Windows 7 Random BSOD

[hdfsi]

I have a custom build pc, with all new parts besides the HDD. I have been getting random BSOD an i can figure out why. I have the windows error report when the pc restarts. Also i can not upload the dump it says i dont have access to it.


Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: 4e
BCP1: 0000000000000099
BCP2: 0000000000123EB9
BCP3: 0000000000000002
BCP4: 0000000000123F38
OS Version: 6_1_7600
Service Pack: 0_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\040511-17312-01.dmp
C:\Users\hdfsi\AppData\Local\Temp\WER-64937-0.sysdata.xml

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

 

[cybercore]

1. C:\Windows\Minidump\

2. 4e-pfn list corrupt Link Removed

 

[hdfsi]

Ok i have gotten the screenshots. Link RemovedLink RemovedLink RemovedLink RemovedLink Removed

 

[cybercore]

1. RAM is set right.

2. Attach your crash dumps.

3. RAM - Test with Memtest86+ - Windows 7 Forums

 

[hdfsi]

Ill run the memtest right now but i can upload the dumps. It says i dont have permission to upload/rar.

 

[Trouble]

hdfsi;
Copy and paste several of your most recent crash dump files into a new folder on your desktop. Then right click the folder and choose send to "Compressed (zipped) folder". This should create a new folder on your desktop with a .zip extension. Please attach that to your next post by selecting reply, then go advanced and then use the paperclip icon to browse for the zipped folder and upload it here.

 

[hdfsi]

Hello,
I have ran the memtest for 8passes and no errors. Also i have tried to compress it with the way you said and its not working it says "File not found or no read permission." I dont know what to do. Is their another way to upload it. I have also tried to upload it to the site and says i dont have permission.

 

[hdfsi]

Ok I had to share than with my admin user.. makes no scene but i have got it.


-----------------
Link Removed
-----------------

 

[cybercore]

RAM is the problem:

PFN_LIST_CORRUPT (4e)
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

MEMORY_MANAGEMENT (1a)
Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

MEMORY_MANAGEMENT (1a)
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

MEMORY_MANAGEMENT (1a)
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f72 )

1. Run the memtest.


2. Update Realtek LAN
Rt64win7.sys Thu Feb 26 04:04:13 2009
Link Removed


3. Update Google Earth/OpenVPN
tap0901t.sys Wed Sep 16 02:02:43 2009



CRASH DUMPS

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\033111-16359-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a06000 PsLoadedModuleList = 0xfffff800`02c43e50
Debug session time: Thu Mar 31 20:34:47.645 2011 (UTC - 4:00)
System Uptime: 0 days 2:25:07.801
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff6800003a6d0, b63000002ff97867, fffff68000055b82}

Probably caused by : win32k.sys ( win32k!SURFACE::Map+175 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff6800003a6d0
Arg3: b63000002ff97867
Arg4: fffff68000055b82

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  TeamViewer_Des

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002a2d228 to fffff80002a77f00

STACK_TEXT:  
fffff880`0e511be8 fffff800`02a2d228 : 00000000`0000001a 00000000`00000403 fffff680`0003a6d0 b6300000`2ff97867 : nt!KeBugCheckEx
fffff880`0e511bf0 fffff800`02aa8b51 : 00000000`00000000 fffff680`0003aff8 fffffa80`04710b30 f0500001`08bbc867 : nt! ?? ::FNODOBFM::`string'+0x31f72
fffff880`0e511da0 fffff800`02aab5d9 : fffff880`00000000 00000000`078eefff fffff900`00000000 00000000`00000068 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0e511f60 fffff800`02d8de50 : fffffa80`03f683c0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0e512080 fffff960`000f3aa5 : 00000000`00000001 fffffa80`05acac80 00000000`00000001 00000cac`00000000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`0e512140 fffff960`0022306e : 00000000`00000000 fffff880`0e512260 fffff880`0e512250 00000000`00000001 : win32k!SURFACE::Map+0x175
fffff880`0e512190 fffff960`001046c8 : fffff900`c0107010 fffff880`0e512250 00000000`00000001 00000438`00000c80 : win32k!DEVLOCKOBJ::bMapTrgSurfaceView+0x3e
fffff880`0e5121c0 fffff960`000c6aeb : fffff900`c20bac30 fffff880`0e512250 00000000`00000001 fffff880`0e512260 : win32k!DEVLOCKOBJ::bPrepareTrgDco+0x98
fffff880`0e5121f0 fffff960`0024947a : fffff900`c0107010 00000000`00000001 fffff880`0e512320 00000000`00000003 : win32k!DEVLOCKOBJ::bLock+0x423
fffff880`0e512230 fffff800`02a77153 : fffffa80`03e2bb60 fffff880`0e512320 00000000`028d0b60 00000000`7efdb000 : win32k!GreSetICMMode+0x86
fffff880`0e5122a0 00000000`747b2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0012dcd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x747b2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::Map+175
fffff960`000f3aa5 8b4574          mov     eax,dword ptr [rbp+74h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!SURFACE::Map+175

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

FAILURE_BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::Map+175

BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::Map+175

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\032611-18937-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0280e000 PsLoadedModuleList = 0xfffff800`02a4be50
Debug session time: Sat Mar 26 14:46:36.941 2011 (UTC - 4:00)
System Uptime: 0 days 0:48:19.144
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff6800003d850, dbd000003c0c5867, fffff68000026908}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff6800003d850
Arg3: dbd000003c0c5867
Arg4: fffff68000026908

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002835228 to fffff8000287ff00

STACK_TEXT:  
fffff880`0ca20328 fffff800`02835228 : 00000000`0000001a 00000000`00000403 fffff680`0003d850 dbd00000`3c0c5867 : nt!KeBugCheckEx
fffff880`0ca20330 fffff800`028b0b51 : 00000000`00000000 fffff680`0003dbf0 fffffa80`05453060 f1800000`52d39867 : nt! ?? ::FNODOBFM::`string'+0x31f72
fffff880`0ca204e0 fffff800`028b35d9 : fffff900`00000000 00000000`07b7efff fffff880`00000000 00000000`0000003c : nt!MiDeleteVirtualAddresses+0x408
fffff880`0ca206a0 fffff800`02b95e50 : fffffa80`04250530 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`0ca207c0 fffff800`02b9625b : 00000416`00000000 00000000`076e0000 fffffa80`00000001 fffff960`0026f000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`0ca20880 fffff800`0287f153 : 00000000`00000001 fffff900`c388e280 fffffa80`05453060 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`0ca208d0 fffff800`0287b6f0 : fffff960`001550ca 00000000`00000001 fffff900`c0107010 fffff900`c394ccd0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0ca20a68 fffff960`001550ca : 00000000`00000001 fffff900`c0107010 fffff900`c394ccd0 00000000`00000000 : nt!KiServiceLinkage
fffff880`0ca20a70 fffff960`0015544c : ffffffff`00000000 fffff880`00000000 fffff900`c394ccd0 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`0ca20bc0 fffff960`0011661d : ffffffff`b105155d fffff900`c394ccd0 00000000`0000155d 00000000`000de530 : win32k!bDeleteSurface+0x34
fffff880`0ca20bf0 fffff800`0287f153 : fffffa80`04855060 fffff900`c00bf010 00000000`003af258 00000000`00000000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`0ca20c20 00000000`73642dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000de4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73642dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3a2
fffff960`001550ca e9d6010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`001552a5)

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3a2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e0

FAILURE_BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3a2

BUCKET_ID:  X64_0x1a_403_win32k!SURFACE::bDeleteSurface+3a2

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\040211-40250-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5e000 PsLoadedModuleList = 0xfffff800`02c9be50
Debug session time: Sun Apr  3 00:37:45.399 2011 (UTC - 4:00)
System Uptime: 0 days 12:49:34.586
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff6800004d598, f780000129af5867, fffff6fc5003b9e8}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f72 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff6800004d598
Arg3: f780000129af5867
Arg4: fffff6fc5003b9e8

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  ManyCam.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002a85228 to fffff80002acff00

STACK_TEXT:  
fffff880`10438678 fffff800`02a85228 : 00000000`0000001a 00000000`00000403 fffff680`0004d598 f7800001`29af5867 : nt!KeBugCheckEx
fffff880`10438680 fffff800`02b00b51 : 00000000`00000000 fffff680`0004dd18 fffffa80`05e7d550 c6f00000`15b26867 : nt! ?? ::FNODOBFM::`string'+0x31f72
fffff880`10438830 fffff800`02b035d9 : 00000000`00000000 00000000`09ba3fff fffff880`00000000 00000000`00000000 : nt!MiDeleteVirtualAddresses+0x408
fffff880`104389f0 fffff800`02de5e50 : fffffa80`04d27840 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`10438b10 fffff800`02de625b : 00000000`00000000 00000000`09810000 fffffa80`00000001 fffffa80`055ee701 : nt!MiUnmapViewOfSection+0x1b0
fffff880`10438bd0 fffff800`02acf153 : 00000000`00000001 00000000`00000000 fffffa80`05e7d550 fffffa80`055ee720 : nt!NtUnmapViewOfSection+0x5f
fffff880`10438c20 00000000`76e6015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0802e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e6015a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+31f72
fffff800`02a85228 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+31f72

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f72

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f72

Followup: MachineOwner
---------




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\040511-17312-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a4e000 PsLoadedModuleList = 0xfffff800`02c8be50
Debug session time: Tue Apr  5 15:55:08.897 2011 (UTC - 4:00)
System Uptime: 0 days 3:28:08.053
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 123eb9, 2, 123f38}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 0000000000123eb9, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000123f38, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002b4e32c to fffff80002abff00

STACK_TEXT:  
fffff880`0e6cdf18 fffff800`02b4e32c : 00000000`0000004e 00000000`00000099 00000000`00123eb9 00000000`00000002 : nt!KeBugCheckEx
fffff880`0e6cdf20 fffff800`02a75545 : 00000000`00000000 fffff680`00010338 00000000`00000002 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`0e6cdf60 fffff800`02a94493 : fffffa80`047497d0 fffff700`000013dc 0000007f`fffffff8 fffff8a0`010083b0 : nt! ?? ::FNODOBFM::`string'+0x322ac
fffff880`0e6cdff0 fffff800`02a92eee : fffffa80`047497d0 fffffa80`00000000 fffff880`00000704 fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`0e6ce8a0 fffff800`02da27af : fffff8a0`0a514060 fffff880`0e6cec20 00000000`00000000 fffffa80`0678c280 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0e6ce8f0 fffff800`02d7cb3d : 00000000`c0000005 00000000`00000001 00000000`7efd5000 fffffa80`03d6eb60 : nt!PspExitThread+0x47f
fffff880`0e6ce9c0 fffff800`02a9ca43 : 00000000`00000000 00000000`00000000 fffffa80`0678c280 fffff800`02c38e80 : nt!PsExitSpecialApc+0x1d
fffff880`0e6ce9f0 fffff800`02a9ce80 : 00000000`77011c20 fffff880`0e6cea70 fffff800`02d7d710 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`0e6cea70 fffff800`02abf1f7 : 00000000`00000000 fffff8a0`0a514a00 00000000`00000000 fffff8a0`0a514a00 : nt!KiInitiateUserApc+0x70
fffff880`0e6cebb0 00000000`74852dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`0166ecf8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74852dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02b4e32c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

DRIVERS

start             end                 module name
fffff880`00f65000 fffff880`00fbc000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02c28000 fffff880`02cb2000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`07bbd000 fffff880`07bd3000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`010e2000 fffff880`010ed000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`010af000 fffff880`010b8000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`010b8000 fffff880`010e2000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`06dba000 fffff880`06dda000   AtihdW76 AtihdW76.sys Wed Nov 17 07:02:04 2010 (4CE3C43C)
fffff880`0725d000 fffff880`07b84000   atikmdag atikmdag.sys Tue Mar 08 23:32:17 2011 (4D7702D1)
fffff880`03b7d000 fffff880`03bcc000   atikmpag atikmpag.sys Tue Mar 08 23:17:42 2011 (4D76FF66)
fffff880`015f9000 fffff880`01600000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03b30000 fffff880`03b41000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`055a3000 fffff880`055c1000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00680000 fffff960`006a7000   cdd      cdd.dll      Mon Jul 13 21:25:40 2009 (4A5BDE94)
fffff880`06cc1000 fffff880`06cde000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`01400000 fffff880`0142a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`015aa000 fffff880`015da000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d48000 fffff880`00da6000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0142a000 fffff880`0149d000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`07bad000 fffff880`07bbd000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06cde000 fffff880`06cec000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03a8f000 fffff880`03b12000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`03b12000 fffff880`03b30000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02ddb000 fffff880`02dea000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01655000 fffff880`0166b000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`06c3d000 fffff880`06c5f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`02d52000 fffff880`02d95000   dtsoftbus01 dtsoftbus01.sys Thu Jan 13 03:27:08 2011 (4D2EB75C)
fffff880`06de6000 fffff880`06def000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06dda000 fffff880`06de6000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`03a50000 fffff880`03a63000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`06def000 fffff880`06dfb000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`06a06000 fffff880`06afa000   dxgkrnl  dxgkrnl.sys  Mon Jul 13 19:38:56 2009 (4A5BC590)
fffff880`06afa000 fffff880`06b40000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`01139000 fffff880`0114d000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`010ed000 fffff880`01139000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`014ae000 fffff880`014b8000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`0161b000 fffff880`01655000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`0170f000 fffff880`01759000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`02a05000 fffff800`02a4e000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`06b40000 fffff880`06b64000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`06c65000 fffff880`06cc1000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`02c00000 fffff880`02c19000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`06cec000 fffff880`06cf4080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`03a80000 fffff880`03a8e000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`054db000 fffff880`055a3000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01612000 fffff880`0161b000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`03b67000 fffff880`03b7d000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`03a32000 fffff880`03a41000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`03bed000 fffff880`03bfb000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bc5000 fffff800`00bcf000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`06cf6000 fffff880`06d39000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`013d9000 fffff880`013f3000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`016e4000 fffff880`0170f000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`06c5f000 fffff880`06c64200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`054ae000 fffff880`054c3000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`00fcf000 fffff880`00ff2000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cf0000 fffff880`00d34000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`02dea000 fffff880`02df8000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`03a41000 fffff880`03a50000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`02c19000 fffff880`02c26000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`01095000 fffff880`010af000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`01200000 fffff880`01231000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`055c1000 fffff880`055d9000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`05400000 fffff880`0542c000   mrxsmb   mrxsmb.sys   Mon Jul 13 19:23:59 2009 (4A5BC20F)
fffff880`0542c000 fffff880`05479000   mrxsmb10 mrxsmb10.sys Mon Jul 13 19:24:08 2009 (4A5BC218)
fffff880`05479000 fffff880`0549c000   mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`01000000 fffff880`0100b000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fc5000 fffff880`00fcf000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0114d000 fffff880`011ab000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02dd0000 fffff880`02ddb000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01600000 fffff880`01612000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014b8000 fffff880`015aa000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`07200000 fffff880`0720c000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0720c000 fffff880`0723b000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`06da5000 fffff880`06dba000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02d26000 fffff880`02d35000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02cb2000 fffff880`02cf7000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01684000 fffff880`016e4000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`09e00000 fffff880`09e15000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`0100b000 fffff880`0101c000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02dc4000 fffff880`02dd0000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a4e000 fffff800`0302b000   nt       ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`01236000 fffff880`013d9000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`017f7000 fffff880`01800000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`02d00000 fffff880`02d26000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`07b90000 fffff880`07bad000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`0107e000 fffff880`01085000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`01085000 fffff880`01095000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0149d000 fffff880`014ae000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`096ba000 fffff880`09760000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`06c00000 fffff880`06c3d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00d34000 fffff880`00d48000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`07bd3000 fffff880`07bf7000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0723b000 fffff880`07256000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`03bcc000 fffff880`03bed000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`03a00000 fffff880`03a1a000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`00da6000 fffff880`00df7000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`03a27000 fffff880`03a32000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`013f3000 fffff880`013fc000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`011ee000 fffff880`011f7000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`011f7000 fffff880`01200000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`017bd000 fffff880`017f7000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`054c3000 fffff880`054db000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`06bcb000 fffff880`06bfd000   Rt64win7 Rt64win7.sys Thu Feb 26 04:04:13 2009 (49A65B0D)
fffff880`09760000 fffff880`0976b000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`07b84000 fffff880`07b90000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02d35000 fffff880`02d52000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`09600000 fffff880`096b7000   Sftfslh  Sftfslh.sys  Wed Dec 02 19:55:48 2009 (4B170C94)
fffff880`0976b000 fffff880`097b8000   Sftplaylh Sftplaylh.sys Wed Dec 02 19:55:40 2009 (4B170C8C)
fffff880`09ff3000 fffff880`09ffe000   Sftredirlh Sftredirlh.sys Wed Dec 02 19:55:52 2009 (4B170C98)
fffff880`0166b000 fffff880`01676000   Sftvollh Sftvollh.sys Wed Dec 02 19:55:23 2009 (4B170C7B)
fffff880`017b5000 fffff880`017bd000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`09e15000 fffff880`09e86000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`09f5b000 fffff880`09ff3000   srv      srv.sys      Mon Jul 13 19:25:11 2009 (4A5BC257)
fffff880`09ef2000 fffff880`09f5b000   srv2     srv2.sys     Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`097b8000 fffff880`097e5000   srvnet   srvnet.sys   Mon Jul 13 19:24:58 2009 (4A5BC24A)
fffff880`06bfd000 fffff880`06bfe480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`03a1a000 fffff880`03a27000   tap0901t tap0901t.sys Wed Sep 16 02:02:43 2009 (4AB07F83)
fffff880`01800000 fffff880`019fd000   tcpip    tcpip.sys    Thu Apr 08 22:45:54 2010 (4BBE94E2)
fffff880`097e5000 fffff880`097f7000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`00e88000 fffff880`00e95000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`00e6a000 fffff880`00e88000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02db0000 fffff880`02dc4000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`004d0000 fffff960`004da000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`03b41000 fffff880`03b67000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`06d39000 fffff880`06d4b000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`015da000 fffff880`015f4c00   usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`03a63000 fffff880`03a80000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`06dfb000 fffff880`06dfcf00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`06b64000 fffff880`06b75000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`06d4b000 fffff880`06da5000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`06b75000 fffff880`06bcb000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`00e95000 fffff880`00eb0000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`011ab000 fffff880`011b9000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`011b9000 fffff880`011de000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`01759000 fffff880`01769000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e55000 fffff880`00e6a000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01022000 fffff880`0107e000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01769000 fffff880`017b5000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02d95000 fffff880`02db0000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`011de000 fffff880`011ee000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eb2000 fffff880`00f56000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f56000 fffff880`00f65000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02cf7000 fffff880`02d00000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000e0000 fffff960`003ef000   win32k   win32k.sys   Mon Jul 13 19:40:16 2009 (4A5BC5E0)
fffff880`00fbc000 fffff880`00fc5000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00cc0000 fffff880`00ce1000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`0166b000 fffff880`01679000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`015da000 fffff880`015e6000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`01679000 fffff880`01682000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`015e6000 fffff880`015f9000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000

 

[hdfsi]

ok i updated Realtek LAN, but i dot have Google earth or open vpn installed. Also i ran mem test for 8 passes and everything was fine.

 

[cybercore]

If blue screens reoccur:

1. Memtest - recommended to test per each stick separately and test in different slots.


2. OpenVPN Tap 32 driver/Google Earth is this one:

tap0901t.sys Wed Sep 16 02:02:43 2009

Some software that uses OpenVPN.