BSOD ntoskrnl.exe

#1
I recently built a new computer and a day after getting windows 7 installed I started getting BSOD's randomly. They tend to happen when i'm not on the computer or the computer is idle with nothing running. Everyonce and a while it will BSOD while i'm on it but that is rare. I have an Asus P7H55-M PRO MB, 2 gig sticks of G. Skill DDR3 (x2) , Intel i3 550 Clarkdale, Geforce GT 440 Video Card. The BSOD's always blame the ntoskrnl.exe at fault. I ran the windows memory checker to verify my ram was good, will run memtest86 tomorrow. I'll attach my .dmp files so you guys can look through them. Thanks for any help because this is very frustrating and I can't seem to resolve the issue on my own.
 


Attachments

#2
DISABLE DRIVER VERIFIER, RAM IS THE CAUSER OF YOUR BLUE SCREENS:


BugCheck 1A, {5003, fffff70001080000, 26b, 26d010004d6}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )

BugCheck 4E, {99, a3c81, 2, a3c5c}
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

BugCheck A, {fffff683ff7bdd28, 0, 0, fffff80002fdf305}
Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )

BugCheck 50, {fffffa8005c39950, 0, fffff80002eee39c, 0}
BugCheck 1000007E, {ffffffffc0000005, fffff80002e7c634, fffff880031a05b8, fffff8800319fe20}

1. Disable Driver Verifier

2. Attach cpu-z CPU and MEMORY tab snips

3. Attach Passmark RAMMon HTML report.zip





CRASH DUMPS

Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042711-26223-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c0c000 PsLoadedModuleList = 0xfffff800`02e49e50
Debug session time: Wed Apr 27 23:45:37.546 2011 (UTC - 4:00)
System Uptime: 0 days 7:21:49.685
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff880013e56cf, fffff88006a91ef0, 0}

Probably caused by : pcw.sys ( pcw!PcwpCompleteInFlightNotification+f7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880013e56cf, Address of the instruction which caused the bugcheck
Arg3: fffff88006a91ef0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
pcw!PcwpCompleteInFlightNotification+f7
fffff880`013e56cf 48896a08        mov     qword ptr [rdx+8],rbp

CONTEXT:  fffff88006a91ef0 -- (.cxr 0xfffff88006a91ef0)
rax=0000000000000000 rbx=ffffffffffffffff rcx=fffff8a003a875a8
rdx=0061006dffffffa0 rsi=fffff8a002a87560 rdi=00000000033df760
rip=fffff880013e56cf rsp=fffff88006a928d0 rbp=fffff8a002a875a8
 r8=0000000000000002  r9=fffff80002e0aa80 r10=fffff80002c0c000
r11=fffffa80041d1860 r12=fffff88006a92980 r13=0000000000000000
r14=00000000033df6f0 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
pcw!PcwpCompleteInFlightNotification+0xf7:
fffff880`013e56cf 48896a08        mov     qword ptr [rdx+8],rbp ds:002b:0061006d`ffffffa8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880013e56cf

STACK_TEXT:  
fffff880`06a928d0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : pcw!PcwpCompleteInFlightNotification+0xf7


FOLLOWUP_IP: 
pcw!PcwpCompleteInFlightNotification+f7
fffff880`013e56cf 48896a08        mov     qword ptr [rdx+8],rbp

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  pcw!PcwpCompleteInFlightNotification+f7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: pcw

IMAGE_NAME:  pcw.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc0ff

STACK_COMMAND:  .cxr 0xfffff88006a91ef0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_pcw!PcwpCompleteInFlightNotification+f7

BUCKET_ID:  X64_0x3B_pcw!PcwpCompleteInFlightNotification+f7

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042811-14976-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`03087e50
Debug session time: Thu Apr 28 11:33:14.655 2011 (UTC - 4:00)
System Uptime: 0 days 11:46:49.184
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 26b, 26d010004d6}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 000000000000026b
Arg4: 0000026d010004d6

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  CurseClient.ex

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f24536 to fffff80002ebbf00

STACK_TEXT:  
fffff880`075008c8 fffff800`02f24536 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`0000026b : nt!KeBugCheckEx
fffff880`075008d0 fffff800`02eedffb : 00000000`94fcf867 fffff683`ff800150 fffffa80`01bef6d0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x21bc6
fffff880`07500920 fffff800`02ed8506 : 00000000`00000000 000007ff`0002a160 fffff683`ff7b2180 fffffa80`06045ec8 : nt!MiResolveTransitionFault+0x40b
fffff880`075009b0 fffff800`02ed5f23 : ffffffff`ffffffff 000007fe`f6430f30 00000000`00000000 00000000`00000000 : nt!MiDispatchFault+0x946
fffff880`07500ac0 fffff800`02eb9fee : 00000000`00000008 00000000`00000a20 ffffffff`ffb3b401 00000000`00000000 : nt!MmAccessFault+0x343
fffff880`07500c20 000007ff`0002a160 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`1f3fe118 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff`0002a160


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+21bc6
fffff800`02f24536 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21bc6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042811-16941-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e61000 PsLoadedModuleList = 0xfffff800`0309ee50
Debug session time: Thu Apr 28 21:31:16.662 2011 (UTC - 4:00)
System Uptime: 0 days 5:29:03.192
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, a3c81, 2, a3c5c}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000a3c81, page frame number
Arg3: 0000000000000002, current page state
Arg4: 00000000000a3c5c, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f6138c to fffff80002ed1740

STACK_TEXT:  
fffff880`05bcb778 fffff800`02f6138c : 00000000`0000004e 00000000`00000099 00000000`000a3c81 00000000`00000002 : nt!KeBugCheckEx
fffff880`05bcb780 fffff800`02f436a9 : 00000000`00000000 fffff680`000357e0 00000000`00000000 fffff880`02f63180 : nt!MiBadShareCount+0x4c
fffff880`05bcb7c0 fffff800`02f02381 : 00000000`00000000 fffff680`00035ff8 fffffa80`05d1c8c0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31ed3
fffff880`05bcb970 fffff800`02f130da : 00000000`00000000 00000000`06e72fff fffffa80`00000000 fffffa80`00000000 : nt!MiDeleteVirtualAddresses+0x408
fffff880`05bcbb30 fffff800`02ed0993 : ffffffff`ffffffff 00000000`0366f1c0 00000000`0366f188 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`05bcbc20 00000000`776af89a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0366f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776af89a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f6138c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042811-19219-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e68000 PsLoadedModuleList = 0xfffff800`030a5e50
Debug session time: Thu Apr 28 14:59:47.255 2011 (UTC - 4:00)
System Uptime: 0 days 0:40:22.395
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff683ff7bdd28, 0, 0, fffff80002fdf305}

Probably caused by : memory_corruption ( nt!MiEmptyWorkingSet+1c5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff683ff7bdd28, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002fdf305, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031100e0
 fffff683ff7bdd28 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiEmptyWorkingSet+1c5
fffff800`02fdf305 488b02          mov     rax,qword ptr [rdx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  CurseClient.ex

TRAP_FRAME:  fffff880087e14b0 -- (.trap 0xfffff880087e14b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=00000003ff7bdd28
rdx=fffff683ff7bdd28 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002fdf305 rsp=fffff880087e1640 rbp=0000000000000009
 r8=0000000fffffffff  r9=0000000000000001 r10=0000000000000000
r11=0000000000000013 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!MiEmptyWorkingSet+0x1c5:
fffff800`02fdf305 488b02          mov     rax,qword ptr [rdx] ds:cc04:fffff683`ff7bdd28=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ed7ca9 to fffff80002ed8740

STACK_TEXT:  
fffff880`087e1368 fffff800`02ed7ca9 : 00000000`0000000a fffff683`ff7bdd28 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`087e1370 fffff800`02ed6920 : 00000000`00000000 ffffffff`ffffffff 000007fe`f6ab0000 000007fe`efd83000 : nt!KiBugCheckDispatch+0x69
fffff880`087e14b0 fffff800`02fdf305 : 00000003`00000000 ffffffff`ffffffff 00000000`00000008 fffffa80`05af6ec8 : nt!KiPageFault+0x260
fffff880`087e1640 fffff800`031204bd : fffffa80`06536b60 00000000`00000001 ffffffff`ffffffff 00000000`00001080 : nt!MiEmptyWorkingSet+0x1c5
fffff880`087e16f0 fffff800`0332aa3d : 00000000`00000001 00000000`00000000 00000000`00000000 fffff8a0`019d6400 : nt!MmAdjustWorkingSetSizeEx+0xad
fffff880`087e1780 fffff800`0323250b : 00000000`00000008 00000000`00000000 00000000`00000001 00000000`1ef8ddd0 : nt!PspSetQuotaLimits+0x32d
fffff880`087e18d0 fffff800`02ed7993 : fffffa80`06536b60 fffff880`087e1ca0 00000000`1aece280 00000000`1aece280 : nt! ?? ::NNGAKEGL::`string'+0x49690
fffff880`087e1c20 00000000`7768f87a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1ef8dd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7768f87a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiEmptyWorkingSet+1c5
fffff800`02fdf305 488b02          mov     rax,qword ptr [rdx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiEmptyWorkingSet+1c5

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiEmptyWorkingSet+1c5

BUCKET_ID:  X64_0xA_nt!MiEmptyWorkingSet+1c5

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042811-19952-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e62000 PsLoadedModuleList = 0xfffff800`0309fe50
Debug session time: Thu Apr 28 23:02:50.471 2011 (UTC - 4:00)
System Uptime: 0 days 0:15:14.016
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8005c39950, 0, fffff80002eee39c, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObReferenceObjectSafe+c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8005c39950, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002eee39c, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310a0e0
 fffffa8005c39950 

FAULTING_IP: 
nt!ObReferenceObjectSafe+c
fffff800`02eee39c 498b02          mov     rax,qword ptr [r10]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800754a7c0 -- (.trap 0xfffff8800754a7c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000ff rbx=0000000000000000 rcx=fffffa8005c39980
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002eee39c rsp=fffff8800754a950 rbp=fffff8a0089967e0
 r8=fffff8800754aa18  r9=fffff8800754aa10 r10=fffffa8005c39950
r11=fffff8800754ab38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!ObReferenceObjectSafe+0xc:
fffff800`02eee39c 498b02          mov     rax,qword ptr [r10] ds:fffffa80`05c39950=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002f52f14 to fffff80002ed2740

STACK_TEXT:  
fffff880`0754a658 fffff800`02f52f14 : 00000000`00000050 fffffa80`05c39950 00000000`00000000 fffff880`0754a7c0 : nt!KeBugCheckEx
fffff880`0754a660 fffff800`02ed082e : 00000000`00000000 fffffa80`065a45e0 fffff8a0`00e4c400 00000000`0000ff00 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`0754a7c0 fffff800`02eee39c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000008 : nt!KiPageFault+0x16e
fffff880`0754a950 fffff800`03176921 : 00000000`00000010 00000000`00010282 fffff880`0754a9a0 00000000`00000018 : nt!ObReferenceObjectSafe+0xc
fffff880`0754a980 fffff800`03175ee6 : 00000000`00000000 fffff880`0754aa30 fffff8a0`08d3b560 fffff800`03196c0e : nt!AlpcpReferenceAndLockTargetPortsAndCommunicationInfo+0x81
fffff880`0754a9c0 fffff800`03176617 : fffffa80`0542f890 00000000`00000008 fffffa80`0542f890 00000000`00010000 : nt!AlpcpDispatchCloseMessage+0x42
fffff880`0754aa10 fffff800`03177179 : fffff8a0`08d3b560 00000000`00000001 fffffa80`0542f890 00000000`00000018 : nt!AlpcpSendCloseMessage+0xdb
fffff880`0754aa90 fffff800`031cc724 : 00000000`00000000 fffffa80`0542f860 00000000`00000000 00000000`00000000 : nt!AlpcpClosePort+0x85
fffff880`0754aac0 fffff800`031e6341 : fffffa80`064b2b30 fffffa80`00000001 fffff8a0`00e4c4e0 00000000`00000000 : nt!ObpDecrementHandleCount+0xb4
fffff880`0754ab40 fffff800`031e6254 : 00000000`0000096c fffffa80`064b2b30 fffff8a0`00e4c4e0 00000000`0000096c : nt!ObpCloseHandleTableEntry+0xb1
fffff880`0754abd0 fffff800`02ed1993 : fffffa80`05987060 fffff880`0754aca0 00000000`00000001 00000000`002b0440 : nt!ObpCloseHandle+0x94
fffff880`0754ac20 00000000`76fdf7aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`012cf8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fdf7aa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ObReferenceObjectSafe+c
fffff800`02eee39c 498b02          mov     rax,qword ptr [r10]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!ObReferenceObjectSafe+c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

FAILURE_BUCKET_ID:  X64_0x50_VRF_nt!ObReferenceObjectSafe+c

BUCKET_ID:  X64_0x50_VRF_nt!ObReferenceObjectSafe+c

Followup: MachineOwner
---------




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\042811-23275-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e50
Debug session time: Thu Apr 28 23:08:03.456 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:09.001
Loading Kernel Symbols
...............................................................
..................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002e7c634, fffff880031a05b8, fffff8800319fe20}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+9e4a0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e7c634, The address that the exception occurred at
Arg3: fffff880031a05b8, Exception Record Address
Arg4: fffff8800319fe20, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!memmove+204
fffff800`02e7c634 488b040a        mov     rax,qword ptr [rdx+rcx]

EXCEPTION_RECORD:  fffff880031a05b8 -- (.exr 0xfffff880031a05b8)
ExceptionAddress: fffff80002e7c634 (nt!memmove+0x0000000000000204)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000001105d236c
Attempt to read from address 00000001105d236c

CONTEXT:  fffff8800319fe20 -- (.cxr 0xfffff8800319fe20)
rax=fffff8a00023f930 rbx=0000000000000008 rcx=fffff8a00023f930
rdx=0000076110392a3c rsi=fffff8a00023f930 rdi=0000000000000008
rip=fffff80002e7c634 rsp=fffff880031a07f8 rbp=fffff880031a0bc0
 r8=0000000000000008  r9=0000000000000001 r10=fffffa80034f3148
r11=fffff8a00023f930 r12=000000000000000a r13=fffff880031a0938
r14=00000001105d236c r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!memmove+0x204:
fffff800`02e7c634 488b040a        mov     rax,qword ptr [rdx+rcx] ds:002b:00000001`105d236c=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000001105d236c

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bd0e0
 00000001105d236c 

FOLLOWUP_IP: 
nvlddmkm+9e4a0
fffff880`0fea04a0 ??              ???

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff8000317c252 to fffff80002e7c634

STACK_TEXT:  
fffff880`031a07f8 fffff800`0317c252 : fffffa80`00000001 00000000`00000008 00000000`00000000 00000000`000007ff : nt!memmove+0x204
fffff880`031a0800 fffff800`0317c10b : fffffa80`052d7980 fffff880`031a0c70 00000000`00000001 fffff880`031a0c00 : nt!ObpCaptureObjectName+0x102
fffff880`031a0880 fffff800`0317f255 : fffffa80`034ffa30 fffffa80`035be200 00000000`0000006c 00000000`00000000 : nt!ObpCaptureObjectCreateInformation+0x279
fffff880`031a0900 fffff800`0311b7c2 : fffffa80`035a0680 fffff880`031a0a80 fffff880`031a0c00 00000000`00000000 : nt!ObCreateObject+0x75
fffff880`031a0970 fffff800`02e84993 : fffffa80`035a0680 00000000`c000009a 00000000`00000000 fffffa80`059bc000 : nt!NtCreateSymbolicLinkObject+0xbe
fffff880`031a0a00 fffff800`02e80f30 : fffff800`031f9706 00000000`000090de fffffa80`059fc270 fffff980`01598fa0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`031a0b98 fffff800`031f9706 : 00000000`000090de fffffa80`059fc270 fffff980`01598fa0 fffffa80`059fc270 : nt!KiServiceLinkage
fffff880`031a0ba0 fffff880`0fea04a0 : 00000000`00000000 fffffa80`059fc270 00000000`c000009a fffff800`032186a1 : nt!IoCreateSymbolicLink+0x46
fffff880`031a0c00 00000000`00000000 : fffffa80`059fc270 00000000`c000009a fffff800`032186a1 fffff980`00000100 : nvlddmkm+0x9e4a0


SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  nvlddmkm+9e4a0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9e7f64

STACK_COMMAND:  .cxr 0xfffff8800319fe20 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_VRF_nvlddmkm+9e4a0

BUCKET_ID:  X64_0x7E_VRF_nvlddmkm+9e4a0

Followup: MachineOwner
---------




DRIVERS

Code:
start             end                 module name
fffff880`00f80000 fffff880`00fd7000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02ce5000 fffff880`02d6f000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`00de0000 fffff880`00deb000   amdxata  amdxata.sys  Fri Mar 19 12:18:18 2010 (4BA3A3CA)
fffff880`02df2000 fffff880`02df9000   AsIO     AsIO.sys     Mon Dec 17 04:11:49 2007 (47663D55)
fffff880`00e00000 fffff880`00e09000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00db6000 fffff880`00de0000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`01972000 fffff880`01979000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`0182b000 fffff880`0183c000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`0193f000 fffff880`01969000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00e0d000 fffff880`00ecd000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`018d9000 fffff880`01909000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00cfb000 fffff880`00d59000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`01909000 fffff880`01917000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02cc3000 fffff880`02ce1000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02cb4000 fffff880`02cc3000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`018c3000 fffff880`018d9000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01923000 fffff880`0192c000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`01917000 fffff880`01923000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0192c000 fffff880`0193f000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`10aa9000 fffff880`10b9d000   dxgkrnl  dxgkrnl.sys  Tue Jan 25 23:22:56 2011 (4D3FA1A0)
fffff880`10b9d000 fffff880`10be3000   dxgmms1  dxgmms1.sys  Tue Jan 25 23:22:12 2011 (4D3FA174)
fffff880`0112f000 fffff880`01143000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010e3000 fffff880`0112f000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`013f2000 fffff880`013fc000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01889000 fffff880`018c3000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01400000 fffff880`0144a000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`033f2000 fffff800`0343b000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`015e4000 fffff880`015ed000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`01862000 fffff880`01878000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff800`00bae000 fffff800`00bb8000   kdcom    kdcom.dll    Sat Feb 05 07:21:45 2011 (4D4D40D9)
fffff880`013c7000 fffff880`013e1000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`015b9000 fffff880`015e4000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`00ca3000 fffff880`00ce7000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`00c6c000 fffff880`00c86000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`019d7000 fffff880`019e2000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fe0000 fffff880`00fea000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01143000 fffff880`011a1000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02ca9000 fffff880`02cb4000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01452000 fffff880`01464000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01467000 fffff880`01559000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02de3000 fffff880`02df2000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02d6f000 fffff880`02db4000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01559000 fffff880`015b9000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`019e2000 fffff880`019f3000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02c9d000 fffff880`02ca9000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02e15000 fffff800`033f2000   nt       ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD)
fffff880`01225000 fffff880`013c7000   Ntfs     Ntfs.sys     Thu Mar 10 22:39:25 2011 (4D79996D)
fffff880`01969000 fffff880`01972000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`10aa7000 fffff880`10aa8180   nvBridge nvBridge.kmd Thu Apr 07 23:14:49 2011 (4D9E7DA9)
fffff880`0fe02000 fffff880`10aa6300   nvlddmkm nvlddmkm.sys Thu Apr 07 23:22:12 2011 (4D9E7F64)
fffff880`02dbd000 fffff880`02de3000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00d8c000 fffff880`00da1000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d59000 fffff880`00d8c000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00ff7000 fffff880`00ffe000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00c5c000 fffff880`00c6c000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013e1000 fffff880`013f2000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`00ce7000 fffff880`00cfb000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`02c4c000 fffff880`02c9d000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`019bc000 fffff880`019c5000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019c5000 fffff880`019ce000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019ce000 fffff880`019d7000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`011a1000 fffff880`011db000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02c00000 fffff880`02c1d000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0144a000 fffff880`01452000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`01601000 fffff880`017fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0181e000 fffff880`0182b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`01800000 fffff880`0181e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02c38000 fffff880`02c4c000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`0183c000 fffff880`01862000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`00fea000 fffff880`00ff7000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01979000 fffff880`01987000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01987000 fffff880`019ac000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00da1000 fffff880`00db6000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c1d000 fffff880`02c38000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`019ac000 fffff880`019bc000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ecd000 fffff880`00f71000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f71000 fffff880`00f80000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02db4000 fffff880`02dbd000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`00fd7000 fffff880`00fe0000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
 


#4
After looking over other threads in this forum I saw where you had suggested someone turned on XMP and had their ram run at 1600MHZ which was the same g-skill ram I had. I've done that and also renamed a driver I saw asus utilities were notorious for causing BSOD's, now I am having no BSOD's as of yet, when the computer was idle I would get them every four hours or more and now it has been 16 hours with no BSOD's. Hopefully it was that, any other suggestions? Should I go ahead and run memtest86 just to make sure?
 


#5
I saw where you had suggested someone turned on XMP and had their ram run at 1600MHZ which was the same g-skill ram I had. I've done that and also renamed a driver I saw asus utilities were notorious for causing BSOD's, now I am having no BSOD's as of yet, when the computer was idle I would get them every four hours or more and now it has been 16 hours with no BSOD's.
Yes, right move. Check for your RAM if you are supposed to set the voltage manually, since wrong voltage can cause problems too.

The CPU is running 3200Mhz at idle, the feature EIST (lowerring frequency when idle) should be on.
 


#6
I saw asus utilities were notorious for causing BSOD's, now I am having no BSOD's as of yet, when the computer was idle I would get them every four hours or more and now it has been 16 hours with no BSOD's. Hopefully it was that, any other suggestions? Should I go ahead and run memtest86 just to make sure?

asus utilities were notorious

- no, not in your case. Only if they are old.

Memtest - run it IF you keep getting blue screens. If no bsods now, then no need to waste your time.
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.