08:03:48 2013 (52A7CF0C)
ViaHub3.sys Wed Dec 11 08:03:53 2013 (52A7CF11)
iwdbus.sys Fri Mar 14 03:29:14 2014 (53222A32)
iaStorA.sys Sat May 3 04:36:56 2014 (53642510)
RTKVHD64.sys Wed May 14 15:58:52 2014 (53734564)
Rt630x64.sys Tue Jun 17 17:26:46 2014 (53A02CFE)
nvhda64v.sys Thu Oct 9 22:32:27 2014 (5436BFA3)
nvvad64v.sys Thu Nov 20 21:03:54 2014 (546E09E2)
NvStreamKms.sys Mon Jan 12 23:26:42 2015 (54B40ADA)
VBoxNetFlt.sys Thu Feb 12 21:23:22 2015 (54DCCC72)
VBoxUSBMon.sys Thu Feb 12 21:23:22 2015 (54DCCC72)
VBoxNetAdp.sys Thu Feb 12 21:23:22 2015 (54DCCC72)
VBoxDrv.sys Thu Feb 12 21:24:32 2015 (54DCCCB8)
nvlddmkm.sys Fri Mar 13 21:09:56 2015 (550304CC)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Mar 26 22:14:47.459 2015 (UTC + 5:30)**************************
PLTGC.sys Fri Apr 12 14:15:13 2013 (5167C999)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Mar 26 20:53:33.350 2015 (UTC + 5:30)**************************
nvhda64v.sys Thu Nov 28 19:08:09 2013 (52974741)
nvlddmkm.sys Wed Sep 10 22:34:29 2014 (5410849D)
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
**************************Thu Mar 26 19:55:32.673 2015 (UTC + 5:30)**************************
etdrv.sys Fri Mar 20 08:29:06 2009 (49C3067A)
http://www.carrona.org/drivers/driver.php?id=gdrv.sys
http://www.carrona.org/drivers/driver.php?id=truecrypt.sys
http://www.carrona.org/drivers/driver.php?id=speedfan.sys
http://www.carrona.org/drivers/driver.php?id=npf.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverx64.sys
http://www.carrona.org/drivers/driver.php?id=AppleCharger.sys
http://www.carrona.org/drivers/driver.php?id=xhcdrv.sys
http://www.carrona.org/drivers/driver.php?id=ViaHub3.sys
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
http://www.carrona.org/drivers/driver.php?id=iaStorA.sys
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=Rt630x64.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=nvvad64v.sys
http://www.carrona.org/drivers/driver.php?id=NvStreamKms.sys
http://www.carrona.org/drivers/driver.php?id=VBoxNetFlt.sys
http://www.carrona.org/drivers/driver.php?id=VBoxUSBMon.sys
http://www.carrona.org/drivers/driver.php?id=VBoxNetAdp.sys
http://www.carrona.org/drivers/driver.php?id=VBoxDrv.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=PLTGC.sys
http://www.carrona.org/drivers/driver.php?id=nvhda64v.sys
http://www.carrona.org/drivers/driver.php?id=nvlddmkm.sys
http://www.carrona.org/drivers/driver.php?id=etdrv.sys
Kindly follow the below steps -
- Kindly remove Gigabyte Easy Saver Utility (gdrv.sys) as it is known to cause problems.
- I would suggest you to remove the TrueCrypt as well since it is known to cause problems and is also not secure (**SOURCE**).
- If you are still facing the problems, I would suggest you to perform the free Hardware Diagnostics over here (Thanks Usasma!) - http://www.carrona.org/hwdiag.html
Start with the Hard Drive Diagnostics and then check your RAM and then complete the rest of the steps. While doing the tests, kindly keep an eye on the temperatures of the system and report them back (Before and during the tests).
Let me know how it goes ^_^
-Pranav