Jana Kuzmanova

New Member
Joined
Mar 4, 2011
Messages
6
I've been getting these BSODs for the last few days. At first I was getting different error messages, some of them were MEMORY_MANAGEMENT and FAULT_IN_NONPAGED_AREA. After uninstalling a few programs I suspected, I've been getting the IRQL_NOT_LESS_OR EQUAL BSOD.
Here are all files you might need..I hope I didn't forget anything.
 


Attachments

  • RAMMon - SPD Info.txt
    RAMMon - SPD Info.txt
    20.5 KB · Views: 356
  • minidump.rar
    minidump.rar
    762.2 KB · Views: 323
  • cpuz.webp
    cpuz.webp
    45.1 KB · Views: 468
Solution
Looks like some hardware issue,



BugCheck A, {0, 2, 1, 830923ad}
IRQL_NOT_LESS_OR_EQUAL (a)
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8319a700
Unable to read MiSystemVaType memory at 8317a0c0
00000000
PROCESS_NAME: System
Probably caused by : hardware ( HTTP!UlpTimedWaitOnEvent+18 )


The Realtek drivers haven't been updated:
Link Removed
90732000 90757000 Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
9242f000 926b7c40 RTKVHDA RTKVHDA.sys Mon Jul 20 07:15:20 2009 (4A6451C8)




Uninstall DT driver with the use of this tool:
Link Removed
sptd.sys Sun Oct 11 16:54:02 2009



Run Memtest86+ - Advanced Memory Diagnostic...
The memory settings are right, 800Mhz 6-6-6-18, thank you for the screenshots.


BCCode - A, 4e, 24


030311-18468-01.dmp
BugCheck A, {430c002e, 2, 0, 830f29c3}
IRQL_NOT_LESS_OR_EQUAL (a)
READ_ADDRESS: GetPointerFromAddress: unable to read from 831ae700
Unable to read MiSystemVaType memory at 8318e0c0
430c002e
PROCESS_NAME: WINWORD.EXE
Probably caused by : ntkrnlmp.exe ( nt!IoBoostThreadIoPriority+c1 )

~~~~~~

030211-16312-01.dmp
NTFS_FILE_SYSTEM (24)
EXCEPTION_RECORD: 80e33814 -- (.exr 0xffffffff80e33814)
ExceptionAddress: 830a4c64 (nt!RtlDeleteNoSplay+0x0000005e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
Attempt to write to address 00004000
PROCESS_NAME: System
FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDeleteScb+214

~~~~~~~~~

030311-17640-01.dmp
PFN_LIST_CORRUPT (4e)
PROCESS_NAME: wmpnetwk.exe
FAILURE_BUCKET_ID: 0x4E_99_nt!MiBadShareCount+24

~~~~~~~~~

030411-15421-01.dmp
BugCheck A, {c0415250, 0, 0, 830c1cbb}
IRQL_NOT_LESS_OR_EQUAL (a)
PROCESS_NAME: svchost.exe
Probably caused by : memory_corruption ( nt!MiLocateWsle+97 )






Let's get you updated first:

NVIDIA
nvlddmkm.sys Sun Sep 27 20:13:17 2009

Realtek LAN
Rt86win7.sys Thu Feb 26 04:04:22 2009

Realtek Audio
RTKVHDA.sys Mon Jul 20 07:15:20 2009





Uninstall Daemon Tools / Alcohol
sptd.sys Sun Oct 11 16:54:02 2009





Let know how it is going then, if more crashes attach the latest crash dumps.






Crash Dumps:

Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030311-18468-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x8304f000 PsLoadedModuleList = 0x8318e570
Debug session time: Thu Mar  3 11:29:25.155 2011 (UTC - 5:00)
System Uptime: 0 days 2:08:30.030
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {430c002e, 2, 0, 830f29c3}

Probably caused by : ntkrnlmp.exe ( nt!IoBoostThreadIoPriority+c1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 430c002e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 830f29c3, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 831ae700
Unable to read MiSystemVaType memory at 8318e0c0
 430c002e 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IoBoostThreadIoPriority+c1
830f29c3 8a4812          mov     cl,byte ptr [eax+12h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  WINWORD.EXE

TRAP_FRAME:  9d5ad8fc -- (.trap 0xffffffff9d5ad8fc)
ErrCode = 00000000
eax=430c001c ebx=850972f8 ecx=9d5ad9c0 edx=831ab7dc esi=00000018 edi=00000020
eip=830f29c3 esp=9d5ad970 ebp=9d5ada20 iopl=0         ov up ei ng nz na pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010a87
nt!IoBoostThreadIoPriority+0xc1:
830f29c3 8a4812          mov     cl,byte ptr [eax+12h]      ds:0023:430c002e=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from 830f29c3 to 83087b3b

STACK_TEXT:  
9d5ad8fc 830f29c3 badb0d00 831ab7dc 00000001 nt!KiTrap0E+0x2cf
9d5ada20 830e561b 00000000 00000002 00000000 nt!IoBoostThreadIoPriority+0xc1
9d5ada54 830fa0c6 00000002 83170d20 8509735c nt!ExpCheckForIoPriorityBoost+0x8e
9d5ada9c 830b2eb7 861fc3d0 00000000 a1475a30 nt!ExpWaitForResource+0x7b
9d5adae8 88132531 8509735c 85964b01 9d5adb1c nt!ExAcquireResourceExclusiveLite+0x1cf
9d5adaf8 8813257c 86893a20 a1475a30 85964b01 Ntfs!NtfsAcquireResourceExclusive+0x25
9d5adb1c 88138e88 86893a20 a1475a30 00000000 Ntfs!NtfsAcquireExclusiveFcb+0x42
9d5adb48 881b5dec 86893a01 a1475a30 00000000 Ntfs!NtfsAcquireFcbWithPaging+0x8d
9d5adba4 881b665b 86893a20 85964b48 85964240 Ntfs!NtfsFindPrefixHashEntry+0x454
9d5adc00 881b8c5c 86893a20 84b7b278 89985918 Ntfs!NtfsFindStartingNode+0x7b6
9d5adcdc 8813f210 86893a20 84b7b278 9d549544 Ntfs!NtfsCommonCreate+0x65f
9d5add1c 830abf96 9d5494dc 0000045c ffffffff Ntfs!NtfsCommonCreateCallout+0x20
9d5add1c 830ac08d 9d5494dc 0000045c ffffffff nt!KiSwapKernelStackAndExit+0x15a
9d549440 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IoBoostThreadIoPriority+c1
830f29c3 8a4812          mov     cl,byte ptr [eax+12h]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!IoBoostThreadIoPriority+c1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc78eb6

FAILURE_BUCKET_ID:  0xA_nt!IoBoostThreadIoPriority+c1

BUCKET_ID:  0xA_nt!IoBoostThreadIoPriority+c1

Followup: MachineOwner
---------






















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030211-16312-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x8300f000 PsLoadedModuleList = 0x8314e570
Debug session time: Wed Mar  2 08:15:58.125 2011 (UTC - 5:00)
System Uptime: 0 days 0:43:53.000
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: 80e33814
Arg3: 80e333f0
Arg4: 830a4c64

Debugging Details:
------------------


EXCEPTION_RECORD:  80e33814 -- (.exr 0xffffffff80e33814)
ExceptionAddress: 830a4c64 (nt!RtlDeleteNoSplay+0x0000005e)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 00004000
Attempt to write to address 00004000

CONTEXT:  80e333f0 -- (.cxr 0xffffffff80e333f0)
eax=00004000 ebx=00000000 ecx=a0ff86ec edx=00000000 esi=a0ff86ec edi=86b35ed4
eip=830a4c64 esp=80e338dc ebp=80e338e8 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!RtlDeleteNoSplay+0x5e:
830a4c64 8900            mov     dword ptr [eax],eax  ds:0023:00004000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  00004000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8316e700
Unable to read MiSystemVaType memory at 8314e0c0
 00004000 

FOLLOWUP_IP: 
Ntfs!NtfsDeleteScb+214
881adfb2 8b06            mov     eax,dword ptr [esi]

FAULTING_IP: 
nt!RtlDeleteNoSplay+5e
830a4c64 8900            mov     dword ptr [eax],eax

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 880c4839 to 830a4c64

STACK_TEXT:  
80e338e8 880c4839 a0ff86ec 86b35ed4 a0ff86ec nt!RtlDeleteNoSplay+0x5e
80e338fc 880c4af4 a0ff86ec 86b35ed0 86b35ed0 fltmgr!TreeUnlinkNoBalance+0x13
80e33914 880ce5f5 86b35ed4 ffffffff ffffffff fltmgr!TreeUnlinkMulti+0x22
80e33930 880db793 86b35ed4 86b35ed0 ffffffff fltmgr!FltpDeleteContextList+0x2f
80e33950 880db9b4 86b35ea8 a2617d78 00000000 fltmgr!CleanupStreamListCtrl+0x1b
80e33964 83256681 86b35eac 9a8c53d2 00000000 fltmgr!DeleteStreamListCtrlCallback+0x5a
80e339a4 881adfb2 a2617d78 a2617c88 a2617d78 nt!FsRtlTeardownPerStreamContexts+0x13a
80e339c0 881a4b3b 00000705 a2617cb0 a2617c88 Ntfs!NtfsDeleteScb+0x214
80e339d8 8811471e 852a41d8 a2617d78 00000000 Ntfs!NtfsRemoveScb+0xc5
80e339f4 881950d2 852a41d8 a2617c88 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x62
80e33a38 88111bec 852a41d8 a2617d78 00000000 Ntfs!NtfsTeardownStructures+0x68
80e33a60 8819155b 852a41d8 a2617d78 00000000 Ntfs!NtfsDecrementCloseCounts+0xaf
80e33ac0 881931a9 852a41d8 a2617d78 a2617c88 Ntfs!NtfsCommonClose+0x4f2
80e33b5c 8303df34 00000000 853a2008 853a2008 Ntfs!NtfsFsdClose+0x403
80e33b74 880c020c 8591ded8 853a2008 00000000 nt!IofCallDriver+0x63
80e33b98 880c03cb 80e33bb8 8591ded8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa
80e33bd0 8303df34 8591ded8 853a2008 8591e024 fltmgr!FltpDispatch+0xc5
80e33be8 83227bd5 84aaa040 86eb7560 00000000 nt!IofCallDriver+0x63
80e33c2c 83257601 86eb7578 86eb7578 86eb7560 nt!IopDeleteFile+0x10c
80e33c44 830652ea 00000000 85275ea8 858c6c40 nt!ObpRemoveObjectRoutine+0x59
80e33c58 8306525a 86eb7578 8309873d 00000000 nt!ObfDereferenceObjectWithTag+0x88
80e33c60 8309873d 00000000 85275ea8 86eb7578 nt!ObfDereferenceObject+0xd
80e33c78 8309b937 00000001 00000000 85cae168 nt!CcDeleteSharedCacheMap+0x131
80e33ca8 830a2f33 80e33cc4 9a8c5776 84ab3118 nt!CcWriteBehind+0x715
80e33d00 83069fc3 84ab3118 00000000 84aa9a70 nt!CcWorkerThread+0x164
80e33d50 831f6e7c 00000000 9a8c57e6 00000000 nt!ExpWorkerThread+0x10d
80e33d90 830980d9 83069eb6 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  Ntfs!NtfsDeleteScb+214

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf45

STACK_COMMAND:  .cxr 0xffffffff80e333f0 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsDeleteScb+214

BUCKET_ID:  0x24_Ntfs!NtfsDeleteScb+214

Followup: MachineOwner
---------




















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030311-17640-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x83004000 PsLoadedModuleList = 0x83143570
Debug session time: Thu Mar  3 09:04:43.536 2011 (UTC - 5:00)
System Uptime: 0 days 0:52:28.411
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00019404, page frame number
Arg3: 00000003, current page state
Arg4: ffffffff, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  wmpnetwk.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 830e6500 to 830d54d4

STACK_TEXT:  
80e73928 830e6500 0000004e 00000099 00019404 nt!KeBugCheckEx+0x1e
80e73940 83077944 c0403200 8488baa8 c01b8988 nt!MiBadShareCount+0x24
80e73a98 8306cdd8 a0c3e8b0 80e73b48 a0c3e8b0 nt!MiFreeWsleList+0x5e0
80e73c10 83061d86 a0c3e8b0 00000001 00000001 nt!MiAgeWorkingSet+0x454
80e73c5c 83061a4b 00000002 00000001 00000000 nt!MiProcessWorkingSets+0x25b
80e73c88 83062213 00000000 84aae628 00000000 nt!MmWorkingSetManager+0xa4
80e73d50 831ebe7c 00000000 9a89881d 00000000 nt!KeBalanceSetManager+0x1af
80e73d90 8308d0d9 83062064 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+24
830e6500 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+24

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc78eb6

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

BUCKET_ID:  0x4E_99_nt!MiBadShareCount+24

Followup: MachineOwner
---------





















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030411-15421-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x83049000 PsLoadedModuleList = 0x83188570
Debug session time: Thu Mar  3 12:12:51.188 2011 (UTC - 5:00)
System Uptime: 0 days 0:43:04.047
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {c0415250, 0, 0, 830c1cbb}

Probably caused by : memory_corruption ( nt!MiLocateWsle+97 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c0415250, memory referenced
Arg2: 00000000, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 830c1cbb, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 831a8700
Unable to read MiSystemVaType memory at 831880c0
 c0415250 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiLocateWsle+97
830c1cbb 8b049e          mov     eax,dword ptr [esi+ebx*4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  a6ab5b88 -- (.trap 0xffffffffa6ab5b88)
ErrCode = 00000000
eax=c09d611c ebx=00004aea ecx=00000001 edx=c0402000 esi=c04026a8 edi=75447001
eip=830c1cbb esp=a6ab5bfc ebp=a6ab5c08 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!MiLocateWsle+0x97:
830c1cbb 8b049e          mov     eax,dword ptr [esi+ebx*4] ds:0023:c0415250=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 830c1cbb to 83081b3b

STACK_TEXT:  
a6ab5b88 830c1cbb badb0d00 c0402000 8695f520 nt!KiTrap0E+0x2cf
a6ab5c08 830cf9b9 c09d611c c01d511c 8623fdb8 nt!MiLocateWsle+0x97
a6ab5c24 830d346a a6ab5c98 86e696d8 8695f330 nt!MiGetPageProtection+0xd1
a6ab5c40 830d3218 75447000 07200002 8695f330 nt!MiQueryAddressState+0x1cc
a6ab5c78 8328741e 75447000 8623fdb8 bcc04871 nt!MiQueryAddressSpan+0x76
a6ab5d14 8307e75a 00000150 75441000 00000000 nt!NtQueryVirtualMemory+0x572
a6ab5d14 77466344 00000150 75441000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
001ccdd4 00000000 00000000 00000000 00000000 0x77466344


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiLocateWsle+97
830c1cbb 8b049e          mov     eax,dword ptr [esi+ebx*4]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiLocateWsle+97

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc78eb6

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiLocateWsle+97

BUCKET_ID:  0xA_nt!MiLocateWsle+97

Followup: MachineOwner
---------




Drivers:

Code:
start    end        module name
87f5d000 87fa5000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8f01c000 8f076000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
90751000 90763000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
9070b000 90744000   ahsuh6jq ahsuh6jq.SYS Tue Jul 14 17:12:41 2009 (4A5CF4C9)
880aa000 880b3000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
9a617000 9a620000   asyncmac asyncmac.sys Mon Jul 13 19:54:46 2009 (4A5BC946)
8807e000 88087000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
88087000 880aa000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
92c60000 92cad000   ATMFD    ATMFD.DLL    Fri Jan 07 00:33:10 2011 (4D26A596)
8871b000 88722000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8f19e000 8f1ac000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
87cc7000 87ccf000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
9277d000 92796000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
92c40000 92c5e000   cdd      cdd.dll      unavailable (00000000)
886ce000 886ed000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
87d11000 87dbc000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
88677000 8869c000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
87ccf000 87d11000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
88265000 882c2000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
90744000 90751000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
9269e000 926ab000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8f186000 8f19e000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8f17a000 8f186000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
88666000 88677000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
8f2aa000 8f2c3000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
926b6000 926bf000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
926ab000 926b6000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
926bf000 926d0000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
92694000 9269e000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
9052b000 905e2000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:37:53 2010 (4CCF7981)
905e2000 9061b000   dxgmms1  dxgmms1.sys  Wed Feb 02 22:34:49 2011 (4D4A2259)
9a637000 9a661000   fastfat  fastfat.SYS  Mon Jul 13 19:14:01 2009 (4A5BBFB9)
880e7000 880f8000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
880b3000 880e7000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
882d0000 882d9000   Fs_Rec   Fs_Rec.sys   unavailable (00000000)
88634000 88666000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
88577000 885a8000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
83012000 83049000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
9061b000 9063a000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
926f4000 92707000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
92707000 9270d480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
926e9000 926f4000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
8f2c3000 8f348000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8862c000 88634000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
906e6000 906fe000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
88053000 8805a000   intelide intelide.sys Mon Jul 13 19:11:19 2009 (4A5BBF17)
8f1cd000 8f1df000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
907ee000 907fb000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
9270e000 9271a000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80bbc000 80bc4000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
8f1df000 8f213000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
88252000 88265000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
883ce000 883f3000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
9275a000 9276a000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
92725000 92740000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
87c3e000 87cb6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
9271a000 92725000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
906fe000 9070b000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
88068000 8807e000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
886ed000 88713680   MpFilter MpFilter.sys Tue Sep 14 17:23:59 2010 (4C8FE7EF)
8f174000 8f179900   MpKsl1963fea1 MpKsl1963fea1.sys Tue Mar 30 22:06:14 2010 (4BB2AE16)
8f16e000 8f173900   MpKslc35f9614 MpKslc35f9614.sys Tue Mar 30 22:06:14 2010 (4BB2AE16)
9a59b000 9a5a0900   MpKslc94a9e18 MpKslc94a9e18.sys Tue Mar 30 22:06:14 2010 (4BB2AE16)
9a540000 9a549200   MpNWMon  MpNWMon.sys  Tue Sep 14 17:23:50 2010 (4C8FE7E6)
92796000 927a8000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
927a8000 927cb000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
8f348000 8f383000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
927cb000 927e6000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
88774000 8877f000   Msfs     Msfs.SYS     unavailable (00000000)
87fa5000 87fad000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
88227000 88252000   msrpc    msrpc.sys    unavailable (00000000)
8f164000 8f16e000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8861c000 8862c000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
882d9000 88390000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
9077b000 90786000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
90786000 907a8000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
8f257000 8f268000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
8f0ce000 8f0dc000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
8f076000 8f0a8000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
88390000 883ce000   NETIO    NETIO.SYS    Thu Apr 08 22:32:21 2010 (4BBE91B5)
9a5a1000 9a5acc00   NisDrvWFP NisDrvWFP.sys Tue Sep 14 17:24:12 2010 (4C8FE7FC)
8877f000 8878d000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
8f15a000 8f164000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
83049000 8344a000   nt       ntkrnlmp.exe Tue Oct 26 22:30:14 2010 (4CC78EB6)
880f8000 88227000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
88714000 8871b000   Null     Null.SYS     unavailable (00000000)
90529000 9052a080   nvBridge nvBridge.kmd Sun Sep 27 19:56:53 2009 (4ABFFBC5)
8f268000 8f27b000   nvhda32v nvhda32v.sys Fri Aug 21 16:23:35 2009 (4A8F0247)
8fc18000 90528160   nvlddmkm nvlddmkm.sys Sun Sep 27 20:13:17 2009 (4ABFFF9D)
8f0af000 8f0ce000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
906ce000 906e6000   parport  parport.sys  Mon Jul 13 19:45:34 2009 (4A5BC71E)
87fe2000 87ff3000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
927e6000 927ed000   parvdm   parvdm.sys   unavailable (00000000)
87fb8000 87fe2000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
8805a000 88068000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
882c2000 882d0000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
9a422000 9a4b9000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
8f27b000 8f2aa000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
87cb6000 87cc7000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
90763000 9077b000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
907a8000 907c0000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
907c0000 907d7000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
907d7000 907ee000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
8f119000 8f15a000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
8875c000 88764000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
88764000 8876c000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
8876c000 88774000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
885ef000 8861c000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
9276a000 9277d000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
9063a000 9065f000   Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
9240b000 92693c40   RTKVHDA  RTKVHDA.sys  Mon Jul 20 07:15:20 2009 (4A6451C8)
87f37000 87f5d000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
9a4b9000 9a4c3000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
906c4000 906ce000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
8f0dc000 8f0f6000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
885e7000 885ef000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
87e3b000 87f2e000   sptd     sptd.sys     Sun Oct 11 16:54:02 2009 (4AD245EA)
9a54a000 9a59b000   srv      srv.sys      Thu Aug 26 23:31:26 2010 (4C77318E)
9a4f1000 9a540000   srv2     srv2.sys     Thu Aug 26 23:30:45 2010 (4C773165)
9a4c3000 9a4e4000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
907fb000 907fc380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8842e000 88577000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
9a4e4000 9a4f1000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
887a4000 887af000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
8878d000 887a4000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
8f109000 8f119000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
92c10000 92c19000   TSDDD    TSDDD.dll    Mon Jul 13 20:01:40 2009 (4A5BCAE4)
8f1ac000 8f1cd000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
8fc00000 8fc0e000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
926d0000 926e7000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
926e7000 926e8700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
906b5000 906c4000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
8f213000 8f257000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
9066a000 906b5000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
9065f000 9066a000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
87fad000 87fb8000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
88722000 8872e000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
8872e000 8874f000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
87c00000 87c10000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
88008000 88053000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
885a8000 885e7000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
8f0f6000 8f109000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
8874f000 8875c000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
87dbc000 87e2d000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
87e2d000 87e3b000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8f0a8000 8f0af000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
92db0000 92ffb000   win32k   win32k.sys   Tue Jan 04 22:37:16 2011 (4D23E76C)
87f2e000 87f37000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
92740000 9275a000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)

Unloaded modules:
9a661000 9a682000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00021000
9a620000 9a637000   USBSTOR.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00017000
9a5ad000 9a617000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0006A000
8869c000 886a9000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
886a9000 886b4000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
886b4000 886bd000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
886bd000 886ce000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
 


I uninstalled Daemon Tools and updated the NVIDIA, but I still got 3 new BSODs, one after I updated the graphics driver, one while downloading the other 2 (Daemon Tools was uninstalled here), and then a third when I rebooted after the second one. That one came before it booted, so I couldn't upload the new crash dumps.
All I can help you with right now is the stop errors: 0x0..7f; 0x0..8a and another 0x0..0a. I'm going to try uploading the crash dumps tomorrow.
 


Attachments

Last edited:
Looks like some hardware issue,



BugCheck A, {0, 2, 1, 830923ad}
IRQL_NOT_LESS_OR_EQUAL (a)
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8319a700
Unable to read MiSystemVaType memory at 8317a0c0
00000000
PROCESS_NAME: System
Probably caused by : hardware ( HTTP!UlpTimedWaitOnEvent+18 )


The Realtek drivers haven't been updated:
Link Removed
90732000 90757000 Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
9242f000 926b7c40 RTKVHDA RTKVHDA.sys Mon Jul 20 07:15:20 2009 (4A6451C8)




Uninstall DT driver with the use of this tool:
Link Removed
sptd.sys Sun Oct 11 16:54:02 2009



Run Memtest86+ - Advanced Memory Diagnostic Tool 10 passes overnight.






Crash Dumps:

Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030511-16703-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x8303b000 PsLoadedModuleList = 0x8317a570
Debug session time: Fri Mar  4 14:55:16.875 2011 (UTC - 5:00)
System Uptime: 0 days 0:00:24.734
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 830923ad}

Probably caused by : hardware ( HTTP!UlpTimedWaitOnEvent+18 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 830923ad, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 8319a700
Unable to read MiSystemVaType memory at 8317a0c0
 00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiProcessTimerDpcTable+26
830923ad 0020            add     byte ptr [eax],ah

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  8cf63bb4 -- (.trap 0xffffffff8cf63bb4)
ErrCode = 00000002
eax=00000000 ebx=80dc5a3c ecx=00000000 edx=8001083b esi=80dc4920 edi=86a54188
eip=830923ad esp=8cf63c28 ebp=8cf63458 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
nt!KiProcessTimerDpcTable+0x26:
830923ad 0020            add     byte ptr [eax],ah          ds:0023:00000000=??
Resetting default scope

MISALIGNED_IP: 
nt!KiProcessTimerDpcTable+26
830923ad 0020            add     byte ptr [eax],ah

LAST_CONTROL_TRANSFER:  from 830923ad to 83073b3b

STACK_TEXT:  
8cf63bb4 830923ad badb0d00 8001083b 00004800 nt!KiTrap0E+0x2cf
8cf63cd4 8304c3b4 84a32b56 8cf63d1c 00000004 nt!KiProcessTimerDpcTable+0x26
8cf63cfc 8af9a247 86a54dc8 00000000 00000000 nt!EtwpCCSwapTrace+0x433
8cf63d1c 8af9a11a 86a50e20 00000000 86a54188 HTTP!UlpTimedWaitOnEvent+0x18
8cf63d44 83009ba9 060f21f2 8cf63d90 83226e7c HTTP!UlpThreadPoolWorker+0x115
8cf63d50 83226e7c 86a54448 96c664de 00000000 hal!KfLowerIrql+0x61
8cf63d90 830c48d9 8af9a005 86a54448 00000000 nt!NtQueryObject+0x2f
00000000 00000000 00000000 00000000 00000000 nt!ExpGetSystemBasicInformation+0x52


STACK_COMMAND:  kb

FOLLOWUP_IP: 
HTTP!UlpTimedWaitOnEvent+18
8af9a247 8b4604          mov     eax,dword ptr [esi+4]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  HTTP!UlpTimedWaitOnEvent+18

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED

BUCKET_ID:  IP_MISALIGNED

Followup: MachineOwner
---------




Drivers:

Code:
start    end        module name
87f52000 87f9a000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8ac13000 8ac6d000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
8add0000 8ade2000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
880ae000 880b7000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
88082000 8808b000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
8808b000 880ae000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
92ad0000 92b1d000   ATMFD    ATMFD.DLL    unavailable (00000000)
8871c000 88723000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8ad8f000 8ad9d000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
87cbc000 87cc4000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
927a1000 927ba000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
92ab0000 92ace000   cdd      cdd.dll      unavailable (00000000)
886cf000 886ee000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
87d06000 87db1000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
88678000 8869d000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
87cc4000 87d06000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
88269000 882c6000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8fc0d000 8fc1a000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
92422000 9242b000   cpuz135_x32 cpuz135_x32.sys Wed Jan 19 11:45:17 2011 (4D37151D)
926c2000 926cf000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8ad77000 8ad8f000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8ad6b000 8ad77000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
88667000 88678000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
8af56000 8af6f000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
926da000 926e3000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
926cf000 926da000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
926e3000 926f4000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
926b8000 926c2000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
90623000 906da000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:37:53 2010 (4CCF7981)
906da000 90713000   dxgmms1  dxgmms1.sys  Wed Feb 02 22:34:49 2011 (4D4A2259)
880eb000 880fc000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
880b7000 880eb000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
882d4000 882dd000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
88635000 88667000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
88578000 885a9000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
83004000 8303b000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
90713000 90732000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
92723000 92736000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
92736000 9273c480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
92718000 92723000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
8af6f000 8aff4000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8862d000 88635000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
907de000 907f6000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
88057000 8805e000   intelide intelide.sys Mon Jul 13 19:11:19 2009 (4A5BBF17)
8adbe000 8add0000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
8ae62000 8ae6f000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
9273d000 92749000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80bd2000 80bda000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
8ae6f000 8aea3000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
88256000 88269000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
883d2000 883f7000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
9277e000 9278e000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
92749000 92764000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
87c33000 87cab000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
926f4000 926ff000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
8fc00000 8fc0d000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
8806c000 88082000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
886ee000 88714680   MpFilter MpFilter.sys Tue Sep 14 17:23:59 2010 (4C8FE7EF)
8ad65000 8ad6a900   MpKsl8bcf8f22 MpKsl8bcf8f22.sys Tue Mar 30 22:06:14 2010 (4BB2AE16)
927ba000 927cc000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
927cc000 927ef000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
887b0000 887eb000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
92400000 9241b000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
88775000 88780000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
87f9a000 87fa2000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
8822b000 88256000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
8ad5b000 8ad65000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8861d000 8862d000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
882dd000 88394000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
8fc1a000 8fc25000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
8adfa000 8ae1c000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
8aef5000 8af06000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
8acc5000 8acd3000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
8ac6d000 8ac9f000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
88394000 883d2000   NETIO    NETIO.SYS    Thu Apr 08 22:32:21 2010 (4BBE91B5)
88780000 8878e000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
8ad51000 8ad5b000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
8303b000 8343c000   nt       ntkrnlmp.exe Tue Oct 26 22:30:14 2010 (4CC78EB6)
880fc000 8822b000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
88715000 8871c000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
90621000 90622040   nvBridge nvBridge.kmd Fri Jan 07 20:57:19 2011 (4D27C47F)
8af06000 8af27000   nvhda32v nvhda32v.sys Thu Nov 11 18:10:19 2010 (4CDC77DB)
8fc27000 90620ee0   nvlddmkm nvlddmkm.sys Fri Jan 07 21:03:58 2011 (4D27C60E)
8aca6000 8acc5000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
907c6000 907de000   parport  parport.sys  Mon Jul 13 19:45:34 2009 (4A5BC71E)
87fd7000 87fe8000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
9241b000 92422000   parvdm   parvdm.sys   Mon Jul 13 19:45:29 2009 (4A5BC719)
87fad000 87fd7000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
8805e000 8806c000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
882c6000 882d4000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
9342f000 934c6000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
8af27000 8af56000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
87cab000 87cbc000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
8ade2000 8adfa000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
8ae1c000 8ae34000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
8ae34000 8ae4b000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
8ae4b000 8ae62000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
8ad10000 8ad51000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
8875d000 88765000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
88765000 8876d000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
8876d000 88775000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
885f0000 8861d000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
9278e000 927a1000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
90732000 90757000   Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
9242f000 926b7c40   RTKVHDA  RTKVHDA.sys  Mon Jul 20 07:15:20 2009 (4A6451C8)
87f2c000 87f52000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
934c6000 934d0000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
907bc000 907c6000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
8acd3000 8aced000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
885e8000 885f0000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
87e30000 87f23000   sptd     sptd.sys     Sun Oct 11 16:54:02 2009 (4AD245EA)
934d0000 934f1000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
8fc25000 8fc26380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
8842f000 88578000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
934f1000 934fe000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
887a5000 887b0000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
8878e000 887a5000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
8ad00000 8ad10000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
92a80000 92a89000   TSDDD    TSDDD.dll    unavailable (00000000)
8ad9d000 8adbe000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
8aea3000 8aeb1000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
926ff000 92716000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
92716000 92717700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
907ad000 907bc000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
8aeb1000 8aef5000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
90762000 907ad000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
90757000 90762000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
87fa2000 87fad000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
88723000 8872f000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
8872f000 88750000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
87fe8000 87ff8000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8800c000 88057000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
885a9000 885e8000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
8aced000 8ad00000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
88750000 8875d000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
87db1000 87e22000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
87e22000 87e30000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8ac9f000 8aca6000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
92820000 92a6b000   win32k   win32k.sys   unavailable (00000000)
87f23000 87f2c000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
92764000 9277e000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)

Unloaded modules:
8869d000 886aa000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
886aa000 886b5000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
886b5000 886be000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
886be000 886cf000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
 


Solution
I updated all drivers (finally) but I still got a new BDOS. Here are the latest dumps. I guess the next step is running a memtest.
 


Attachments

Your drivers are in excellent shape now, but the system still crashes:



030611-16750-01.dmp
NTFS_FILE_SYSTEM (24)
EXCEPTION_RECORD: 80e2fa1c -- (.exr 0xffffffff80e2fa1c)
ExceptionAddress: 881fe0a2 (Ntfs!EfsCleanup+0x00000010)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000804
Attempt to read from address 00000804

READ_ADDRESS: GetPointerFromAddress: unable to read from 831a2700
Unable to read MiSystemVaType memory at 831820c0
00000804

FOLLOWUP_IP:
Ntfs!EfsCleanup+10
881fe0a2 817e0410660000 cmp dword ptr [esi+4],6610h

FAULTING_IP:
Ntfs!EfsCleanup+10
881fe0a2 817e0410660000 cmp dword ptr [esi+4],6610h



1. Start > Accessories > Command Prompt > type > chkdsk /f > Press 'Enter'

2. Again, run Memtest86+ - Advanced Memory Diagnostic Tool during 10 passes overnight

3. Hard disk S.M.A.R.T. HD Tune website HDDScan





Crash Dumps:

Code:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\030611-16750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x83043000 PsLoadedModuleList = 0x83182570
Debug session time: Sat Mar  5 14:29:30.671 2011 (UTC - 5:00)
System Uptime: 0 days 1:54:40.531
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.......
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001904fb
Arg2: 80e2fa1c
Arg3: 80e2f600
Arg4: 881fe0a2

Debugging Details:
------------------


EXCEPTION_RECORD:  80e2fa1c -- (.exr 0xffffffff80e2fa1c)
ExceptionAddress: 881fe0a2 (Ntfs!EfsCleanup+0x00000010)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000804
Attempt to read from address 00000804

CONTEXT:  80e2f600 -- (.cxr 0xffffffff80e2f600)
eax=a6c8521c ebx=8315aa9c ecx=881fe092 edx=00000001 esi=00000800 edi=a6c8521c
eip=881fe0a2 esp=80e2fae4 ebp=80e2faec iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
Ntfs!EfsCleanup+0x10:
881fe0a2 817e0410660000  cmp     dword ptr [esi+4],6610h ds:0023:00000804=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000804

READ_ADDRESS: GetPointerFromAddress: unable to read from 831a2700
Unable to read MiSystemVaType memory at 831820c0
 00000804 

FOLLOWUP_IP: 
Ntfs!EfsCleanup+10
881fe0a2 817e0410660000  cmp     dword ptr [esi+4],6610h

FAULTING_IP: 
Ntfs!EfsCleanup+10
881fe0a2 817e0410660000  cmp     dword ptr [esi+4],6610h

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 881acf7c to 881fe0a2

STACK_TEXT:  
80e2faec 881acf7c a6c8521c a6c85008 a6c850f8 Ntfs!EfsCleanup+0x10
80e2fb08 881a3b3b 00000703 a6c85030 00000000 Ntfs!NtfsDeleteScb+0x1de
80e2fb20 8811371e 84b7f008 a6c850f8 00000000 Ntfs!NtfsRemoveScb+0xc5
80e2fb3c 881181c1 84b7f008 a6c85008 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x62
80e2fb94 8819415d 84b7f008 85a840d8 9a257a90 Ntfs!NtfsTeardownFromLcb+0x29c
80e2fbe4 88110bec 84b7f008 9a257b80 01000000 Ntfs!NtfsTeardownStructures+0xf3
80e2fc0c 8819055b 84b7f008 9a257b80 00000000 Ntfs!NtfsDecrementCloseCounts+0xaf
80e2fc6c 881af4c3 84b7f008 9a257b80 9a257a90 Ntfs!NtfsCommonClose+0x4f2
80e2fd00 8309dfc3 00000000 00000000 84aa9d48 Ntfs!NtfsFspClose+0x118
80e2fd50 8322ae7c 00000000 9a8a1642 00000000 nt!ExpWorkerThread+0x10d
80e2fd90 830cc0d9 8309deb6 00000000 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!EfsCleanup+10

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf45

STACK_COMMAND:  .cxr 0xffffffff80e2f600 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!EfsCleanup+10

BUCKET_ID:  0x24_Ntfs!EfsCleanup+10

Followup: MachineOwner
---------




Drivers:

Code:
start    end        module name
87f48000 87f90000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
8e411000 8e46b000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
8e5e8000 8e5fa000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
880b0000 880b9000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
99f4a000 99f53000   asyncmac asyncmac.sys Mon Jul 13 19:54:46 2009 (4A5BC946)
88084000 8808d000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
8808d000 880b0000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
936f0000 9373d000   ATMFD    ATMFD.DLL    unavailable (00000000)
8871e000 88725000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
8e58d000 8e59b000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
87cb2000 87cba000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
99ca1000 99cba000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
936d0000 936ee000   cdd      cdd.dll      unavailable (00000000)
886d1000 886f0000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
87cfc000 87da7000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
8867a000 8869f000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
87cba000 87cfc000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
8826b000 882c8000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
8e5db000 8e5e8000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
99d4c000 99d55000   cpuz135_x32 cpuz135_x32.sys Wed Jan 19 11:45:17 2011 (4D37151D)
92f59000 92f66000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
8e575000 8e58d000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
8e569000 8e575000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
88669000 8867a000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
8e779000 8e792000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
92f71000 92f7a000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
92f66000 92f71000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
92f7a000 92f8b000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
92f8b000 92f95000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
8f636000 8f6ed000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:37:53 2010 (4CCF7981)
8f6ed000 8f726000   dxgmms1  dxgmms1.sys  Wed Feb 02 22:34:49 2011 (4D4A2259)
887b2000 887dc000   fastfat  fastfat.SYS  Mon Jul 13 19:14:01 2009 (4A5BBFB9)
880ed000 880fe000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
880b9000 880ed000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
882d6000 882df000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
88637000 88669000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
8857a000 885ab000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
8300c000 83043000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
8f726000 8f745000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
92fc4000 92fd7000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
92fd7000 92fdd480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
92fb9000 92fc4000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
99c1c000 99ca1000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8862f000 88637000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
8ec22000 8ec3a000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
88059000 88060000   intelide intelide.sys Mon Jul 13 19:11:19 2009 (4A5BBF17)
8e5bc000 8e5ce000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
8e685000 8e692000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
92fde000 92fea000   kbdhid   kbdhid.sys   Mon Jul 13 19:45:09 2009 (4A5BC705)
80b9f000 80ba7000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
8e692000 8e6c6000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
88258000 8826b000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
883d4000 883f9000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
92fea000 92ffa000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
8e792000 8e7ad000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
87c29000 87ca1000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
92f95000 92fa0000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
8e5ce000 8e5db000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
8806e000 88084000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
886f0000 88716680   MpFilter MpFilter.sys Tue Sep 14 17:23:59 2010 (4C8FE7EF)
99eda000 99edf900   MpKsle305e8aa MpKsle305e8aa.sys Tue Mar 30 22:06:14 2010 (4BB2AE16)
99ec4000 99ecd200   MpNWMon  MpNWMon.sys  Tue Sep 14 17:23:50 2010 (4C8FE7E6)
99cba000 99ccc000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
99ccc000 99cef000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
99cef000 99d2a000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
99d2a000 99d45000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
88777000 88782000   Msfs     Msfs.SYS     unavailable (00000000)
87f90000 87f98000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
8822d000 88258000   msrpc    msrpc.sys    unavailable (00000000)
8e559000 8e563000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8861f000 8862f000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
882df000 88396000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
8e612000 8e61d000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
8e61d000 8e63f000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
8e718000 8e729000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
8e4c3000 8e4d1000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
8e46b000 8e49d000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
88396000 883d4000   NETIO    NETIO.SYS    Thu Apr 08 22:32:21 2010 (4BBE91B5)
99ece000 99ed9c00   NisDrvWFP NisDrvWFP.sys Tue Sep 14 17:24:12 2010 (4C8FE7FC)
88782000 88790000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
8e54f000 8e559000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
83043000 83444000   nt       ntkrnlmp.exe Tue Oct 26 22:30:14 2010 (4CC78EB6)
880fe000 8822d000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
88717000 8871e000   Null     Null.SYS     unavailable (00000000)
8f634000 8f635040   nvBridge nvBridge.kmd Fri Jan 07 20:57:19 2011 (4D27C47F)
8e729000 8e74a000   nvhda32v nvhda32v.sys Thu Nov 11 18:10:19 2010 (4CDC77DB)
8ec3a000 8f633ee0   nvlddmkm nvlddmkm.sys Fri Jan 07 21:03:58 2011 (4D27C60E)
8e4a4000 8e4c3000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
8ec0a000 8ec22000   parport  parport.sys  Mon Jul 13 19:45:34 2009 (4A5BC71E)
87fcd000 87fde000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
99d45000 99d4c000   parvdm   parvdm.sys   Mon Jul 13 19:45:29 2009 (4A5BC719)
87fa3000 87fcd000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
88060000 8806e000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
882c8000 882d6000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
99d55000 99dec000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
8e74a000 8e779000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
87ca1000 87cb2000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
8e5fa000 8e612000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
8e63f000 8e657000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
8e657000 8e66e000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
8e66e000 8e685000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
8e50e000 8e54f000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
8875f000 88767000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
88767000 8876f000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
8876f000 88777000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
885f2000 8861f000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
8e7c7000 8e7da000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
8f745000 8f799000   Rt86win7 Rt86win7.sys Wed Feb 16 04:02:51 2011 (4D5B92BB)
92c21000 92f584c0   RTKVHDA  RTKVHDA.sys  Tue Jan 18 07:08:04 2011 (4D3582A4)
87f22000 87f48000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
99dec000 99df6000   secdrv   secdrv.SYS   Wed Sep 13 09:18:32 2006 (45080528)
8ec00000 8ec0a000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
8e4d1000 8e4eb000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
885ea000 885f2000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
87e26000 87f19000   sptd     sptd.sys     Sun Oct 11 16:54:02 2009 (4AD245EA)
99e73000 99ec4000   srv      srv.sys      Thu Aug 26 23:31:26 2010 (4C77318E)
99e24000 99e73000   srv2     srv2.sys     Thu Aug 26 23:30:45 2010 (4C773165)
99df6000 99e17000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
8f7fe000 8f7ff380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
88431000 8857a000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
99e17000 99e24000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
887a7000 887b2000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
88790000 887a7000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
8e4fe000 8e50e000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
936a0000 936a9000   TSDDD    TSDDD.dll    unavailable (00000000)
8e59b000 8e5bc000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
8e6c6000 8e6d4000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
92fa0000 92fb7000   usbccgp  usbccgp.sys  Mon Jul 13 19:51:31 2009 (4A5BC883)
92fb7000 92fb8700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
8f7ef000 8f7fe000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
8e6d4000 8e718000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
8f7a4000 8f7ef000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
8f799000 8f7a4000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
87f98000 87fa3000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
88725000 88731000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
88731000 88752000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
87fde000 87fee000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8800e000 88059000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
885ab000 885ea000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
8e4eb000 8e4fe000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
88752000 8875f000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
87da7000 87e18000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
87e18000 87e26000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
8e49d000 8e4a4000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
93440000 9368b000   win32k   win32k.sys   unavailable (00000000)
87f19000 87f22000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
8e7ad000 8e7c7000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)

Unloaded modules:
99ee0000 99f4a000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0006A000
92c00000 92c17000   USBSTOR.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00017000
8869f000 886ac000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000D000
886ac000 886b7000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000
886b7000 886c0000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
886c0000 886d1000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
8e563000 8e569000   MpKslcfcf2d2
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00006000
 


Back
Top