Windows 7 x64 System Service Exception

[keggy85]

Buongiorno a tutti,
stamattina è arrivato un brutto BSOD nel mio schermo, durante la creazione del dump la schermata titolava SYSTEM_SERVICE EXCEPTION.

Analizzato il file .dmp creato nell'apposita cartella da windows che vi riporto qua sotto e che vi allego dice causato probabilmente da memory corruption.

Fino ad oggi nessun problema. Cosa posso / devo fare?

Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Accius\Desktop\100915-11356-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18939.amd64fre.win7sp1_gdr.150722-0600
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`03091730
Debug session time: Fri Oct  9 10:10:10.172 2015 (UTC + 2:00)
System Uptime: 0 days 11:19:50.356
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ef064c, fffff880047fa120, 0}

Probably caused by : memory_corruption ( nt!MiGetPreviousNode+3c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ef064c, Address of the instruction which caused the bugcheck
Arg3: fffff880047fa120, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a 0x%08lx ha fatto riferimento alla memoria a 0x%08lx. La memoria non poteva essere %s.

FAULTING_IP: 
nt!MiGetPreviousNode+3c
fffff800`02ef064c 488b4810        mov     rcx,qword ptr [rax+10h]

CONTEXT:  fffff880047fa120 -- (.cxr 0xfffff880047fa120;r)
rax=0000000100000000 rbx=fffffa80074d0820 rcx=fffffa80074d0820
rdx=0000000000000350 rsi=fffffa80068172c0 rdi=fffffa8006816960
rip=fffff80002ef064c rsp=fffff880047fab08 rbp=0000000000001000
 r8=0000000000000000  r9=0000000000000001 r10=fffff800031d6f80
r11=0000000000318d80 r12=0000000000000000 r13=0000000000000000
r14=0000000000350fff r15=0000000000350000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MiGetPreviousNode+0x3c:
fffff800`02ef064c 488b4810        mov     rcx,qword ptr [rax+10h] ds:002b:00000001`00000010=????????????????
Last set context:
rax=0000000100000000 rbx=fffffa80074d0820 rcx=fffffa80074d0820
rdx=0000000000000350 rsi=fffffa80068172c0 rdi=fffffa8006816960
rip=fffff80002ef064c rsp=fffff880047fab08 rbp=0000000000001000
 r8=0000000000000000  r9=0000000000000001 r10=fffff800031d6f80
r11=0000000000318d80 r12=0000000000000000 r13=0000000000000000
r14=0000000000350fff r15=0000000000350000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MiGetPreviousNode+0x3c:
fffff800`02ef064c 488b4810        mov     rcx,qword ptr [rax+10h] ds:002b:00000001`00000010=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  sched.exe

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER:  from fffff800031d6b33 to fffff80002ef064c

STACK_TEXT:  
fffff880`047fab08 fffff800`031d6b33 : 00000000`0023e800 fffffa80`068172c0 00000000`00000001 fffff8a0`0188e6d0 : nt!MiGetPreviousNode+0x3c
fffff880`047fab10 fffff800`031d6fdf : 0000007f`00000000 00000000`00350000 fffffa80`00000001 00000000`0023e801 : nt!MiUnmapViewOfSection+0x113
fffff880`047fabd0 fffff800`02ebc853 : 00000000`00000000 00000000`0106ccda fffffa80`068172c0 00000000`0106d4d8 : nt!NtUnmapViewOfSection+0x5f
fffff880`047fac20 00000000`77a1dc5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0023df78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a1dc5a


FOLLOWUP_IP: 
nt!MiGetPreviousNode+3c
fffff800`02ef064c 488b4810        mov     rcx,qword ptr [rax+10h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiGetPreviousNode+3c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  55afca65

IMAGE_VERSION:  6.1.7601.18939

STACK_COMMAND:  .cxr 0xfffff880047fa120 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiGetPreviousNode+3c

BUCKET_ID:  X64_0x3B_nt!MiGetPreviousNode+3c

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0x3b_nt!migetpreviousnode+3c

FAILURE_ID_HASH:  {bfb7f142-cc32-456c-f71a-fdd908a8bca2}

Followup: MachineOwner
---------

[tallines]

Ciao, può essere la ram, driver della scheda video o......

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

PROCESS_NAME: sched.exe

SYMBOL_NAME: nt!MiGetPreviousNode+3c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0x3B_nt!MiGetPreviousNode+3c

BUCKET_ID: X64_0x3B_nt!MiGetPreviousNode+3c

Hai per caso installato come antivirus Avira ?

[keggy85]

Si ho Avira come antivirus. Quale collegamento potrebbe esserci?

[tallines]

Originariamente inviato da keggy85

Si ho Avira come antivirus. Quale collegamento potrebbe esserci?

Che il processo Sched.exe si riferisce ad Avira .

Disinstallalo .

Poi riprovi a installarlo o installi un altro antivirus tipo Avast .

Quando ti è capitata la bsod, avevi appena avviato il pc o stavi lavorando al pc o..........?

[keggy85]

Il PC era acceso da un po' di tempo e stava facendo niente o forse giusto sincronizzando file su cloud tipo Dropbox o Box

[tallines]

E' la prima volta che succede o è già accaduto il fatto che è uscita una bsod ?

Prova a vedere anche cosa ti dice il visualizzatore eventi (eventvwr da Start/ Cerca) .

Espandi la voce Registri di windows e vai in Applicazione e in Sistema, alla voce Errore, che deve chiaramente riferirsi come data e ora alla bsod che hai avuto .

[keggy85]

Non ho ricordi di BSOD, quando torno in quel PC provo e ti faccio sapere...

Grazie per adesso!

[tallines]

Ok, quindi è la prima volta, può essere Avira come anche no, vediamo cosa dice il Visualizzatore eventi .

Quando riesci, fai sapere