Windows 7: Random BSOD on Win7 64-bit

lwrand · 04 Nov 2010

Hi everyone,
in attach you can find all the data gathered (using the batch provided by this website) about my last five BSOD.
I have tried to install the latest motherboard and graphic drivers with no luck; I also tried to uninstall NOD32 (64bit version) but there seems to be no connection with the problem since my last crashes are all with no antivirus on.

In the past I had these BSOD, while playing and/or surfing:
- MEMORY_MANAGEMENT
- PNL_LIST_CORRUPTED
*Please note that I have already RMA 2xRAM banks.

A quick brief of my system (more details on my profile):
OS: Windows 7 64 bit Ultimate
System age: 3 weeks (assembled)
OS age: 1 week

Thanks for your precious analisys

.
Kindly,

CarlTR6 · 04 Nov 2010

Welcome to the forum, lwrand; sorry you are having problems.

Quote:

Error code 4E, PFN_LIST_CORRUPT. Usual causes: Device driver, ?memory.

Error code A, IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

I recommend that you download and install Microsoft Security Essentials. It supersedes Windows Defender, provides better protection and runs more smoothly with Win 7. MSE will turn off Windows Defender.

All three of your dumps blame or indicate memory corruption. I recommend that you test your RAM with Memtest following the instructions in this tutorial:

RAM - Test with Memtest86+

Run Memtest for at least 7 passes. This will take 6- 8 hours. Also run Memtest a second time from a cold boot after your computer has been off for a while. Errors, if any, will show on your screen in red. Post your results.

If you do get get any RAM errors, enable Driver Verifier following the instructions in this tutorial: Driver Verifier - Enable and Disable. Upload any and all dumps generated by Driver Verifier.

Code:

Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`01a1c000 PsLoadedModuleList = 0xfffff800`01c59e50
Debug session time: Thu Nov  4 14:49:48.929 2010 (GMT-4)
System Uptime: 0 days 0:43:14.788
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 77ff, 0, 78ff}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000077ff, page frame number
Arg3: 0000000000000000, current page state
Arg4: 00000000000078ff, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80001b1c38c to fffff80001a8c740

STACK_TEXT:  
fffff880`097eff98 fffff800`01b1c38c : 00000000`0000004e 00000000`00000099 00000000`000077ff 00000000`00000000 : nt!KeBugCheckEx
fffff880`097effa0 fffff800`01afe9f7 : 00000000`00000000 fffff683`ff7ed348 86700002`1de6a025 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`097effe0 fffff800`01a60c23 : fffffa80`08e76a70 fffff700`00001617 0000007f`fffffff8 fffff8a0`01555f90 : nt! ?? ::FNODOBFM::`string'+0x3223e
fffff880`097f0070 fffff800`01a5f68a : fffffa80`08e76a70 fffffa80`0000000a fffff8a0`00000f4a fffff880`00000507 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`097f0920 fffff800`01d71dcf : fffff8a0`099f3940 fffff880`097f0c20 00000000`00000000 fffffa80`07d70b60 : nt!MmCleanProcessAddressSpace+0x96
fffff880`097f0970 fffff800`01d4a635 : 00000000`000000ff fffff8a0`07209501 000007ff`fffdc000 fffffa80`08948b60 : nt!PspExitThread+0x92f
fffff880`097f0a30 fffff800`01a691db : 00000000`00000000 fffffa80`07103780 00000000`00000000 00000000`00000000 : nt!PsExitSpecialApc+0x1d
fffff880`097f0a60 fffff800`01a69620 : 00000000`76fe4298 fffff880`097f0ae0 fffff800`01d4a74c 00000000`00000001 : nt!KiDeliverApc+0x2eb
fffff880`097f0ae0 fffff800`01a8ba37 : fffffa80`07d70b60 00000000`76fe4270 00000000`000000c0 00000000`003d6340 : nt!KiInitiateUserApc+0x70
fffff880`097f0c20 00000000`76f3165a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`009af758 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f3165a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`01b1c38c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

5: kd> lmtsmn
start             end                 module name
fffff880`05246000 fffff880`05284000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00e0c000 fffff880`00e63000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04e00000 fffff880`04e8a000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`05e00000 fffff880`05e16000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`02c55000 fffff880`02c6a000   amdppm   amdppm.sys   Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00fa0000 fffff880`00fab000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`05fd1000 fffff880`05fd9000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
fffff880`00f6d000 fffff880`00f76000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00f76000 fffff880`00fa0000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`05cd5000 fffff880`05cf5000   AtihdW76 AtihdW76.sys Mon Aug 16 06:41:02 2010 (4C6915BE)
fffff880`05424000 fffff880`05bfa000   atikmdag atikmdag.sys Tue Sep 28 21:41:26 2010 (4CA29946)
fffff880`052b4000 fffff880`052ff000   atikmpag atikmpag.sys Tue Sep 28 21:14:49 2010 (4CA29309)
fffff880`04f31000 fffff880`04f38000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02c1e000 fffff880`02c2f000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`089bb000 fffff880`089d9000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00710000 fffff960`00737000   cdd      cdd.dll      unavailable (00000000)
fffff880`04efe000 fffff880`04f28000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00d40000 fffff880`00e00000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01000000 fffff880`01030000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ce2000 fffff880`00d40000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010c2000 fffff880`01135000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`05fe2000 fffff880`05ff2000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`05da5000 fffff880`05db3000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02d7a000 fffff880`02dfd000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02c00000 fffff880`02c1e000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02d6b000 fffff880`02d7a000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01200000 fffff880`01216000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05d32000 fffff880`05d54000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`05dbf000 fffff880`05dc8000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05db3000 fffff880`05dbf000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`05dc8000 fffff880`05ddb000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`069c5000 fffff880`069d1000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`052ff000 fffff880`053f3000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`05200000 fffff880`05246000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`01050000 fffff880`01064000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`00fab000 fffff880`00ff7000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`013e5000 fffff880`013ef000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`011bb000 fffff880`011f5000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`01ff8000 fffff800`02041000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`05400000 fffff880`05424000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`09000000 fffff880`09019000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`05d81000 fffff880`05d89080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`091e1000 fffff880`091ef000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`088f3000 fffff880`089bb000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`015f3000 fffff880`015fc000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`05ed6000 fffff880`05ee5000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`09019000 fffff880`09027000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`017f8000 fffff800`01802000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`05c11000 fffff880`05c54000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013ba000 fffff880`013d4000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`05d54000 fffff880`05d59200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`05de9000 fffff880`05dfe000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`02c6a000 fffff880`02c8d000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00cc1000 fffff880`00cce000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`05ddb000 fffff880`05de9000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05284000 fffff880`05293000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`09027000 fffff880`09034000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00f53000 fffff880`00f6d000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`089d9000 fffff880`089f1000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`08800000 fffff880`0882d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0882d000 fffff880`0887b000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0887b000 fffff880`0889e000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`04f96000 fffff880`04fa1000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e6c000 fffff880`00e76000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01064000 fffff880`010c2000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02d60000 fffff880`02d6b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`015e1000 fffff880`015f3000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014ef000 fffff880`015e1000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`05e3a000 fffff880`05e46000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`05e46000 fffff880`05e75000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05cc0000 fffff880`05cd5000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02cc5000 fffff880`02cd4000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`04e8a000 fffff880`04ecf000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`04fa1000 fffff880`04fb2000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02d54000 fffff880`02d60000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`01a1c000 fffff800`01ff8000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01217000 fffff880`013ba000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`04f28000 fffff880`04f31000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`02c9f000 fffff880`02cc5000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00eb6000 fffff880`00ecb000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e76000 fffff880`00ea9000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00f3c000 fffff880`00f43000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00f43000 fffff880`00f53000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013d4000 fffff880`013e5000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`08cef000 fffff880`08d95000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05cf5000 fffff880`05d32000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cce000 fffff880`00ce2000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`05e16000 fffff880`05e3a000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05e75000 fffff880`05e90000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`05e90000 fffff880`05eb1000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`05eb1000 fffff880`05ecb000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02d03000 fffff880`02d54000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`05ecb000 fffff880`05ed6000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`04f7b000 fffff880`04f84000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04f84000 fffff880`04f8d000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04f8d000 fffff880`04f96000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01181000 fffff880`011bb000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`04ed8000 fffff880`04ef0000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`08d95000 fffff880`08da0000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`014e5000 fffff880`014ed000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`09153000 fffff880`091c4000   spsys    spsys.sys    Mon May 11 13:20:58 2009 (4A085E7A)
fffff880`090bd000 fffff880`09153000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`08c00000 fffff880`08c67000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`08da0000 fffff880`08dcd000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`05ee5000 fffff880`05ee6480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`08dcd000 fffff880`08ddf000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`04fd0000 fffff880`04fdd000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`04fb2000 fffff880`04fd0000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02cef000 fffff880`02d03000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00590000 fffff960`0059a000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02c2f000 fffff880`02c55000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`05c54000 fffff880`05c66000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`091c4000 fffff880`091e1000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`05fbe000 fffff880`05fbff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`05fc0000 fffff880`05fd1000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05fb1000 fffff880`05fbe000   usbfilter usbfilter.sys Wed Oct 07 03:44:08 2009 (4ACC46C8)
fffff880`05c66000 fffff880`05cc0000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`05f50000 fffff880`05f5b000   usbohci  usbohci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`05f5b000 fffff880`05fb1000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`069d1000 fffff880`069dd000   usbprint usbprint.sys Mon Jul 13 20:38:18 2009 (4A5BD37A)
fffff880`00ea9000 fffff880`00eb6000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`04f38000 fffff880`04f46000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`06806000 fffff880`069b7000   viahduaa viahduaa.sys Tue Mar 02 06:30:18 2010 (4B8CF6CA)
fffff880`04f46000 fffff880`04f6b000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`069b7000 fffff880`069c5000   VMfilt64 VMfilt64.sys Thu Jul 30 23:40:32 2009 (4A7267B0)
fffff880`014d5000 fffff880`014e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00ecb000 fffff880`00ee0000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00ee0000 fffff880`00f3c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01135000 fffff880`01181000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02cd4000 fffff880`02cef000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`04f6b000 fffff880`04f7b000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00c00000 fffff880`00ca4000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00ca4000 fffff880`00cb3000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04ecf000 fffff880`04ed8000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000b0000 fffff960`003bf000   win32k   win32k.sys   Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`05fd9000 fffff880`05fe2000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00e63000 fffff880`00e6c000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`05293000 fffff880`052b4000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`05eeb000 fffff880`05f50000   yk62x64  yk62x64.sys  Mon Feb 15 10:46:41 2010 (4B796C61)

Unloaded modules:
fffff880`069dd000 fffff880`069fa000   usbccgp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`05d68000 fffff880`05d81000   HIDCLASS.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`05d5a000 fffff880`05d68000   hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`05d8a000 fffff880`05d98000   kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`05d98000 fffff880`05da5000   mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`013ef000 fffff880`013fd000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01030000 fffff880`0103c000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0103c000 fffff880`01045000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04eeb000 fffff880`04efe000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffff683ff6db410, 0, 0, fffff80001b8fef7}

Probably caused by : memory_corruption ( nt!MiCaptureAndResetWorkingSetAccessBits+97 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff683ff6db410, memory referenced
Arg2: 0000000000000000, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001b8fef7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80001cc10e0
 fffff683ff6db410 

CURRENT_IRQL:  0

FAULTING_IP: 
nt!MiCaptureAndResetWorkingSetAccessBits+97
fffff800`01b8fef7 488b5d00        mov     rbx,qword ptr [rbp]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  LogonUI.exe

TRAP_FRAME:  fffff88002124850 -- (.trap 0xfffff88002124850)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000098000000000 rbx=0000000000000000 rcx=00000003ff6db410
rdx=000007fefb7b1000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001b8fef7 rsp=fffff880021249e0 rbp=fffff683ff6db410
 r8=0000000000000001  r9=0000000000000014 r10=0000000000000014
r11=fffff6fb40003000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
nt!MiCaptureAndResetWorkingSetAccessBits+0x97:
fffff800`01b8fef7 488b5d00        mov     rbx,qword ptr [rbp] ss:fffff683`ff6db410=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80001a88ca9 to fffff80001a89740

STACK_TEXT:  
fffff880`02124708 fffff800`01a88ca9 : 00000000`0000000a fffff683`ff6db410 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`02124710 fffff800`01a87920 : 00000000`00000000 73200002`0b171005 00000000`00001000 fffff800`01bbdbfe : nt!KiBugCheckDispatch+0x69
fffff880`02124850 fffff800`01b8fef7 : 00000003`00000000 73200002`0b171025 fffff683`ff7dbd88 fffff700`01087e18 : nt!KiPageFault+0x260
fffff880`021249e0 fffff800`01b0ba70 : 00000000`00000000 00000000`00000012 fffff880`02124ba0 fffff880`02124bb0 : nt!MiCaptureAndResetWorkingSetAccessBits+0x97
fffff880`02124ae0 fffff800`01a9dee2 : 00000000`0000163a 00000000`00000000 fffffa80`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x496e8
fffff880`02124b80 fffff800`01a9e0e8 : 00000000`00000008 fffff880`02124c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`02124bd0 fffff800`01d2dc06 : fffffa80`06a0a960 00000000`00000080 fffffa80`069ec040 00000000`00000001 : nt!KeBalanceSetManager+0x138
fffff880`02124d40 fffff800`01a67c26 : fffff880`01c5d180 fffffa80`06a0a960 fffff880`01c68040 e824ac8b`4c185b8b : nt!PspSystemThreadStartup+0x5a
fffff880`02124d80 00000000`00000000 : fffff880`02125000 fffff880`0211f000 fffff880`02124710 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCaptureAndResetWorkingSetAccessBits+97
fffff800`01b8fef7 488b5d00        mov     rbx,qword ptr [rbp]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiCaptureAndResetWorkingSetAccessBits+97

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiCaptureAndResetWorkingSetAccessBits+97

BUCKET_ID:  X64_0xA_nt!MiCaptureAndResetWorkingSetAccessBits+97

Followup: MachineOwner
---------

lwrand · 05 Nov 2010

Hi Carl,
thank you for your analisys.
I'm going to use memtest later on (as soos as I get home

, damn work

) and post the results.

After the test I'll to see how Microsoft Security Essentials impacts on the system.
Kindly,

CarlTR6 · 05 Nov 2010

You are welcome. Please keep us updated.

lwrand · 05 Nov 2010

I run memtest and after 10 minutes i got 6144 errors...!

(screen in attach)
I'm going to enable driver verifier to catch the next BSOD.

Kindly,

lwrand · 05 Nov 2010

Here we go...
In order to create the new dump zip, I had to go in SafeMode and disable the Driver Verifier and reboot. I got 3 more BSOD and I saw some drivers involved in the crashes.

All of them came out with no great activity by the system, I was playing a game when suddenly the application crashed, then I tried to open Firefox and it crashed too after a bit. Then I tried to reopen the same game and it crashed again then freeze and BSOD. The last two were the same, with no great activity, just open a windows or two, plus the browser nothing much (but I had to SafeMode...!

)

Any thoughts ?
Kindly,

CarlTR6 · 05 Nov 2010

I will look at the dumps; but you have found a problem, a big one, RAM. Let's get the RAM sorted out and we will look at other things. When you get RAM errors with Memtest, it can be several things: you can have a bad RAM stick, a RAM slot on your motherboard is bad, the RAM sticks are mismatched, the RAM is not compatible with your motherboard, the memory controller is faulty, or even the power supply is faulty.

Remove all of your RAM sticks except the one in the first slot. Run Memtest on that stick. If it passes, remove that stick and test the next stick, etc. If all sticks pass, take a good stick and test each slot with it. This will take some time. Also, see how your computer runs with just one stick of RAM.

Post back with the results.

zigzag3143 · 05 Nov 2010

Quote: Originally Posted by lwrand

Here we go...
In order to create the new dump zip, I had to go in SafeMode and disable the Driver Verifier and reboot. I got 3 more BSOD and I saw some drivers involved in the crashes.

All of them came out with no great activity by the system, I was playing a game when suddenly the application crashed, then I tried to open Firefox and it crashed too after a bit. Then I tried to reopen the same game and it crashed again then freeze and BSOD. The last two were the same, with no great activity, just open a windows or two, plus the browser nothing much (but I had to SafeMode...!

)

Any thoughts ?
Kindly,

Virtually all of them are memory corruption as you saw when you ran memtest

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\110510-35521-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`01a10000 PsLoadedModuleList = 0xfffff800`01c4de50
Debug session time: Fri Nov  5 15:52:42.541 2010 (GMT-4)
System Uptime: 0 days 0:11:54.400
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffcb6400adb3b, 0, fffff80001a9453b, 7}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+41b )

Followup: MachineOwner
---------

lwrand · 05 Nov 2010

I have cleared the CMOS and reset BIOS to default values and I'm currently running memtest on all sticks. At the moment I see no errors (32 minutes now).

@Carl: I will test all sticks as you suggest.
@zigzag: thx for your time too

Is there a possibility that the CMOS clear and BIOS reset will hide RAM errors ?

Kindly,

CarlTR6 · 05 Nov 2010

You've asked a good question and I do not know the answer. It is possible that the something in the BIOS was corrupted and causing a conflicts and resetting the CMOS cleared it. It is just as possible that reseating your RAM cleared up a problem.

Windows 7: Random BSOD on Win7 64-bit

Random BSOD on Win7 64-bit problems?