Windows 7: BSODs and unstable Win7

tumblebug · 24 Jan 2011

Hi

I've got a fairly new work laptop (4 months old - Toshiba Tecra A11) with Windows 7 Professional x64 and its been behaving very strangely with screen flashes, momentary system freezes and lately, frequent BSODs that appear to be mostly related to "ntoskrnl.exe".

I'm a web .net programmer so I push the laptop fairly hard with projects open in Visual Studio 2008, a XP SP2 virtual pc (in Virtual PC 2007) running Visual Studio 2003, source control, Office, etc, etc - standard developer stuff. No gaming, iTunes, movies, etc. When in the office, I have a Samsung SyncMaster 205bw external monitor hooked up as the primary display (with external keyboard and mouse) with the latop screen as the secondary display. When at home, I just used the laptop display.

Ever since I got the laptop, I've been having momentary freezes of the system, most noticeablely when hovering over the task bar and displaying the small snapshots of the currently open windows but the freeze would happen at other times as well - particularly when working in the virtual pc environment.

A while back I had a situation in the office where both displays would go black for a second, and then come back - it did this constantly for about 10 minutes and settled back down. I still get this but very sporadically.

Just recently I started a web project in the virtual pc environment that works with flash video and I don't know if its co-incidence, but the Windows 7 system gets more and more unstable with Skype, Messenger, the Desktop Manager, Windows Explorer, IE8, Intel Management, etc shutting down at random times to the point where a BSOD occurs (I've attached the last 5 dumps). The BSOD doesn't always occur though. The only hint of a pattern is that the random shutdowns occur AFTER I start working with video, or playing video through the browser. I've checked the flash plugin version and I have the latest one installed in both IE8 and Firefox.

I've opened the dumps in Windows Debugger but nothing really jumps out as a particular buggy driver - they mainly point to the ntoskrnl.exe or memory managment. The last dump from 2.38am this morning looks like it occured after a chkdsk run I left running overnight. I've done several chkdsks over the last few days which found and fixed bad/unreadable sectors on the disk.

I've run Memtest a couple of times but nothing appeared to be wrong there - although memtest DOES have a message saying "hardware issues exist" but doesn't say anything more than that. I'm going to try an overnight run for Memtest tonight.

Sorry for the long post, but anyone got any suggestions of where else to look? Maybe I've just got a lemon of a laptop

CarlTR6 · 24 Jan 2011

Hi tumblebug; welcome to the forum. I will take a look at your dumps; but please read this tutorial and follow the instructions. This will help us help you.

I looked at four of your five dumps. One of them is a Driver Verifier enabled dump. Make sure you have Driver Verifier turned off. Each dump shows a different bugcheck code; this generally means a hardware or hardware related (driver) problem. All the dumps indicate memory corruption.

Since I don't have the uploads that come from following the tutorial, I will start with drivers. Out of date drivers can cause conflicts, memory corruption and BSOD's. I find the following outsated drivers loaded on your system. One of them is really obsolete. Update these drivers or uninstall the software/hardware they are associated with.

Quote:

pgeffect.sys Mon Jun 22 05:00:11 2009 - Pangu Effect driver, Toshiba Universal Camera Filter driver. Toshiba Support - Homepage. Update this driver or uninstall the camera and upgrade to a camera certified compatible with Win 7.

rimspe64.sys Wed Jul 01 19:54:49 2009 - Ricoh-PCIe-Memory-Stick-Host-Controller. OEM – none at Downloads | Ricoh Global. If you cannot update the Ricoh drivers from the Toshiba website, uninstall the device.

rixdpe64.sys Sat Jul 04 06:27:00 2009 - Ricoh-PCIe-Memory-Stick-Host-Controller. OEM - none at Downloads | Ricoh Global. See above.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Update this driver.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Update this driver.

tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 - Toshiba tos_sps64 Service. Toshiba Support - Homepage. Update.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Update.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. Update.

vmm.sys Fri May 15 08:28:12 2009 - Virtual Machine Monitor driver - Microsoft Virtual PC 2004. Microsoft Download Center. Upgrade your MS Virtual Machine software.

VMNetSrv.sys Wed Jan 24 07:05:46 2007 - Microsoft Virtual Machine Network Services Driver. Microsoft Download Center. Upgrade your MS Virtual Machine software.

Take care of these drivers reboot and see how your system runs. Post back and let us know. If you get another BSOD, upload it and we will go from there. I may find something else when you upload the files following the instructions in the tutorial.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03010000 PsLoadedModuleList = 0xfffff800`0324de50
Debug session time: Sun Jan 23 18:28:42.565 2011 (GMT-5)
System Uptime: 0 days 1:11:07.391
Loading Kernel Symbols
...............................................................
................................................................
...............................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, fffff8800dc20001, 157a, fffff78000001000}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: fffff8800dc20001
Arg3: 000000000000157a
Arg4: fffff78000001000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  csrss.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800030d53b3 to fffff80003080740

STACK_TEXT:  
fffff880`0a164138 fffff800`030d53b3 : 00000000`0000001a 00000000`00041284 fffff880`0dc20001 00000000`0000157a : nt!KeBugCheckEx
fffff880`0a164140 fffff800`03025fbe : 00000000`0000157a fffffa80`040c5e70 00000000`00000000 fffffa80`07cf9060 : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`0a164180 fffff800`03430260 : fffff880`0dc20000 fffff800`00000c40 fffffa80`07089550 fffff880`04405e00 : nt! ?? ::FNODOBFM::`string'+0x2df20
fffff880`0a1642d0 fffff800`03430333 : fffff8a0`11264780 fffffa80`0b899000 fffff8a0`00f64000 fffffa80`0b899000 : nt!MiRemoveFromSystemSpace+0x1d0
fffff880`0a164330 fffff880`0441ab1e : fffffa80`0705e360 fffff880`0441b5fd 00000000`00000000 00000000`00000001 : nt!MmUnmapViewInSystemSpace+0x73
fffff880`0a164360 fffff880`0440198f : fffffa80`0b3411e0 fffff8a0`015da640 fffffa80`0b899000 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+0x146
fffff880`0a164440 fffff880`0452306f : fffff8a0`1086a210 00000000`00000000 fffff8a0`00f64000 00000000`00000174 : dxgmms1!VidMmDestroyAllocation+0x4f
fffff880`0a164470 fffff880`045233ac : fffff8a0`1086a210 00000000`00000000 00000000`00000001 fffff8a0`00f64000 : dxgkrnl!DXGDEVICE::DestroyAllocations+0x5eb
fffff880`0a164560 fffff880`04522651 : fffff8a0`00f64000 fffff8a0`00f64000 fffff8a0`05f25220 005c006c`00000000 : dxgkrnl!DXGDEVICE::DestroyResource+0x84
fffff880`0a164590 fffff880`045228e1 : fffffa80`0a3711a0 fffff8a0`00f64000 00000000`00000001 fffff8a0`0439e7f0 : dxgkrnl!DXGDEVICE::ProcessTerminationList+0x95
fffff880`0a1645e0 fffff880`045263e7 : fffff8a0`00f64000 00000000`400003c0 fffff880`0a164790 fffff880`044ed3af : dxgkrnl!DXGDEVICE::TerminateAllocations+0xb9
fffff880`0a164630 fffff880`0452ffc1 : fffff8a0`00f64000 fffff880`0a164728 00000000`00000b00 fffff880`0a164720 : dxgkrnl!DXGDEVICE::DestroyAllocation+0x93
fffff880`0a1646c0 fffff960`00768804 : fffffa80`0b8f1250 00000000`00000000 00000000`00000050 00000000`00000000 : dxgkrnl!DxgkCddDestroyAllocation+0x241
fffff880`0a164770 fffff960`0076d69b : 00000000`00000000 fffff900`c00c39f0 00000000`00000990 00000000`0000045a : cdd!CDDPDEV::DestroyAllocation+0x68
fffff880`0a1647e0 fffff960`0076d6cd : fffffa80`07cf9168 fffff900`c00c0020 00000000`00000981 00000000`400003c0 : cdd!CddBitmapStagingApertureMem::InvalidateDeviceAllocations+0x2b
fffff880`0a164810 fffff960`0076bc1e : fffff900`c00c0020 00000000`00000981 00000000`00000001 fffff880`0718bad0 : cdd!CddBitmapStagingApertureMem::Reallocate+0x21
fffff880`0a164840 fffff960`0076c215 : fffffa80`00000000 fffff900`c00c7028 fffff880`0a164a30 00000000`00000001 : cdd!CStagingPoolBase::AllocateRect+0x366
fffff880`0a1648c0 fffff960`00779154 : 00000000`00000000 00000000`00000000 fffff900`c00c0020 fffff880`0a165180 : cdd!CStagingPool::GetGdiSurface+0x145
fffff880`0a164930 fffff960`0077a12b : 00000000`00000000 fffff900`c23a8468 fffff900`c5800018 00000000`00000000 : cdd!BitBltBitmap+0x53c
fffff880`0a164ec0 fffff960`0077b138 : 00000000`00000000 00000000`0000007f 00000000`00000000 00000000`00000000 : cdd!DrvBitBlt+0x17b
fffff880`0a1650e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : cdd!DrvCopyBits+0x44


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146
fffff880`0441ab1e 488b8b48010000  mov     rcx,qword ptr [rbx+148h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ccf7c90

FAILURE_BUCKET_ID:  X64_0x1a_41284_dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

BUCKET_ID:  X64_0x1a_41284_dxgmms1!VIDMM_GLOBAL::DestroyOneAllocation+146

Followup: MachineOwner
---------

Debug session time: Sun Jan 23 18:59:13.095 2011 (GMT-5)
System Uptime: 0 days 0:29:42.000
Loading Kernel Symbols
...............................................................
................................................................
................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa83fe74081b, 0, fffff800030a353b, 5}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiAgeWorkingSet+41b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa83fe74081b, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff800030a353b, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c70e0
 fffffa83fe74081b 

FAULTING_IP: 
nt!MiAgeWorkingSet+41b
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880035167a0 -- (.trap 0xfffff880035167a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000058000000000 rbx=0000000000000000 rcx=fffff6fcc0046348
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030a353b rsp=fffff88003516930 rbp=007ffffcc004634e
 r8=0000000000000001  r9=fffff8000321be00 r10=0000000000000005
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiAgeWorkingSet+0x41b:
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh] ds:2030:00000000`0000001b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000310e8c1 to fffff8000308f740

STACK_TEXT:  
fffff880`03516638 fffff800`0310e8c1 : 00000000`00000050 fffffa83`fe74081b 00000000`00000000 fffff880`035167a0 : nt!KeBugCheckEx
fffff880`03516640 fffff800`0308d82e : 00000000`00000000 f8a00154`d1580400 00000000`00040000 00000000`0000000b : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`035167a0 fffff800`030a353b : 00000000`00006000 51e00001`25e73921 00000000`00000000 00000000`00002d1e : nt!KiPageFault+0x16e
fffff880`03516930 fffff800`03111a5e : fffff800`0321be00 fffff880`00000001 00000000`00000001 fffff880`03516bb0 : nt!MiAgeWorkingSet+0x41b
fffff880`03516ae0 fffff800`030a3ee2 : 00000000`000006f8 00000000`00000000 fffffa80`00000000 00000000`00000004 : nt! ?? ::FNODOBFM::`string'+0x496d6
fffff880`03516b80 fffff800`030a4173 : 00000000`00000008 fffff880`03516c10 00000000`00000001 fffffa80`00000000 : nt!MmWorkingSetManager+0x6e
fffff880`03516bd0 fffff800`03333c06 : fffffa80`06c8cb60 00000000`00000080 fffffa80`06be2420 00000000`00000001 : nt!KeBalanceSetManager+0x1c3
fffff880`03516d40 fffff800`0306dc26 : fffff880`009ea180 fffffa80`06c8cb60 fffff880`009f4fc0 6ebe9b7f`f2bffffe : nt!PspSystemThreadStartup+0x5a
fffff880`03516d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiAgeWorkingSet+41b
fffff800`030a353b 410fb65f1b      movzx   ebx,byte ptr [r15+1Bh]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiAgeWorkingSet+41b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

BUCKET_ID:  X64_0x50_nt!MiAgeWorkingSet+41b

Followup: MachineOwner
---------

Debug session time: Sun Jan 23 21:33:51.091 2011 (GMT-5)
System Uptime: 0 days 0:20:13.231
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {3, fffffa800ca51360, fffff80000b9c518, fffff98004dc0bd0}

*** WARNING: Unable to verify timestamp for usbhub.sys
*** ERROR: Module load completed but symbols could not be loaded for usbhub.sys
Probably caused by : usbhub.sys

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800ca51360, Physical Device Object of the stack
Arg3: fffff80000b9c518, Functional Device Object of the stack
Arg4: fffff98004dc0bd0, The blocked IRP

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  3

IRP_ADDRESS:  fffff98004dc0bd0

DEVICE_OBJECT: fffffa800cb5a050

DRIVER_OBJECT: fffffa800c986d60

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b18b9af

MODULE_NAME: usbhub

FAULTING_MODULE: fffff88007ae1000 usbhub

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800030e7273 to fffff80003078740

STACK_TEXT:  
fffff800`00b9c4c8 fffff800`030e7273 : 00000000`0000009f 00000000`00000003 fffffa80`0ca51360 fffff800`00b9c518 : nt!KeBugCheckEx
fffff800`00b9c4d0 fffff800`0308429e : fffff800`00b9c600 fffff800`00b9c600 00000000`00000001 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x292b0
fffff800`00b9c570 fffff800`03083dd6 : fffff800`03228700 00000000`00012fca 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x66
fffff800`00b9c5e0 fffff800`030844be : 00000002`d32468cc fffff800`00b9cc58 00000000`00012fca fffff800`031f6bc8 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`03083cb7 : 00000000`c54ca5c1 00000000`00012fca 00000000`c54ca542 00000000`000000ca : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`03080eea : fffff800`031f2e80 fffff800`03200c40 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0x9F_VRF_IMAGE_usbhub.sys

BUCKET_ID:  X64_0x9F_VRF_IMAGE_usbhub.sys

Followup: MachineOwner
---------

Debug session time: Mon Jan 24 10:37:32.262 2011 (GMT-5)
System Uptime: 0 days 0:26:59.761
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck BE, {fffff8a000fbd358, 8000000214426101, fffff88008c594a0, b}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4237e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8a000fbd358, Virtual address for the attempted write.
Arg2: 8000000214426101, PTE contents.
Arg3: fffff88008c594a0, (reserved)
Arg4: 000000000000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  1

TRAP_FRAME:  fffff88008c594a0 -- (.trap 0xfffff88008c594a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a000fbd358 rbx=0000000000000000 rcx=fffff8a004fbd2c0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001508b76 rsp=fffff88008c59630 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffff880014b3380
r11=fffff8a00607c928 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
Ntfs!NtfsOpenAttribute+0x326:
fffff880`01508b76 4c8918          mov     qword ptr [rax],r11 ds:fffff8a0`00fbd358=0000004200000008
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000350aae2 to fffff8000348a740

STACK_TEXT:  
fffff880`08c59338 fffff800`0350aae2 : 00000000`000000be fffff8a0`00fbd358 80000002`14426101 fffff880`08c594a0 : nt!KeBugCheckEx
fffff880`08c59340 fffff800`0348882e : 00000000`00000001 fffffa80`06eafae0 fffffa80`071d0000 fffffa80`07498f70 : nt! ?? ::FNODOBFM::`string'+0x4237e
fffff880`08c594a0 fffff880`01508b76 : fffffa80`06eafae0 fffff880`02498400 fffff8a0`01749450 fffff8a0`04fbd3a8 : nt!KiPageFault+0x16e
fffff880`08c59630 fffff880`014f6e45 : fffffa80`06f30b10 fffffa80`07498f70 fffffa80`07e3b180 fffff8a0`04fbd3a8 : Ntfs!NtfsOpenAttribute+0x326
fffff880`08c59740 fffff880`014f378b : fffff880`024984b0 fffffa80`06f30b10 fffff8a0`04fbd3a8 fffff8a0`0000009a : Ntfs!NtfsOpenExistingAttr+0x145
fffff880`08c59800 fffff880`014f3eff : fffffa80`06f30b10 fffffa80`07498bd0 fffff8a0`04fbd3a8 fffff880`0000009a : Ntfs!NtfsOpenAttributeInExistingFile+0x5ab
fffff880`08c59990 fffff880`01504e76 : fffffa80`06f30b10 fffffa80`07498bd0 fffff8a0`04fbd3a8 00000000`00000701 : Ntfs!NtfsOpenExistingPrefixFcb+0x1ef
fffff880`08c59a80 fffff880`014ff28d : fffffa80`06f30b10 fffffa80`07498bd0 fffff880`08c59c60 fffff880`08c59ca8 : Ntfs!NtfsFindStartingNode+0x5e6
fffff880`08c59b50 fffff880`01468c0d : fffffa80`06f30b10 fffffa80`07498bd0 fffff880`024984b0 fffffa80`0c078b00 : Ntfs!NtfsCommonCreate+0x3dd
fffff880`08c59d30 fffff800`034825c7 : fffff880`02498420 00000000`002f4d68 00000000`002f4d68 00000000`002f4e10 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08c59d60 fffff800`03482581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`024982f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4237e
fffff800`0350aae2 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4237e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+4237e

BUCKET_ID:  X64_0xBE_nt!_??_::FNODOBFM::_string_+4237e

Followup: MachineOwner
---------

0: kd> lmtsmn
start             end                 module name
fffff880`00f9e000 fffff880`00ff5000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04339000 fffff880`043c3000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04666000 fffff880`0467c000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`07a4d000 fffff880`07b7e000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`01278000 fffff880`01283000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04a00000 fffff880`04a48000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`0123a000 fffff880`01243000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`01243000 fffff880`0126d000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`05400000 fffff880`054c1000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00e68000 fffff880`00e74000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`0428d000 fffff880`04294000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`04732000 fffff880`04743000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`029b0000 fffff880`029ce000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`006e0000 fffff960`00707000   cdd      cdd.dll      unavailable (00000000)
fffff880`0422d000 fffff880`04257000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cec000 fffff880`00dac000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01a50000 fffff880`01a80000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c8e000 fffff880`00cec000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`05888000 fffff880`0588c500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01341000 fffff880`013b4000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e5f000 fffff880`00e68000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`04656000 fffff880`04666000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`07a35000 fffff880`07a43000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`046af000 fffff880`04732000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`0456e000 fffff880`04589000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`04550000 fffff880`0456e000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`04541000 fffff880`04550000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01a3a000 fffff880`01a50000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0559b000 fffff880`055bd000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`054c1000 fffff880`054d4000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`0400f000 fffff880`04217000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`07bd6000 fffff880`07be2000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`05249000 fffff880`0533d000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`0533d000 fffff880`05383000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`05394000 fffff880`053e3000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`012cf000 fffff880`012e3000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01283000 fffff880`012cf000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0142b000 fffff880`01435000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01a00000 fffff880`01a3a000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0168b000 fffff880`016d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039f6000 fffff800`03a3f000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`05200000 fffff880`05224000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`05383000 fffff880`05394000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`028e8000 fffff880`029b0000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01bd3000 fffff880`01bdc000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0581b000 fffff880`05839000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`01032000 fffff880`0123a000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a4a000 fffff880`051c4ce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`05861000 fffff880`05887c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`07b8f000 fffff880`07bd6000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`04769000 fffff880`0477f000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05839000 fffff880`05848000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bab000 fffff800`00bb5000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`04400000 fffff880`04443000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01400000 fffff880`0141a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`079ed000 fffff880`079f2200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`055e0000 fffff880`055f5000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`055bd000 fffff880`055e0000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c36000 fffff880`00c7a000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`07b80000 fffff880`07b8f000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`054d4000 fffff880`054e2000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`05848000 fffff880`05857000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00dac000 fffff880`00dc6000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04257000 fffff880`04284000   MpFilter MpFilter.sys Sat Mar 20 01:58:08 2010 (4BA463F0)
fffff880`08379000 fffff880`08389000   MpNWMon  MpNWMon.sys  Sat Mar 20 01:58:00 2010 (4BA463E8)
fffff880`029ce000 fffff880`029e6000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02800000 fffff880`0282d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`03cb2000 fffff880`03d00000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`03d00000 fffff880`03d23000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`0126d000 fffff880`01278000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`042f2000 fffff880`042fd000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e0a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`012e3000 fffff880`01341000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`04536000 fffff880`04541000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01bc1000 fffff880`01bd3000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016f3000 fffff880`017e5000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`053f4000 fffff880`05400000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`028bd000 fffff880`028d0000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04589000 fffff880`045b8000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`05549000 fffff880`0555e000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`04000000 fffff880`0400f000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01a8e000 fffff880`01ad3000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0588d000 fffff880`05fec000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`042fd000 fffff880`0430e000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0452a000 fffff880`04536000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`0341a000 fffff800`039f6000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01457000 fffff880`015fa000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`04284000 fffff880`0428d000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`0286a000 fffff880`028bd000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`043cc000 fffff880`043f2000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e4a000 fffff880`00e5f000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e0a000 fffff880`00e3d000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00dc6000 fffff880`00dcd000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00dcd000 fffff880`00ddd000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0141a000 fffff880`0142b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`03d2d000 fffff880`03dd3000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`07a2e000 fffff880`07a34e80   pgeffect pgeffect.sys Mon Jun 22 05:00:11 2009 (4A3F481B)
fffff880`0555e000 fffff880`0559b000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c7a000 fffff880`00c8e000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`0467c000 fffff880`046a0000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`047d5000 fffff880`047f0000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`045b8000 fffff880`045d9000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`045d9000 fffff880`045f3000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`044d9000 fffff880`0452a000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`051f3000 fffff880`051fe000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`042d7000 fffff880`042e0000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`042e0000 fffff880`042e9000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`042e9000 fffff880`042f2000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01b87000 fffff880`01bc1000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`051c5000 fffff880`051de000   rimspe64 rimspe64.sys Wed Jul 01 19:54:49 2009 (4A4BF749)
fffff880`05224000 fffff880`0523d000   risdpe64 risdpe64.sys Fri Nov 27 07:53:49 2009 (4B0FCBDD)
fffff880`04600000 fffff880`04656000   rixdpe64 rixdpe64.sys Sat Jul 04 06:27:00 2009 (4A4F2E74)
fffff880`028d0000 fffff880`028e8000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`07801000 fffff880`079eca80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`03dd3000 fffff880`03dde000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`0580f000 fffff880`0581b000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`01bdc000 fffff880`01bf9000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01b7f000 fffff880`01b87000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`082e3000 fffff880`08379000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`03c3f000 fffff880`03ca6000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`03c00000 fffff880`03c2d000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`05246000 fffff880`05247480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01803000 fffff880`01a00000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`03c2d000 fffff880`03c3f000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`05857000 fffff880`05861000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0432c000 fffff880`04339000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`0430e000 fffff880`0432c000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`044c5000 fffff880`044d9000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01b73000 fffff880`01b7f000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01b71000 fffff880`01b72f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01af7000 fffff880`01b71000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`0523d000 fffff880`05246000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05800000 fffff880`0580f000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`00550000 fffff960`0055a000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`04743000 fffff880`04769000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`016e5000 fffff880`016e9e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`05ff9000 fffff880`06000000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`04443000 fffff880`04455000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`07be2000 fffff880`07bff000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`07b7e000 fffff880`07b7ff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`053e3000 fffff880`053f4000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`054ef000 fffff880`05549000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`0477f000 fffff880`047d5000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`07a00000 fffff880`07a2d200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`043f2000 fffff880`043fc000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`04294000 fffff880`042a2000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`042a2000 fffff880`042c7000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`04478000 fffff880`044c5000   vmm      vmm.sys      Fri May 15 08:28:12 2009 (4A0D5FDC)
fffff880`051de000 fffff880`051f3000   VMNetSrv VMNetSrv.sys Wed Jan 24 07:05:46 2007 (45B74B9A)
fffff880`016d5000 fffff880`016e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e74000 fffff880`00e89000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e89000 fffff880`00ee5000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`013b4000 fffff880`01400000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`05fec000 fffff880`05ff9000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`01ad3000 fffff880`01ae9000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`03d23000 fffff880`03d2d000   vwifimp  vwifimp.sys  Mon Jul 13 20:07:28 2009 (4A5BCC40)
fffff880`017e5000 fffff880`01800000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`042c7000 fffff880`042d7000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eeb000 fffff880`00f8f000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f8f000 fffff880`00f9e000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`043c3000 fffff880`043cc000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000c0000 fffff960`003d0000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00ff5000 fffff880`00ffe000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`04455000 fffff880`04476000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`08389000 fffff880`083fa000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01a80000 fffff880`01a8e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`04012000 fffff880`0421a000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0421a000 fffff880`0422d000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

tumblebug · 24 Jan 2011

Hi CarlTR6

Thanks for the quick reply.

I assumed you meant the posting tutorial so I followed that and have uploaded another zipfile for you.

This system is currently still the oem install that came with the laptop. I keep it up to date with windows update - however I noticed this morning that it wasnt looking after the drivers so I enabled that. It didnt appear to do much.

I've tried to disable the driver verifier by deleting all existing settings but it said there were no settings to delete - is that all I need to do or is there a disable option somewhere I need to switch as well?

I'll fix up all these drivers and reboot. One thing though, I'm running Virtual PC 2007 - should I still upgrade these drivers?

Thanks heaps for the help

CarlTR6 · 24 Jan 2011

You are very welcome for the help. Thanks for uploading the files.

We recommend that you NOT use Windows update for drivers. We recommend going to the website of your computer manufacturer or the manufacturer of the device or software, download the updates and install them yourself. Unfortunately, Windows Update does not always have the latest third party drivers. I have Windows Update configured to notify me of updates. Then I pick the ones I wish to install. I usually do not let it install drivers.

If you can update the Virtual PC drivers to a date of 13 July 2009 or later, do so. If not, I suggest that you need to uninstall Virtual PC 2007 and upgrade to the latest version. Your version is not designed to run on Win 7.

tumblebug · 24 Jan 2011

Hi Carl

No problem - I've switched of the automated update for the device drivers. I'll set to and update them one by one. Let you know how I go

Tim

CarlTR6 · 25 Jan 2011

Very good, Tim. Upgrade your Virtual PC and see if that helps your system.

tumblebug · 26 Jan 2011

Hi Carl

Following actions taken

pgeffect.sys - datetime moved from 22/06/2009 05:00:11 to 23/06/2009 23:05:00 (note this is Australian time - UTC+10) so I'm not sure if this updated or not. I used the web cam installer from Australian Toshiba site that firstly removed the current webcam software, and then reinstalled.
rimspe64.sys - nothing on Aust Toshiba site so uninstalled device. On reboot, windows wanted to reinstall it so the device has been disabled
rixdpe64.sys - nothing on Aust Toshiba site so uninstalled device. On reboot, windows wanted to reinstall it so the device has been disabled
thpdrv.sys - updated - datetime moved from 28/06/2009 22:02:56 to 30/06/2009 4:25:00
Thpevm.SYS - updated - datetime moved from 29/06/2009 04:15:37 to 30/06/2009 10:16:00
tos_sps64 tos_sps64.sys - updated - datetime moved from 24/06/2009 01:31:09 to 25/07/2009 09:57:00
tosrfec.sys - updated - datetime moved from 01/06/2009 02:58:53 to 14/07/2009 16:12:00
TVALZFL.sys - updated - datetime moved from 19/06/2009 06:05:44 to 20/06/2009 13:15:00
vmm.sys - updated - datetime moved from 15/05/2009 08:28:12 to 27/01/2011 9:00:00 - applied Virtual PC 2007 SP1 from Microsoft website. Upon reboot this morning, Windows Update also advised a security patch to Virtual PC (which I applied).
VMNetSrv.sys - updated - datetime moved from 24/01/2007 07:05:46 to 05/02/2008 1:50:00 - applied Virtual PC 2007 SP1 from Microsoft website. Upon reboot this morning, Windows Update advised a security patch to Virtual PC (which I applied).

I have been in Virtual PC with my web video project, and also browsing video websites with IE8 in the Windows 7 system - which is usually where the system instability starts and no BSODs...yet *crosses fingers*. My system has calmed down alot.

so far...so good

Thanks for your help thus far....

CarlTR6 · 26 Jan 2011

Good work! And a great report back. Glad your system is running better. Generally speaking, the "magic" date for third party drivers with Win 7 is 13 July 2009 or later. There are exceptions. Drivers dated in 2009, but prior to 13 July, are Vista drivers and some Vista drivers work well with Win 7. Being that VMNetSrv.sys is a Microsoft driver, the 05/02/2008 date may well be OK.

Please post back in two or three days and let us know how your system is running. If you get another BSOD, upload it and we will go from there.

You are welcome for the help.

tumblebug · 27 Jan 2011

Hi Carl

Got some more dump files - this time, I had been in Virtual PC but I'm fairly sure I'd shut it down again. I'd been editing some fairly large script files in SQL Management Tools but I'd also logged out of that too. No video programming or playing though.

I left the laptop open and on on the table and then heard it reboot itself. I didn't see the actually blue screens but I assume they happened.

Noticed two more dump files - one relating to ntfs.sys and the other win32k.sys. I've run the entire information gathering routine for you to look through - hope you find something

Given that I've run chkdsk and it reported unreadable sectors (which I did get it to fix) - could I be looking at a hard drive on its way out maybe?

Tim

CarlTR6 · 27 Jan 2011

Hi, Tim; I am sorry that you are still having problems.

How many bad or unreadable sectors did you have? A few is not unusual, even on a brand new HD. A lot of them can be an indication your hard drive is on its way out. I suggest that you backup all of your files to an external HD - which is a good idea to do routinely anyway. I recommend that you further test your hard drive: HD Diagnostic (read the details at the link). Do keep in mind that other things such as a driver can cause this crash.

Quote:

Bugcheck 19, BAD_POOL_HEADER. Usual causes: Device driver.

Bugcheck 50, PAGE_FAULT_IN_NONPAGED_AREA. Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS.

The second and most recent dump blames win32k.sys, which is a Windows system driver. When this driver is blames is usually another driver causing a conflict.

I believe that your problem is Microsoft Virtual PC 2004. It is XP software and not compatible with Win 7. Download details: Virtual PC 2004 SP1

Quote:

Virtual PC 2004 SP1 runs on: Windows 2000 Professional SP4, Windows XP Professional, and Windows XP Tablet PC Edition.

I recommend that you uninstall this version and install Virtual PC 2007 which is compatible with Win 7. Windows Virtual PC: Home Page. I think this will improve your system's stability. Your most out of date drivers belong to Virtual PC.

Quote:

vmm.sys Tue Apr 07 09:25:54 2009 - Virtual Machine Monitor driver - Microsoft Virtual PC 2004

VMNetSrv.sys Wed Jan 16 06:52:01 2008 - Microsoft Virtual Machine Network Services Driver.

Your remaining out of date drivers are Toshiba drivers.

thpdrv.sys Sun Jun 28 22:02:56 2009 - Toshiba HDD Protection. Toshiba Support - Homepage. Ignore this one for now.

Thpevm.SYS Mon Jun 29 04:15:37 2009 - TOSHIBA HDD Protection - Shock Sensor Driver is a driver file from TOSHIBA Corporation belonging to TOSHIBA HDD Protection. Toshiba Support - Homepage. Ignore this one for now.

tos_sps64.sys Wed Jun 24 01:31:09 2009 - . Toshiba Support - Homepage. Regarding this driver, read this article: TRS driver? - Toshiba Forums. You should get a chuckle out of the second post. After you read that article, you can decide if you want to try renaming this driver to disable it.

tosrfec.sys Mon Jun 01 02:58:53 2009 - Toshiba Bluetooth USB Controller driver. Toshiba Support - Homepage. Rename this driver or uninstall the Toshiba Bluetooth utility.

TVALZFL.sys Fri Jun 19 06:05:44 2009 - TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Toshiba Support - Homepage. This appears to be a general utility driver and not necessary for your systems operation. Seeing that it is out of date, rename it.[quote]
Renaming drivers: create a restore point, using Windows Explorer, navigate to C:\Windows\System32\Drivers, locate the driver files, and rename them from .sys to .old. Reboot and the drivers will not load. This will break whatever software or hardware these drivers are associated with. This way you can always go back and rename the drivers again.

If you want to do this in stages, start with upgrading Virtual PC and see how your system runs. If you are BSOD free, you have solved the problem. If you get another BSOD, upload it and rename the drivers, reboot, and see how your system runs. Please post back and update us.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`03450000 PsLoadedModuleList = 0xfffff800`0368de50
Debug session time: Thu Jan 27 06:57:14.744 2011 (GMT-5)
System Uptime: 0 days 0:07:20.242
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffff8a004dcb230, fffff8a004dcbc30, bca08000}

GetPointerFromAddress: unable to read from fffff800036f80e0
GetUlongFromAddress: unable to read from fffff800036661b0
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+203 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffff8a004dcb230, The pool entry we were looking for within the page.
Arg3: fffff8a004dcbc30, The next pool entry.
Arg4: 00000000bca08000, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff800036661b0

BUGCHECK_STR:  0x19_20

POOL_ADDRESS:  fffff8a004dcb230 

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800035f36d3 to fffff800034c0740

STACK_TEXT:  
fffff880`0338c8e8 fffff800`035f36d3 : 00000000`00000019 00000000`00000020 fffff8a0`04dcb230 fffff8a0`04dcbc30 : nt!KeBugCheckEx
fffff880`0338c8f0 fffff880`014d0cc7 : 00000000`00000703 00000000`00000130 00000000`60495bea 00000000`00000705 : nt!ExDeferredFreePool+0x12c4
fffff880`0338c9a0 fffff880`014d08d5 : 00000000`00000000 00000000`00000000 fffff800`03665500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x203
fffff880`0338c9e0 fffff880`01443cb4 : fffff8a0`050b69d0 fffff8a0`050b6ad0 fffff800`03665500 fffff880`0338cb52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0338ca20 fffff880`014ce2dc : fffff8a0`050b69a0 fffff800`036655a0 fffff880`0338cb52 fffffa80`07085830 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0338ca50 fffff880`0144c882 : fffffa80`07085830 fffffa80`07085830 fffff8a0`050b69a0 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0338cad0 fffff880`014e5813 : fffffa80`07085830 fffff800`036655a0 fffff8a0`050b69a0 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0338cb10 fffff880`014bf38f : fffffa80`07085830 fffff8a0`050b6ad0 fffff8a0`050b69a0 fffffa80`09f5e180 : Ntfs!NtfsCommonClose+0x353
fffff880`0338cbe0 fffff800`034cd961 : 00000000`00000000 fffff800`034b4300 fffff800`036c7101 fffffa80`00000003 : Ntfs!NtfsFspClose+0x15f
fffff880`0338ccb0 fffff800`03764c06 : fbf75eff`69a1dd63 fffffa80`06c80b60 00000000`00000080 fffffa80`06be2420 : nt!ExpWorkerThread+0x111
fffff880`0338cd40 fffff800`0349ec26 : fffff880`031d5180 fffffa80`06c80b60 fffff880`031dffc0 e77fcfff`ecbcc63e : nt!PspSystemThreadStartup+0x5a
fffff880`0338cd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsDeleteScb+203
fffff880`014d0cc7 e9cbfeffff      jmp     Ntfs!NtfsDeleteScb+0xd3 (fffff880`014d0b97)

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsDeleteScb+203

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

FAILURE_BUCKET_ID:  X64_0x19_20_Ntfs!NtfsDeleteScb+203

BUCKET_ID:  X64_0x19_20_Ntfs!NtfsDeleteScb+203

Followup: MachineOwner
---------

Debug session time: Thu Jan 27 06:48:51.228 2011 (GMT-5)
System Uptime: 0 days 2:53:24.726
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c86b0fa0, 0, fffff9600018f4ba, 2}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!DwmNotifyChildrenLinkUnlink+c2 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c86b0fa0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff9600018f4ba, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c50e0
 fffff900c86b0fa0 

FAULTING_IP: 
win32k!DwmNotifyChildrenLinkUnlink+c2
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  dwm.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008382990 -- (.trap 0xfffff88008382990)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800cad4090 rbx=0000000000000000 rcx=fffffa800cad4090
rdx=fffffa800bdcd701 rsi=0000000000000000 rdi=0000000000000000
rip=fffff9600018f4ba rsp=fffff88008382b20 rbp=fffff900c0659610
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffff88008382b10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
win32k!DwmNotifyChildrenLinkUnlink+0xc2:
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx] ds:0382:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000350c8f2 to fffff8000348d740

STACK_TEXT:  
fffff880`08382828 fffff800`0350c8f2 : 00000000`00000050 fffff900`c86b0fa0 00000000`00000000 fffff880`08382990 : nt!KeBugCheckEx
fffff880`08382830 fffff800`0348b82e : 00000000`00000000 fffff900`c86b0fa0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`08382990 fffff960`0018f4ba : fffff900`c86b0fa0 00000000`00000001 00000000`00000001 fffff960`002166ee : nt!KiPageFault+0x16e
fffff880`08382b20 fffff960`001902fe : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : win32k!DwmNotifyChildrenLinkUnlink+0xc2
fffff880`08382b70 fffff960`0016726b : fffffa80`0ba846a0 fffff880`08382ca0 00000000`00000000 00000000`00000000 : win32k!xxxDwmStopRedirection+0x82
fffff880`08382bc0 fffff960`00126f70 : 00000000`00000001 000007ff`fffd8000 00000000`00000020 000007ff`fffd8000 : win32k!xxxDwmProcessShutdown+0x3b
fffff880`08382bf0 fffff800`0348c993 : 00000000`0000032c 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!NtUserUnregisterSessionPort+0x40
fffff880`08382c20 00000000`7772baaa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0393fb58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7772baaa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!DwmNotifyChildrenLinkUnlink+c2
fffff960`0018f4ba 4c8b03          mov     r8,qword ptr [rbx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!DwmNotifyChildrenLinkUnlink+c2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4cbe5d3e

FAILURE_BUCKET_ID:  X64_0x50_win32k!DwmNotifyChildrenLinkUnlink+c2

BUCKET_ID:  X64_0x50_win32k!DwmNotifyChildrenLinkUnlink+c2

Followup: MachineOwner
---------

Drivers

Code:

start             end                 module name
fffff880`00f9e000 fffff880`00ff5000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`0402b000 fffff880`040b5000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`044fb000 fffff880`04511000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0748d000 fffff880`075be000   agrsm64  agrsm64.sys  Tue Jul 21 14:03:31 2009 (4A6602F3)
fffff880`0130e000 fffff880`01319000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04439000 fffff880`04481000   Apfiltr  Apfiltr.sys  Fri Nov 27 08:39:59 2009 (4B0FD6AF)
fffff880`089a2000 fffff880`089ad000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`012d0000 fffff880`012d9000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`012d9000 fffff880`01303000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Tue Oct 19 23:05:45 2010 (4CBE5C89)
fffff880`02282000 fffff880`02343000   ATSwpWDF ATSwpWDF.sys Wed May 19 23:31:31 2010 (4BF4AD13)
fffff880`00e68000 fffff880`00e74000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`04364000 fffff880`0436b000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02e9e000 fffff880`02eaf000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`02cd3000 fffff880`02cf1000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`007d0000 fffff960`007f7000   cdd      cdd.dll      Tue Nov 02 00:59:22 2010 (4CCF9AAA)
fffff880`04300000 fffff880`0432a000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ce5000 fffff880`00da5000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01b9d000 fffff880`01bcd000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c87000 fffff880`00ce5000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`044d1000 fffff880`044d5500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01000000 fffff880`01073000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e5f000 fffff880`00e68000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`044eb000 fffff880`044fb000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`07453000 fffff880`07461000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02e1b000 fffff880`02e9e000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02e00000 fffff880`02e1b000   ctxusbm  ctxusbm.sys  Mon Sep 07 14:09:28 2009 (4AA54C58)
fffff880`02fcd000 fffff880`02feb000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02fbe000 fffff880`02fcd000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01b87000 fffff880`01b9d000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0479e000 fffff880`047c0000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`07461000 fffff880`07474000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`040e4000 fffff880`042ec000   dump_iaStor dump_iaStor.sys Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`07447000 fffff880`07453000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0b430000 fffff880`0b524000   dxgkrnl  dxgkrnl.sys  Mon Nov 01 22:51:31 2010 (4CCF7CB3)
fffff880`0b524000 fffff880`0b56a000   dxgmms1  dxgmms1.sys  Mon Nov 01 22:50:56 2010 (4CCF7C90)
fffff880`0b57b000 fffff880`0b5ca000   e1k62x64 e1k62x64.sys Wed Sep 29 16:02:28 2010 (4CA39B54)
fffff880`01365000 fffff880`01379000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01319000 fffff880`01365000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0142b000 fffff880`01435000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01b4d000 fffff880`01b87000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0168b000 fffff880`016d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`039f9000 fffff800`03a42000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`0b5db000 fffff880`0b5ff000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`0b56a000 fffff880`0b57b000   HECIx64  HECIx64.sys  Thu Sep 17 15:54:16 2009 (4AB293E8)
fffff880`0236e000 fffff880`02387000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`02387000 fffff880`0238f080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`02360000 fffff880`0236e000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`02c0b000 fffff880`02cd3000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01b44000 fffff880`01b4d000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`05fb0000 fffff880`05fce000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`010c8000 fffff880`012d0000   iaStor   iaStor.sys   Fri Jan 15 15:21:57 2010 (4B50CE65)
fffff880`04a78000 fffff880`051f2ce0   igdkmd64 igdkmd64.sys Wed Feb 10 19:56:24 2010 (4B7355B8)
fffff880`0449a000 fffff880`044c0c00   Impcd    Impcd.sys    Wed Feb 10 18:01:59 2010 (4B733AE7)
fffff880`07400000 fffff880`07447000   IntcDAud IntcDAud.sys Fri Jan 08 06:51:38 2010 (4B471C4A)
fffff880`02ed5000 fffff880`02eeb000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05fce000 fffff880`05fdd000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00bc8000 fffff800`00bd2000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0469d000 fffff880`046e0000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01400000 fffff880`0141a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`071f5000 fffff880`071fa200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`02221000 fffff880`02236000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`023d9000 fffff880`023fc000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c2f000 fffff880`00c73000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`075c0000 fffff880`075cf000   modem    modem.sys    Mon Jul 13 20:10:48 2009 (4A5BCD08)
fffff880`023cb000 fffff880`023d9000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04481000 fffff880`04490000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`023be000 fffff880`023cb000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00da5000 fffff880`00dbf000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0432a000 fffff880`0435b000   MpFilter MpFilter.sys Tue Sep 14 20:19:28 2010 (4C901110)
fffff880`02da7000 fffff880`02db7000   MpNWMon  MpNWMon.sys  Tue Sep 14 20:19:30 2010 (4C901112)
fffff880`02cf1000 fffff880`02d09000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`02d09000 fffff880`02d36000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`02d36000 fffff880`02d84000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`02d84000 fffff880`02da7000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`01303000 fffff880`0130e000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`043c9000 fffff880`043d4000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e00000 fffff880`00e0a000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01379000 fffff880`013d7000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02fb3000 fffff880`02fbe000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`01b32000 fffff880`01b44000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016ed000 fffff880`017df000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04535000 fffff880`04541000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`02236000 fffff880`02249000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04541000 fffff880`04570000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0474c000 fffff880`04761000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`01a4f000 fffff880`01a5e000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`01a00000 fffff880`01a45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Thu Apr 08 22:43:59 2010 (4BBE946F)
fffff880`05829000 fffff880`05f88000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`0891c000 fffff880`08931000   NisDrvWFP NisDrvWFP.sys Tue Sep 14 20:20:25 2010 (4C901149)
fffff880`043d4000 fffff880`043e5000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02fa7000 fffff880`02fb3000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`0341d000 fffff800`039f9000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`0144c000 fffff880`015ef000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0435b000 fffff880`04364000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`04600000 fffff880`04653000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`040be000 fffff880`040e4000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00e4a000 fffff880`00e5f000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e0a000 fffff880`00e3d000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00dbf000 fffff880`00dc6000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00dc6000 fffff880`00dd6000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0141a000 fffff880`0142b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`064de000 fffff880`06584000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04761000 fffff880`0479e000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c73000 fffff880`00c87000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04511000 fffff880`04535000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04570000 fffff880`0458b000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`0458b000 fffff880`045ac000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`045ac000 fffff880`045c6000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02f56000 fffff880`02fa7000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`045c6000 fffff880`045d1000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`043ae000 fffff880`043b7000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043b7000 fffff880`043c0000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`043c0000 fffff880`043c9000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01af8000 fffff880`01b32000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`02249000 fffff880`02261000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`07009000 fffff880`071f4a80   RTKVHD64 RTKVHD64.sys Fri Oct 30 06:17:58 2009 (4AEABD56)
fffff880`0b400000 fffff880`0b420000   sdbus    sdbus.sys    Fri Oct 09 22:41:20 2009 (4ACFF450)
fffff880`06584000 fffff880`0658f000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`05fa4000 fffff880`05fb0000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`01bdb000 fffff880`01bf8000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01af0000 fffff880`01af8000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`08886000 fffff880`0891c000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`06400000 fffff880`06467000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`0658f000 fffff880`065bc000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`045d1000 fffff880`045d2480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`065bc000 fffff880`065ce000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`04490000 fffff880`0449a000   tdcmdpst tdcmdpst.sys Thu Jul 30 04:39:35 2009 (4A715C47)
fffff880`0401e000 fffff880`0402b000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`04000000 fffff880`0401e000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02f42000 fffff880`02f56000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`01ae4000 fffff880`01af0000   thpdrv   thpdrv.sys   Sun Jun 28 22:02:56 2009 (4A4820D0)
fffff880`01ae2000 fffff880`01ae3f80   Thpevm   Thpevm.SYS   Mon Jun 29 04:15:37 2009 (4A487829)
fffff880`01a68000 fffff880`01ae2000   tos_sps64 tos_sps64.sys Wed Jun 24 01:31:09 2009 (4A41BA1D)
fffff880`044c8000 fffff880`044d1000   tosrfec  tosrfec.sys  Mon Jun 01 02:58:53 2009 (4A237C2D)
fffff880`05f95000 fffff880`05fa4000   tpm      tpm.sys      Mon Jul 13 19:21:48 2009 (4A5BC18C)
fffff960`005b0000 fffff960`005ba000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02eaf000 fffff880`02ed5000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`016e5000 fffff880`016e9e00   TVALZ    TVALZ.SYS    Mon Jul 13 22:18:54 2009 (4A5BEB0E)
fffff880`044c1000 fffff880`044c8000   TVALZFL  TVALZFL.sys  Fri Jun 19 06:05:44 2009 (4A3B62F8)
fffff880`046e0000 fffff880`046f2000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`02343000 fffff880`02360000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`075be000 fffff880`075bff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`0b5ca000 fffff880`0b5db000   usbehci  usbehci.sys  Fri Dec 04 02:26:02 2009 (4B18B98A)
fffff880`046f2000 fffff880`0474c000   usbhub   usbhub.sys   Fri Dec 04 02:26:39 2009 (4B18B9AF)
fffff880`04a00000 fffff880`04a56000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`02390000 fffff880`023bd200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00e3d000 fffff880`00e4a000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`01a45000 fffff880`01a4f000   vfilter  vfilter.sys  Thu Jul 08 22:18:29 2010 (4C3686F5)
fffff880`0436b000 fffff880`04379000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`04379000 fffff880`0439e000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`02ef5000 fffff880`02f42000   vmm      vmm.sys      Tue Apr 07 09:25:54 2009 (49DB5462)
fffff880`044d6000 fffff880`044eb000   VMNetSrv VMNetSrv.sys Wed Jan 16 06:52:01 2008 (478DEFE1)
fffff880`016d5000 fffff880`016e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e74000 fffff880`00e89000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00e89000 fffff880`00ee5000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01073000 fffff880`010bf000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`05f88000 fffff880`05f95000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`043e5000 fffff880`043fb000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`017df000 fffff880`017fa000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`0439e000 fffff880`043ae000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eeb000 fffff880`00f8f000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f8f000 fffff880`00f9e000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`040b5000 fffff880`040be000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00040000 fffff960`00350000   win32k   win32k.sys   Tue Oct 19 23:08:46 2010 (4CBE5D3E)
fffff880`00ff5000 fffff880`00ffe000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`02200000 fffff880`02221000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`02db7000 fffff880`02dc1000   vwifimp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`08931000 fffff880`089a2000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01bcd000 fffff880`01bdb000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`040e5000 fffff880`042ed000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`042ed000 fffff880`04300000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

Windows 7: BSODs and unstable Win7

BSODs and unstable Win7 problems?