Windows 7 Random BSOD right after login

S

Soichiro

New Member
Hi

I've Windows 7 Home Edition 64-bit installed, and everything had been working fine for almost a year until early this month. Getting random BSOD or simply a split second garbage screen and immediate reboot a few seconds after keying in password in the login screen most of the time (around 7 out of 10 tries).

Sometimes the BSOD appears while I'm not doing anything except waiting for some torrents to complete, but if I get past the login stage and have it work for 10 seconds in the desktop, it will be fine with a very low chance of BSOD.

Attached latest minidump file, would appreciate any help or clues to troubleshooting this problem. @.@

Some things I've tried...
- I have 2 sticks of 2GB ram, used either one individually but still had the problem
- After this problem surfaced, Firefox has a weird tendency to not start up, using about 2MB of memory and getting stuck. I had to try terminating Firefox, then restarting Firefox or closing other apps and then restart it.
- Gets BSOD when I tried cleaning registry using Windows 7 Manager
- Removed all startup apps except Windows Live using msconfig, same thing still happens
- System temperatures look normal
- Happened even in safe mode once

Some dumb things I might have done just before it happened..
- Running ESET NOD32 and Windows Security Essentials together. I have since removed WSE as that was a more recent installation, but I noticed it detected way more things than NOD32.
- Installed numerous apps for testing, but all had since been removed

System specs:
Gigabyte P55A-UD3
2 x 2GB Ram
i7 860 2.8GHz

Appreciate any help or hints to troubleshoot this further. Many thanks in advance!
 

Attachments

  • 123110-17581-01.dmp
    267.8 KB · Views: 454
Forgot to add that random BSOD means random BSOD messages, not just timing.

Off my mind some frequent ones that I saw...

irql_not_less_or_equal
page fault in nonpaged area
etc etc etc

The garbage screen before reboot (instead of BSOD) happened frequently as well, but only immediately after login
 
Hello and Welcome !

Seems like the crash has something to do with CA Antivirus if you have CA uninstall it completely. Follow this article and run a Hardware Diagnostic just in case Link Removed - Invalid URL

Bugcheck:

Code: 
 IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ea2803, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02ea2803 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88007adaa70 -- (.trap 0xfffff88007adaa70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88007adb428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ea2803 rsp=fffff88007adac00 rbp=fffff88007adad50
 r8=fffffa80064a3480  r9=fffff88007adad00 r10=0000000000000002
r11=fffffa80068a34a0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`02ea2803 488b09          mov     rcx,qword ptr [rcx] ds:c850:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e7eae9 to fffff80002e7f580

STACK_TEXT:  
fffff880`07ada928 fffff800`02e7eae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07ada930 fffff800`02e7d760 : 00000000`00000000 00000000`00000000 fffff8a0`02ea2800 fffffa80`05329de0 : nt!KiBugCheckDispatch+0x69
fffff880`07adaa70 fffff800`02ea2803 : fffff880`07adade8 fffff8a0`02e40c10 fffffa80`0694c070 fffffa80`0694c850 : nt!KiPageFault+0x260
fffff880`07adac00 fffff800`02e5a58f : 00000000`00000001 00008001`0074004c 00000000`00000700 00000000`00000000 : nt!IopCompleteRequest+0xae3
fffff880`07adacd0 fffff800`02e5a957 : 00000000`0000022e 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`07adad50 fffff800`02e8d4cc : fffff880`030f7180 fffff800`00000001 00000000`00000000 fffff880`00000000 : nt!KiApcInterrupt+0xd7
fffff880`07adaee0 fffff800`02e97ef1 : 00000000`00000000 00000000`00000002 00000000`00000001 fffff800`030ba840 : nt!KeFlushMultipleRangeTb+0x1cc
fffff880`07adafb0 fffff800`02eb0773 : 00000000`00000002 fffff880`07adb100 fffff8a0`02ea5000 ffffffff`ffffffff : nt!MiFlushTbAsNeeded+0x1d1
fffff880`07adb0c0 fffff800`02fb2445 : 00000000`00002000 fffffa80`0365c000 00000000`00000001 fffff6fc`50017528 : nt!MiAllocatePagedPoolPages+0x1433
fffff880`07adb1f0 fffff800`02e91fc0 : 00000000`00002000 fffffa80`0365c000 00000000`00000001 fffff800`02fb234f : nt!MiAllocatePoolPages+0x35
fffff880`07adb330 00000000`00000200 : 00000001`00000080 fffff880`07adb428 fffff880`07adb428 fffffa80`0365c000 : nt!ExpAllocateBigPool+0xb0
fffff880`07adb420 00000001`00000080 : fffff880`07adb428 fffff880`07adb428 fffffa80`0365c000 fffffa80`036e4b40 : 0x200
fffff880`07adb428 fffff880`07adb428 : fffff880`07adb428 fffffa80`0365c000 fffffa80`036e4b40 fffff800`02e644ad : 0x1`00000080
fffff880`07adb430 fffff880`07adb428 : fffffa80`0365c000 fffffa80`036e4b40 fffff800`02e644ad 00000000`0029b1c0 : 0xfffff880`07adb428
fffff880`07adb438 fffffa80`0365c000 : fffffa80`036e4b40 fffff800`02e644ad 00000000`0029b1c0 fffffa80`044b7000 : 0xfffff880`07adb428
fffff880`07adb440 fffffa80`036e4b40 : fffff800`02e644ad 00000000`0029b1c0 fffffa80`044b7000 00000000`00000000 : 0xfffffa80`0365c000
fffff880`07adb448 fffff800`02e644ad : 00000000`0029b1c0 fffffa80`044b7000 00000000`00000000 fffff880`07adb520 : 0xfffffa80`036e4b40
fffff880`07adb450 fffff880`07adb780 : fffffa80`05b61000 00000000`00002000 00000000`00000000 fffff800`031658da : nt!EtwpReserveTraceBuffer+0xe1
fffff880`07adb4f0 fffffa80`05b61000 : 00000000`00002000 00000000`00000000 fffff800`031658da fffff880`00401802 : 0xfffff880`07adb780
fffff880`07adb4f8 00000000`00002000 : 00000000`00000000 fffff800`031658da fffff880`00401802 fffffa80`05b61070 : 0xfffffa80`05b61000
fffff880`07adb500 00000000`00000000 : fffff800`031658da fffff880`00401802 fffffa80`05b61070 fffff880`20206f49 : 0x2000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02e7d760 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c42e3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260
 
Hi Super Sarge and Captain Jack,

Thanks for your replies!

I've already run memtest86, it did not report any errors. I've also tried removing either RAM sticks and the same problem persisted.

I've also done a full chkdsk on c: and verified the system files as suggested in some other threads here - no problems on that.

I have never installed CA Antivirus before, where did you see it? The BSOD is pretty much random, sometimes there is no BSOD and the screen can also just hang at "Welcome..." after trying to login.

Attached latest minidump if it helps. Thanks in advance!
 

Attachments

  • 123110-25100-01.dmp
    267.8 KB · Views: 477
Thanks for the link!

I've attached the ZIP in this post.

There are alot of HDD failure events, those belonged to an external HDD that I was pulling out files from, should not be related as I started that after the problems started.

I've also removed some entries from hosts file that are specific to my work.

Thanks in advance!
 

Attachments

  • Seven_Forums.zip
    2.1 MB · Views: 513
1. Remove Eset:

eamon.sys Fri Sep 11 01:12:19 2009


2. Install the latest version of Eset or MSE.

www.microsoft.com/security_essentials/

ESET - Antivirus Software with Spyware and Malware Protection

3. Update Realtek LAN and Audio:

Rt64win7.sys Thu Aug 20 12:05:06 2009
Realtek 8136/8168/8169 PCI/PCIe

RTKVHD64.sys Tue Dec 08 05:20:05 2009
Realtek Audio



4. Update the motherboard driver for NEC USB 3.0 Hub:

nusb3xhc.sys Mon Oct 26 10:19:48 2009







Crash Dumps:

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\123110-18704-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e08000 PsLoadedModuleList = 0xfffff800`0303ceb0
Debug session time: Thu Dec 30 23:19:42.037 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:35.052
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002e91803}

Probably caused by : msrpc.sys ( msrpc!LRPC_CASSOCIATION::OpenSecurityContext+e0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e91803, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030a70e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02e91803 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88002b950a0 -- (.trap 0xfffff88002b950a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002b95428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e91803 rsp=fffff88002b95230 rbp=fffff88002b95380
 r8=fffffa800569d300  r9=fffff88002b95330 r10=0000000000000002
r11=fffffa80044fd710 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`02e91803 488b09          mov     rcx,qword ptr [rcx] ds:3f68:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e6dae9 to fffff80002e6e580

STACK_TEXT:  
fffff880`02b94f58 fffff800`02e6dae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02b94f60 fffff800`02e6c760 : 00000000`00000000 00000000`00000000 fffffa80`0450f100 fffffa80`0670c160 : nt!KiBugCheckDispatch+0x69
fffff880`02b950a0 fffff800`02e91803 : fffff880`02b95350 fffffa80`05503f68 00000000`74706d00 fffff880`00d9e6e4 : nt!KiPageFault+0x260
fffff880`02b95230 fffff800`02e4958f : 00000000`00000001 00000000`06000000 00000000`00000000 00000000`00000000 : nt!IopCompleteRequest+0xae3
fffff880`02b95300 fffff800`02e49957 : fffff800`02fe9e80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`02b95380 fffff800`02e7f7fb : fffff800`02fe9e80 fffff800`02fe9e80 00000000`00000000 fffffa80`06d2fbe0 : nt!KiApcInterrupt+0xd7
fffff880`02b95510 fffff800`0316ab08 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInsertQueue+0x193
fffff880`02b95580 fffff880`01174190 : 00000000`00000001 fffff8a0`02e5f7d0 00000000`00000002 fffffa80`06934480 : nt!IoSetIoCompletionEx+0x58
fffff880`02b955b0 fffff880`0117305d : fffffa80`06d3e060 fffff8a0`02e5da30 00000000`00000001 fffffa80`cd637052 : msrpc!LRPC_CASSOCIATION::OpenSecurityContext+0xe0
fffff880`02b95620 fffff880`0117337b : fffff8a0`02e62970 00000000`00000000 fffff8a0`02e62970 fffff8a0`02e5da30 : msrpc!LRPC_BASE_BINDING_HANDLE::BaseBindingCopy+0x15d
fffff880`02b95760 fffff880`011769d2 : fffff8a0`02e5da30 fffff8a0`02e5da30 00000000`00000001 00000000`00000058 : msrpc!LRPC_FAST_BINDING_HANDLE::BindingCopy+0x8b
fffff880`02b95790 fffff960`003154f3 : fffff8a0`02e55430 fffff900`c3118010 fffff800`0301e560 00000000`000007ff : msrpc!RpcBindingCopy+0x42
fffff880`02b957c0 fffff960`000924b1 : fffff900`c3118010 00000000`00000000 fffffa80`06d1f6f0 00000000`00000000 : win32k!PlaySoundPostMessage+0x77
fffff880`02b95820 fffff960`000ed081 : fffff900`c3118010 fffff880`02b95c20 00000000`00000000 fffff900`c3118010 : win32k!PostPlaySoundMessage+0x25
fffff880`02b95850 fffff960`000e421f : fffff900`c3118010 fffff880`02b95c20 00000000`ffffffff 00000000`00000000 : win32k!DestroyProcessInfo+0x125
fffff880`02b95880 fffff960`000e431a : fffffa80`0614f600 fffff900`c3118010 00020500`00000000 00000000`774eec01 : win32k!xxxUserProcessCallout+0x15f
fffff880`02b958d0 fffff800`03153455 : fffffa80`0614f660 00000000`00000000 00000000`00000000 fffffa80`06d3e060 : win32k!W32pProcessCallout+0x4e
fffff880`02b95900 fffff800`0312c0ed : 00000000`00000001 fffff800`0316cc01 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`02b959c0 fffff800`02e496a3 : fffffa80`06701901 fffffa80`0626e4d0 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`02b959f0 fffff800`02e49af0 : 00000000`0030a8b0 fffff880`02b95a70 fffff800`0312c1fc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`02b95a70 fffff800`02e6d877 : fffffa80`06d3a6a0 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`02b95bb0 00000000`775301ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`023eeea8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775301ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
msrpc!LRPC_CASSOCIATION::OpenSecurityContext+e0
fffff880`01174190 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  msrpc!LRPC_CASSOCIATION::OpenSecurityContext+e0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: msrpc

IMAGE_NAME:  msrpc.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc17c

FAILURE_BUCKET_ID:  X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+e0

BUCKET_ID:  X64_0xA_msrpc!LRPC_CASSOCIATION::OpenSecurityContext+e0

Followup: MachineOwner
---------


















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\123110-20217-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e05000 PsLoadedModuleList = 0xfffff800`03039eb0
Debug session time: Thu Dec 30 23:22:32.086 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:30.101
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002e8e986}

Probably caused by : win32k.sys ( win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+5c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e8e986, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030a40e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+c73
fffff800`02e8e986 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff88

TRAP_FRAME:  fffff88007991340 -- (.trap 0xfffff88007991340)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88007991428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e8e986 rsp=fffff880079914d0 rbp=fffff88007991620
 r8=fffffa80066bf8e0  r9=fffff880079915d0 r10=0000000000000002
r11=fffffa80068b0360 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xc73:
fffff800`02e8e986 488b09          mov     rcx,qword ptr [rcx] ds:06a8:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e6aae9 to fffff80002e6b580

STACK_TEXT:  
fffff880`079911f8 fffff800`02e6aae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`07991200 fffff800`02e69760 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`065196f0 : nt!KiBugCheckDispatch+0x69
fffff880`07991340 fffff800`02e8e986 : fffff900`c30c3350 00000000`00000003 fffff900`c30c3340 fffff800`02fa22dd : nt!KiPageFault+0x260
fffff880`079914d0 fffff800`02e4658f : 00000000`00000000 fffff900`c0200000 00000000`00000000 fffffa80`00000000 : nt!IopCompleteRequest+0xc73
fffff880`079915a0 fffff800`02e46957 : 00000000`00003f18 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`07991620 fffff800`02e94b00 : fffff960`000edd58 00000000`00000001 00000000`00000001 ffff01e0`07b7458c : nt!KiApcInterrupt+0xd7
fffff880`079917b8 fffff960`000edd58 : 00000000`00000001 00000000`00000001 ffff01e0`07b7458c 00000000`0000094c : nt!PsGetCurrentProcessId
fffff880`079917c0 fffff960`000ed5f1 : 00000000`00000000 fffff880`07991c1f 00000000`0000094c fffff900`c312c010 : win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+0x5c
fffff880`079917f0 fffff960`000e4c00 : 00000000`0000094c fffff880`07991c00 fffff900`c312c010 fffff900`00000000 : win32k!NtGdiCloseProcess+0x25d
fffff880`07991850 fffff960`000e4337 : fffffa80`06140000 fffff880`07991c20 00020500`00000000 00000000`76cdec01 : win32k!GdiProcessCallout+0x200
fffff880`079918d0 fffff800`03150455 : fffffa80`06140090 00000000`00000000 00000000`00000000 fffffa80`06ae7b60 : win32k!W32pProcessCallout+0x6b
fffff880`07991900 fffff800`031290ed : 00000000`00000001 fffff800`03169c01 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`079919c0 fffff800`02e466a3 : fffffa80`06711b01 fffffa80`06844010 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`079919f0 fffff800`02e46af0 : 00000000`0032a3e0 fffff880`07991a70 fffff800`031291fc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`07991a70 fffff800`02e6a877 : fffffa80`06aeb860 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`07991bb0 00000000`76d201ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0232ed98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76d201ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+5c
fffff960`000edd58 8b4c3b08        mov     ecx,dword ptr [rbx+rdi+8]

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+5c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cbe5d3e

FAILURE_BUCKET_ID:  X64_0xA_win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+5c

BUCKET_ID:  X64_0xA_win32k!MultiUserGreCleanupHmgOwnRemoveAllLocks+5c

Followup: MachineOwner
---------














Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\123110-21543-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`03053eb0
Debug session time: Thu Dec 30 12:36:45.024 2010 (UTC - 5:00)
System Uptime: 0 days 1:59:36.039
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002ea8803}

Probably caused by : win32k.sys ( win32k!GreAcquireSemaphore+1c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ea8803, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030be0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02ea8803 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  aitagent.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff88003e4a080 -- (.trap 0xfffff88003e4a080)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88003e4a428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ea8803 rsp=fffff88003e4a210 rbp=fffff88003e4a360
 r8=fffffa8003f6e010  r9=fffff88003e4a310 r10=0000000000000002
r11=fffffa8005334ad0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`02ea8803 488b09          mov     rcx,qword ptr [rcx] ds:e6a8:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e84ae9 to fffff80002e85580

STACK_TEXT:  
fffff880`03e49f38 fffff800`02e84ae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`03e49f40 fffff800`02e83760 : 00000000`00000000 00000000`00000000 fffffa80`06701000 fffffa80`03854c60 : nt!KiBugCheckDispatch+0x69
fffff880`03e4a080 fffff800`02ea8803 : fffff800`03000e80 fffffa80`0685d720 00000000`00000000 fffffa80`06701010 : nt!KiPageFault+0x260
fffff880`03e4a210 fffff800`02e6058f : 00000000`00000001 00000000`00004443 00000000`00000000 fffffa80`00000000 : nt!IopCompleteRequest+0xae3
fffff880`03e4a2e0 fffff800`02e60957 : fffffa80`050cbbf0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`03e4a360 fffff800`02e8d525 : fffff900`c2a22580 fffff960`001343a9 fffffa80`0652a060 00000000`00000010 : nt!KiApcInterrupt+0xd7
fffff880`03e4a4f0 fffff800`02e911fb : 00000000`00000000 fffffa80`050cbbf0 00000000`00000001 00000000`00000001 : nt!ExAcquireResourceExclusiveLite+0xb5
fffff880`03e4a560 fffff960`001f6b40 : 00000000`00004fb8 fffff960`001f6c2f 00000000`00000000 00000000`00000000 : nt!ExEnterCriticalRegionAndAcquireResourceExclusive+0x1b
fffff880`03e4a590 fffff960`001f6bdc : fffff900`c02031b0 fffff800`02e91322 fffff900`c2a32750 00000000`00000001 : win32k!GreAcquireSemaphore+0x1c
fffff880`03e4a5c0 fffff960`00134e0b : 00000000`00004fb8 fffff960`001f6c2f fffff900`c02036d8 fffff800`02e91322 : win32k!GreAcquireHmgrSemaphore+0x10
fffff880`03e4a5f0 fffff960`00134f52 : 00000000`00000001 fffff900`c2a32750 00000000`00000001 fffff900`c2a32978 : win32k!HmgRemoveObject+0x3f
fffff880`03e4a660 fffff960`001355c9 : fffff900`c00b7010 fffff900`c2a32750 00000000`00000001 fffff900`c2a32978 : win32k!XEPALOBJ::vUnrefPalette+0x22
fffff880`03e4a6a0 fffff960`0013d65d : 00000000`00000000 fffff880`00000001 fffff900`c2a32750 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x5c1
fffff880`03e4a7f0 fffff960`00134c00 : 00000000`00004fb8 fffff880`03e4ac00 fffff900`c2a416a0 fffff900`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`03e4a850 fffff960`00134337 : fffffa80`050b5a00 fffff880`03e4ac20 fffffa00`00000000 00000000`778fec01 : win32k!GdiProcessCallout+0x200
fffff880`03e4a8d0 fffff800`0316a455 : fffffa80`050b5ab0 00000000`00000000 00000000`00000000 fffffa80`04a26750 : win32k!W32pProcessCallout+0x6b
fffff880`03e4a900 fffff800`031430ed : 00000000`00000000 fffff800`03183c01 fffffa80`78457300 00000000`00000000 : nt!PspExitThread+0x561
fffff880`03e4a9c0 fffff800`02e606a3 : fffffa80`04a09001 fffffa80`04795300 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`03e4a9f0 fffff800`02e60af0 : 00000000`00141590 fffff880`03e4aa70 fffff800`031431fc 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`03e4aa70 fffff800`02e84877 : fffffa80`049269a0 0000007f`fffffff8 00000000`00000001 00000980`00000000 : nt!KiInitiateUserApc+0x70
fffff880`03e4abb0 00000000`779401ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`00ceee28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779401ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!GreAcquireSemaphore+1c
fffff960`001f6b40 4883c420        add     rsp,20h

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  win32k!GreAcquireSemaphore+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cbe5d3e

FAILURE_BUCKET_ID:  X64_0xA_win32k!GreAcquireSemaphore+1c

BUCKET_ID:  X64_0xA_win32k!GreAcquireSemaphore+1c

Followup: MachineOwner
---------


















Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\123110-25100-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e0e000 PsLoadedModuleList = 0xfffff800`03042eb0
Debug session time: Fri Dec 31 03:22:56.798 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:37.813
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 0, fffff80002e97803}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e97803, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ad0e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!IopCompleteRequest+ae3
fffff800`02e97803 488b09          mov     rcx,qword ptr [rcx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  AtBroker.exe

IRP_ADDRESS:  ffffffffffffff89

TRAP_FRAME:  fffff8800442da70 -- (.trap 0xfffff8800442da70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8800442e428 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e97803 rsp=fffff8800442dc00 rbp=fffff8800442dd50
 r8=fffffa80055b8a10  r9=fffff8800442dd00 r10=0000000000000002
r11=fffffa800658fb20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po cy
nt!IopCompleteRequest+0xae3:
fffff800`02e97803 488b09          mov     rcx,qword ptr [rcx] ds:26a8:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e73ae9 to fffff80002e74580

STACK_TEXT:  
fffff880`0442d928 fffff800`02e73ae9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0442d930 fffff800`02e72760 : 00000000`00000000 00000000`00000000 fffff8a0`020b4f00 fffffa80`06d69970 : nt!KiBugCheckDispatch+0x69
fffff880`0442da70 fffff800`02e97803 : fffff880`0442dde8 fffff8a0`029f0d00 fffffa80`06d75e60 fffffa80`06d73a20 : nt!KiPageFault+0x260
fffff880`0442dc00 fffff800`02e4f58f : 00000000`00000001 00008001`0074004c 00000000`00000000 fffffa80`00000000 : nt!IopCompleteRequest+0xae3
fffff880`0442dcd0 fffff800`02e4f957 : 00000000`000003fd 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`0442dd50 fffff800`02e824cc : fffff800`02fefe80 fffff800`00000001 00000000`00000000 fffff880`00000000 : nt!KiApcInterrupt+0xd7
fffff880`0442dee0 fffff800`02e8cef1 : 00000000`00000000 00000000`00000002 00000000`00000001 fffff800`030af840 : nt!KeFlushMultipleRangeTb+0x1cc
fffff880`0442dfb0 fffff800`02ea5773 : 00000000`00000002 fffff880`0442e100 fffff8a0`0a60e000 ffffffff`ffffffff : nt!MiFlushTbAsNeeded+0x1d1
fffff880`0442e0c0 fffff800`02fa7445 : 00000000`00002000 fffffa80`0365d000 00000000`00000001 fffff6fc`50053070 : nt!MiAllocatePagedPoolPages+0x1433
fffff880`0442e1f0 fffff800`02e86fc0 : 00000000`00002000 fffffa80`0365d000 00000000`00000001 fffff800`02fa734f : nt!MiAllocatePoolPages+0x35
fffff880`0442e330 00000000`00000200 : 00000001`00000080 fffff880`0442e428 fffff880`0442e428 0050e0c2`4f000000 : nt!ExpAllocateBigPool+0xb0
fffff880`0442e420 00000001`00000080 : fffff880`0442e428 fffff880`0442e428 0050e0c2`4f000000 00000000`00000000 : 0x200
fffff880`0442e428 fffff880`0442e428 : fffff880`0442e428 0050e0c2`4f000000 00000000`00000000 fffff800`02e50000 : 0x1`00000080
fffff880`0442e430 fffff880`0442e428 : 0050e0c2`4f000000 00000000`00000000 fffff800`02e50000 00000000`0029b1ac : 0xfffff880`0442e428
fffff880`0442e438 0050e0c2`4f000000 : 00000000`00000000 fffff800`02e50000 00000000`0029b1ac fffffa80`042b8000 : 0xfffff880`0442e428
fffff880`0442e440 00000000`00000000 : fffff800`02e50000 00000000`0029b1ac fffffa80`042b8000 00000000`00000000 : 0x50e0c2`4f000000


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02e72760 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c42e3

FAILURE_BUCKET_ID:  X64_0xA_nt!KiPageFault+260

BUCKET_ID:  X64_0xA_nt!KiPageFault+260

Followup: MachineOwner
---------




Drivers:

Code: 
start             end                 module name
fffff880`00ed4000 fffff880`00f2b000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02a86000 fffff880`02a9e000   adfs     adfs.SYS     Thu Jun 26 16:52:37 2008 (48640195)
fffff880`02c47000 fffff880`02cd1000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`03c1f000 fffff880`03c35000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`010d5000 fffff880`010e0000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`03caf000 fffff880`03cba000   appliand appliand.sys Fri May 28 07:54:10 2010 (4BFFAEE2)
fffff880`00fd9000 fffff880`00fe2000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`010ab000 fffff880`010d5000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`04160000 fffff880`04181000   AtiHdmi  AtiHdmi.sys  Wed Sep 30 09:54:46 2009 (4AC36326)
fffff880`03cc0000 fffff880`03cf4000   atikmpag atikmpag.sys Tue Feb 02 22:23:59 2010 (4B68EC4F)
fffff880`04848000 fffff880`04eac000   atipmdag atipmdag.sys Tue Feb 02 23:21:24 2010 (4B68F9C4)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`019d3000 fffff880`019da000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`01200000 fffff880`01211000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`02a00000 fffff880`02a1e000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`006a0000 fffff960`006c7000   cdd      cdd.dll      Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`019a0000 fffff880`019ca000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cda000 fffff880`00d9a000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0193a000 fffff880`0196a000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c7c000 fffff880`00cda000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`03c0f000 fffff880`03c1f000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`066f8000 fffff880`06706000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02c1a000 fffff880`02c38000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02c0b000 fffff880`02c1a000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01924000 fffff880`0193a000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`041be000 fffff880`041e0000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`06712000 fffff880`0671b000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06706000 fffff880`06712000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0671b000 fffff880`0672e000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`066ec000 fffff880`066f8000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04eac000 fffff880`04fa0000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`04fa0000 fffff880`04fe6000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`02aad000 fffff880`02b7f000   eamon    eamon.sys    Fri Sep 11 01:12:19 2009 (4AA9DC33)
fffff880`019da000 fffff880`019fd000   ehdrv    ehdrv.sys    Fri Sep 11 01:12:55 2009 (4AA9DC57)
fffff880`02ba0000 fffff880`02bcc000   epfw     epfw.sys     Fri Sep 11 01:07:43 2009 (4AA9DB1F)
fffff880`04ff2000 fffff880`04ffd000   Epfwndis Epfwndis.sys Thu Apr 09 08:43:20 2009 (49DDED68)
fffff880`067ea000 fffff880`067fa000   epfwwfp  epfwwfp.sys  Fri Sep 11 01:07:43 2009 (4AA9DB1F)
fffff880`0112c000 fffff880`01140000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010e0000 fffff880`0112c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`013f6000 fffff880`01400000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`018ea000 fffff880`01924000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`033e1000 fffff800`0342a000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`04800000 fffff880`04824000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`0673c000 fffff880`06755000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`06755000 fffff880`0675d080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`0672e000 fffff880`0673c000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`06400000 fffff880`064c8000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`018e1000 fffff880`018ea000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03dd5000 fffff880`03df3000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01211000 fffff880`01227000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`03c00000 fffff880`03c0f000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00ba9000 fffff800`00bac000   kdcom    kdcom.dll    Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`04085000 fffff880`040c8000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013cb000 fffff880`013e5000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`041e0000 fffff880`041e5200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`02bcc000 fffff880`02be1000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`06779000 fffff880`0679c000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`04017000 fffff880`04053880   mcdbus   mcdbus.sys   Tue Feb 24 05:34:07 2009 (49A3CD1F)
fffff880`00c24000 fffff880`00c68000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`0676b000 fffff880`06779000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`02c38000 fffff880`02c47000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`0675e000 fffff880`0676b000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00fbf000 fffff880`00fd9000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02a1e000 fffff880`02a36000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02a36000 fffff880`02a63000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0679c000 fffff880`067ea000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`02a63000 fffff880`02a86000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`0185e000 fffff880`01869000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f34000 fffff880`00f3e000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01140000 fffff880`0119e000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02c00000 fffff880`02c0b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`018cf000 fffff880`018e1000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014db000 fffff880`015cd000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`03c59000 fffff880`03c65000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`03c65000 fffff880`03c94000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0414b000 fffff880`04160000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02d45000 fffff880`02d54000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02cd1000 fffff880`02d16000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01869000 fffff880`0187a000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02df1000 fffff880`02dfd000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02e0e000 fffff800`033e1000   nt       ntkrnlmp.exe Sat Jun 19 00:09:07 2010 (4C1C42E3)
fffff880`01228000 fffff880`013cb000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`019ca000 fffff880`019d3000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04134000 fffff880`0414b000   nusb3hub nusb3hub.sys Mon Oct 26 10:19:44 2009 (4AE5B000)
fffff880`03d89000 fffff880`03db8000   nusb3xhc nusb3xhc.sys Mon Oct 26 10:19:48 2009 (4AE5B004)
fffff880`02d1f000 fffff880`02d45000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`03db8000 fffff880`03dd5000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`00f7e000 fffff880`00f93000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f3e000 fffff880`00f71000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fa8000 fffff880`00faf000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00faf000 fffff880`00fbf000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013e5000 fffff880`013f6000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`072c8000 fffff880`0736e000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04181000 fffff880`041be000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c68000 fffff880`00c7c000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`03c35000 fffff880`03c59000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`03c94000 fffff880`03caf000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`00e00000 fffff880`00e21000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`00fe2000 fffff880`00ffc000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02da0000 fffff880`02df1000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`01843000 fffff880`0184c000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0184c000 fffff880`01855000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`01855000 fffff880`0185e000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01895000 fffff880`018cf000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02be1000 fffff880`02bf9000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`03d4a000 fffff880`03d89000   Rt64win7 Rt64win7.sys Thu Aug 20 12:05:06 2009 (4A8D7432)
fffff880`064ce000 fffff880`066eb300   RTKVHD64 RTKVHD64.sys Tue Dec 08 05:20:05 2009 (4B1E2855)
fffff880`04054000 fffff880`04083000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0736e000 fffff880`07379000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04fe6000 fffff880`04ff2000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02d54000 fffff880`02d71000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`015cd000 fffff880`015d5000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`08af4000 fffff880`08b8a000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`07200000 fffff880`07267000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`07379000 fffff880`073a6000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04083000 fffff880`04084480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`073a6000 fffff880`073b8000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`0187a000 fffff880`01887000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`015d5000 fffff880`015f3000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02d8c000 fffff880`02da0000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00480000 fffff960`0048a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`01073000 fffff880`01099000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`040c8000 fffff880`040da000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`04842000 fffff880`04843f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04831000 fffff880`04842000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`040da000 fffff880`04134000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`03cf4000 fffff880`03d4a000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`04824000 fffff880`04831000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00f71000 fffff880`00f7e000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01800000 fffff880`0180e000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0180e000 fffff880`01833000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00f93000 fffff880`00fa8000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d9a000 fffff880`00df6000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`0119e000 fffff880`011ea000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02d71000 fffff880`02d8c000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`01833000 fffff880`01843000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e21000 fffff880`00ec5000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ec5000 fffff880`00ed4000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02d16000 fffff880`02d1f000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00040000 fffff960`00350000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00f2b000 fffff880`00f34000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`02b7f000 fffff880`02ba0000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`0196a000 fffff880`01978000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`01978000 fffff880`01984000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`01984000 fffff880`0198d000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`0198d000 fffff880`019a0000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
 
Thanks for the suggestions!

I've removed ESET, and installed WSE from MS website (should be latest), did an update and a full scan as well.

The LAN, Audio and USB3 drivers have also been updated. Attached latest system info with the minidumps today.

Still getting the BSODs though. BUT.... I had also done some windows updates.. and since it often requires a reboot to carry on part of the install and my reboots often end up with BSOD... I'm not sure if any of the updates screwed up at all.

The most frequent BSOD is still
IRQL_NOT_LESS_OR_EQUAL

Still a mind boggling issue for me. The system could run for days
without problems but once it had to reboot, it just dies often
within the first few seconds of login.
 

Attachments

  • Seven Forums v2.zip
    610.9 KB · Views: 650
Caused by ataport.sys.

Give some more info,

http://windows7forums.com/blue-scre...mportant-every-thread-starter-please-see.html






Crash Dumps:

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\010111-19453-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.20738.amd64fre.win7_ldr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e0f000 PsLoadedModuleList = 0xfffff800`03043eb0
Debug session time: Fri Dec 31 22:15:32.487 2010 (UTC - 5:00)
System Uptime: 0 days 0:00:36.517
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8, 2, 0, fffff80002e501f1}

Probably caused by : ataport.SYS ( ataport!IdeCompleteScsiIrp+62 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002e501f1, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030ae0e0
 0000000000000008 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertQueueApc+1e9
fffff800`02e501f1 488b5108        mov     rdx,qword ptr [rcx+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c650 -- (.trap 0xfffff80000b9c650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8006337e58 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e501f1 rsp=fffff80000b9c7e0 rbp=fffff80002ff0e80
 r8=0000000000000000  r9=0000000000000000 r10=0000000000003800
r11=fffff8000302b702 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!KiInsertQueueApc+0x1e9:
fffff800`02e501f1 488b5108        mov     rdx,qword ptr [rcx+8] ds:7650:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e74ae9 to fffff80002e75580

STACK_TEXT:  
fffff800`00b9c508 fffff800`02e74ae9 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff800`00b9c510 fffff800`02e73760 : 00000000`00000000 00000000`00000008 fffffa80`06269600 fffffa80`06401b60 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c650 fffff800`02e501f1 : fffffa80`062697c0 00000000`00000200 fffffa80`062984e8 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c7e0 fffff800`02e534f0 : fffffa80`06401b60 00000000`00000002 00000000`00000000 fffffa80`06337e58 : nt!KiInsertQueueApc+0x1e9
fffff800`00b9c810 fffff800`02e7844b : 00000000`00000000 00000000`a000000c 00000000`00000000 00000000`00000002 : nt!KeInsertQueueApc+0x80
fffff800`00b9c870 fffff880`00ddd41a : 00000000`00000200 00000000`00000001 fffffa80`062686f0 00000000`00000000 : nt!IopfCompleteRequest+0xbdb
fffff800`00b9c950 fffff880`00ddd242 : fffffa80`062686f0 fffff880`00ddfb3b fffffa80`062696f0 fffffa80`0452a1b0 : ataport!IdeCompleteScsiIrp+0x62
fffff800`00b9c980 fffff880`00dd7e32 : 00000000`00000000 00000000`00000000 fffffa80`04501500 fffffa80`0452a1b0 : ataport!IdeCommonCrbCompletion+0x5a
fffff800`00b9c9b0 fffff880`00de07ed : fffffa80`045001a0 fffffa80`062686f0 00000000`00000000 fffffa80`062686f0 : ataport!IdeTranslateCompletedRequest+0x236
fffff800`00b9cae0 fffff880`00de00ec : fffffa80`045001a0 00000000`00000000 fffffa80`045001a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff800`00b9cc10 fffff800`02e80ddc : fffff800`02ff0e80 fffff800`02f8165e fffffa80`04500050 fffffa80`04500118 : ataport!IdePortCompletionDpc+0x1a8
fffff800`00b9ccd0 fffff800`02e7defa : fffff800`02ff0e80 fffff800`02ffecc0 00000000`00000000 fffff880`00ddff44 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ataport!IdeCompleteScsiIrp+62
fffff880`00ddd41a 8bc3            mov     eax,ebx

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  ataport!IdeCompleteScsiIrp+62

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ataport

IMAGE_NAME:  ataport.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc118

FAILURE_BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

BUCKET_ID:  X64_0xA_ataport!IdeCompleteScsiIrp+62

Followup: MachineOwner
---------




Drivers:

Code: 
start             end                 module name
fffff880`00eb7000 fffff880`00f0e000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04623000 fffff880`0463b000   adfs     adfs.SYS     Thu Jun 26 16:52:37 2008 (48640195)
fffff880`02cee000 fffff880`02d78000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04355000 fffff880`0436b000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00c00000 fffff880`00c0b000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04800000 fffff880`0480b000   appliand appliand.sys Fri May 28 07:54:10 2010 (4BFFAEE2)
fffff880`00dcb000 fffff880`00dd4000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00dd4000 fffff880`00dfe000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`045d3000 fffff880`045f4000   AtiHdmi  AtiHdmi.sys  Wed Sep 30 09:54:46 2009 (4AC36326)
fffff880`0480b000 fffff880`05000000   atikmdag atikmdag.sys Tue Oct 26 22:29:53 2010 (4CC78EA1)
fffff880`03c40000 fffff880`03c8b000   atikmpag atikmpag.sys Tue Oct 26 22:14:23 2010 (4CC78AFF)
fffff960`00820000 fffff960`00881000   ATMFD    ATMFD.DLL    unavailable (00000000)
fffff880`01991000 fffff880`01998000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`01847000 fffff880`01858000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`0474e000 fffff880`0476c000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00710000 fffff960`00737000   cdd      cdd.dll      unavailable (00000000)
fffff880`0192d000 fffff880`01957000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cf1000 fffff880`00db1000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`018c7000 fffff880`018f7000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c93000 fffff880`00cf1000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0115c000 fffff880`011cf000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04345000 fffff880`04355000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05abd000 fffff880`05acb000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02cc3000 fffff880`02ce1000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02cb4000 fffff880`02cc3000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`018b1000 fffff880`018c7000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0443d000 fffff880`0445f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05ad7000 fffff880`05ae0000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05acb000 fffff880`05ad7000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05ae0000 fffff880`05af3000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05b32000 fffff880`05b3e000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`03c8b000 fffff880`03d7f000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`03d7f000 fffff880`03dc5000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`010ea000 fffff880`010fe000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0109e000 fffff880`010ea000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01211000 fffff880`0121b000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01877000 fffff880`018b1000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`033e2000 fffff800`0342b000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`03dc5000 fffff880`03de9000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05b01000 fffff880`05b1a000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05b1a000 fffff880`05b22080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`05af3000 fffff880`05b01000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`04686000 fffff880`0474e000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`015e1000 fffff880`015ea000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`04318000 fffff880`04336000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01858000 fffff880`0186e000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`04336000 fffff880`04345000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bcb000 fffff800`00bce000   kdcom    kdcom.dll    Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`0450f000 fffff880`04552000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013e1000 fffff880`013fb000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`0445f000 fffff880`04464200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`05b90000 fffff880`05ba5000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05b4c000 fffff880`05b6f000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`044a1000 fffff880`044dd880   mcdbus   mcdbus.sys   Tue Feb 24 05:34:07 2009 (49A3CD1F)
fffff880`00c3b000 fffff880`00c7f000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`05b3e000 fffff880`05b4c000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`03c00000 fffff880`03c0f000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`05b25000 fffff880`05b32000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00db1000 fffff880`00dcb000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`01957000 fffff880`01988000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`0463b000 fffff880`0464b000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`0476c000 fffff880`04784000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`04784000 fffff880`047b1000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`047b1000 fffff880`047ff000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`04600000 fffff880`04623000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01800000 fffff880`0180b000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f17000 fffff880`00f21000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`010fe000 fffff880`0115c000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02ca9000 fffff880`02cb4000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`014dd000 fffff880`014ef000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014ef000 fffff880`015e1000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`0438f000 fffff880`0439b000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0439b000 fffff880`043ca000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`045be000 fffff880`045d3000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02dec000 fffff880`02dfb000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02d78000 fffff880`02dbd000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`0676e000 fffff880`06783000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`0180b000 fffff880`0181c000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02c9d000 fffff880`02ca9000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02e0f000 fffff800`033e2000   nt       ntkrnlmp.exe Sat Jun 19 00:09:07 2010 (4C1C42E3)
fffff880`0123e000 fffff880`013e1000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`01988000 fffff880`01991000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`06783000 fffff880`067b4000   nusb3xhc nusb3xhc.sys Thu Nov 18 20:34:25 2010 (4CE5D421)
fffff880`02dc6000 fffff880`02dec000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`042fb000 fffff880`04318000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`00f61000 fffff880`00f76000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f21000 fffff880`00f54000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fe7000 fffff880`00fee000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00fee000 fffff880`00ffe000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01200000 fffff880`01211000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`06430000 fffff880`064d6000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04400000 fffff880`0443d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c7f000 fffff880`00c93000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`0436b000 fffff880`0438f000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`043ca000 fffff880`043e5000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04200000 fffff880`04221000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`043e5000 fffff880`043ff000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02c4c000 fffff880`02c9d000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`019db000 fffff880`019e4000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019e4000 fffff880`019ed000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`019ed000 fffff880`019f6000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`0104c000 fffff880`01086000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05ba5000 fffff880`05bbd000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04289000 fffff880`042ef000   Rt64win7 Rt64win7.sys Tue Nov 30 01:01:28 2010 (4CF49338)
fffff880`05838000 fffff880`05abcb80   RTKVHD64 RTKVHD64.sys Tue Nov 30 04:03:19 2010 (4CF4BDD7)
fffff880`044de000 fffff880`0450d000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`064d6000 fffff880`064e1000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`042ef000 fffff880`042fb000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02c00000 fffff880`02c1d000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`014d5000 fffff880`014dd000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`066d8000 fffff880`0676e000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`06520000 fffff880`06587000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`064e1000 fffff880`0650e000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`0450d000 fffff880`0450e480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01600000 fffff880`017fd000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0650e000 fffff880`06520000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`0183a000 fffff880`01847000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`0181c000 fffff880`0183a000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02c38000 fffff880`02c4c000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00560000 fffff960`0056a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`011cf000 fffff880`011f5000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`04552000 fffff880`04564000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`05b23000 fffff880`05b24f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04278000 fffff880`04289000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04564000 fffff880`045be000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04222000 fffff880`04278000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`03de9000 fffff880`03df6000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00f54000 fffff880`00f61000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01998000 fffff880`019a6000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`019a6000 fffff880`019cb000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`00f76000 fffff880`00f8b000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f8b000 fffff880`00fe7000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01000000 fffff880`0104c000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c1d000 fffff880`02c38000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`019cb000 fffff880`019db000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e04000 fffff880`00ea8000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ea8000 fffff880`00eb7000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02dbd000 fffff880`02dc6000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00050000 fffff960`00360000   win32k   win32k.sys   unavailable (00000000)
fffff880`00f0e000 fffff880`00f17000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`05b6f000 fffff880`05b90000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`018f7000 fffff880`01905000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`01905000 fffff880`01911000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`01911000 fffff880`0191a000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`0191a000 fffff880`0192d000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
 
Uploaded the tabs from CPUID. Seems to be happening more frequently today, even after logging in. Overall still pretty random.
 

Attachments

  • cpuid_cpu.gif
    cpuid_cpu.gif
    24.4 KB · Views: 424
  • cpuid_spd.gif
    cpuid_spd.gif
    19.2 KB · Views: 450
  • cpuid_memory.gif
    cpuid_memory.gif
    16.4 KB · Views: 413
Your most recent crash was caused by ataport.sys. The problem is likely with the hardware - RAM/HDD/Motherboard. Since RAM is a very frequent causer, I'd like to be sure it's OK.
 
Hi!

I've run 10 passes with memtest86 over 7 hours, seems to have no problems. Attached a pic of the test just in case I've gotten anything wrong. I also tried using each piece of RAM individually and the same problems occurred.

Had run chkdsk /r c: yesterday, no errors detected.

Not sure how to test the motherboard though?

Thanks!
 

Attachments

  • memtest.jpg
    memtest.jpg
    82.3 KB · Views: 416
The memtest looks good, no errors. Yet, give link to your RAM web site or .pdf file with the specs outlined - let's verify it.
 
Attached report from HDDScan. Is this the one you are referring to?

I had run chkdsk /r c: before as well, no errors reported.
 

Attachments

  • hddsmart.gif
    hddsmart.gif
    43.9 KB · Views: 431
Yes, thanks and good news your hdd looks fine. : )


I had run chkdsk /r c: before as well, no errors reported.
Click to expand...

Not sure how long ago that was, and also you might benefit from checking the entire drive space not just c.
chkdsk /r /f
 
You must log in or register to reply here.

Similar threads

H
Windows 10 Intermittent Hang after Login - System App Only
Replies
0
Views
383
hppr223556
H
D
Win 11 profile list problem
Replies
2
Views
377
Digger
D
S
Windows 10 Bizarre power issue
Replies
2
Views
510
MikeHawthorne
MikeHawthorne
andybn1
windows 11 think's it's in preinstallation after rebuilding the bcd store
Replies
7
Views
1K
ussnorway
ussnorway
gwynbleidd
Windows 11 Very slow cold boot, driver loading problems
Replies
3
Views
862
gwynbleidd
gwynbleidd
Back
Top