Windows 7 Random Crashes BSOD Win 7

PhotographicaUK · Mar 20, 2011

Hello all,

I have a randon BSOD crash problem that is driving me mad, I hope you can help.

My PC is a self build with the components in the Jpegs above. The case is a CoolerMaster HAF and the powersupply is a modular 900w.

The BSODs occur at apparently random intervals and the system can be fine for days with no problems. the BSODs occur even when the PC is idle, having just booted up and no user activity has taken place.

The most recent crash was typical; the pc was switched on and left to start up, windows loaded and was idle, the PC BSOD'd and restarted, then BSOD'd again, eventually windows start up repair kicked in and was unable to repair. I switched off PC (no power) switched it back on again and windows loaded fine (although when this happens I have to tell Avira Firewall what applications it can trust again - not sure if that is a red herring).

I have asked a local supplier to analyse the PC for faults (Novatech - charged for of course) they had it for a week and could find nothing saying it did not crash). It sometimes does not crash for several weeks!

Things I have tried;

I have swapped the Graphics card (was an ATI 5870, now is an nvidia GTX570)
I ran memtest86 for 15 hours and it did not detect any errors.
I ran a similar test for the graphics card memory for 6-7 hours and again no errors were found.
I changed from AVG2011 to Avira in case it was that.

I have attached a zip file with the latest series of crash dump files in the hope that someone can spot something, unfortunately they are beyond my experience level to understand...

I would be very grateful if someone could take a look and give me a pointer as to what to try next.

Thanks

cybercore · Mar 20, 2011

Welcome to windows7forums.

You attached more information that I ever dreamt of to have for analysis.

1. RAM: 4 identical Corsair sticks rated 1333Mhz 9-9-9-24 1.5v. Your current settings are 1316Mhz 9-9-9-24 which is wrong and that's why you're getting memory_corruption in some of your crash dumps. You need to set it 1333Mhz to have it work smooth.

2. Update drivers:

Wacom Mouse
wacommousefilter.sys Fri Feb 16 13:12:17 2007

Realtek Audio
RTKVHD64.sys Tue Nov 03 06:39:55 2009

Realtek LAN
Rt64win7.sys Fri May 22 10:52:30 2009

Motherboard USB 3.0 Controller
nusb3hub.sys Mon Oct 26 10:19:44 2009
nusb3xhc.sys Mon Oct 26 10:19:48 2009

Marvell (SATA Controller)
mv61xx.sys Wed Aug 05 23:20:12 2009

Intel Management Engine Interface
HECIx64.sys Thu Sep 17 15:54:16 2009

3. Update or better uninstall for now,

RemotelyAnywhere
RaInfo.sys Fri Jan 04 13:57:14 2008

LogMeIn
lmimirr.sys Tue Apr 10 18:32:45 2007

4. Should crashes persist, I would also recommend to replce Avira with MSE for as long as you're having blue screens.

CRASH DUMPS

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\DMP\032011-34881-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03c0c000 PsLoadedModuleList = 0xfffff800`03e49e50 Debug session time: Sun Mar 20 05:19:05.781 2011 (UTC - 4:00) System Uptime: 0 days 0:01:19.843 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ . Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff96000311897, fffff88008685730, 0} Probably caused by : win32k.sys ( win32k!BmfdQueryAdvanceWidthsTE+3f ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff96000311897, Address of the instruction which caused the bugcheck Arg3: fffff88008685730, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: win32k!BmfdQueryAdvanceWidthsTE+3f fffff960`00311897 488b4910 mov rcx,qword ptr [rcx+10h] CONTEXT: fffff88008685730 -- (.cxr 0xfffff88008685730) rax=fffff88008686158 rbx=00000000ffffffff rcx=fffef900c0d5b020 rdx=fffff88008686138 rsi=fffff900c08dcca0 rdi=fffff900c08dccb8 rip=fffff96000311897 rsp=fffff88008686100 rbp=0000000000000001 r8=fffff88008686160 r9=0000000000000001 r10=0000000000000008 r11=fffff80003e7cb60 r12=fffff88008686220 r13=0000000000000001 r14=0000000000000001 r15=fffff900c0081000 iopl=0 nv up ei ng nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282 win32k!BmfdQueryAdvanceWidthsTE+0x3f: fffff960`00311897 488b4910 mov rcx,qword ptr [rcx+10h] ds:002b:fffef900`c0d5b030=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: csrss.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff96000311897 STACK_TEXT: fffff880`08686100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!BmfdQueryAdvanceWidthsTE+0x3f FOLLOWUP_IP: win32k!BmfdQueryAdvanceWidthsTE+3f fffff960`00311897 488b4910 mov rcx,qword ptr [rcx+10h] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: win32k!BmfdQueryAdvanceWidthsTE+3f FOLLOWUP_NAME: MachineOwner MODULE_NAME: win32k IMAGE_NAME: win32k.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4d23ecb0 STACK_COMMAND: .cxr 0xfffff88008685730 ; kb FAILURE_BUCKET_ID: X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f BUCKET_ID: X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\DMP\032011-28750-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03c4a000 PsLoadedModuleList = 0xfffff800`03e87e50 Debug session time: Sun Mar 20 05:28:53.459 2011 (UTC - 4:00) System Uptime: 0 days 0:05:41.911 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ... Loading User Symbols Loading unloaded module list ........ ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff800040317f1, fffff88008bca0f0, 0} Probably caused by : ntkrnlmp.exe ( nt!AuthzBasepRemoveSecurityAttributeFromLists+31 ) Followup: MachineOwner --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff800040317f1, Address of the instruction which caused the bugcheck Arg3: fffff88008bca0f0, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: nt!AuthzBasepRemoveSecurityAttributeFromLists+31 fffff800`040317f1 f6423801 test byte ptr [rdx+38h],1 CONTEXT: fffff88008bca0f0 -- (.cxr 0xfffff88008bca0f0) rax=00000000000000c8 rbx=fffef8a005e1fcf8 rcx=fffff8a005e1fcf0 rdx=fffef8a005e1fcf8 rsi=fffff8a005e1fcf8 rdi=fffff8a005f88060 rip=fffff800040317f1 rsp=fffff88008bcaac8 rbp=fffff8a005e1fcf0 r8=0000000000000001 r9=0000000000000000 r10=fffff8a005e1fcf0 r11=00000000001f0001 r12=0000000000000000 r13=0000000000000001 r14=0000000001a4f550 r15=0000000000000001 iopl=0 nv up ei pl nz na pe nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202 nt!AuthzBasepRemoveSecurityAttributeFromLists+0x31: fffff800`040317f1 f6423801 test byte ptr [rdx+38h],1 ds:002b:fffef8a0`05e1fd30=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: wmpnetwk.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff80003feb8c3 to fffff800040317f1 STACK_TEXT: fffff880`08bcaac8 fffff800`03feb8c3 : fffff8a0`05e849e0 fffff800`03def2dd fffffa80`066a0a20 00000000`00000000 : nt!AuthzBasepRemoveSecurityAttributeFromLists+0x31 fffff880`08bcaad0 fffff800`03cbf8b4 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`066a0a20 : nt! ?? ::NNGAKEGL::`string'+0x101c5 fffff880`08bcab00 fffff800`03fa569e : 00000000`00000000 fffff8a0`05d1bd40 fffff8a0`05d1bd20 00000000`00000001 : nt!ObfDereferenceObject+0xd4 fffff880`08bcab60 fffff800`03fb9d68 : fffff8a0`05d1bd20 00000000`00000001 fffffa80`06e5e910 00000000`ffffffff : nt!AlpcpSecurityDestroyProcedure+0x10e fffff880`08bcab90 fffff800`03f55cfd : fffff8a0`05d1bd40 fffffa80`06e5e910 fffffa80`06e5e910 00000000`00000000 : nt!AlpcpDestroyBlob+0x28 fffff880`08bcabc0 fffff800`03cb9993 : fffffa80`06c7fb60 fffff880`08bcaca0 00000000`01a4f660 fffffa80`06e5e910 : nt!NtAlpcDeleteSecurityContext+0xdd fffff880`08bcac20 00000000`779afe8a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`01a4f4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779afe8a FOLLOWUP_IP: nt!AuthzBasepRemoveSecurityAttributeFromLists+31 fffff800`040317f1 f6423801 test byte ptr [rdx+38h],1 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt!AuthzBasepRemoveSecurityAttributeFromLists+31 FOLLOWUP_NAME: MachineOwner MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe DEBUG_FLR_IMAGE_TIMESTAMP: 4cc791bd STACK_COMMAND: .cxr 0xfffff88008bca0f0 ; kb FAILURE_BUCKET_ID: X64_0x3B_nt!AuthzBasepRemoveSecurityAttributeFromLists+31 BUCKET_ID: X64_0x3B_nt!AuthzBasepRemoveSecurityAttributeFromLists+31 Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\DMP\031311-45645-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03811000 PsLoadedModuleList = 0xfffff800`03a4ee50 Debug session time: Sun Mar 13 11:23:55.216 2011 (UTC - 4:00) System Uptime: 0 days 0:17:09.668 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ........ Loading User Symbols Loading unloaded module list ................................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff88001050e99, fffff880097bab60, 0} Probably caused by : Npfs.SYS ( Npfs!NpCreateClientEnd+45d ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c0000005, Exception code that caused the bugcheck Arg2: fffff88001050e99, Address of the instruction which caused the bugcheck Arg3: fffff880097bab60, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: Npfs!NpCreateClientEnd+45d fffff880`01050e99 488b01 mov rax,qword ptr [rcx] CONTEXT: fffff880097bab60 -- (.cxr 0xfffff880097bab60) rax=fffff8a001188a08 rbx=0000000000000001 rcx=fffefa800b2c9d68 rdx=fffff8a002ca6cf8 rsi=fffff8a002ca6c50 rdi=fffff880097bb700 rip=fffff88001050e99 rsp=fffff880097bb530 rbp=0000000000000004 r8=fffff880097bb690 r9=0000000000000000 r10=fffff800039fd480 r11=fffff8a00314e188 r12=0000000000000000 r13=0000000000000000 r14=fffffa800ad59340 r15=fffff8a0011889a0 iopl=0 nv up ei ng nz na pe cy cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010283 Npfs!NpCreateClientEnd+0x45d: fffff880`01050e99 488b01 mov rax,qword ptr [rcx] ds:002b:fffefa80`0b2c9d68=???????????????? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x3B PROCESS_NAME: wmpnetwk.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff88001050e99 STACK_TEXT: fffff880`097bb530 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Npfs!NpCreateClientEnd+0x45d FOLLOWUP_IP: Npfs!NpCreateClientEnd+45d fffff880`01050e99 488b01 mov rax,qword ptr [rcx] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Npfs!NpCreateClientEnd+45d FOLLOWUP_NAME: MachineOwner MODULE_NAME: Npfs IMAGE_NAME: Npfs.SYS DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc114 STACK_COMMAND: .cxr 0xfffff880097bab60 ; kb FAILURE_BUCKET_ID: X64_0x3B_Npfs!NpCreateClientEnd+45d BUCKET_ID: X64_0x3B_Npfs!NpCreateClientEnd+45d Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\DMP\032011-33056-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03c1e000 PsLoadedModuleList = 0xfffff800`03e5be50 Debug session time: Sun Mar 20 05:00:31.949 2011 (UTC - 4:00) System Uptime: 0 days 0:25:03.379 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ .... Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 24, {1904fb, fffff88009eec8d8, fffff88009eec140, fffff880012b9660} Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonClose+1a0 ) Followup: MachineOwner --------- 3: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* NTFS_FILE_SYSTEM (24) If you see NtfsExceptionFilter on the stack then the 2nd and 3rd parameters are the exception record and context record. Do a .cxr on the 3rd parameter and then kb to obtain a more informative stack trace. Arguments: Arg1: 00000000001904fb Arg2: fffff88009eec8d8 Arg3: fffff88009eec140 Arg4: fffff880012b9660 Debugging Details: ------------------ EXCEPTION_RECORD: fffff88009eec8d8 -- (.exr 0xfffff88009eec8d8) ExceptionAddress: fffff880012b9660 (Ntfs!NtfsCommonClose+0x00000000000001a0) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff CONTEXT: fffff88009eec140 -- (.cxr 0xfffff88009eec140) rax=fffef8a00c4c6990 rbx=fffffa80085aec40 rcx=fffffa80085aec88 rdx=fffff8a00c4c67a0 rsi=fffff8a00c4c6670 rdi=fffff88009eecc38 rip=fffff880012b9660 rsp=fffff88009eecb10 rbp=fffff80003e335a0 r8=0000000000000000 r9=0000000000000009 r10=0000000000000004 r11=fffffa80081c78b0 r12=fffffa80081c7180 r13=0000000000000000 r14=0000000000000000 r15=0000000000000001 iopl=0 nv up ei ng nz na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286 Ntfs!NtfsCommonClose+0x1a0: fffff880`012b9660 f6400804 test byte ptr [rax+8],4 ds:002b:fffef8a0`0c4c6998=?? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT PROCESS_NAME: System CURRENT_IRQL: 0 ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000000 EXCEPTION_PARAMETER2: ffffffffffffffff READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003ec60e0 ffffffffffffffff FOLLOWUP_IP: Ntfs!NtfsCommonClose+1a0 fffff880`012b9660 f6400804 test byte ptr [rax+8],4 FAULTING_IP: Ntfs!NtfsCommonClose+1a0 fffff880`012b9660 f6400804 test byte ptr [rax+8],4 BUGCHECK_STR: 0x24 LAST_CONTROL_TRANSFER: from fffff8800129338f to fffff880012b9660 STACK_TEXT: fffff880`09eecb10 fffff880`0129338f : fffffa80`085aec40 fffff8a0`0c4c67a0 fffff8a0`0c4c6670 fffffa80`081c7180 : Ntfs!NtfsCommonClose+0x1a0 fffff880`09eecbe0 fffff800`03c9b961 : 00000000`00000000 fffff880`01892500 fffffa80`0ae85f01 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f fffff880`09eeccb0 fffff800`03f317c6 : 00000000`1167b07b fffffa80`0b85a660 00000000`00000080 fffffa80`067215f0 : nt!ExpWorkerThread+0x111 fffff880`09eecd40 fffff800`03c6cc26 : fffff880`02fd5180 fffffa80`0b85a660 fffffa80`06741b60 fffff880`0121d534 : nt!PspSystemThreadStartup+0x5a fffff880`09eecd80 00000000`00000000 : fffff880`09eed000 fffff880`09ee7000 fffff880`09eec700 00000000`00000000 : nt!KxStartSystemThread+0x16 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: Ntfs!NtfsCommonClose+1a0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: Ntfs IMAGE_NAME: Ntfs.sys DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f STACK_COMMAND: .cxr 0xfffff88009eec140 ; kb FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsCommonClose+1a0 BUCKET_ID: X64_0x24_Ntfs!NtfsCommonClose+1a0 Followup: MachineOwner --------- Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\DMP\032011-30076-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (4 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Built by: 7600.16695.amd64fre.win7_gdr.101026-1503 Machine Name: Kernel base = 0xfffff800`03c0a000 PsLoadedModuleList = 0xfffff800`03e47e50 Debug session time: Sun Mar 20 05:21:33.097 2011 (UTC - 4:00) System Uptime: 0 days 0:00:48.158 Loading Kernel Symbols ............................................................... ................................................................ ........................................................ Loading User Symbols Loading unloaded module list ......... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 3B, {c000001d, fffff96000149d9d, fffff8800602d510, 0} Probably caused by : memory_corruption Followup: memory_corruption --------- 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* SYSTEM_SERVICE_EXCEPTION (3b) An exception happened while executing a system service routine. Arguments: Arg1: 00000000c000001d, Exception code that caused the bugcheck Arg2: fffff96000149d9d, Address of the instruction which caused the bugcheck Arg3: fffff8800602d510, Address of the context record for the exception that caused the bugcheck Arg4: 0000000000000000, zero. Debugging Details: ------------------ EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. FAULTING_IP: win32k!xxxCreateWindowSmIcon+7d fffff960`00149d9d 4c ??? CONTEXT: fffff8800602d510 -- (.cxr 0xfffff8800602d510) rax=fffff900c0581414 rbx=0000000000000000 rcx=fffff900c0580a70 rdx=00000000fffffffe rsi=fffff900c0c08670 rdi=0000000000000000 rip=fffff96000149d9d rsp=fffff8800602dee0 rbp=fffff900c00e3b40 r8=fffff900c0581290 r9=0000000000004000 r10=0000000000000003 r11=0000000000000003 r12=0000000000000001 r13=0000000000000005 r14=0000000000000000 r15=0000000000010027 iopl=0 nv up ei pl zr na po nc cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246 win32k!xxxCreateWindowSmIcon+0x7d: fffff960`00149d9d 4c ??? Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: CODE_CORRUPTION BUGCHECK_STR: 0x3B PROCESS_NAME: AsLoader.exe CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from fffff96000149cd0 to fffff96000149d9d STACK_TEXT: fffff880`0602dee0 fffff960`00149cd0 : 00000000`00000000 fffff900`c0c08670 00000000`00000001 00000000`00000000 : win32k!xxxCreateWindowSmIcon+0x7d fffff880`0602df20 fffff960`00179e34 : 00000000`00000002 fffff900`c0c08670 00000000`00000001 00000000`00000000 : win32k!xxxDWP_SetIcon+0x1a0 fffff880`0602df70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!xxxRealDefWindowProc+0xa7c CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k fffff96000149d9e - win32k!xxxCreateWindowSmIcon+7e [ 0f:0e ] 1 error : !win32k (fffff96000149d9e) MODULE_NAME: memory_corruption IMAGE_NAME: memory_corruption FOLLOWUP_NAME: memory_corruption DEBUG_FLR_IMAGE_TIMESTAMP: 0 MEMORY_CORRUPTOR: ONE_BIT STACK_COMMAND: .cxr 0xfffff8800602d510 ; kb FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT Followup: memory_corruption ---------

DRIVERS

Code:

start end module name fffff880`041c1000 fffff880`041ff000 1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30) fffff880`00f30000 fffff880`00f87000 ACPI ACPI.sys Mon Jul 13 19:19:34 2009 (4A5BC106) fffff880`02cfd000 fffff880`02d87000 afd afd.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`048b2000 fffff880`048c8000 AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0) fffff880`0111e000 fffff880`01129000 amdxata amdxata.sys Tue May 19 13:56:59 2009 (4A12F2EB) fffff880`04014000 fffff880`04037000 AnyDVD AnyDVD.sys Wed Dec 01 14:06:20 2010 (4CF69CAC) fffff880`04000000 fffff880`04008000 ASACPI ASACPI.sys Wed Jul 15 23:31:29 2009 (4A5E9F11) fffff880`03bf5000 fffff880`03bfb000 AsIO AsIO.sys Mon Aug 03 03:03:16 2009 (4A768BB4) fffff880`00d92000 fffff880`00d9b000 atapi atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00d9b000 fffff880`00dc5000 ataport ataport.SYS Mon Jul 13 19:19:52 2009 (4A5BC118) fffff880`10d36000 fffff880`10d85000 atksgt atksgt.sys Sun May 17 09:36:34 2009 (4A1012E2) fffff960`00a70000 fffff960`00ad1000 ATMFD ATMFD.DLL Fri Jan 07 00:49:20 2011 (4D26A960) fffff880`01073000 fffff880`0108e000 avfwim avfwim.sys Mon Feb 15 05:30:26 2010 (4B792242) fffff880`02cd9000 fffff880`02cfd000 avfwot avfwot.sys Wed Apr 14 04:46:47 2010 (4BC580F7) fffff880`058aa000 fffff880`058c7000 avgntflt avgntflt.sys Thu Nov 11 10:59:48 2010 (4CDC12F4) fffff880`03bd3000 fffff880`03bf5000 avipbb avipbb.sys Mon Feb 22 05:08:50 2010 (4B8257B2) fffff880`018af000 fffff880`018b6000 Beep Beep.SYS Mon Jul 13 20:00:13 2009 (4A5BCA8D) fffff880`03bc2000 fffff880`03bd3000 blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF) fffff880`04a00000 fffff880`04a1e000 bowser bowser.sys Mon Jul 13 19:23:50 2009 (4A5BC206) fffff880`0187c000 fffff880`018a6000 cdrom cdrom.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`00c00000 fffff880`00cc0000 CI CI.dll Mon Jul 13 21:32:13 2009 (4A5BE01D) fffff880`04833000 fffff880`04845000 circlass circlass.sys Mon Jul 13 20:06:34 2009 (4A5BCC0A) fffff880`01816000 fffff880`01846000 CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00d1a000 fffff880`00d78000 CLFS CLFS.SYS Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`01000000 fffff880`01073000 cng cng.sys Mon Jul 13 19:49:40 2009 (4A5BC814) fffff880`10c09000 fffff880`10c19000 CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`05c00000 fffff880`05c0e000 crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD) fffff880`03b21000 fffff880`03ba4000 csc csc.sys Mon Jul 13 19:24:26 2009 (4A5BC22A) fffff880`059b1000 fffff880`059e6000 CT20XUT CT20XUT.SYS Wed May 05 09:01:28 2010 (4BE16C28) fffff880`058e8000 fffff880`05996000 ctac32k ctac32k.sys Wed Jul 02 04:38:22 2008 (486B3E7E) fffff880`0403a000 fffff880`040df700 ctaud2k ctaud2k.sys Wed May 05 08:59:48 2010 (4BE16BC4) fffff880`05c73000 fffff880`05dd0000 CTEXFIFX CTEXFIFX.SYS Wed May 05 09:01:21 2010 (4BE16C21) fffff880`05996000 fffff880`059b1000 CTHWIUT CTHWIUT.SYS Wed May 05 09:01:32 2010 (4BE16C2C) fffff880`04182000 fffff880`041b3000 ctoss2k ctoss2k.sys Wed May 05 08:57:46 2010 (4BE16B4A) fffff880`041b3000 fffff880`041bb000 ctprxy2k ctprxy2k.sys Wed May 05 08:59:51 2010 (4BE16BC7) fffff880`057c1000 fffff880`057f9000 ctsfm2k ctsfm2k.sys Wed May 05 08:57:33 2010 (4BE16B3D) fffff880`03ba4000 fffff880`03bc2000 dfsc dfsc.sys Mon Jul 13 19:23:44 2009 (4A5BC200) fffff880`03b12000 fffff880`03b21000 discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E) fffff880`01800000 fffff880`01816000 disk disk.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`0411d000 fffff880`0413f000 drmk drmk.sys Mon Jul 13 21:01:25 2009 (4A5BD8E5) fffff880`05c1a000 fffff880`05c23000 dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`05c0e000 fffff880`05c1a000 dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`05c23000 fffff880`05c36000 dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F) fffff880`05e00000 fffff880`05e0c000 Dxapi Dxapi.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff960`004d0000 fffff960`004ee000 dxg dxg.sys Mon Jul 13 19:38:28 2009 (4A5BC574) fffff880`11880000 fffff880`11974000 dxgkrnl dxgkrnl.sys Tue Jan 25 23:22:56 2011 (4D3FA1A0) fffff880`03b06000 fffff880`03b12000 ElbyCDIO ElbyCDIO.sys Thu Dec 16 17:58:13 2010 (4D0A9985) fffff880`04b44000 fffff880`04b8e000 emupia2k emupia2k.sys Wed May 05 08:57:27 2010 (4BE16B37) fffff880`01175000 fffff880`01189000 fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481) fffff880`01129000 fffff880`01175000 fltmgr fltmgr.sys Mon Jul 13 19:19:59 2009 (4A5BC11F) fffff960`009b0000 fffff960`009b9000 framebuf framebuf.dll Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`013ec000 fffff880`013f6000 Fs_Rec Fs_Rec.sys Mon Jul 13 19:19:45 2009 (4A5BC111) fffff880`019bb000 fffff880`019f5000 fvevol fvevol.sys Fri Sep 25 22:34:26 2009 (4ABD7DB2) fffff880`018b8000 fffff880`01902000 fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164) fffff880`119eb000 fffff880`119f8000 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0) fffff880`05640000 fffff880`057c1000 ha20x2k ha20x2k.sys Wed May 05 08:59:10 2010 (4BE16B9E) fffff800`041e7000 fffff800`04230000 hal hal.dll Mon Jul 13 21:27:36 2009 (4A5BDF08) fffff880`11974000 fffff880`11998000 HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5) fffff880`11998000 fffff880`119a9000 HECIx64 HECIx64.sys Thu Sep 17 15:54:16 2009 (4AB293E8) fffff880`0108e000 fffff880`010a7000 HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD) fffff880`03a92000 fffff880`03a9a080 HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9) fffff880`059e6000 fffff880`059f4000 hidusb hidusb.sys Mon Jul 13 20:06:22 2009 (4A5BCBFE) fffff880`10c20000 fffff880`10ce8000 HTTP HTTP.sys Mon Jul 13 19:22:16 2009 (4A5BC1A8) fffff880`019b2000 fffff880`019bb000 hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA) fffff880`03a26000 fffff880`03a3c000 intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD) fffff880`04988000 fffff880`04997000 kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`05800000 fffff880`0580e000 kbdhid kbdhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff800`00bbc000 fffff800`00bc6000 kdcom kdcom.dll Mon Jul 13 21:31:07 2009 (4A5BDFDB) fffff880`0413f000 fffff880`04182000 ks ks.sys Wed Mar 03 23:32:25 2010 (4B8F37D9) fffff880`013c1000 fffff880`013db000 ksecdd ksecdd.sys Mon Jul 13 19:20:54 2009 (4A5BC156) fffff880`01460000 fffff880`0148b000 ksecpkg ksecpkg.sys Fri Dec 11 01:03:32 2009 (4B21E0B4) fffff880`041bb000 fffff880`041c0200 ksthunk ksthunk.sys Mon Jul 13 20:00:19 2009 (4A5BCA93) fffff880`04845000 fffff880`04848d80 LGBusEnum LGBusEnum.sys Mon Nov 23 20:36:48 2009 (4B0B38B0) fffff880`05600000 fffff880`05615000 LHidFilt LHidFilt.Sys Thu Mar 18 04:51:17 2010 (4BA1E985) fffff880`04a86000 fffff880`04a93000 lirsgt lirsgt.sys Sun May 17 09:06:57 2009 (4A100BF1) fffff880`04bcd000 fffff880`04be2000 lltdio lltdio.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`10c19000 fffff880`10c20000 lmimirr lmimirr.sys Tue Apr 10 18:32:45 2007 (461C108D) fffff880`05615000 fffff880`05629000 LMouFilt LMouFilt.Sys Thu Mar 18 04:51:24 2010 (4BA1E98C) fffff880`05887000 fffff880`058aa000 luafv luafv.sys Mon Jul 13 19:26:13 2009 (4A5BC295) fffff880`00cc2000 fffff880`00d06000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66) fffff880`04997000 fffff880`049a6000 mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116) fffff880`04b1a000 fffff880`04b27000 mouhid mouhid.sys Mon Jul 13 20:00:20 2009 (4A5BCA94) fffff880`00d78000 fffff880`00d92000 mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`04a1e000 fffff880`04a36000 mpsdrv mpsdrv.sys Mon Jul 13 20:08:25 2009 (4A5BCC79) fffff880`04a36000 fffff880`04a63000 mrxsmb mrxsmb.sys Sat Feb 27 02:52:19 2010 (4B88CF33) fffff880`10ce8000 fffff880`10d36000 mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C) fffff880`04a63000 fffff880`04a86000 mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A) fffff880`015d7000 fffff880`015e2000 Msfs Msfs.SYS Mon Jul 13 19:19:47 2009 (4A5BC113) fffff880`00f90000 fffff880`00f9a000 msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE) fffff880`01195000 fffff880`011f3000 msrpc msrpc.sys Mon Jul 13 19:21:32 2009 (4A5BC17C) fffff880`03afb000 fffff880`03b06000 mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE) fffff880`019a0000 fffff880`019b2000 mup mup.sys Mon Jul 13 19:23:45 2009 (4A5BC201) fffff880`010a8000 fffff880`010ef000 mv61xx mv61xx.sys Wed Aug 05 23:20:12 2009 (4A7A4BEC) fffff880`014d3000 fffff880`015c5000 ndis ndis.sys Mon Jul 13 19:21:40 2009 (4A5BC184) fffff880`048ec000 fffff880`048f8000 ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8) fffff880`048f8000 fffff880`04927000 ndiswan ndiswan.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04b2f000 fffff880`04b44000 NDProxy NDProxy.SYS Mon Jul 13 20:10:05 2009 (4A5BCCDD) fffff880`02dd5000 fffff880`02de4000 netbios netbios.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff880`02c94000 fffff880`02cd9000 netbt netbt.sys Mon Jul 13 19:21:28 2009 (4A5BC178) fffff880`01400000 fffff880`01460000 NETIO NETIO.SYS Mon Jul 13 19:21:46 2009 (4A5BC18A) fffff880`015e2000 fffff880`015f3000 Npfs Npfs.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`03aef000 fffff880`03afb000 nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E) fffff800`03c0a000 fffff800`041e7000 nt ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD) fffff880`0121e000 fffff880`013c1000 Ntfs Ntfs.sys Mon Jul 13 19:20:47 2009 (4A5BC14F) fffff880`018a6000 fffff880`018af000 Null Null.SYS Mon Jul 13 19:19:37 2009 (4A5BC109) fffff880`04b03000 fffff880`04b1a000 nusb3hub nusb3hub.sys Mon Oct 26 10:19:44 2009 (4AE5B000) fffff880`119ba000 fffff880`119e9000 nusb3xhc nusb3xhc.sys Mon Oct 26 10:19:48 2009 (4AE5B004) fffff880`1187e000 fffff880`1187f180 nvBridge nvBridge.kmd Fri Jan 07 20:57:22 2011 (4D27C482) fffff880`05dd0000 fffff880`05df9000 nvhda64v nvhda64v.sys Thu Nov 11 18:10:36 2010 (4CDC77EC) fffff880`05831000 fffff880`0583e000 nx6000 nx6000.sys Thu Dec 02 17:23:39 2010 (4CF81C6B) fffff880`02d9b000 fffff880`02dc1000 pacer pacer.sys Mon Jul 13 20:09:41 2009 (4A5BCCC5) fffff880`00fda000 fffff880`00fef000 partmgr partmgr.sys Mon Jul 13 19:19:58 2009 (4A5BC11E) fffff880`00f9a000 fffff880`00fcd000 pci pci.sys Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`00e71000 fffff880`00e78000 pciide pciide.sys Mon Jul 13 19:19:49 2009 (4A5BC115) fffff880`00fef000 fffff880`00fff000 PCIIDEX PCIIDEX.SYS Mon Jul 13 19:19:48 2009 (4A5BC114) fffff880`013db000 fffff880`013ec000 pcw pcw.sys Mon Jul 13 19:19:27 2009 (4A5BC0FF) fffff880`040e0000 fffff880`0411d000 portcls portcls.sys Mon Jul 13 20:06:27 2009 (4A5BCC03) fffff880`00d06000 fffff880`00d1a000 PSHED PSHED.dll Mon Jul 13 21:32:23 2009 (4A5BE027) fffff880`01189000 fffff880`01194e00 PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253) fffff880`05df9000 fffff880`05e00000 RaInfo RaInfo.sys Fri Jan 04 13:57:14 2008 (477E818A) fffff880`048c8000 fffff880`048ec000 rasl2tp rasl2tp.sys Mon Jul 13 20:10:11 2009 (4A5BCCE3) fffff880`04927000 fffff880`04942000 raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9) fffff880`04942000 fffff880`04963000 raspptp raspptp.sys Mon Jul 13 20:10:18 2009 (4A5BCCEA) fffff880`04963000 fffff880`0497d000 rassstp rassstp.sys Mon Jul 13 20:10:25 2009 (4A5BCCF1) fffff880`03a9e000 fffff880`03aef000 rdbss rdbss.sys Mon Jul 13 19:24:09 2009 (4A5BC219) fffff880`0497d000 fffff880`04988000 rdpbus rdpbus.sys Mon Jul 13 20:17:46 2009 (4A5BCEAA) fffff880`019f5000 fffff880`019fe000 RDPCDD RDPCDD.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`015c5000 fffff880`015ce000 rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62) fffff880`015ce000 fffff880`015d7000 rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63) fffff880`01966000 fffff880`019a0000 rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A) fffff880`04be2000 fffff880`04bfa000 rspndr rspndr.sys Mon Jul 13 20:08:50 2009 (4A5BCC92) fffff880`00dc5000 fffff880`00dfe000 Rt64win7 Rt64win7.sys Fri May 22 10:52:30 2009 (4A16BC2E) fffff880`05e0d000 fffff880`05ff9780 RTKVHD64 RTKVHD64.sys Tue Nov 03 06:39:55 2009 (4AF0168B) fffff880`04bbf000 fffff880`04bcd000 scfilter scfilter.sys Mon Jul 13 19:50:17 2009 (4A5BC839) fffff880`010ef000 fffff880`0111e000 SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0) fffff880`04008000 fffff880`04014000 serenum serenum.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1) fffff880`02c00000 fffff880`02c1d000 serial serial.sys Mon Jul 13 20:00:40 2009 (4A5BCAA8) fffff880`0195e000 fffff880`01966000 spldr spldr.sys Mon May 11 12:56:27 2009 (4A0858BB) fffff880`04831000 fffff880`04832480 swenum swenum.sys Mon Jul 13 20:00:18 2009 (4A5BCA92) fffff880`01603000 fffff880`01800000 tcpip tcpip.sys Sun Jun 13 23:39:04 2010 (4C15A458) fffff880`015f3000 fffff880`01600000 TDI TDI.SYS Mon Jul 13 19:21:18 2009 (4A5BC16E) fffff880`01200000 fffff880`0121e000 tdx tdx.sys Mon Jul 13 19:21:15 2009 (4A5BC16B) fffff880`02de4000 fffff880`02df8000 termdd termdd.sys Mon Jul 13 20:16:36 2009 (4A5BCE64) fffff960`00730000 fffff960`0073a000 TSDDD TSDDD.dll unavailable (00000000) fffff880`03a00000 fffff880`03a26000 tunnel tunnel.sys Mon Jul 13 20:09:37 2009 (4A5BCCC1) fffff880`04860000 fffff880`04872000 umbus umbus.sys Mon Jul 13 20:06:56 2009 (4A5BCC20) fffff880`0586c000 fffff880`05886c00 usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`05c36000 fffff880`05c53000 usbccgp usbccgp.sys Mon Jul 13 20:06:45 2009 (4A5BCC15) fffff880`119e9000 fffff880`119eaf00 USBD USBD.SYS Mon Jul 13 20:06:23 2009 (4A5BCBFF) fffff880`119a9000 fffff880`119ba000 usbehci usbehci.sys Mon Jul 13 20:06:30 2009 (4A5BCC06) fffff880`04aa9000 fffff880`04b03000 usbhub usbhub.sys Mon Jul 13 20:07:09 2009 (4A5BCC2D) fffff880`03a3c000 fffff880`03a92000 USBPORT USBPORT.SYS Mon Jul 13 20:06:31 2009 (4A5BCC07) fffff880`0488f000 fffff880`0489e000 usbrpm usbrpm.sys Mon Jul 13 20:35:14 2009 (4A5BD2C2) fffff880`0580e000 fffff880`0581f000 usbscan usbscan.sys Mon Jul 13 20:35:32 2009 (4A5BD2D4) fffff880`05c53000 fffff880`05c6e000 USBSTOR USBSTOR.SYS Mon Jul 13 20:06:34 2009 (4A5BCC0A) fffff880`0583e000 fffff880`0586b200 usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9) fffff880`00fcd000 fffff880`00fda000 vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB) fffff880`0148b000 fffff880`01499000 vga vga.sys Mon Jul 13 19:38:47 2009 (4A5BC587) fffff880`01499000 fffff880`014be000 VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B) fffff880`01902000 fffff880`01912000 vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E) fffff880`00e00000 fffff880`00e15000 volmgr volmgr.sys Mon Jul 13 19:19:57 2009 (4A5BC11D) fffff880`00e15000 fffff880`00e71000 volmgrx volmgrx.sys Mon Jul 13 19:20:33 2009 (4A5BC141) fffff880`01912000 fffff880`0195e000 volsnap volsnap.sys Mon Jul 13 19:20:08 2009 (4A5BC128) fffff880`049a6000 fffff880`049e2000 vpchbus vpchbus.sys Tue Sep 22 21:32:32 2009 (4AB97AB0) fffff880`02dc1000 fffff880`02dd5000 vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE) fffff880`04872000 fffff880`0488f000 vpcusb vpcusb.sys Tue Sep 22 21:32:39 2009 (4AB97AB7) fffff880`02c38000 fffff880`02c8e180 vpcvmm vpcvmm.sys Tue Sep 22 21:32:38 2009 (4AB97AB6) fffff880`04b27000 fffff880`04b2f000 wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401) fffff880`04037000 fffff880`04039a00 wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A) fffff880`02c1d000 fffff880`02c38000 wanarp wanarp.sys Mon Jul 13 20:10:21 2009 (4A5BCCED) fffff880`014be000 fffff880`014ce000 watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F) fffff880`00e7d000 fffff880`00f21000 Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F) fffff880`00f21000 fffff880`00f30000 WDFLDR WDFLDR.SYS Mon Jul 13 19:19:54 2009 (4A5BC11A) fffff880`02d92000 fffff880`02d9b000 wfplwf wfplwf.sys Mon Jul 13 20:09:26 2009 (4A5BCCB6) fffff960`000d0000 fffff960`003e0000 win32k win32k.sys Tue Jan 04 22:59:44 2011 (4D23ECB0) fffff880`05629000 fffff880`0563a000 WinUSB WinUSB.sys Mon Jul 13 20:06:28 2009 (4A5BCC04) fffff880`04849000 fffff880`0484dd00 WmBEnum WmBEnum.sys Tue Apr 27 16:10:19 2010 (4BD744AB) fffff880`0581f000 fffff880`05828180 WmFilter WmFilter.sys Tue Apr 27 16:10:19 2010 (4BD744AB) fffff880`10c00000 fffff880`10c09000 wmiacpi wmiacpi.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6) fffff880`00f87000 fffff880`00f90000 WMILIB WMILIB.SYS Mon Jul 13 19:19:51 2009 (4A5BC117) fffff880`0484e000 fffff880`0485f480 WmXlCore WmXlCore.sys Tue Apr 27 16:09:26 2010 (4BD74476) fffff880`02d87000 fffff880`02d92000 ws2ifsl ws2ifsl.sys Mon Jul 13 20:10:33 2009 (4A5BCCF9) fffff880`058c7000 fffff880`058e8000 WudfPf WudfPf.sys Mon Jul 13 20:05:37 2009 (4A5BCBD1) fffff880`04b8e000 fffff880`04bbf000 WUDFRd WUDFRd.sys Mon Jul 13 20:06:06 2009 (4A5BCBEE) Unloaded modules: fffff880`05c53000 fffff880`05c64000 WinUSB.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00011000 fffff880`05800000 fffff880`05831000 WUDFRd.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00031000 fffff880`10c23000 fffff880`1187e000 nvlddmkm.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00C5B000 fffff880`01846000 fffff880`01854000 crashdmp.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 0000E000 fffff880`01854000 fffff880`01860000 dump_ataport Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 0000C000 fffff880`01860000 fffff880`01869000 dump_atapi.s Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00009000 fffff880`01869000 fffff880`0187c000 dump_dumpfve Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00013000 fffff880`04800000 fffff880`04831000 WUDFRd.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00031000 fffff880`049a6000 fffff880`049d7000 WUDFRd.sys Timestamp: unavailable (00000000) Checksum: 00000000 ImageSize: 00031000

PhotographicaUK · Mar 20, 2011

Hello Cybercore,

Thank you for a really speedy reponse.

I have been into the BIOS and changed the DRAM Frequency to 1333. Is that the correct one to change? it was originally set to Auto. Can you tell me how you knew what it was set to please? I was trying to check where you picked it up from to see if I had changed the right setting, but cannot see it in an obvious place?

I have redone the CPUz images (attached fresh) and the Rammon (v2) file...

Am currently updating drivers...

The Asus Mobo has a utility for "saving energy". I believe this changes some settings on the fly when PC idle for example; would this be overriding the memory settings? should it be removed/disabled?

Thanks again.

cybercore · Mar 20, 2011

You're still having it 1316Mhz. You need 1333Mhz.

The Asus Mobo has a utility for "saving energy". I believe this changes some settings on the fly when PC idle for example; would this be overriding the memory settings? should it be removed/disabled?

Good tip, uninstall it for now.

No more SPD attachments, CPU-Z memory will be enough.

PhotographicaUK · Mar 20, 2011

Hello again Cybercore,

I have removed the utility (Asus EVO) and also another called Turbo EVO.

I attach the latest CPUz meomory tab and a screen photo of the Bios settings screen showing 1333MHz.

Not sure what else I should be changing?

Thanks for your patience...

cybercore · Mar 20, 2011

Looks good now, 1333Mhz 9-9-9-24. Should be no more crashes, but if you get any then turn off in the bios:

- OC Tuner [Disabled]

- ASUS / 3rd Party UI Priority [Disabled]

- AI Overclock Tuner [Disabled]

PhotographicaUK · Mar 20, 2011

Hello Cybercore,

Thanks for your help, will leave you in peace to see if more stable. As a matter of interest, how did you know was not set to 1333 from the info I posted?

cybercore · Mar 20, 2011

PhotographicaUK said:
Hello Cybercore,

Thanks for your help, will leave you in peace to see if more stable. As a matter of interest, how did you know was not set to 1333 from the info I posted?

Your CPU-Z screenshots told me that. As a matter of fact, this is the only reason I ask users to attach this kind of information. : )

PhotographicaUK · Mar 21, 2011

I must be really stupid, I keep looking at the memory screenshot, I cannot see that number for the life of me...

PhotographicaUK · Apr 14, 2011

View attachment Minidumps.zip View attachment RAMMon - SPD Info.txt

Hello Cybercore,

I am still getting BSODs at random times, usually when I first switch the PC on. I have attached the latest batch of info files in the hope you might spot something obvious - I am stumped. Any help, ideas, guidance would be appreciated. Thanks.

cybercore · Apr 14, 2011

Let's look for the obvious then:

041211-35615-01.dmp
BugCheck 3B, {c0000005, fffff80003cb2ec1, fffff8800875efa0, 0}
PROCESS_NAME: wmpnscfg.exe
Probably caused by : memory_corruption ( nt!MiRemoveMappedView+1a1 )

041411-31340-01.dmp
BugCheck 1E, {0, 0, 0, 0}
PROCESS_NAME: System
Probably caused by : CLASSPNP.SYS ( CLASSPNP!ClasspSendSynchronousCompletion+31 )

033111-28766-01.dmp
BugCheck C4, {91, 0, fffffa800a927b60, 0}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+9b1df ) -- nvidia

032011-34881-01.dmp
BugCheck 3B, {c0000005, fffff96000311897, fffff88008685730, 0}
PROCESS_NAME: csrss.exe
Probably caused by : win32k.sys ( win32k!BmfdQueryAdvanceWidthsTE+3f )

033111-28719-01.dmp
BugCheck 24, {1904fb, fffff8800b4d7fd8, fffff8800b4d7840, fffff80003e020f3}
PROCESS_NAME: DkService.exe
Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2cc9 )

Follow my 1st post:

Update drivers:

Intel - HECIx64.sys Thu Sep 17 15:54:16 2009
Logitech - LGVirHid.sys Mon Nov 23 20:36:48 2009
Marvell - mv61xx.sys Wed Aug 05 23:20:12 2009
Wacom - wacommousefilter.sys Fri Feb 16 13:12:17 2007

Uninstall LogMeIn:

lmimirr.sys Tue Apr 10 18:32:45 2007
LMIRfsDriver.sys Mon Jul 14 12:26:56 2008
RaInfo.sys Fri Jan 04 13:57:14 2008

CRASH DUMPS

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\033111-28766-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03c63000 PsLoadedModuleList = 0xfffff800`03ea0e50
Debug session time: Thu Mar 31 13:42:15.368 2011 (UTC - 4:00)
System Uptime: 0 days 0:00:24.804
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {91, 0, fffffa800a927b60, 0}

Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+9b1df )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught.  This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000091, A driver switched stacks using a method that is not supported by
	the operating system. The only supported way to extend a kernel
	mode stack is by using KeExpandKernelStackAndCallout.
Arg2: 0000000000000000
Arg3: fffffa800a927b60
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc4_91

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff880029eaab8 -- (.exr 0xfffff880029eaab8)
ExceptionAddress: 0000000000000000
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000008
   Parameter[1]: 0000000000000000
Attempt to execute non-executable address 0000000000000000

TRAP_FRAME:  fffff880029eab60 -- (.trap 0xfffff880029eab60)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a683e30 rbx=0000000000000000 rcx=fffffa800a683000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000000 rsp=fffff880029eacfd rbp=fffff880029f7598
 r8=fffff8801149a4a0  r9=0000000000000000 r10=fffff80003e62888
r11=00000000000008c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
00000000`00000000 ??              ???
Resetting default scope

UNALIGNED_STACK_POINTER:  fffff880029eacfd

LAST_CONTROL_TRANSFER:  from fffff80003d2824a to fffff80003cd3740

STACK_TEXT:  
fffff880`029eacfd fffff880`10d6e1df : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
fffff880`029ead05 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nvlddmkm+0x9b1df


STACK_COMMAND:  .trap 0xfffff880029eab60 ; kb

FOLLOWUP_IP: 
nvlddmkm+9b1df
fffff880`10d6e1df ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nvlddmkm+9b1df

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d27c6da

FAILURE_BUCKET_ID:  X64_0xc4_91_nvlddmkm+9b1df

BUCKET_ID:  X64_0xc4_91_nvlddmkm+9b1df

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\032011-34881-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03c0c000 PsLoadedModuleList = 0xfffff800`03e49e50
Debug session time: Sun Mar 20 05:19:05.781 2011 (UTC - 4:00)
System Uptime: 0 days 0:01:19.843
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff96000311897, fffff88008685730, 0}

Probably caused by : win32k.sys ( win32k!BmfdQueryAdvanceWidthsTE+3f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000311897, Address of the instruction which caused the bugcheck
Arg3: fffff88008685730, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!BmfdQueryAdvanceWidthsTE+3f
fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]

CONTEXT:  fffff88008685730 -- (.cxr 0xfffff88008685730)
rax=fffff88008686158 rbx=00000000ffffffff rcx=fffef900c0d5b020
rdx=fffff88008686138 rsi=fffff900c08dcca0 rdi=fffff900c08dccb8
rip=fffff96000311897 rsp=fffff88008686100 rbp=0000000000000001
 r8=fffff88008686160  r9=0000000000000001 r10=0000000000000008
r11=fffff80003e7cb60 r12=fffff88008686220 r13=0000000000000001
r14=0000000000000001 r15=fffff900c0081000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
win32k!BmfdQueryAdvanceWidthsTE+0x3f:
fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h] ds:002b:fffef900`c0d5b030=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff96000311897

STACK_TEXT:  
fffff880`08686100 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!BmfdQueryAdvanceWidthsTE+0x3f


FOLLOWUP_IP: 
win32k!BmfdQueryAdvanceWidthsTE+3f
fffff960`00311897 488b4910        mov     rcx,qword ptr [rcx+10h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!BmfdQueryAdvanceWidthsTE+3f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d23ecb0

STACK_COMMAND:  .cxr 0xfffff88008685730 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f

BUCKET_ID:  X64_0x3B_win32k!BmfdQueryAdvanceWidthsTE+3f

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\033111-28719-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03c5d000 PsLoadedModuleList = 0xfffff800`03e9ae50
Debug session time: Thu Mar 31 13:24:49.458 2011 (UTC - 4:00)
System Uptime: 0 days 0:24:06.894
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800b4d7fd8, fffff8800b4d7840, fffff80003e020f3}

Probably caused by : Ntfs.sys ( Ntfs! ?? ::FNODOBFM::`string'+2cc9 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800b4d7fd8
Arg3: fffff8800b4d7840
Arg4: fffff80003e020f3

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800b4d7fd8 -- (.exr 0xfffff8800b4d7fd8)
Cannot read Exception record @ fffff8800b4d7fd8

CONTEXT:  fffff8800b4d7840 -- (.cxr 0xfffff8800b4d7840)
rax=0000000000000000 rbx=fffffa800812eca0 rcx=fffefa8007ecb580
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003e020f3 rsp=fffff8800b4d8210 rbp=0000000000000000
 r8=fffff8800b4d83c8  r9=fffff8800b4d83c0 r10=fffffa800812ed18
r11=fffff80003cec7d0 r12=0000000000000001 r13=fffefa8007ecb580
r14=fffffa80080ada90 r15=fffff8800b4d8c20
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExFreePoolWithTag+0x43:
fffff800`03e020f3 418b45f0        mov     eax,dword ptr [r13-10h] ds:002b:fffefa80`07ecb570=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  DkService.exe

CURRENT_IRQL:  1

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003f050e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs! ?? ::FNODOBFM::`string'+2cc9
fffff880`0123a3d8 cc              int     3

FAULTING_IP: 
nt!ExFreePoolWithTag+43
fffff800`03e020f3 418b45f0        mov     eax,dword ptr [r13-10h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003e020f3

STACK_TEXT:  
fffff880`0b4d7008 fffff880`0123a3d8 : 00000000`00000024 00000000`001904fb fffff880`0b4d7fd8 fffff880`0b4d7840 : nt!KeBugCheckEx
fffff880`0b4d7010 fffff880`012973cf : fffff880`0126ab0c fffff880`0b4d8880 fffff880`0b4d8880 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x2cc9
fffff880`0b4d7050 fffff800`03cfbd1c : fffff880`0b4d7088 00000000`00000000 fffff880`0b4d71b0 fffff800`03c5d000 : Ntfs! ?? ::NNGAKEGL::`string'+0x81c8
fffff880`0b4d7090 fffff800`03cf340d : fffff880`0126ab00 fffff880`0b4d8880 00000000`00000000 fffff880`01219000 : nt!_C_specific_handler+0x8c
fffff880`0b4d7100 fffff800`03cfaa90 : fffff880`0126ab00 fffff880`0b4d7178 fffff880`0b4d7fd8 fffff880`01219000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0b4d7130 fffff800`03d079ef : fffff880`0b4d7fd8 fffff880`0b4d7840 fffff880`00000000 00000000`00000000 : nt!RtlDispatchException+0x410
fffff880`0b4d7810 fffff800`03cccd82 : fffff880`0b4d7fd8 fffffa80`0812eca0 fffff880`0b4d8080 00000000`00000000 : nt!KiDispatchException+0x16f
fffff880`0b4d7ea0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2


STACK_COMMAND:  kb

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs! ?? ::FNODOBFM::`string'+2cc9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9

BUCKET_ID:  X64_0x24_Ntfs!_??_::FNODOBFM::_string_+2cc9

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\041211-35615-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03c0f000 PsLoadedModuleList = 0xfffff800`03e4ce50
Debug session time: Tue Apr 12 02:06:15.390 2011 (UTC - 4:00)
System Uptime: 0 days 0:02:32.826
Loading Kernel Symbols
...............................................................
................................................................
................................................................

Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80003cb2ec1, fffff8800875efa0, 0}

Probably caused by : memory_corruption ( nt!MiRemoveMappedView+1a1 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80003cb2ec1, Address of the instruction which caused the bugcheck
Arg3: fffff8800875efa0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiRemoveMappedView+1a1
fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax

CONTEXT:  fffff8800875efa0 -- (.cxr 0xfffff8800875efa0)
rax=fffffa800b06bf50 rbx=ffffffffffffffff rcx=ffff7a800805b7e0
rdx=0000000000216fff rsi=fffffa8007e81c80 rdi=fffffa800b21ec60
rip=fffff80003cb2ec1 rsp=fffff8800875f970 rbp=0000000000000000
 r8=fffff6fb40000000  r9=fffffa8006843b30 r10=0000000fffffffff
r11=fffffa800000001c r12=fffffa8006830060 r13=fffffa8007e81d00
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MiRemoveMappedView+0x1a1:
fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax ds:002b:ffff7a80`0805b7e8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  wmpnscfg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80003cb2ec1

STACK_TEXT:  
fffff880`0875f970 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0x1a1


FOLLOWUP_IP: 
nt!MiRemoveMappedView+1a1
fffff800`03cb2ec1 48894108        mov     qword ptr [rcx+8],rax

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiRemoveMappedView+1a1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4cc791bd

STACK_COMMAND:  .cxr 0xfffff8800875efa0 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiRemoveMappedView+1a1

BUCKET_ID:  X64_0x3B_nt!MiRemoveMappedView+1a1

Followup: MachineOwner
---------




Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\DMP\041411-31340-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.amd64fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0xfffff800`03c57000 PsLoadedModuleList = 0xfffff800`03e94e50
Debug session time: Thu Apr 14 05:15:22.420 2011 (UTC - 4:00)
System Uptime: 0 days 0:03:52.856
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : CLASSPNP.SYS ( CLASSPNP!ClasspSendSynchronousCompletion+31 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3764363430363961
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88002f1b5f8 -- (.exr 0xfffff88002f1b5f8)
ExceptionAddress: fffff880012022e1 (CLASSPNP!ClasspSendSynchronousCompletion+0x0000000000000031)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002f1b6a0 -- (.trap 0xfffff88002f1b6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffef88009641bd8
rdx=fffffa800b13ecb0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012022e1 rsp=fffff88002f1b830 rbp=0000000000000000
 r8=fffffa80079117a8  r9=0000000000000000 r10=fffff88003529000
r11=fffff88002f1b948 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
CLASSPNP!ClasspSendSynchronousCompletion+0x31:
fffff880`012022e1 488901          mov     qword ptr [rcx],rax ds:fffef880`09641bd8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003cbf46e to fffff80003cc7710

STACK_TEXT:  
fffff880`02f1a6e8 fffff800`03cbf46e : fffffa80`0a912820 00000000`00000000 fffff880`02f1ae60 fffff800`03cf4668 : nt!KeBugCheck
fffff880`02f1a6f0 fffff800`03ced40d : fffff800`03ed5b7c fffff800`03e0fea4 fffff800`03c57000 fffff880`02f1b5f8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02f1a720 fffff800`03cf4a90 : fffff800`03e16b34 fffff880`02f1a798 fffff880`02f1b5f8 fffff800`03c57000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02f1a750 fffff800`03d019ef : fffff880`02f1b5f8 fffff880`02f1ae60 fffff880`00000000 fffffa80`0b13ecb0 : nt!RtlDispatchException+0x410
fffff880`02f1ae30 fffff800`03cc6d82 : fffff880`02f1b5f8 fffffa80`0b13ecb0 fffff880`02f1b6a0 00000000`00000000 : nt!KiDispatchException+0x16f
fffff880`02f1b4c0 fffff800`03cc568a : 00000000`00000000 fffffa80`0ad04f50 00000000`00007000 fffff800`03c10524 : nt!KiExceptionDispatch+0xc2
fffff880`02f1b6a0 fffff880`012022e1 : fffff880`00c5d12c fffff880`00c8a552 00000000`00000008 fffff800`03c12a56 : nt!KiGeneralProtectionFault+0x10a
fffff880`02f1b830 fffff800`03cc9d26 : fffffa80`06b640e0 fffff800`03c13156 fffffa80`06690ea0 00000000`00007200 : CLASSPNP!ClasspSendSynchronousCompletion+0x31
fffff880`02f1b870 fffff880`00c8f41a : 00000000`00007200 00000000`00000001 fffffa80`08250b80 00000000`00000000 : nt!IopfCompleteRequest+0x3a6
fffff880`02f1b950 fffff880`00c8f184 : fffffa80`08250b80 fffff880`00c91b3b fffffa80`06b64010 fffffa80`075107d0 : ataport!IdeCompleteScsiIrp+0x62
fffff880`02f1b980 fffff880`00c89e32 : 00000000`00000000 00000000`00000000 fffffa80`074fa500 fffffa80`075107d0 : ataport!IdeAlwaysSuccessCrbCompletion+0x2c
fffff880`02f1b9b0 fffff880`00c927ed : fffffa80`074f91a0 fffffa80`08250b80 00000000`00000000 fffffa80`08250b80 : ataport!IdeTranslateCompletedRequest+0x236
fffff880`02f1bae0 fffff880`00c920ec : fffffa80`074f91a0 00000000`00000000 fffffa80`074f91a0 00000000`00000000 : ataport!IdeProcessCompletedRequests+0x4d5
fffff880`02f1bc10 fffff800`03cd2bfc : fffff880`009eb180 00000000`26253cdc fffffa80`074f9050 fffffa80`074f9118 : ataport!IdePortCompletionDpc+0x1a8
fffff880`02f1bcd0 fffff800`03ccfeea : fffff880`009eb180 fffff880`009f5fc0 00000000`00000000 fffff880`00c91f44 : nt!KiRetireDpcList+0x1bc
fffff880`02f1bd80 00000000`00000000 : fffff880`02f1c000 fffff880`02f16000 fffff880`02f1bd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CLASSPNP!ClasspSendSynchronousCompletion+31
fffff880`012022e1 488901          mov     qword ptr [rcx],rax

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  CLASSPNP!ClasspSendSynchronousCompletion+31

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc11e

FAILURE_BUCKET_ID:  X64_0x1E_0_CLASSPNP!ClasspSendSynchronousCompletion+31

BUCKET_ID:  X64_0x1E_0_CLASSPNP!ClasspSendSynchronousCompletion+31

Followup: MachineOwner
---------

DRIVERS

Code:

start             end                 module name
fffff880`0433e000 fffff880`0437c000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f90000 fffff880`00fe7000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02c00000 fffff880`02c8a000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04209000 fffff880`0421f000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`011c4000 fffff880`011cf000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04390000 fffff880`043b3000   AnyDVD   AnyDVD.sys   Wed Dec 01 14:06:20 2010 (4CF69CAC)
fffff880`0437c000 fffff880`04384000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
fffff880`03ff3000 fffff880`03ff9000   AsIO     AsIO.sys     Mon Aug 03 03:03:16 2009 (4A768BB4)
fffff880`03fed000 fffff880`03ff3000   AsUpIO   AsUpIO.sys   Sun Jul 05 22:21:38 2009 (4A515FB2)
fffff880`00ec7000 fffff880`00ed0000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00c86000 fffff880`00cb0000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`0640f000 fffff880`0645e000   atksgt   atksgt.sys   Sun May 17 09:36:34 2009 (4A1012E2)
fffff960`00860000 fffff960`008c1000   ATMFD    ATMFD.DLL    unavailable (00000000)
fffff880`02ccd000 fffff880`02cd4000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03fdc000 fffff880`03fed000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05f7f000 fffff880`05f9d000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00760000 fffff960`00787000   cdd      cdd.dll      unavailable (00000000)
fffff880`00dc5000 fffff880`00def000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ed0000 fffff880`00f90000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`04912000 fffff880`04924000   circlass circlass.sys Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`01200000 fffff880`01230000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d0a000 fffff880`00d68000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01487000 fffff880`014fa000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`043c9000 fffff880`043d9000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`0645e000 fffff880`06467000   cpuz135_x64 cpuz135_x64.sys Wed Jan 19 11:42:06 2011 (4D37145E)
fffff880`05851000 fffff880`0585f000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03f3b000 fffff880`03fbe000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`0531d000 fffff880`05352000   CT20XUT  CT20XUT.SYS  Wed May 05 09:01:28 2010 (4BE16C28)
fffff880`05254000 fffff880`05302000   ctac32k  ctac32k.sys  Wed Jul 02 04:38:22 2008 (486B3E7E)
fffff880`04000000 fffff880`040a5700   ctaud2k  ctaud2k.sys  Wed May 05 08:59:48 2010 (4BE16BC4)
fffff880`05862000 fffff880`059bf000   CTEXFIFX CTEXFIFX.SYS Wed May 05 09:01:21 2010 (4BE16C21)
fffff880`05302000 fffff880`0531d000   CTHWIUT  CTHWIUT.SYS  Wed May 05 09:01:32 2010 (4BE16C2C)
fffff880`042ff000 fffff880`04330000   ctoss2k  ctoss2k.sys  Wed May 05 08:57:46 2010 (4BE16B4A)
fffff880`04330000 fffff880`04338000   ctprxy2k ctprxy2k.sys Wed May 05 08:59:51 2010 (4BE16BC7)
fffff880`048ae000 fffff880`048e6000   ctsfm2k  ctsfm2k.sys  Wed May 05 08:57:33 2010 (4BE16B3D)
fffff880`03fbe000 fffff880`03fdc000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03f2c000 fffff880`03f3b000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`015e5000 fffff880`015fb000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`041de000 fffff880`04200000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`059f4000 fffff880`059fd000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`059e8000 fffff880`059f4000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0539b000 fffff880`053ae000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`05838000 fffff880`05844000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`118d3000 fffff880`119c7000   dxgkrnl  dxgkrnl.sys  Tue Jan 25 23:22:56 2011 (4D3FA1A0)
fffff880`10c00000 fffff880`10c46000   dxgmms1  dxgmms1.sys  Tue Jan 25 23:22:12 2011 (4D3FA174)
fffff880`03f20000 fffff880`03f2c000   ElbyCDIO ElbyCDIO.sys Thu Dec 16 17:58:13 2010 (4D0A9985)
fffff880`05000000 fffff880`0504a000   emupia2k emupia2k.sys Wed May 05 08:57:27 2010 (4BE16B37)
fffff880`011cf000 fffff880`011e3000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01000000 fffff880`0104c000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0150b000 fffff880`01515000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`015ab000 fffff880`015e5000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`01515000 fffff880`0155f000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`043b3000 fffff880`043c0000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff880`0506b000 fffff880`051ec000   ha20x2k  ha20x2k.sys  Wed May 05 08:59:10 2010 (4BE16B9E)
fffff800`03c0e000 fffff800`03c57000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`10c46000 fffff880`10c6a000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`119c7000 fffff880`119d8000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`043e3000 fffff880`043fc000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`04200000 fffff880`04208080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`053bc000 fffff880`053ca000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`05eb7000 fffff880`05f7f000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`016b5000 fffff880`016be000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`040ce000 fffff880`040e4000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`04890000 fffff880`0489f000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`053ca000 fffff880`053d8000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00b96000 fffff800`00ba0000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`042bc000 fffff880`042ff000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`0146d000 fffff880`01487000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`04338000 fffff880`0433d200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`04924000 fffff880`04927d80   LGBusEnum LGBusEnum.sys Mon Nov 23 20:36:48 2009 (4B0B38B0)
fffff880`0648e000 fffff880`06490480   LGVirHid LGVirHid.sys Mon Nov 23 20:36:48 2009 (4B0B38B0)
fffff880`053e9000 fffff880`053fe000   LHidFilt LHidFilt.Sys Tue Aug 24 13:21:36 2010 (4C73FFA0)
fffff880`06467000 fffff880`06474000   lirsgt   lirsgt.sys   Sun May 17 09:06:57 2009 (4A100BF1)
fffff880`119e9000 fffff880`119fe000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`043d9000 fffff880`043e0000   lmimirr  lmimirr.sys  Tue Apr 10 18:32:45 2007 (461C108D)
fffff880`0647b000 fffff880`0648e000   LMIRfsDriver LMIRfsDriver.sys Mon Jul 14 12:26:56 2008 (487B7E50)
fffff880`05200000 fffff880`05214000   LMouFilt LMouFilt.Sys Tue Aug 24 13:21:43 2010 (4C73FFA7)
fffff880`0521e000 fffff880`05241000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cb2000 fffff880`00cf6000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`053ae000 fffff880`053bc000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`0489f000 fffff880`048ae000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`0485a000 fffff880`04867000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c6c000 fffff880`00c86000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02c93000 fffff880`02cc4000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`05e71000 fffff880`05e81000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`05f9d000 fffff880`05fb5000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`05fb5000 fffff880`05fe2000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`05e00000 fffff880`05e4e000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`05e4e000 fffff880`05e71000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`02d32000 fffff880`02d3d000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00ff0000 fffff880`00ffa000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0140f000 fffff880`0146d000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03f15000 fffff880`03f20000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`016a3000 fffff880`016b5000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`0104c000 fffff880`01093000   mv61xx   mv61xx.sys   Wed Aug 05 23:20:12 2009 (4A7A4BEC)
fffff880`010c2000 fffff880`0114f000   mv91xx   mv91xx.sys   Wed Mar 17 03:53:06 2010 (4BA08A62)
fffff880`0114f000 fffff880`01157000   mvxxmm   mvxxmm.sys   Wed Mar 17 03:52:37 2010 (4BA08A45)
fffff880`016cb000 fffff880`017bd000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04243000 fffff880`0424f000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0424f000 fffff880`0427e000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0504a000 fffff880`0505f000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`01243000 fffff880`01252000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02d79000 fffff880`02dbe000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`09364000 fffff880`09379000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`02d3d000 fffff880`02d4e000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03f09000 fffff880`03f15000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`03c57000 fffff800`04234000   nt       ntkrnlmp.exe Tue Oct 26 22:43:09 2010 (4CC791BD)
fffff880`0125b000 fffff880`013fe000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`02cc4000 fffff880`02ccd000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`118d1000 fffff880`118d2180   nvBridge nvBridge.kmd Wed Feb 23 02:34:23 2011 (4D64B87F)
fffff880`059bf000 fffff880`059e8000   nvhda64v nvhda64v.sys Thu Nov 11 18:10:36 2010 (4CDC77EC)
fffff880`10c75000 fffff880`118d0180   nvlddmkm nvlddmkm.sys Wed Feb 23 02:46:52 2011 (4D64BB6C)
fffff880`05844000 fffff880`05851000   nx6000   nx6000.sys   Thu Dec 02 17:23:39 2010 (4CF81C6B)
fffff880`02dbe000 fffff880`02de4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00d9b000 fffff880`00db0000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d68000 fffff880`00d9b000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00ec0000 fffff880`00ec7000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00c5c000 fffff880`00c6c000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`014fa000 fffff880`0150b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`06491000 fffff880`06537000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`041a1000 fffff880`041de000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cf6000 fffff880`00d0a000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`011e3000 fffff880`011eee00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`06474000 fffff880`0647b000   RaInfo   RaInfo.sys   Fri Jan 04 13:57:14 2008 (477E818A)
fffff880`0421f000 fffff880`04243000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0427e000 fffff880`04299000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`04299000 fffff880`042ba000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`0486b000 fffff880`04885000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03eb8000 fffff880`03f09000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04885000 fffff880`04890000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`02d17000 fffff880`02d20000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d20000 fffff880`02d29000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d29000 fffff880`02d32000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`017bd000 fffff880`017f7000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05e9f000 fffff880`05eb7000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`0413a000 fffff880`041a1000   Rt64win7 Rt64win7.sys Fri Jan 21 02:34:00 2011 (4D3936E8)
fffff880`049ec000 fffff880`049fa000   scfilter scfilter.sys Mon Jul 13 19:50:17 2009 (4A5BC839)
fffff880`01093000 fffff880`010c2000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`06537000 fffff880`06542000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04384000 fffff880`04390000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`03e15000 fffff880`03e32000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0169b000 fffff880`016a3000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`092ce000 fffff880`09364000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`06581000 fffff880`065e8000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`06542000 fffff880`0656f000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`01162000 fffff880`011c4000   storport storport.sys Mon Jul 13 20:01:18 2009 (4A5BCACE)
fffff880`04910000 fffff880`04911480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0656f000 fffff880`06581000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`02d6c000 fffff880`02d79000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`02d4e000 fffff880`02d6c000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`03ea4000 fffff880`03eb8000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00400000 fffff960`0040a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`040a8000 fffff880`040ce000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`0493f000 fffff880`04951000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`05380000 fffff880`0539ac00   usbaudio usbaudio.sys Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`05800000 fffff880`0581d000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`0497d000 fffff880`0497ef00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`119d8000 fffff880`119e9000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`04800000 fffff880`0485a000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`040e4000 fffff880`0413a000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`0496e000 fffff880`0497d000   usbrpm   usbrpm.sys   Mon Jul 13 20:35:14 2009 (4A5BD2C2)
fffff880`053d8000 fffff880`053e9000   usbscan  usbscan.sys  Mon Jul 13 20:35:32 2009 (4A5BD2D4)
fffff880`0581d000 fffff880`05838000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`05352000 fffff880`0537f200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00eb3000 fffff880`00ec0000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`02cd4000 fffff880`02ce2000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`02ce2000 fffff880`02d07000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00db0000 fffff880`00dc5000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`0155f000 fffff880`015ab000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`0497f000 fffff880`049bb000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
fffff880`02de4000 fffff880`02df8000   vpcnfltr vpcnfltr.sys Tue Sep 22 21:32:30 2009 (4AB97AAE)
fffff880`04951000 fffff880`0496e000   vpcusb   vpcusb.sys   Tue Sep 22 21:32:39 2009 (4AB97AB7)
fffff880`03e4d000 fffff880`03ea3180   vpcvmm   vpcvmm.sys   Tue Sep 22 21:32:38 2009 (4AB97AB6)
fffff880`051ec000 fffff880`051f4000   wacommousefilter wacommousefilter.sys Fri Feb 16 13:12:17 2007 (45D5F401)
fffff880`043e0000 fffff880`043e2a00   wacomvhid wacomvhid.sys Mon Sep 21 19:29:14 2009 (4AB80C4A)
fffff880`03e32000 fffff880`03e4d000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`02d07000 fffff880`02d17000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00e00000 fffff880`00ea4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ea4000 fffff880`00eb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02c8a000 fffff880`02c93000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00060000 fffff960`00370000   win32k   win32k.sys   unavailable (00000000)
fffff880`05241000 fffff880`05252000   WinUSB   WinUSB.sys   Mon Jul 13 20:06:28 2009 (4A5BCC04)
fffff880`04928000 fffff880`0492cd00   WmBEnum  WmBEnum.sys  Tue Apr 27 16:10:19 2010 (4BD744AB)
fffff880`05214000 fffff880`0521d180   WmFilter WmFilter.sys Tue Apr 27 16:10:19 2010 (4BD744AB)
fffff880`043c0000 fffff880`043c9000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fe7000 fffff880`00ff0000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`0492d000 fffff880`0493e480   WmXlCore WmXlCore.sys Tue Apr 27 16:09:26 2010 (4BD74476)
fffff880`048e6000 fffff880`04907000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`049bb000 fffff880`049ec000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`0581d000 fffff880`0582e000   WinUSB.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00011000
fffff880`0582e000 fffff880`0585f000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`01400000 fffff880`0140e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`016be000 fffff880`016ca000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000C000
fffff880`017f7000 fffff880`01800000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00009000
fffff880`01230000 fffff880`01243000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
fffff880`048df000 fffff880`04910000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`048ae000 fffff880`048df000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00031000
fffff880`01157000 fffff880`01162000   acs6nts.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000B000

Windows 7 Random Crashes BSOD Win 7

PhotographicaUK

New Member

Attachments

cybercore

New Member

PhotographicaUK

New Member

Attachments

cybercore

New Member

PhotographicaUK

New Member

cybercore

New Member

PhotographicaUK

New Member

cybercore

New Member

PhotographicaUK

New Member

PhotographicaUK

New Member

cybercore

New Member

Similar threads