15 PC's all configured similar all experiencing random BSOD's

kingbear · Jan 8, 2012

Hello experts,

I am an IT provider and I set up 15 heavy duty computers at 15 client locations. They are all exactly the same PC:

Dell Optiplex 990
Core i7
4GB RAM preinstalled + 8GB RAM installed by me
500GB HDD

Ruuning the preinstalled OEM copy of Windows 7 64-bit.

The only thing we did with these PC's when we got them was open them up and add the 8GB of RAM - (Newegg.com - G.SKILL Value Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10600) Desktop Memory Model F3-10600CL9D-8GBNT) - G.SKILL Value Series 8GB (2 x 4GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10600) Desktop Memory Model F3-10600CL9D-8GBNT, and we installed vSpace by ncomputing (NComputing | Desktop Virtualization for Enterprise, Education, SMB, Government) to use as a vSpace server, which has been working quite well, aside from the random reboots. The BSOD's started almost immediately after we put these PC's into production. First they wouldn't restart themselves and we needed someone to go down and hold down the power button for 5 seconds to shut off and then turn it back on. These days they are rebooting themselves and we see Windows has recovered from an error (bluescreen) on first sign-in. The BSOD's happen more when I am installing new software or doing maintenance on the computers. For example the other night I installed Office 2010 and all windows updates and over the weekend 5 of them bluescreen'd.

The 2 obvious culprits may be the 8GB of RAM which is for some reason causing it, or the vSpace software which is driver based at the system level. nComputing tech support reports that they have not heard of any other customer complaining about random BSOD's on Windows 7 64-bit so I am at a loss. I have never read any memory dumps as I don't even know where to begin, and I've found this forum and I'm hoping one of you guys can help.

BTW, the systems were purchased 3 months ago and it began happening immediately after we put them into production.

I have enclosed a zip with the 15 different zip files as requested on the sticky to this forum, and I've done a perfmon on 4 systems and enclosed it.

Thanks so much in advance to anyone who can help me with this issue, as aside from this the setup is actually working quite well for me.

The attachments from all 15 ended up at 13MB so I split it into 3.

writhziden · Jan 8, 2012

One thing I would like to ask before looking these over: does that model for Dell have any known problems?

kingbear · Jan 8, 2012

writhziden said:
One thing I would like to ask before looking these over: does that model for Dell have any known problems?

I've done research on Optiplex BSOD and have not found anything significant. I appreciate the time you are taking to look over my logs. Most likely after 1 or 2 it will become apparent what the issue is.

writhziden · Jan 8, 2012

First five

BATESVILLE

Code:

[list=1]
[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\kingbear\First 5\BATESVILLE-PC-BSOD\Windows_NT6_BSOD_jcgriff2\110411-21606-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5e000 PsLoadedModuleList = 0xfffff800`02ea3670
Debug session time: Fri Nov  4 11:16:30.029 2011 (UTC - 7:00)
System Uptime: 3 days 14:24:25.857
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff80002e0aa9b, 0, ffffffffffffffff}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1df )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002e0aa9b, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+1df
fffff800`02e0aa9b 4c395808        cmp     qword ptr [rax+8],r11

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0d100
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  winlogon.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d26588 to fffff80002cdac40

STACK_TEXT:  
fffff880`078fc568 fffff800`02d26588 : 00000000`0000001e ffffffff`c0000005 fffff800`02e0aa9b 00000000`00000000 : nt!KeBugCheckEx
fffff880`078fc570 fffff800`02cda2c2 : fffff880`078fcd48 00000000`00000000 fffff880`078fcdf0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`078fcc10 fffff800`02cd8bca : fffff880`078fd020 fffff880`012a0807 fffff880`078fcf28 fffffa80`0c4cb180 : nt!KiExceptionDispatch+0xc2
fffff880`078fcdf0 fffff800`02e0aa9b : 00000000`00000000 00000000`00000000 fffff880`078fd080 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`078fcf80 fffff800`02e0a1a1 : fffff8a0`00001b30 fffffa80`0e6beb00 00000000`00000000 fffffa80`0a5ab8a0 : nt!ExDeferredFreePool+0x1df
fffff880`078fd010 fffff800`02fd74a9 : fffffa80`0c1ef820 fffffa80`09a04a30 fffffa80`58434f46 fffffa80`0c1ef820 : nt!ExFreePoolWithTag+0x411
fffff880`078fd0c0 fffff800`02ce4af4 : fffffa80`0e6beb10 fffffa80`11888920 fffffa80`09a04a30 fffff880`078fd3c8 : nt!IopDeleteFile+0x239
fffff880`078fd150 fffff800`02fd1f44 : fffffa80`11888920 00000000`00000000 fffffa80`0ec06b60 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`078fd1b0 fffff800`02fd24f4 : 00000000`00002d64 fffffa80`11888920 fffff8a0`00001b30 00000000`00002d64 : nt!ObpCloseHandleTableEntry+0xc4
fffff880`078fd240 fffff800`02cd9ed3 : fffffa80`0ec06b60 fffff880`078fd310 fffff880`078fd480 00000000`00000000 : nt!ObpCloseHandle+0x94
fffff880`078fd290 fffff800`02cd6470 : fffff880`011c366c 00000000`00000000 fffff8a0`050fb0b0 fffff880`078fd480 : nt!KiSystemServiceCopyEnd+0x13
fffff880`078fd428 fffff880`011c366c : 00000000`00000000 fffff8a0`050fb0b0 fffff880`078fd480 fffff800`02ce4afc : nt!KiServiceLinkage
fffff880`078fd430 fffff800`03049405 : fffff880`078fd608 fffff880`078fd600 fffff8a0`0369cfd4 00000000`000007ff : fileinfo!FIPfInterfaceClose+0x48
fffff880`078fd460 fffff800`030d33e7 : fffff8a0`0369c150 fffff8a0`0369c150 fffff8a0`0369cfd4 fffff880`078fd600 : nt!PfpOpenHandleClose+0x55
fffff880`078fd4b0 fffff800`03136c71 : 00000000`00000000 00000000`00000000 fffffa80`4c506343 00000000`00000000 : nt!PfSnCleanupPrefetchSectionInfo+0x57
fffff880`078fd4e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PfSnPrefetchSections+0x4b1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+1df
fffff800`02e0aa9b 4c395808        cmp     qword ptr [rax+8],r11

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nt!ExDeferredFreePool+1df

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_nt!ExDeferredFreePool+1df

BUCKET_ID:  X64_0x1E_c0000005_nt!ExDeferredFreePool+1df

Followup: Pool_corruption
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\kingbear\First 5\BATESVILLE-PC-BSOD\Windows_NT6_BSOD_jcgriff2\121411-15444-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c08000 PsLoadedModuleList = 0xfffff800`02e4d670
Debug session time: Wed Dec 14 08:38:42.205 2011 (UTC - 7:00)
System Uptime: 0 days 10:58:18.033
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002c09530, fffff8800355ae58, fffff8800355a6b0}

Probably caused by : ndis.sys ( ndis!ndisMInitializeAdapter+9fd )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002c09530, The address that the exception occurred at
Arg3: fffff8800355ae58, Exception Record Address
Arg4: fffff8800355a6b0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!WmipDoFindRegEntryByDevice+10
fffff800`02c09530 48394810        cmp     qword ptr [rax+10h],rcx

EXCEPTION_RECORD:  fffff8800355ae58 -- (.exr 0xfffff8800355ae58)
ExceptionAddress: fffff80002c09530 (nt!WmipDoFindRegEntryByDevice+0x0000000000000010)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800355a6b0 -- (.cxr 0xfffff8800355a6b0)
rax=ff49009249209249 rbx=fffffa801021f050 rcx=fffffa801021f050
rdx=fffff80002df6460 rsi=0000000000000000 rdi=fffffa801021f050
rip=fffff80002c09530 rsp=fffff8800355b098 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff880009cf180 r12=fffffa801021f050 r13=0000000000000000
r14=0000000000000000 r15=0000000000000004
iopl=0         nv up ei ng nz na pe cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
nt!WmipDoFindRegEntryByDevice+0x10:
fffff800`02c09530 48394810        cmp     qword ptr [rax+10h],rcx ds:002b:ff490092`49209259=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb7100
 ffffffffffffffff 

FOLLOWUP_IP: 
ndis!ndisMInitializeAdapter+9fd
fffff880`016d114d 85c0            test    eax,eax

BUGCHECK_STR:  0x7E

LOCK_ADDRESS:  fffff80002e83b80 -- (!locks fffff80002e83b80)

Resource @ nt!PiEngineLock (0xfffff80002e83b80)    Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE: 
	Lock address  : 0xfffff80002e83b80
	Thread Count  : 0
	Thread address: 0x0000000000000000
	Thread wait   : 0x0

LAST_CONTROL_TRANSFER:  from fffff8000301263d to fffff80002c09530

STACK_TEXT:  
fffff880`0355b098 fffff800`0301263d : 00000000`00000000 fffffa80`09d52300 fffff880`009cf180 fffffa80`0fe69020 : nt!WmipDoFindRegEntryByDevice+0x10
fffff880`0355b0a0 fffff800`030af177 : fffffa80`0fe69020 80000000`00000004 00000000`00000000 fffffa80`0fe69020 : nt!WmipFindRegEntryByDevice+0x1d
fffff880`0355b0d0 fffff800`030af37c : fffffa80`10220100 00000000`00000000 00000000`00000000 fffffa80`1021f050 : nt!WmipRegisterDevice+0x37
fffff880`0355b100 fffff880`016d114d : fffffa80`10220100 00000000`00000004 80000000`00000004 fffffa80`1021f1a0 : nt!IoWMIRegistrationControl+0xec
fffff880`0355b130 fffff880`016d0683 : fffffa80`0d0f1ea0 fffffa80`0fe69020 00000000`00000000 01ccba76`7532937c : ndis!ndisMInitializeAdapter+0x9fd
fffff880`0355b4f0 fffff880`016d276c : fffffa80`0d0f1ea0 fffffa80`1021f050 00000000`00000000 fffff880`01625300 : ndis!ndisInitializeAdapter+0x113
fffff880`0355b550 fffff880`016d0356 : fffffa80`1021f1a0 fffffa80`0d0f1ea0 00000000`00000000 ffffd353`6b43ca50 : ndis!ndisPnPStartDevice+0xac
fffff880`0355b5b0 fffff800`0303dd6e : 00000000`00000000 fffffa80`0d0f1ea0 fffffa80`1021f050 fffff880`0355b6e0 : ndis!ndisPnPDispatch+0x246
fffff880`0355b650 fffff800`02d7587d : fffffa80`0fee84b0 fffffa80`0a6ed4b0 fffff800`02d7efa0 00000000`00000000 : nt!PnpAsynchronousCall+0xce
fffff880`0355b690 fffff800`0304d0b6 : fffff800`02e83940 fffffa80`0fedea30 fffffa80`0a6ed4b0 fffffa80`0fedebd8 : nt!PnpStartDevice+0x11d
fffff880`0355b750 fffff800`0304d354 : fffffa80`0fedea30 fffffa80`09a10032 fffffa80`09a1fb60 00000000`00000001 : nt!PnpStartDeviceNode+0x156
fffff880`0355b7e0 fffff800`03070a86 : fffffa80`0fedea30 fffffa80`09a1fb60 00000000`00000002 00000000`00000000 : nt!PipProcessStartPhase1+0x74
fffff880`0355b810 fffff800`03071018 : fffff800`02e81500 00000000`00000000 00000000`00000001 fffff800`02eee814 : nt!PipProcessDevNodeTree+0x296
fffff880`0355ba80 fffff800`02d818e7 : 00000001`00000003 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PiProcessReenumeration+0x98
fffff880`0355bad0 fffff800`02c8f001 : fffff800`02d815c0 fffff800`02f7b901 fffffa80`09a5cb00 00000000`00000000 : nt!PnpDeviceActionWorker+0x327
fffff880`0355bb70 fffff800`02f1ffee : 00000000`00000000 fffffa80`09a5cb60 00000000`00000080 fffffa80`099dc040 : nt!ExpWorkerThread+0x111
fffff880`0355bc00 fffff800`02c765e6 : fffff880`02174180 fffffa80`09a5cb60 fffff880`0217f0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0355bc40 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  ndis!ndisMInitializeAdapter+9fd

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ndis

IMAGE_NAME:  ndis.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d1ad232

STACK_COMMAND:  .cxr 0xfffff8800355a6b0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_ndis!ndisMInitializeAdapter+9fd

BUCKET_ID:  X64_0x7E_ndis!ndisMInitializeAdapter+9fd

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\kingbear\First 5\BATESVILLE-PC-BSOD\Windows_NT6_BSOD_jcgriff2\121611-13478-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c66000 PsLoadedModuleList = 0xfffff800`02eab670
Debug session time: Fri Dec 16 06:29:41.613 2011 (UTC - 7:00)
System Uptime: 0 days 5:11:02.314
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa8058acb0b4, 0, fffff88005bb7497, 5}


Could not read faulting driver name
Probably caused by : dxgmms1.sys ( dxgmms1!VidMmGetTotalSegmentSize+23 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa8058acb0b4, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88005bb7497, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f15100
 fffffa8058acb0b4 

FAULTING_IP: 
dxgmms1!VidMmGetTotalSegmentSize+23
fffff880`05bb7497 f6403001        test    byte ptr [rax+30h],1

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007cf6820 -- (.trap 0xfffff88007cf6820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8058acb084 rbx=0000000000000000 rcx=fffffa800e3b1000
rdx=fffff8a00be700d0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88005bb7497 rsp=fffff88007cf69b8 rbp=fffff88007cf6b60
 r8=fffff8a00be700d8  r9=fffff8a00be700e0 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
dxgmms1!VidMmGetTotalSegmentSize+0x23:
fffff880`05bb7497 f6403001        test    byte ptr [rax+30h],1 ds:00d0:fffffa80`58acb0b4=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c8d3bf to fffff80002ce2c40

STACK_TEXT:  
fffff880`07cf66b8 fffff800`02c8d3bf : 00000000`00000050 fffffa80`58acb0b4 00000000`00000000 fffff880`07cf6820 : nt!KeBugCheckEx
fffff880`07cf66c0 fffff800`02ce0d6e : 00000000`00000000 fffffa80`58acb0b4 00000000`00000000 fffffa80`0e174000 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`07cf6820 fffff880`05bb7497 : fffff880`05ae8a97 fffffa80`0e174000 fffffa80`0e174000 00000000`0265ef00 : nt!KiPageFault+0x16e
fffff880`07cf69b8 fffff880`05ae8a97 : fffffa80`0e174000 fffffa80`0e174000 00000000`0265ef00 00000000`000007ff : dxgmms1!VidMmGetTotalSegmentSize+0x23
fffff880`07cf69c0 fffff960`001157a2 : fffffa80`09ee6b60 00000000`00000018 00000000`00000003 00000000`000007df : dxgkrnl!DxgkQueryAdapterInfo+0x5a3
fffff880`07cf6ab0 fffff800`02ce1ed3 : fffffa80`09ee6b60 fffff880`07cf6b60 00000000`7efa7000 fffffa80`0c8e76d0 : win32k!NtGdiDdDDIQueryAdapterInfo+0x12
fffff880`07cf6ae0 00000000`74c115ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0265e618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74c115ea


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VidMmGetTotalSegmentSize+23
fffff880`05bb7497 f6403001        test    byte ptr [rax+30h],1

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  dxgmms1!VidMmGetTotalSegmentSize+23

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce799c1

FAILURE_BUCKET_ID:  X64_0x50_dxgmms1!VidMmGetTotalSegmentSize+23

BUCKET_ID:  X64_0x50_dxgmms1!VidMmGetTotalSegmentSize+23

Followup: MachineOwner
---------

[*]
Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\kingbear\First 5\BATESVILLE-PC-BSOD\Windows_NT6_BSOD_jcgriff2\121911-14726-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e4c670
Debug session time: Mon Dec 19 14:10:33.785 2011 (UTC - 7:00)
System Uptime: 3 days 6:44:15.612
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck E4, {1, fffffa800d5004c0, 1, 0}

Probably caused by : usbhub.sys ( usbhub!UsbhHubQueueProcessChangeWorker+77 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WORKER_INVALID (e4)
A executive worker item was found in memory which must not contain such
items or a work item was queued that is currently active in the system.
Usually this is memory being freed.  This is usually caused by
a device driver that has not cleaned up properly before freeing memory.
Arguments:
Arg1: 0000000000000001, Queuing of active worker item
Arg2: fffffa800d5004c0, Address of worker item
Arg3: 0000000000000001, Queue number
Arg4: 0000000000000000, 0

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xE4

PROCESS_NAME:  NCWTService.ex

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002c3f59a to fffff80002c83c40

STACK_TEXT:  
fffff880`0cf002d8 fffff800`02c3f59a : 00000000`000000e4 00000000`00000001 fffffa80`0d5004c0 00000000`00000001 : nt!KeBugCheckEx
fffff880`0cf002e0 fffff880`05d36bc7 : fffffa80`0e00d640 fffffa80`0e00d640 fffffa80`0d3d1000 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x104aa
fffff880`0cf00320 fffff880`05d31362 : fffffa80`0e00d640 fffffa80`0d3d1050 fffffa80`0d3d1050 fffffa80`63654448 : usbhub!UsbhHubQueueProcessChangeWorker+0x77
fffff880`0cf00360 fffff880`05d2fbef : 00000000`00000000 fffffa80`50447100 fffffa80`0e00d640 00000000`00100000 : usbhub!Usbh_PCE_Enable_Action+0x212
fffff880`0cf003b0 fffff880`05d34900 : fffffa80`0d3d1050 00000000`00000001 fffffa80`0d3d1918 00000000`00000003 : usbhub!UsbhDispatch_PortChangeQueueEventEx+0x123
fffff880`0cf003f0 fffff880`05d2cfeb : 00000000`00000003 fffffa80`0d3d1918 00000000`00000000 fffff800`00000000 : usbhub!UsbhPCE_Enable+0xb0
fffff880`0cf00440 fffff880`05d2c850 : 00000000`00000003 fffffa80`0d3d11a0 fffffa80`0d3d1050 00000000`00000008 : usbhub!UsbhBusResume_Action+0x8f
fffff880`0cf00480 fffff880`05d2cea3 : fffffa80`0d3d11a0 00000000`00000008 fffffa80`0d3d1050 00000000`00000000 : usbhub!UsbhReleaseBusStateLock+0x50
fffff880`0cf004b0 fffff880`05d2d9a6 : fffffa80`0d3d1918 fffffa80`0d3d11a0 fffffa80`0d3d1050 fffffa80`10aede08 : usbhub!UsbhDispatch_BusEvent+0x1fb
fffff880`0cf00500 fffff880`05d5ea75 : 00000000`00000000 fffff880`6e447352 00000000`00000000 fffffa80`0d640000 : usbhub!UsbhSyncBusResume+0x42
fffff880`0cf00540 fffff880`05d5da9e : 00000000`00000000 fffffa80`0d3d11a0 fffffa80`0d3d11a0 fffffa80`0d3d1050 : usbhub!UsbhSshResumeDownstream+0x59
fffff880`0cf005c0 fffff880`05d5d473 : 00000000`00000008 00000000`00000001 fffffa80`0d3d1050 00000000`00000000 : usbhub!Usbh_SSH_HubPendingResume+0xb6
fffff880`0cf00600 fffff880`05d260ad : fffffa80`10aedc60 fffffa80`0d02a050 fffffa80`0d640050 fffffa80`0d3d1050 : usbhub!Usbh_SSH_Event+0x10b
fffff880`0cf00630 fffff880`05d25fdf : fffffa80`10aedc60 fffffa80`0d640050 00000000`00000001 fffffa80`0d6401a0 : usbhub!UsbhFdoInternalDeviceControl+0x75
fffff880`0cf00670 fffff880`04816459 : fffffa80`0d3c4640 fffffa80`0d3d1050 00000000`00000000 fffffa80`0d640050 : usbhub!UsbhGenDispatch+0x7f
fffff880`0cf006a0 fffff880`04816363 : fffffa80`0d3c4640 fffffa80`0d02a050 fffffa80`0d02a1a0 00000000`00000000 : USBPORT!USBPORT_SendSynchronousUsbIoctlRequest+0xd1
fffff880`0cf00730 fffff880`05d5e949 : 00000000`00000000 fffffa80`0d3d11a0 fffffa80`0d3d1868 fffffa80`0d3d1050 : USBPORT!USBPORTBUSIF_ResumeRootHub+0x19f
fffff880`0cf00780 fffff880`05d5d993 : 00000000`00000000 00000000`00000001 fffff880`00000003 fffffa80`0d3d1050 : usbhub!UsbhSshResumeUpstream+0x79
fffff880`0cf007e0 fffff880`05d5d482 : 00000000`00000006 fffffa80`0d3d1050 00000040`00000000 00000000`00600056 : usbhub!Usbh_SSH_HubSuspended+0xd3
fffff880`0cf00810 fffff880`05d261f4 : 00000000`00220450 fffffa80`109e0200 fffffa80`0d3d1050 fffffa80`109e0010 : usbhub!Usbh_SSH_Event+0x11a
fffff880`0cf00840 fffff880`05d25fdf : fffffa80`108d8d00 fffff880`0cf00b60 fffffa80`108d8d00 00000000`00000004 : usbhub!UsbhFdoDeviceControl+0xc0
fffff880`0cf008a0 fffff800`02f9ea97 : fffffa80`109e0248 fffff880`0cf00b60 fffffa80`109e0248 fffffa80`109e0010 : usbhub!UsbhGenDispatch+0x7f
fffff880`0cf008d0 fffff800`02f9f2f6 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0cf00a00 fffff800`02c82ed3 : fffffa80`114a19b0 fffff880`0cf00b60 fffff880`746c6644 fffff880`0cf00af8 : nt!NtDeviceIoControlFile+0x56
fffff880`0cf00a70 00000000`7781138a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06d2d6f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7781138a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbhub!UsbhHubQueueProcessChangeWorker+77
fffff880`05d36bc7 488d8b78090000  lea     rcx,[rbx+978h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  usbhub!UsbhHubQueueProcessChangeWorker+77

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbhub

IMAGE_NAME:  usbhub.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d8c0b08

FAILURE_BUCKET_ID:  X64_0xE4_usbhub!UsbhHubQueueProcessChangeWorker+77

BUCKET_ID:  X64_0xE4_usbhub!UsbhHubQueueProcessChangeWorker+77

Followup: MachineOwner
---------


[/list]