BSOD - ntoskrnl.exe+289fc

Hello everyone,

I'm just lost with my ideas. I'm getting BSOD PAGE_FAULT_IN_NONPAGED_AREA for long time now. I tried to reinstall computer but it's still with me.

It's totally random to be honest. I didn't find any specific software.

Informations:
- My system is Windows 7 - Ultimate 64bit
- I reinstalled OS 6 months ago from full retail disc
- Computer is around one year old:

- AMD Phenom II X6 1090T Black Edition
- ASUS M4A88TD-V EVO/USB3
- Gigabyte GTX460 1GB DDR5 GV-N460OC-1GI
- 2x Kingston HyperX Blu XMP 4GB (kit 2x 2GB) 1600MHz
- WD Caviar Black WD1002FAEX 3.5" 1TB
- Arctic Cooling Fusion 550 550W Bulk

I'm sorry for .html log. It will be in Czech language. But I can do English one if you will give me idea how :)


Thanks for your time and tips!

Code:

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011112-20467-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03262000 PsLoadedModuleList = 0xfffff800`034a7670
Debug session time: Wed Jan 11 06:43:16.543 2012 (UTC - 7:00)
System Uptime: 0 days 0:02:50.730
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff98058aabfeb, 0, fffff880012d5caf, 5}


Could not read faulting driver name
Probably caused by : Ntfs.sys ( Ntfs!NtfsCheckAttributeRecord+df )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff98058aabfeb, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880012d5caf, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003511100
 fffff98058aabfeb 

FAULTING_IP: 
Ntfs!NtfsCheckAttributeRecord+df
fffff880`012d5caf 0f8535830400    jne     Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea)

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  uTorrent.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008a74c40 -- (.trap 0xfffff88008a74c40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000020 rbx=0000000000000000 rcx=0000000000000020
rdx=0000000000000028 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012d5caf rsp=fffff88008a74dd0 rbp=0000000000000090
 r8=fffff98013aa0780  r9=0000000000000000 r10=0000000000000400
r11=fffffa8008f83180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
Ntfs!NtfsCheckAttributeRecord+0xdf:
fffff880`012d5caf 0f8535830400    jne     Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea) [br=0]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032893bf to fffff800032dec40

STACK_TEXT:  
fffff880`08a74ad8 fffff800`032893bf : 00000000`00000050 fffff980`58aabfeb 00000000`00000000 fffff880`08a74c40 : nt!KeBugCheckEx
fffff880`08a74ae0 fffff800`032dcd6e : 00000000`00000000 fffff980`58aabfeb ffff0800`00000000 fffff980`13aa0750 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`08a74c40 fffff880`012d5caf : 0073002e`00000000 fffff980`13aa1400 fffffa80`06a21bc0 fffffa80`0a488060 : nt!KiPageFault+0x16e
fffff880`08a74dd0 fffff880`012d6475 : fffffa80`08f83180 00000000`02ed9234 00000000`00000000 00000000`00000090 : Ntfs!NtfsCheckAttributeRecord+0xdf
fffff880`08a74e40 fffff880`012d1d5c : fffff880`08a75340 fffffa80`08f83180 fffff8a0`0481a5c8 fffff880`08a75101 : Ntfs!NtfsReadMftRecord+0x344
fffff880`08a74ef0 fffff880`012d6ae0 : fffff880`08a75290 fffff8a0`0481a7a0 fffff8a0`0481a6f0 fffff880`08a75120 : Ntfs!NtfsLookupInFileRecord+0x6c
fffff880`08a74f80 fffff880`012dadb1 : fffff880`08a75340 fffffa80`0a99f3d0 00000000`01760174 fffff8a0`0c742762 : Ntfs!FindFirstIndexEntry+0x50
fffff880`08a75010 fffff880`012cecf5 : fffff880`08a75340 fffff880`08a75340 fffff8a0`0c075601 00000000`00000000 : Ntfs!NtfsFindIndexEntry+0x5d
fffff880`08a75080 fffff880`012b0441 : fffff880`08a75340 fffffa80`098f8470 fffff880`08a75290 fffffa80`098f8400 : Ntfs!NtfsCommonCreate+0x7c5
fffff880`08a75260 fffff880`00da5367 : fffffa80`098f8470 fffffa80`098f8858 fffff880`08a755d0 fffffa80`08364b00 : Ntfs!NtfsNetworkOpenCreate+0x115
fffff880`08a75540 fffff880`00dc6aed : 00000000`00000000 fffffa80`098f8858 00000000`0000000c 00000000`0000000c : fltmgr!FltpPerformFastIoCall+0x357
fffff880`08a755a0 fffff800`035dd4c8 : 00000000`00000045 fffff880`08a759e0 fffffa80`00000080 00000000`000007ff : fltmgr!FltpFastIoQueryOpen+0x15d
fffff880`08a75640 fffff800`035d9838 : fffffa80`08eb5cd0 fffff800`00000000 fffffa80`0aaa9680 00000000`00000101 : nt!IopParseDevice+0xad8
fffff880`08a757d0 fffff800`035daa56 : 00000000`00000000 fffffa80`0aaa9680 fffffa80`6d4e624f fffffa80`06b07660 : nt!ObpLookupObjectName+0x588
fffff880`08a758c0 fffff800`035ba9d6 : fffffa80`0a488060 00000000`0202e7f8 fffff880`08a75a01 00000000`00000004 : nt!ObOpenObjectByName+0x306
fffff880`08a75990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtQueryAttributesFile+0x145


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCheckAttributeRecord+df
fffff880`012d5caf 0f8535830400    jne     Ntfs! ?? ::NNGAKEGL::`string'+0x90bd (fffff880`0131dfea)

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  Ntfs!NtfsCheckAttributeRecord+df

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

FAILURE_BUCKET_ID:  X64_0x50_Ntfs!NtfsCheckAttributeRecord+df

BUCKET_ID:  X64_0x50_Ntfs!NtfsCheckAttributeRecord+df

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011312-19297-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0325f000 PsLoadedModuleList = 0xfffff800`034a4670
Debug session time: Fri Jan 13 09:48:40.692 2012 (UTC - 7:00)
System Uptime: 0 days 1:18:18.879
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff96000600011, 8, fffff96000600011, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600011, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600011, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350e100
 fffff96000600011 

FAULTING_IP: 
+3566393831333761
fffff960`00600011 ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  Steam.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a664ff0 -- (.trap 0xfffff8800a664ff0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffff900c0a49ba0
rdx=fffff900c554e470 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600011 rsp=fffff8800a665180 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffff8800a6652d0
r11=000000000000000b r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
fffff960`00600011 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032879fc to fffff800032dbc40

STACK_TEXT:  
fffff880`0a664e88 fffff800`032879fc : 00000000`00000050 fffff960`00600011 00000000`00000008 fffff880`0a664ff0 : nt!KeBugCheckEx
fffff880`0a664e90 fffff800`032d9d6e : 00000000`00000008 fffff960`00600011 fffff880`0a665200 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`0a664ff0 fffff960`00600011 : fffff900`c09e5b80 fffff900`c0a49780 fffff900`c09e5b80 fffff900`c0a49630 : nt!KiPageFault+0x16e
fffff880`0a665180 fffff900`c09e5b80 : fffff900`c0a49780 fffff900`c09e5b80 fffff900`c0a49630 00000000`00000000 : 0xfffff960`00600011
fffff880`0a665188 fffff900`c0a49780 : fffff900`c09e5b80 fffff900`c0a49630 00000000`00000000 fffff880`0a665210 : 0xfffff900`c09e5b80
fffff880`0a665190 fffff900`c09e5b80 : fffff900`c0a49630 00000000`00000000 fffff880`0a665210 00000000`7efdb3a8 : 0xfffff900`c0a49780
fffff880`0a665198 fffff900`c0a49630 : 00000000`00000000 fffff880`0a665210 00000000`7efdb3a8 00000000`0008fd20 : 0xfffff900`c09e5b80
fffff880`0a6651a0 00000000`00000000 : fffff880`0a665210 00000000`7efdb3a8 00000000`0008fd20 00000000`7efdb000 : 0xfffff900`c0a49630


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`032879fc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4611f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011412-18392-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03254000 PsLoadedModuleList = 0xfffff800`03499670
Debug session time: Sat Jan 14 01:52:23.400 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:19.586
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff80003000002, 8, fffff80003000002, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80003000002, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff80003000002, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003503100
 fffff80003000002 

FAULTING_IP: 
+3566393831333761
fffff800`03000002 ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  lsass.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88005f94820 -- (.trap 0xfffff88005f94820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=fffff8a0014ad0e0
rdx=000000000000000e rsi=0000000000000000 rdi=0000000000000000
rip=fffff80003000002 rsp=fffff88005f949b0 rbp=000000006353624f
 r8=0000000000000000  r9=0000000000000000 r10=fffff80003254000
r11=fffff88005f94b38 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
fffff800`03000002 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000327c9fc to fffff800032d0c40

STACK_TEXT:  
fffff880`05f946b8 fffff800`0327c9fc : 00000000`00000050 fffff800`03000002 00000000`00000008 fffff880`05f94820 : nt!KeBugCheckEx
fffff880`05f946c0 fffff800`032ced6e : 00000000`00000008 fffff800`03000002 fffff880`05f94b00 fffff8a0`014ad000 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`05f94820 fffff800`03000002 : fffff880`05f94ca0 fffff8a0`014b0940 00000000`00cde718 00000000`00000001 : nt!KiPageFault+0x16e
fffff880`05f949b0 fffff880`05f94ca0 : fffff8a0`014b0940 00000000`00cde718 00000000`00000001 00000000`746c6644 : 0xfffff800`03000002
fffff880`05f949b8 fffff8a0`014b0940 : 00000000`00cde718 00000000`00000001 00000000`746c6644 fffff880`05f94ad8 : 0xfffff880`05f94ca0
fffff880`05f949c0 00000000`00cde718 : 00000000`00000001 00000000`746c6644 fffff880`05f94ad8 fffff8a0`014ad0e0 : 0xfffff8a0`014b0940
fffff880`05f949c8 00000000`00000001 : 00000000`746c6644 fffff880`05f94ad8 fffff8a0`014ad0e0 000007ff`fffae000 : 0xcde718
fffff880`05f949d0 00000000`746c6644 : fffff880`05f94ad8 fffff8a0`014ad0e0 000007ff`fffae000 fffffa80`08b01b30 : 0x1
fffff880`05f949d8 fffff880`05f94ad8 : fffff8a0`014ad0e0 000007ff`fffae000 fffffa80`08b01b30 00000000`00000000 : 0x746c6644
fffff880`05f949e0 fffff8a0`014ad0e0 : 000007ff`fffae000 fffffa80`08b01b30 00000000`00000000 00000000`00000000 : 0xfffff880`05f94ad8
fffff880`05f949e8 000007ff`fffae000 : fffffa80`08b01b30 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff8a0`014ad0e0
fffff880`05f949f0 fffffa80`08b01b30 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff`fffae000
fffff880`05f949f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffffff`fffffffe : 0xfffffa80`08b01b30


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`0327c9fc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4611f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011412-21559-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0325b000 PsLoadedModuleList = 0xfffff800`034a0670
Debug session time: Sat Jan 14 08:39:51.076 2012 (UTC - 7:00)
System Uptime: 0 days 0:13:37.231
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff96000600049, 8, fffff96000600049, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4611f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600049, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600049, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350a100
 fffff96000600049 

FAULTING_IP: 
+3034323862323064
fffff960`00600049 ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88009211f20 -- (.trap 0xfffff88009211f20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000c2000000 rbx=0000000000000000 rcx=fffff900c2a649e0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600049 rsp=fffff880092120b0 rbp=fffff900c2a64630
 r8=0000000000000204  r9=0000000000000000 r10=0000000000000001
r11=fffff88009212148 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac pe cy
fffff960`00600049 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800032839fc to fffff800032d7c40

STACK_TEXT:  
fffff880`09211db8 fffff800`032839fc : 00000000`00000050 fffff960`00600049 00000000`00000008 fffff880`09211f20 : nt!KeBugCheckEx
fffff880`09211dc0 fffff800`032d5d6e : 00000000`00000008 fffff960`00600049 00000000`00000000 fffff900`c2a64630 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`09211f20 fffff960`00600049 : 00000000`000009a0 00000000`00000000 00000000`00000000 fffff960`000e5629 : nt!KiPageFault+0x16e
fffff880`092120b0 00000000`000009a0 : 00000000`00000000 00000000`00000000 fffff960`000e5629 00000000`3f800000 : 0xfffff960`00600049
fffff880`092120b8 00000000`00000000 : 00000000`00000000 fffff960`000e5629 00000000`3f800000 00000000`00000000 : 0x9a0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4611f
fffff800`032839fc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4611f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

BUCKET_ID:  X64_0x50_nt!_??_::FNODOBFM::_string_+4611f

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011512-18361-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03253000 PsLoadedModuleList = 0xfffff800`03498670
Debug session time: Sun Jan 15 02:54:16.616 2012 (UTC - 7:00)
System Uptime: 0 days 0:55:07.469
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff96000600000, 8, fffff96000600000, 0}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!GrayShrinkDIB_CX+19f )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff96000600000, memory referenced.
Arg2: 0000000000000008, value 0 = read operation, 1 = write operation.
Arg3: fffff96000600000, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003502100
 fffff96000600000 

FAULTING_IP: 
+3034323862323064
fffff960`00600000 ??              ???

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  explorer.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88009e416a0 -- (.trap 0xfffff88009e416a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000017 rbx=0000000000000000 rcx=fffff900c3581824
rdx=fffff900c35817c8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff96000600000 rsp=fffff88009e41830 rbp=fffff900c3f36020
 r8=fffff900c08c9221  r9=0000000000000001 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po nc
fffff960`00600000 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000327b9fc to fffff800032cfc40

STACK_TEXT:  
fffff880`09e41538 fffff800`0327b9fc : 00000000`00000050 fffff960`00600000 00000000`00000008 fffff880`09e416a0 : nt!KeBugCheckEx
fffff880`09e41540 fffff800`032cdd6e : 00000000`00000008 fffff960`00600000 00000000`00000800 fffff900`c08c91c0 : nt! ?? ::FNODOBFM::`string'+0x4611f
fffff880`09e416a0 fffff960`00600000 : fffff900`c08c91c0 00000000`4004600c fffff880`09e418f4 fffff880`09e418fc : nt!KiPageFault+0x16e
fffff880`09e41830 fffff900`c08c91c0 : 00000000`4004600c fffff880`09e418f4 fffff880`09e418fc fffff900`00002800 : 0xfffff960`00600000
fffff880`09e41838 00000000`4004600c : fffff880`09e418f4 fffff880`09e418fc fffff900`00002800 00001f80`ffffffe0 : 0xfffff900`c08c91c0
fffff880`09e41840 fffff880`09e418f4 : fffff880`09e418fc fffff900`00002800 00001f80`ffffffe0 00000000`00000017 : 0x4004600c
fffff880`09e41848 fffff880`09e418fc : fffff900`00002800 00001f80`ffffffe0 00000000`00000017 fffff880`09e41904 : 0xfffff880`09e418f4
fffff880`09e41850 fffff900`00002800 : 00001f80`ffffffe0 00000000`00000017 fffff880`09e41904 fffff880`09e4190c : 0xfffff880`09e418fc
fffff880`09e41858 00001f80`ffffffe0 : 00000000`00000017 fffff880`09e41904 fffff880`09e4190c fffff900`00000ae0 : 0xfffff900`00002800
fffff880`09e41860 00000000`00000017 : fffff880`09e41904 fffff880`09e4190c fffff900`00000ae0 fffff960`00207c78 : 0x1f80`ffffffe0
fffff880`09e41868 fffff880`09e41904 : fffff880`09e4190c fffff900`00000ae0 fffff960`00207c78 00000020`00000017 : 0x17
fffff880`09e41870 fffff880`09e4190c : fffff900`00000ae0 fffff960`00207c78 00000020`00000017 fffff900`00000000 : 0xfffff880`09e41904
fffff880`09e41878 fffff900`00000ae0 : fffff960`00207c78 00000020`00000017 fffff900`00000000 00000000`00000001 : 0xfffff880`09e4190c
fffff880`09e41880 fffff960`00207c77 : 00000020`00000017 fffff900`00000000 00000000`00000001 fffff880`09e41d80 : 0xfffff900`00000ae0
fffff880`09e41888 00000102`00082044 : fffff960`00207ad8 fffff960`001fe6c0 fffff960`001fe6c0 fffff960`002005d8 : win32k!GrayShrinkDIB_CX+0x19f
fffff880`09e418b8 fffff960`00207ad7 : fffff960`001fe6c0 fffff960`001fe6c0 fffff960`002005d8 fffff960`00200694 : 0x102`00082044
fffff880`09e418c0 fffff880`09e41ba8 : fffff900`c00d4280 fffff960`00358e80 fffffa80`0452d990 00000000`00000000 : win32k!GrayExpandDIB_CY+0x79f
fffff880`09e41c20 fffff900`c00d4280 : fffff960`00358e80 fffffa80`0452d990 00000000`00000000 fffff8a0`00000001 : 0xfffff880`09e41ba8
fffff880`09e41c28 fffff960`00358e80 : fffffa80`0452d990 00000000`00000000 fffff8a0`00000001 fffff900`c35815a8 : 0xfffff900`c00d4280
fffff880`09e41c30 fffffa80`0452d990 : 00000000`00000000 fffff8a0`00000001 fffff900`c35815a8 00000017`04010001 : win32k!xloIdent
fffff880`09e41c38 00000000`00000000 : fffff8a0`00000001 fffff900`c35815a8 00000017`04010001 00000004`00000017 : 0xfffffa80`0452d990


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!GrayShrinkDIB_CX+19f
fffff960`00207c77 90              nop

SYMBOL_STACK_INDEX:  e

SYMBOL_NAME:  win32k!GrayShrinkDIB_CX+19f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ecdcd5a

FAILURE_BUCKET_ID:  X64_0x50_win32k!GrayShrinkDIB_CX+19f

BUCKET_ID:  X64_0x50_win32k!GrayShrinkDIB_CX+19f

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\Ellendway\Windows_NT6_BSOD_jcgriff2\011512-22791-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03217000 PsLoadedModuleList = 0xfffff800`0345c670
Debug session time: Sun Jan 15 14:33:45.921 2012 (UTC - 7:00)
System Uptime: 0 days 0:00:34.060
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, fffffa8009647630, fffffa8009647910, fffff800035978b0}

Probably caused by : csrss.exe

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8009647630, Terminating object
Arg3: fffffa8009647910, Process image file name
Arg4: fffff800035978b0, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8009647630

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 0000000000000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0xF4_C0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

STACK_TEXT:  
fffff880`027e9b58 fffff800`0361e5e2 : 00000000`000000f4 00000000`00000003 fffffa80`09647630 fffffa80`09647910 : nt!KeBugCheckEx
fffff880`027e9b60 fffff800`035cb99b : ffffffff`ffffffff fffffa80`079fdb60 fffffa80`09647630 fffffa80`09647630 : nt!PspCatchCriticalBreak+0x92
fffff880`027e9ba0 fffff800`0354b448 : ffffffff`ffffffff 00000000`00000001 fffffa80`09647630 fffffa80`00000008 : nt! ?? ::NNGAKEGL::`string'+0x176d6
fffff880`027e9bf0 fffff800`03292ed3 : fffffa80`09647630 fffffa80`c0000005 fffffa80`079fdb60 fffff880`010a34e6 : nt!NtTerminateProcess+0xf4
fffff880`027e9c70 fffff800`0328f470 : fffff800`032df67f fffff880`027eaa00 fffff880`027ea340 fffff880`027eac20 : nt!KiSystemServiceCopyEnd+0x13
fffff880`027e9e08 fffff800`032df67f : fffff880`027eaa00 fffff880`027ea340 fffff880`027eac20 00000000`00000002 : nt!KiServiceLinkage
fffff880`027e9e10 fffff800`032e1af8 : fffff880`027eaa00 fffff880`027eaa00 fffff880`027eac20 fffff880`027ea4e0 : nt! ?? ::FNODOBFM::`string'+0x49874
fffff880`027ea4b0 fffff800`032959fb : fffff880`027eaa00 fffffa80`079fdb60 00000000`003cd960 fffff880`027eabc0 : nt!KiRaiseException+0x1b4
fffff880`027eaae0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtRaiseException+0x7b


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID:  X64_0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

When you re-installed Windows, did you do a clean install with a quick format or a full format, or did you do a repair install?

Your first blue screen crash a week ago was hard disk related and could be due to hard disk corruption.

Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log

All of these could be related to hardware problems and possibly memory modules.

Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

Update your BIOS to the latest version and update your Chipset drivers. If you need help with this, ask us. :)

I did clean install with full format.

I also Memory Test from few weeks ago. http://imgbank.cz/images/photo0304.jpg

All drivers are up-to-date and bios is the latest version from asus website (number 2001 I think).

Ellendway said:

I did clean install with full format.

I also Memory Test from few weeks ago. http://imgbank.cz/images/photo0304.jpg

All drivers are up-to-date and bios is the latest version from asus website (number 2001 I think).

Memtest86+ sometimes misses RAM errors. I still suggest the Windows diagnostic tool to further verify the memory. Also recommend running the disk check just to be sure there are no errors on the disk.

Yeah I will do it. I used it one time but I can't see it in log right now. But I will just do it again. I will have full answer in two days.

I hope I can leave PC alone when system will do disk check and diagnostic tool.

Just a question in passing. Are you overclocking anything?

zigzag3143 said:

Just a question in passing. Are you overclocking anything?

My CPU and GPU is overclocked like a week right now. I have got problems with this BSOD for long time. I tried to run computer without overclocked parts but it's still same.

Ellendway said:

zigzag3143 said:

Just a question in passing. Are you overclocking anything?

My CPU and GPU is overclocked like a week right now. I have got problems with this BSOD for long time. I tried to run computer without overclocked parts but it's still same.

Thanks for that, zigzag3143. Appreciate the question.

We still recommend stopping overclocking during these checks as it does cause less stability and makes it harder to determine other possible stability conflicts. Please stop all overclocking during this procedure. :)

Sure. I will reset my BIOS to default. Anyway can I leave PC alone when it will do these bloody tests? :)

Ellendway said:

zigzag3143 said:

Just a question in passing. Are you overclocking anything?

My CPU and GPU is overclocked like a week right now. I have got problems with this BSOD for long time. I tried to run computer without overclocked parts but it's still same.

I agree completely with writhziden. It is one less thing we have to consider when looking at the causes.