BSOD - ntoskrnl.exe+70740 - w/ dump info

#1
Hi everybody. I just stumbled on this board, hope I'm practicing proper etiquette here...but I'm having a BSOD issue. It seems to happen most frequently while using iTunes or MediaMonkey, but has happened without either of those programs being open.

I just did a clean install of Windows 7 (64-bit) but after a few days of serenity, back to rebooting every now and then.

Windows Memory Diagnostics doesn't show any memory issues. I used BlueScreenView to grab the following (UPDATE: actual dump files in zip below, too) ---

Thank you!
Sasha



==================================================
Dump File : 102510-27112-01.dmp
Crash Time : 10/25/2010 11:30:38 AM
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`028b57e7
Parameter 3 : 00000000`00000000
Parameter 4 : 000007ff`fffa0000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\102510-27112-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 102510-36956-01.dmp
Crash Time : 10/25/2010 10:33:04 AM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x00000050
Parameter 1 : fffff880`0824d928
Parameter 2 : 00000000`00000000
Parameter 3 : fffffa80`047b0058
Parameter 4 : 00000000`00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\102510-36956-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 102510-37955-01.dmp
Crash Time : 10/25/2010 10:17:18 AM
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`028aa7e7
Parameter 3 : 00000000`00000000
Parameter 4 : 000007ff`fffa0000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\102510-37955-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 102310-38532-01.dmp
Crash Time : 10/23/2010 1:40:39 PM
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : ffffffff`c0000005
Parameter 2 : fffff800`028577e7
Parameter 3 : 00000000`00000000
Parameter 4 : 000007ff`fffa0000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+70740
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16617 (win7_gdr.100618-1621)
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\102310-38532-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7600
==================================================
 


Attachments

Last edited:
#2
Attach the .dmp's found in your C:\Windows\Minidump.
 


#3
oops. Okay, attached them in a zip file - hope that works.
 


#4
1. Update:

atikmdag.sys Fri Apr 24 13:51:57 2009
ATI

Rt64win7.sys Thu Feb 26 11:04:13 2009
Realtek 8136/8168/8169 PCI/PCIe Adapters




2. Uninstall Avast, replace it with MSE:

avast! Uninstall Utility

http://www.microsoft.com/security_essentials/




3. If crashes still occur, run memtest overnight:

RAM - Test with Memtest86+ - Windows 7 Forums



Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\102510-36956-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0281f000 PsLoadedModuleList = 0xfffff800`02a5ce50
Debug session time: Mon Oct 25 17:30:14.705 2010 (UTC - 5:00)
System Uptime: 0 days 0:13:36.736
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8800824d928, 0, fffffa80047b0058, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42837 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800824d928, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffffa80047b0058, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac70e0
 fffff8800824d928 

FAULTING_IP: 
+3163303463316639
fffffa80`047b0058 8b4358          mov     eax,dword ptr [rbx+58h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88002e14880 -- (.trap 0xfffff88002e14880)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8003d5bee1
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80047b0058 rsp=fffff88002e14a10 rbp=fffff88002e14b10
 r8=fffffa8003ef3370  r9=0000000000000130 r10=fffff88002f640c0
r11=fffffa80054bfb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
fffffa80`047b0058 8b4358          mov     eax,dword ptr [rbx+58h] ds:d8d0:00000000`00000058=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000290ff14 to fffff8000288f740

STACK_TEXT:  
fffff880`02e14718 fffff800`0290ff14 : 00000000`00000050 fffff880`0824d928 00000000`00000000 fffff880`02e14880 : nt!KeBugCheckEx
fffff880`02e14720 fffff800`0288d82e : 00000000`00000000 fffff880`0824d8d0 fffffa80`05db9800 fffff880`00eb9400 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`02e14880 fffffa80`047b0058 : fffff880`00000000 fffffa80`00000008 fffffa80`0000000a ffffffff`80003378 : nt!KiPageFault+0x16e
fffff880`02e14a10 fffff880`00000000 : fffffa80`00000008 fffffa80`0000000a ffffffff`80003378 00000000`00000000 : 0xfffffa80`047b0058
fffff880`02e14a18 fffffa80`00000008 : fffffa80`0000000a ffffffff`80003378 00000000`00000000 00000000`00000001 : 0xfffff880`00000000
fffff880`02e14a20 fffffa80`0000000a : ffffffff`80003378 00000000`00000000 00000000`00000001 00000000`00000e9c : 0xfffffa80`00000008
fffff880`02e14a28 ffffffff`80003378 : 00000000`00000000 00000000`00000001 00000000`00000e9c 00000000`00000000 : 0xfffffa80`0000000a
fffff880`02e14a30 00000000`00000000 : 00000000`00000001 00000000`00000e9c 00000000`00000000 00000000`00000030 : 0xffffffff`80003378


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+42837
fffff800`0290ff14 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+42837

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+42837

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+42837

Followup: MachineOwner
---------













































Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\102510-37955-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0285a000 PsLoadedModuleList = 0xfffff800`02a97e50
Debug session time: Mon Oct 25 17:14:37.269 2010 (UTC - 5:00)
System Uptime: 0 days 12:12:51.300
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800028aa7e7, 0, 7fffffa0000}

Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800028aa7e7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

FAULTING_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000007fffffa0000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b020e0
 000007fffffa0000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88003369438 -- (.exr 0xfffff88003369438)
ExceptionAddress: fffff800028aa7e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000

TRAP_FRAME:  fffff880033694e0 -- (.trap 0xfffff880033694e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028aa7e7 rsp=fffff88003369678 rbp=fffff880033697b0
 r8=0000000000000000  r9=fffff880033696b8 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002904a39 to fffff800028ca740

STACK_TEXT:  
fffff880`03368c68 fffff800`02904a39 : 00000000`0000001e ffffffff`c0000005 fffff800`028aa7e7 00000000`00000000 : nt!KeBugCheckEx
fffff880`03368c70 fffff800`028c9d82 : fffff880`03369438 fffff880`0879d8d0 fffff880`033694e0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`03369300 fffff800`028c88fa : 00000000`00000000 fffff880`0879d8d0 fffffa80`05985100 fffff800`02be0d2e : nt!KiExceptionDispatch+0xc2
fffff880`033694e0 fffff800`028aa7e7 : fffff800`028aa872 00000000`00000010 00000000`00000082 fffff880`033696a8 : nt!KiPageFault+0x23a
fffff880`03369678 fffff800`028aa872 : 00000000`00000010 00000000`00000082 fffff880`033696a8 fffffa80`0371e040 : nt!RtlImageNtHeaderEx+0x3f
fffff880`03369680 fffffa80`047afbc6 : fffff880`033697b0 00000000`00000000 fffffa80`047b4260 fffffa80`047b8300 : nt!RtlImageNtHeader+0x1e
fffff880`033696b0 fffff880`033697b0 : 00000000`00000000 fffffa80`047b4260 fffffa80`047b8300 00000000`00000000 : 0xfffffa80`047afbc6
fffff880`033696b8 00000000`00000000 : fffffa80`047b4260 fffffa80`047b8300 00000000`00000000 00000000`00000000 : 0xfffff880`033697b0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028aa7e7 66390a          cmp     word ptr [rdx],cx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f

BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f

Followup: MachineOwner
---------






































Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\102510-27112-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02865000 PsLoadedModuleList = 0xfffff800`02aa2e50
Debug session time: Mon Oct 25 18:28:07.403 2010 (UTC - 5:00)
System Uptime: 0 days 0:55:41.434
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800028b57e7, 0, 7fffffa0000}

Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800028b57e7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

FAULTING_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000007fffffa0000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002b0d0e0
 000007fffffa0000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88003362438 -- (.exr 0xfffff88003362438)
ExceptionAddress: fffff800028b57e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000

TRAP_FRAME:  fffff880033624e0 -- (.trap 0xfffff880033624e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028b57e7 rsp=fffff88003362678 rbp=fffff880033627b0
 r8=0000000000000000  r9=fffff880033626b8 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000290fa39 to fffff800028d5740

STACK_TEXT:  
fffff880`03361c68 fffff800`0290fa39 : 00000000`0000001e ffffffff`c0000005 fffff800`028b57e7 00000000`00000000 : nt!KeBugCheckEx
fffff880`03361c70 fffff800`028d4d82 : fffff880`03362438 fffff880`06a338d0 fffff880`033624e0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`03362300 fffff800`028d38fa : 00000000`00000000 fffff880`06a338d0 fffffa80`066b1000 fffff800`02bebd2e : nt!KiExceptionDispatch+0xc2
fffff880`033624e0 fffff800`028b57e7 : fffff800`028b5872 00000000`00000010 00000000`00000082 fffff880`033626a8 : nt!KiPageFault+0x23a
fffff880`03362678 fffff800`028b5872 : 00000000`00000010 00000000`00000082 fffff880`033626a8 fffffa80`0372a680 : nt!RtlImageNtHeaderEx+0x3f
fffff880`03362680 fffffa80`047aebc6 : fffff880`033627b0 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 : nt!RtlImageNtHeader+0x1e
fffff880`033626b0 fffff880`033627b0 : 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 : 0xfffffa80`047aebc6
fffff880`033626b8 00000000`00000000 : fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 00000000`00000000 : 0xfffff880`033627b0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028b57e7 66390a          cmp     word ptr [rdx],cx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f

BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f

Followup: MachineOwner
---------


































Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\102310-38532-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02807000 PsLoadedModuleList = 0xfffff800`02a44e50
Debug session time: Sat Oct 23 20:37:42.333 2010 (UTC - 5:00)
System Uptime: 0 days 2:34:06.252
Loading Kernel Symbols
..

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

.............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800028577e7, 0, 7fffffa0000}

Probably caused by : ntkrnlmp.exe ( nt!RtlImageNtHeaderEx+3f )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800028577e7, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 000007fffffa0000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

FAULTING_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028577e7 66390a          cmp     word ptr [rdx],cx

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  000007fffffa0000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002aaf0e0
 000007fffffa0000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  conhost.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88003377438 -- (.exr 0xfffff88003377438)
ExceptionAddress: fffff800028577e7 (nt!RtlImageNtHeaderEx+0x000000000000003f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 000007fffffa0000
Attempt to read from address 000007fffffa0000

TRAP_FRAME:  fffff880033774e0 -- (.trap 0xfffff880033774e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000005a4d
rdx=000007fffffa0000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800028577e7 rsp=fffff88003377678 rbp=fffff880033777b0
 r8=0000000000000000  r9=fffff880033776b8 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!RtlImageNtHeaderEx+0x3f:
fffff800`028577e7 66390a          cmp     word ptr [rdx],cx ds:0001:000007ff`fffa0000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800028b1a39 to fffff80002877740

STACK_TEXT:  
fffff880`03376c68 fffff800`028b1a39 : 00000000`0000001e ffffffff`c0000005 fffff800`028577e7 00000000`00000000 : nt!KeBugCheckEx
fffff880`03376c70 fffff800`02876d82 : fffff880`03377438 fffff880`0693e8d0 fffff880`033774e0 00000000`00000000 : nt!KiDispatchException+0x1b9
fffff880`03377300 fffff800`028758fa : 00000000`00000000 fffff880`0693e8d0 fffffa80`07002900 fffff800`02b8dd2e : nt!KiExceptionDispatch+0xc2
fffff880`033774e0 fffff800`028577e7 : fffff800`02857872 00000000`00000010 00000000`00000082 fffff880`033776a8 : nt!KiPageFault+0x23a
fffff880`03377678 fffff800`02857872 : 00000000`00000010 00000000`00000082 fffff880`033776a8 fffffa80`0371d680 : nt!RtlImageNtHeaderEx+0x3f
fffff880`03377680 fffffa80`047aebc6 : fffff880`033777b0 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 : nt!RtlImageNtHeader+0x1e
fffff880`033776b0 fffff880`033777b0 : 00000000`00000000 fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 : 0xfffffa80`047aebc6
fffff880`033776b8 00000000`00000000 : fffffa80`047b3260 fffffa80`047b7300 00000000`00000000 00000000`00000000 : 0xfffff880`033777b0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!RtlImageNtHeaderEx+3f
fffff800`028577e7 66390a          cmp     word ptr [rdx],cx

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!RtlImageNtHeaderEx+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f

BUCKET_ID:  X64_0x1E_c0000005_nt!RtlImageNtHeaderEx+3f



fffff880`00e0f000 fffff880`00e66000   ACPI     ACPI.sys     Tue Jul 14 02:19:34 2009 (4A5BC106)
fffff880`02c18000 fffff880`02ca2000   afd      afd.sys      Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`0422d000 fffff880`04243000   AgileVpn AgileVpn.sys Tue Jul 14 03:10:24 2009 (4A5BCCF0)
fffff880`00c54000 fffff880`00c5f000   amdxata  amdxata.sys  Tue May 19 20:56:59 2009 (4A12F2EB)
fffff880`025d0000 fffff880`025d9000   aswFsBlk aswFsBlk.SYS Tue Sep 07 17:47:09 2010 (4C86506D)
fffff880`02596000 fffff880`025d0000   aswMonFlt aswMonFlt.sys Tue Sep 07 17:47:32 2010 (4C865084)
fffff880`02ca2000 fffff880`02cac000   aswRdr   aswRdr.SYS   Tue Sep 07 17:47:47 2010 (4C865093)
fffff880`04181000 fffff880`041a4000   aswSP    aswSP.SYS    Tue Sep 07 17:52:07 2010 (4C865197)
fffff880`01872000 fffff880`01882000   aswTdi   aswTdi.SYS   Tue Sep 07 17:52:27 2010 (4C8651AB)
fffff880`06400000 fffff880`0640b000   asyncmac asyncmac.sys Tue Jul 14 03:10:13 2009 (4A5BCCE5)
fffff880`00ff6000 fffff880`00fff000   atapi    atapi.sys    Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`00c2a000 fffff880`00c54000   ataport  ataport.SYS  Tue Jul 14 02:19:52 2009 (4A5BC118)
fffff880`048b7000 fffff880`04dd9000   atikmdag atikmdag.sys Fri Apr 24 13:51:57 2009 (49F199CD)
fffff960`00930000 fffff960`00991000   ATMFD    ATMFD.DLL    unavailable (00000000)
fffff880`019b8000 fffff880`019bf000   Beep     Beep.SYS     Tue Jul 14 03:00:13 2009 (4A5BCA8D)
fffff880`04170000 fffff880`04181000   blbdrive blbdrive.sys Tue Jul 14 02:35:59 2009 (4A5BC4DF)
fffff880`06133000 fffff880`06151000   bowser   bowser.sys   Tue Jul 14 02:23:50 2009 (4A5BC206)
fffff960`006f0000 fffff960`00717000   cdd      cdd.dll      unavailable (00000000)
fffff880`0640b000 fffff880`06435000   cdrom    cdrom.sys    Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`00e92000 fffff880`00f52000   CI       CI.dll       Tue Jul 14 04:32:13 2009 (4A5BE01D)
fffff880`0191f000 fffff880`0194f000   CLASSPNP CLASSPNP.SYS Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00ce5000 fffff880`00d43000   CLFS     CLFS.SYS     Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`010f7000 fffff880`0116a000   cng      cng.sys      Tue Jul 14 02:49:40 2009 (4A5BC814)
fffff880`0421d000 fffff880`0422d000   CompositeBus CompositeBus.sys Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`0253d000 fffff880`0254b000   crashdmp crashdmp.sys Tue Jul 14 03:01:01 2009 (4A5BCABD)
fffff880`040cf000 fffff880`04152000   csc      csc.sys      Tue Jul 14 02:24:26 2009 (4A5BC22A)
fffff880`04152000 fffff880`04170000   dfsc     dfsc.sys     Tue Jul 14 02:23:44 2009 (4A5BC200)
fffff880`02de3000 fffff880`02df2000   discache discache.sys Tue Jul 14 02:37:18 2009 (4A5BC52E)
fffff880`01909000 fffff880`0191f000   disk     disk.sys     Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`04f0d000 fffff880`04f2f000   drmk     drmk.sys     Tue Jul 14 04:01:25 2009 (4A5BD8E5)
fffff880`02557000 fffff880`02560000   dump_atapi dump_atapi.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`0254b000 fffff880`02557000   dump_dumpata dump_dumpata.sys Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`02560000 fffff880`02573000   dump_dumpfve dump_dumpfve.sys Tue Jul 14 02:21:51 2009 (4A5BC18F)
fffff880`04f75000 fffff880`04f81000   Dxapi    Dxapi.sys    Tue Jul 14 02:38:28 2009 (4A5BC574)
fffff880`042a1000 fffff880`04395000   dxgkrnl  dxgkrnl.sys  Fri Oct 02 04:00:14 2009 (4AC5509E)
fffff880`04395000 fffff880`043db000   dxgmms1  dxgmms1.sys  Tue Jul 14 02:38:32 2009 (4A5BC578)
fffff880`01085000 fffff880`01099000   fileinfo fileinfo.sys Tue Jul 14 02:34:25 2009 (4A5BC481)
fffff880`01039000 fffff880`01085000   fltmgr   fltmgr.sys   Tue Jul 14 02:19:59 2009 (4A5BC11F)
fffff880`013d0000 fffff880`013da000   Fs_Rec   Fs_Rec.sys   Tue Jul 14 02:19:45 2009 (4A5BC111)
fffff880`018cf000 fffff880`01909000   fvevol   fvevol.sys   Tue Jul 14 02:22:15 2009 (4A5BC1A7)
fffff880`0157f000 fffff880`015c9000   fwpkclnt fwpkclnt.sys Tue Jul 14 02:21:08 2009 (4A5BC164)
fffff880`06435000 fffff880`06442000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 15:17:04 2009 (4A1151C0)
fffff800`02de3000 fffff800`02e2c000   hal      hal.dll      Tue Jul 14 04:27:36 2009 (4A5BDF08)
fffff880`04067000 fffff880`0408b000   HDAudBus HDAudBus.sys Tue Jul 14 03:06:13 2009 (4A5BCBF5)
fffff880`04e74000 fffff880`04ed0000   HdAudio  HdAudio.sys  Tue Jul 14 03:06:59 2009 (4A5BCC23)
fffff880`04f43000 fffff880`04f5c000   HIDCLASS HIDCLASS.SYS Tue Jul 14 03:06:21 2009 (4A5BCBFD)
fffff880`04f5c000 fffff880`04f64080   HIDPARSE HIDPARSE.SYS Tue Jul 14 03:06:17 2009 (4A5BCBF9)
fffff880`04f35000 fffff880`04f43000   hidusb   hidusb.sys   Tue Jul 14 03:06:22 2009 (4A5BCBFE)
fffff880`0606b000 fffff880`06133000   HTTP     HTTP.sys     Tue Jul 14 02:22:16 2009 (4A5BC1A8)
fffff880`015f3000 fffff880`015fc000   hwpolicy hwpolicy.sys Tue Jul 14 02:19:22 2009 (4A5BC0FA)
fffff880`041ca000 fffff880`041e0000   intelppm intelppm.sys Tue Jul 14 02:19:25 2009 (4A5BC0FD)
fffff880`043e7000 fffff880`043f6000   kbdclass kbdclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`04f67000 fffff880`04f75000   kbdhid   kbdhid.sys   Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff800`00bc0000 fffff800`00bc3000   kdcom    kdcom.dll    Fri Oct 08 14:17:09 2010 (4CAEFDB5)
fffff880`01882000 fffff880`018c5000   ks       ks.sys       Tue Jul 14 03:00:31 2009 (4A5BCA9F)
fffff880`013a5000 fffff880`013bf000   ksecdd   ksecdd.sys   Tue Jul 14 02:20:54 2009 (4A5BC156)
fffff880`01554000 fffff880`0157f000   ksecpkg  ksecpkg.sys  Fri Dec 11 08:03:32 2009 (4B21E0B4)
fffff880`04f2f000 fffff880`04f34200   ksthunk  ksthunk.sys  Tue Jul 14 03:00:19 2009 (4A5BCA93)
fffff880`02400000 fffff880`02415000   lltdio   lltdio.sys   Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`02573000 fffff880`02596000   luafv    luafv.sys    Tue Jul 14 02:26:13 2009 (4A5BC295)
fffff880`00c8d000 fffff880`00cd1000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 04:29:10 2009 (4A5BDF66)
fffff880`04fa9000 fffff880`04fb7000   monitor  monitor.sys  Tue Jul 14 02:38:52 2009 (4A5BC58C)
fffff880`0486a000 fffff880`04879000   mouclass mouclass.sys Tue Jul 14 02:19:50 2009 (4A5BC116)
fffff880`04f9c000 fffff880`04fa9000   mouhid   mouhid.sys   Tue Jul 14 03:00:20 2009 (4A5BCA94)
fffff880`00c10000 fffff880`00c2a000   mountmgr mountmgr.sys Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`06151000 fffff880`06169000   mpsdrv   mpsdrv.sys   Tue Jul 14 03:08:25 2009 (4A5BCC79)
fffff880`06169000 fffff880`06196000   mrxsmb   mrxsmb.sys   Sat Feb 27 09:52:19 2010 (4B88CF33)
fffff880`06196000 fffff880`061e4000   mrxsmb10 mrxsmb10.sys Sat Feb 27 09:52:28 2010 (4B88CF3C)
fffff880`06000000 fffff880`06023000   mrxsmb20 mrxsmb20.sys Sat Feb 27 09:52:26 2010 (4B88CF3A)
fffff880`0182b000 fffff880`01836000   Msfs     Msfs.SYS     Tue Jul 14 02:19:47 2009 (4A5BC113)
fffff880`00e6f000 fffff880`00e79000   msisadrv msisadrv.sys Tue Jul 14 02:19:26 2009 (4A5BC0FE)
fffff880`01099000 fffff880`010f7000   msrpc    msrpc.sys    Tue Jul 14 02:21:32 2009 (4A5BC17C)
fffff880`02dd8000 fffff880`02de3000   mssmbios mssmbios.sys Tue Jul 14 02:31:10 2009 (4A5BC3BE)
fffff880`015e1000 fffff880`015f3000   mup      mup.sys      Tue Jul 14 02:23:45 2009 (4A5BC201)
fffff880`01402000 fffff880`014f4000   ndis     ndis.sys     Tue Jul 14 02:21:40 2009 (4A5BC184)
fffff880`04267000 fffff880`04273000   ndistapi ndistapi.sys Tue Jul 14 03:10:00 2009 (4A5BCCD8)
fffff880`04800000 fffff880`0482f000   ndiswan  ndiswan.sys  Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04e5f000 fffff880`04e74000   NDProxy  NDProxy.SYS  Tue Jul 14 03:10:05 2009 (4A5BCCDD)
fffff880`02d20000 fffff880`02d2f000   netbios  netbios.sys  Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff880`02cac000 fffff880`02cf1000   netbt    netbt.sys    Tue Jul 14 02:21:28 2009 (4A5BC178)
fffff880`014f4000 fffff880`01554000   NETIO    NETIO.SYS    Tue Jul 14 02:21:46 2009 (4A5BC18A)
fffff880`01836000 fffff880`01847000   Npfs     Npfs.SYS     Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`02dcc000 fffff880`02dd8000   nsiproxy nsiproxy.sys Tue Jul 14 02:21:02 2009 (4A5BC15E)
fffff800`02807000 fffff800`02de3000   nt       ntkrnlmp.exe Sat Jun 19 07:16:41 2010 (4C1C44A9)
fffff880`01202000 fffff880`013a5000   Ntfs     Ntfs.sys     Tue Jul 14 02:20:47 2009 (4A5BC14F)
fffff880`019af000 fffff880`019b8000   Null     Null.SYS     Tue Jul 14 02:19:37 2009 (4A5BC109)
fffff880`02cfa000 fffff880`02d20000   pacer    pacer.sys    Tue Jul 14 03:09:41 2009 (4A5BCCC5)
fffff880`04200000 fffff880`0421d000   parport  parport.sys  Tue Jul 14 03:00:40 2009 (4A5BCAA8)
fffff880`00d76000 fffff880`00d8b000   partmgr  partmgr.sys  Tue Jul 14 02:19:58 2009 (4A5BC11E)
fffff880`00d43000 fffff880`00d76000   pci      pci.sys      Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`00e86000 fffff880`00e8d000   pciide   pciide.sys   Tue Jul 14 02:19:49 2009 (4A5BC115)
fffff880`00c00000 fffff880`00c10000   PCIIDEX  PCIIDEX.SYS  Tue Jul 14 02:19:48 2009 (4A5BC114)
fffff880`013bf000 fffff880`013d0000   pcw      pcw.sys      Tue Jul 14 02:19:27 2009 (4A5BC0FF)
fffff880`0242d000 fffff880`024d3000   peauth   peauth.sys   Tue Jul 14 04:01:19 2009 (4A5BD8DF)
fffff880`04ed0000 fffff880`04f0d000   portcls  portcls.sys  Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`00cd1000 fffff880`00ce5000   PSHED    PSHED.dll    Tue Jul 14 04:32:23 2009 (4A5BE027)
fffff880`04243000 fffff880`04267000   rasl2tp  rasl2tp.sys  Tue Jul 14 03:10:11 2009 (4A5BCCE3)
fffff880`04273000 fffff880`0428e000   raspppoe raspppoe.sys Tue Jul 14 03:10:17 2009 (4A5BCCE9)
fffff880`0482f000 fffff880`04850000   raspptp  raspptp.sys  Tue Jul 14 03:10:18 2009 (4A5BCCEA)
fffff880`04850000 fffff880`0486a000   rassstp  rassstp.sys  Tue Jul 14 03:10:25 2009 (4A5BCCF1)
fffff880`02d7b000 fffff880`02dcc000   rdbss    rdbss.sys    Tue Jul 14 02:24:09 2009 (4A5BC219)
fffff880`0428e000 fffff880`04299000   rdpbus   rdpbus.sys   Tue Jul 14 03:17:46 2009 (4A5BCEAA)
fffff880`01810000 fffff880`01819000   RDPCDD   RDPCDD.sys   Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`01819000 fffff880`01822000   rdpencdd rdpencdd.sys Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`01822000 fffff880`0182b000   rdprefmp rdprefmp.sys Tue Jul 14 03:16:35 2009 (4A5BCE63)
fffff880`011b6000 fffff880`011f0000   rdyboost rdyboost.sys Tue Jul 14 02:34:34 2009 (4A5BC48A)
fffff880`02415000 fffff880`0242d000   rspndr   rspndr.sys   Tue Jul 14 03:08:50 2009 (4A5BCC92)
fffff880`0408b000 fffff880`040bd000   Rt64win7 Rt64win7.sys Thu Feb 26 11:04:13 2009 (49A65B0D)
fffff880`06023000 fffff880`0602e000   secdrv   secdrv.SYS   Wed Sep 13 16:18:38 2006 (4508052E)
fffff880`043db000 fffff880`043e7000   serenum  serenum.sys  Tue Jul 14 03:00:33 2009 (4A5BCAA1)
fffff880`02d2f000 fffff880`02d4c000   serial   serial.sys   Tue Jul 14 03:00:40 2009 (4A5BCAA8)
fffff880`015d9000 fffff880`015e1000   spldr    spldr.sys    Mon May 11 19:56:27 2009 (4A0858BB)
fffff880`064f9000 fffff880`0658f000   srv      srv.sys      Fri Aug 27 06:38:00 2010 (4C773318)
fffff880`06492000 fffff880`064f9000   srv2     srv2.sys     Fri Aug 27 06:37:46 2010 (4C77330A)
fffff880`0602e000 fffff880`0605b000   srvnet   srvnet.sys   Fri Aug 27 06:37:24 2010 (4C7732F4)
fffff880`043f6000 fffff880`043f7480   swenum   swenum.sys   Tue Jul 14 03:00:18 2009 (4A5BCA92)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Mon Jun 14 06:39:04 2010 (4C15A458)
fffff880`061e4000 fffff880`061f6000   tcpipreg tcpipreg.sys Tue Jul 14 03:09:49 2009 (4A5BCCCD)
fffff880`01865000 fffff880`01872000   TDI      TDI.SYS      Tue Jul 14 02:21:18 2009 (4A5BC16E)
fffff880`01847000 fffff880`01865000   tdx      tdx.sys      Tue Jul 14 02:21:15 2009 (4A5BC16B)
fffff880`02d67000 fffff880`02d7b000   termdd   termdd.sys   Tue Jul 14 03:16:36 2009 (4A5BCE64)
fffff960`00590000 fffff960`0059a000   TSDDD    TSDDD.dll    Tue Jul 14 03:16:34 2009 (4A5BCE62)
fffff880`041a4000 fffff880`041ca000   tunnel   tunnel.sys   Tue Jul 14 03:09:37 2009 (4A5BCCC1)
fffff880`024e9000 fffff880`0253d000   udfs     udfs.sys     Tue Jul 14 02:23:37 2009 (4A5BC1F9)
fffff880`04879000 fffff880`0488b000   umbus    umbus.sys    Tue Jul 14 03:06:56 2009 (4A5BCC20)
fffff880`04f65000 fffff880`04f66f00   USBD     USBD.SYS     Tue Jul 14 03:06:23 2009 (4A5BCBFF)
fffff880`04056000 fffff880`04067000   usbehci  usbehci.sys  Tue Jul 14 03:06:30 2009 (4A5BCC06)
fffff880`04e05000 fffff880`04e5f000   usbhub   usbhub.sys   Tue Jul 14 03:07:09 2009 (4A5BCC2D)
fffff880`04000000 fffff880`04056000   USBPORT  USBPORT.SYS  Tue Jul 14 03:06:31 2009 (4A5BCC07)
fffff880`06442000 fffff880`0645d000   USBSTOR  USBSTOR.SYS  Tue Jul 14 03:06:34 2009 (4A5BCC0A)
fffff880`041e0000 fffff880`041ed000   usbuhci  usbuhci.sys  Tue Jul 14 03:06:27 2009 (4A5BCC03)
fffff880`00e79000 fffff880`00e86000   vdrvroot vdrvroot.sys Tue Jul 14 03:01:31 2009 (4A5BCADB)
fffff880`019bf000 fffff880`019cd000   vga      vga.sys      Tue Jul 14 02:38:47 2009 (4A5BC587)
fffff880`019cd000 fffff880`019f2000   VIDEOPRT VIDEOPRT.SYS Tue Jul 14 02:38:51 2009 (4A5BC58B)
fffff880`015c9000 fffff880`015d9000   vmstorfl vmstorfl.sys Tue Jul 14 02:42:54 2009 (4A5BC67E)
fffff880`00d8b000 fffff880`00da0000   volmgr   volmgr.sys   Tue Jul 14 02:19:57 2009 (4A5BC11D)
fffff880`00da0000 fffff880`00dfc000   volmgrx  volmgrx.sys  Tue Jul 14 02:20:33 2009 (4A5BC141)
fffff880`0116a000 fffff880`011b6000   volsnap  volsnap.sys  Tue Jul 14 02:20:08 2009 (4A5BC128)
fffff880`02d4c000 fffff880`02d67000   wanarp   wanarp.sys   Tue Jul 14 03:10:21 2009 (4A5BCCED)
fffff880`01800000 fffff880`01810000   watchdog watchdog.sys Tue Jul 14 02:37:35 2009 (4A5BC53F)
fffff880`00f52000 fffff880`00ff6000   Wdf01000 Wdf01000.sys Tue Jul 14 02:22:07 2009 (4A5BC19F)
fffff880`00e00000 fffff880`00e0f000   WDFLDR   WDFLDR.SYS   Tue Jul 14 02:19:54 2009 (4A5BC11A)
fffff880`02cf1000 fffff880`02cfa000   wfplwf   wfplwf.sys   Tue Jul 14 03:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Wed Sep 01 05:58:04 2010 (4C7DC13C)
fffff880`00e66000 fffff880`00e6f000   WMILIB   WMILIB.SYS   Tue Jul 14 02:19:51 2009 (4A5BC117)
fffff880`025d9000 fffff880`025fa000   WudfPf   WudfPf.sys   Tue Jul 14 03:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`0645d000 fffff880`0646e000   usbaapl64.sy
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`04fb7000 fffff880`04fe8000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`0646e000 fffff880`0647f000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`0658f000 fffff880`06600000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00071000
fffff880`0658f000 fffff880`065a0000   usbaapl64.sy
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`065b1000 fffff880`065e2000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`065a0000 fffff880`065b1000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`065c0000 fffff880`065d1000   usbaapl64.sy
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`0645d000 fffff880`0648e000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`065d1000 fffff880`065e2000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`0645d000 fffff880`0646e000   usbaapl64.sy
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`0658f000 fffff880`065c0000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`0646e000 fffff880`0647f000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`04f81000 fffff880`04f9c000   USBSTOR.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0001B000
fffff880`0658f000 fffff880`06600000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00071000
fffff880`01985000 fffff880`019af000   cdrom.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0002A000
fffff880`0194f000 fffff880`0195d000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`0195d000 fffff880`01969000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`01969000 fffff880`01972000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`01972000 fffff880`01985000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
 


#5
Thank you. I should mention, I did run MSE previously and only switched to AVAST for the fresh install. I will try that memtest.
 


#6
MSE is BSOD-proof and is always recommended for the period of troubleshooting. Later if and when your system is stable, you can install any AV you want. But for now MSE please.
 


#7
Update those 2 drivers I listed above, and if you run memtest make sure you run it overnight.
 


#8
OK, thanks. I'm a little hazy on how to update said drivers.

I did find a scenario that was bringing the BSOD without fail - converting an album using dbPoweramp. Around the second track, every time, it would go BSOD - and once even just a black-screen, no-dump reboot.

I re-installed Windows again, and the first thing I did - after installing MSE and Chrome - was reinstall dbPoweramp and convert the same album, and it went through without trouble.

Anyway, I don't know if that indicates anything. But I'll be running the memtest all night tonight.
 


#10
Here's the correct Realtek lan driver:

RTL8111
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.