BSOD "KMODE_EXCEPTION_NOT_HANDLED" ntkrnlmp.exe

Cuahchic · 24 Nov 2012

Hi all,

In June 2012 I built my first PC from scratch. The system details can be found in the attached "Cuahchic.zip" under "SystemInfo.txt" (I won't repeat them here).

The components are stock except I did overclock the CPU to 4.2GHz for a while (I had a few unstable attempts but this appeared to be stable). However, due to recent BSOD I have now returned the CPU settings to their default as decided by the motherboard (this was done on 24th Nov 2012 at 17:43).

Since having the PC I have had intermittent BSOD most of which can be attributed to either unstable overclocks or AVG anti-virus (which I un-installed around 13th Sept 2012 and replaced with Microsoft Security Essentials) - you can hopefully see all this by looking at the crash dump history.

What I would like help with is the crash dumps which have occurred since 20th Oct 2012 onwards (files 102012-8970-01.dmp onward). These appear to all be related to ntoskrnl.exe.

I have attempted to diagnose these myself using WinDbg and BlueScreenView but my knowledge of these programs and what they are telling me is limited at best. I also tried using Verifier.exe but as yet I don't see what difference it made?

I can't guarantee to repeat the crash exactly but the following sequence of events causes this crash 95% of the time:

Start Google Chrome to browse the web. Open multiple tabs to look at multiple pages simultaneously.
Open Windows Explorer to view files from my NAS.
Open Windows Media Player to play music from my NAS.

I seem to have no problem using Chrome on its own. So my suspicions are leaning towards Windows Media Player playing music from my NAS - however, I can't see any evidence of this using my limited skills to examine the crash dumps.

Things I have tried:

Running memtest86+ with both DIMMs installed, which passed (no errors) with 2 attempts after about 75 minutes. I will retry to see if it passes the magic 7 times later this evening but my belief is that the memory is not the culprit given that I have played through Crysis 2 on full settings with no BSODs whereas opening the three programs above causes a crash 95% of the time. I am aware that generally the sticks should be tested separately however I wanted to know how they would work simultaneously.
Removing any overclocking of the CPU (note the memory was never overclocked) back to the default settings as decided by the motherboard. I still got one BSOD shortly after this by opening the three programs listed above.

I hope this is enough information but please let me know if you need more.

Also I am away with work and without internet from 26/11/2012 at 0900 GMT until 01/12/2012 at 0900 GMT so I won't be able to respond during these times, my apologies.

I hope someone can help!

Regards,

Colin

tom982 · 24 Nov 2012

Hello Colin and welcome to the forums

I have run all of your dump files and I'll post the output here so the others can make use of it without having to do the same process again:

24/11/2012 20:54:32.70 98-dbug Sysnative BSOD scripts
…………………………………………………………………………………………………………………………………………………………………………………………………………………………

TOTAL DUMP FILES PROCESSED THIS RUN: 32
TOTAL DUMP FILES PROCESSED TO DATE: 123

…………………………………………………………………………………………………………………………………………………………………………………………………………………………

BSOD BUGCHECK SUMMARY

[code]
Debug session time: Sat Nov 24 19:38:06.305 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\112412-15272-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:03:35.507
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Nov 24 19:07:30.084 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\112412-10296-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 1:22:25.286
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Nov 24 15:54:49.724 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\112412-9110-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:14:24.895
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Nov 24 15:39:25.310 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\112412-8517-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 3:57:17.106
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov 11 19:01:19.322 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\111112-8283-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:06:43.493
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov 11 18:54:15.403 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\111112-8377-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 1:35:51.551
BugCheck 1E, {0, 0, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )
Bugcheck code 0000001E
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x1E
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x1E_VRF_nt!KiKernelCalloutExceptionHandler+e
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Nov 4 11:15:07.839 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\110412-8205-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 1:33:59.525
BugCheck 50, {fffffffffa0f2ce8, 0, fffff80002f86995, 2}
Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGFASTMUTEX::Acquire+13 )
Bugcheck code 00000050
Arguments:
Arg1: fffffffffa0f2ce8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002f86995, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: dwm.exe
FAILURE_BUCKET_ID: X64_0x50_VRF_dxgkrnl!DXGFASTMUTEX::Acquire+13
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Mon Oct 29 22:38:37.072 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\102912-8923-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 1:50:52.869
BugCheck 50, {ffffe9001052099c, 0, fffff80002f9d6cd, 7}
Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGFASTMUTEX::Acquire+13 )
Bugcheck code 00000050
Arguments:
Arg1: ffffe9001052099c, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002f9d6cd, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0x50
PROCESS_NAME: dwm.exe
FAILURE_BUCKET_ID: X64_0x50_VRF_dxgkrnl!DXGFASTMUTEX::Acquire+13
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Mon Oct 29 19:00:22.319 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\102912-8299-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:26.116
BugCheck F4, {3, fffffa8008034110, fffffa80080343f0, fffff80003191460}
Probably caused by : csrss.exe
Bugcheck code 000000f4
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8008034110, Terminating object
Arg3: fffffa80080343f0, Process image file name
Arg4: fffff80003191460, Explanatory message (ascii)
PROCESS_NAME: csrss.exe
BUGCHECK_STR: 0xF4_c0000005
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
FAILURE_BUCKET_ID: X64_0xF4_c0000005_VRF_IMAGE_csrss.exe
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sat Oct 20 06:59:03.300 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\102012-8970-01.dmp]
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
System Uptime: 0 days 0:00:56.096
BugCheck 50, {fffff180cae76450, 0, fffff960002c719e, 7}
Probably caused by : memory_corruption
Bugcheck code 00000050
Arguments:
Arg1: fffff180cae76450, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960002c719e, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
PROCESS_NAME: firefox.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Thu Sep 13 16:36:44.680 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091312-10732-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:14.851
BugCheck A, {fffff80002f7cb94, 2, 0, fffff80002cb3912}
Probably caused by : ntkrnlmp.exe ( nt!RtlDispatchException+122 )
Bugcheck code 0000000A
Arguments:
Arg1: fffff80002f7cb94, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cb3912, address which referenced memory
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
BUGCHECK_STR: 0xA
PROCESS_NAME: TrustedInstall
FAILURE_BUCKET_ID: X64_0xA_VRF_nt!RtlDispatchException+122
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 19:37:02.024 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-9921-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:17:10.210
BugCheck C4, {0, 0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+59be )
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
BUGCHECK_STR: 0xc4_0
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: avgnsa.exe
FAILURE_BUCKET_ID: X64_0xc4_0_VRF_avgtdia+59be
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 19:19:35.121 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-9734-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:45.292
BugCheck C4, {0, 0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+59be )
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
BUGCHECK_STR: 0xc4_0
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: avgnsa.exe
FAILURE_BUCKET_ID: X64_0xc4_0_VRF_avgtdia+59be
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 19:18:29.771 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-10342-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:07:36.957
BugCheck C4, {62, fffffa8007b46960, fffffa8007b48a90, a}
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
Probably caused by : avgldx64.sys
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000062, A driver has forgotten to free its pool allocations prior to unloading.
Arg2: fffffa8007b46960, name of the driver having the issue.
Arg3: fffffa8007b48a90, verifier internal structure with driver information.
Arg4: 000000000000000a, total # of (paged+nonpaged) allocations that weren't freed.
Type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.
BUGCHECK_STR: 0xc4_62
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: services.exe
FAILURE_BUCKET_ID: X64_0xc4_62_VRF_LEAKED_POOL_IMAGE_avgldx64.sys
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 19:10:32.391 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-10857-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:11:00.562
BugCheck C4, {62, fffffa8007b1cb70, fffffa8007b1c9a0, 15}
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
Probably caused by : avgldx64.sys
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000062, A driver has forgotten to free its pool allocations prior to unloading.
Arg2: fffffa8007b1cb70, name of the driver having the issue.
Arg3: fffffa8007b1c9a0, verifier internal structure with driver information.
Arg4: 0000000000000015, total # of (paged+nonpaged) allocations that weren't freed.
Type !verifier 3 drivername.sys for info on the allocations
that were leaked that caused the bugcheck.
BUGCHECK_STR: 0xc4_62
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: services.exe
FAILURE_BUCKET_ID: X64_0xc4_62_VRF_LEAKED_POOL_IMAGE_avgldx64.sys
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:59:13.890 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-10358-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:41.061
BugCheck C4, {0, 0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+59be )
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
BUGCHECK_STR: 0xc4_0
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: avgnsa.exe
FAILURE_BUCKET_ID: X64_0xc4_0_VRF_avgtdia+59be
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:58:11.924 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-10108-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:08:58.721
BugCheck C4, {0, 0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+59be )
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
BUGCHECK_STR: 0xc4_0
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: avgnsa.exe
FAILURE_BUCKET_ID: X64_0xc4_0_VRF_avgtdia+59be
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:48:40.604 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-10842-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:07:10.775
BugCheck C4, {0, 0, 0, 0}
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for avgtdia.sys
*** ERROR: Module load completed but symbols could not be loaded for avgtdia.sys
Probably caused by : avgtdia.sys ( avgtdia+59be )
Bugcheck code 000000c4
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
BUGCHECK_STR: 0xc4_0
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: avgnsa.exe
FAILURE_BUCKET_ID: X64_0xc4_0_VRF_avgtdia+59be
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:30:43.485 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-6520-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:23.266
BugCheck D1, {fffff3000c9d5698, 2, 0, fffff88004fc8081}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : HIDCLASS.SYS ( HIDCLASS!memmove+1d1 )
Bugcheck code 000000d1
Arguments:
Arg1: fffff3000c9d5698, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88004fc8081, address which referenced memory
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0xD1_HIDCLASS!memmove+1d1
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:30:04.489 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-5740-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:02:19.675
BugCheck 3B, {c0000005, fffff9600012e11b, fffff88005dc80b0, 0}
Probably caused by : memory_corruption
Bugcheck code 0000003B
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff9600012e11b, Address of the instruction which caused the bugcheck
Arg3: fffff88005dc80b0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x3B
PROCESS_NAME: chrome.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 11 18:27:23.323 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\091112-5834-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:01:06.494
BugCheck 24, {1904fb, fffff88008a0a168, fffff88008a099c0, fffff880010e3626}
*** WARNING: Unable to verify timestamp for avgidsfiltera.sys
*** ERROR: Module load completed but symbols could not be loaded for avgidsfiltera.sys
Probably caused by : avgidsfiltera.sys ( avgidsfiltera+35c3 )
Bugcheck code 00000024
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008a0a168
Arg3: fffff88008a099c0
Arg4: fffff880010e3626
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: chrome.exe
BUGCHECK_STR: 0x24
FAILURE_BUCKET_ID: X64_0x24_avgidsfiltera+35c3
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 4 06:46:11.786 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\090412-6177-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:01:06.957
BugCheck 7F, {8, 80050033, 406f8, fffff88004e63a22}
*** ERROR: Module load completed but symbols could not be loaded for nwifi.sys
Probably caused by : memory_corruption
Bugcheck code 0000007F
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000406f8
Arg4: fffff88004e63a22
BUGCHECK_STR: 0x7f_8
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: svchost.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 4 06:44:50.009 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\090412-6318-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:24.790
BugCheck F4, {3, fffffa8007ad2b30, fffffa8007ad2e10, fffff80002fda510}
Probably caused by : csrss.exe
Bugcheck code 000000f4
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8007ad2b30, Terminating object
Arg3: fffffa8007ad2e10, Process image file name
Arg4: fffff80002fda510, Explanatory message (ascii)
PROCESS_NAME: csrss.exe
BUGCHECK_STR: 0xF4_c0000005
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
FAILURE_BUCKET_ID: X64_0xF4_c0000005_IMAGE_csrss.exe
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue Sep 4 06:43:59.681 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\090412-6926-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:10.462
BugCheck 7F, {8, 80050033, 406f8, fffff88004ee5a22}
*** ERROR: Module load completed but symbols could not be loaded for nwifi.sys
Probably caused by : memory_corruption
Bugcheck code 0000007F
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050033
Arg3: 00000000000406f8
Arg4: fffff88004ee5a22
BUGCHECK_STR: 0x7f_8
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: svchost.exe
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Mon Sep 3 18:30:18.226 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\090312-6630-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:04:10.007
BugCheck FC, {fffff8a0047f8230, 8a20000156451963, fffff880087037e0, 2}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4534c )
Bugcheck code 000000fC
Arguments:
Arg1: fffff8a0047f8230, Virtual address for the attempted execute.
Arg2: 8a20000156451963, PTE contents.
Arg3: fffff880087037e0, (reserved)
Arg4: 0000000000000002, (reserved)
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: svchost.exe
FAILURE_BUCKET_ID: X64_0xFC_nt!_??_::FNODOBFM::_string_+4534c
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Wed Aug 29 22:33:47.591 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\082912-6786-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 1:30:46.471
*** ERROR: Module load completed but symbols could not be loaded for Wdf01000.sys
BugCheck 1000007E, {ffffffffc0000005, fffff88000fc2beb, fffff880095667a8, fffff88009566000}
Probably caused by : Wdf01000.sys ( Wdf01000+78beb )
Bugcheck code 1000007E
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88000fc2beb, The address that the exception occurred at
Arg3: fffff880095667a8, Exception Record Address
Arg4: fffff88009566000, Context Record Address
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
BUGCHECK_STR: 0x7E
FAILURE_BUCKET_ID: X64_0x7E_Wdf01000+78beb
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Jul 29 18:51:02.529 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\072912-5085-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 4:55:24.299
BugCheck 124, {0, fffffa800705e028, f2000040, 10005}
Probably caused by : GenuineIntel
Bugcheck code 00000124
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: fffffa800705e028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000f2000040, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000010005, Low order 32-bits of the MCi_STATUS value.
BUGCHECK_STR: 0x124_GenuineIntel
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: Bubbles.scr
FAILURE_BUCKET_ID: X64_0x124_GenuineIntel_PROCESSOR_MAE
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Jul 15 19:50:18.974 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\071512-6910-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 5:40:38.771
BugCheck 3B, {c0000005, fffff80002fd9d7e, fffff88009986b20, 0}
Probably caused by : hardware ( nt!ObpLookupDirectoryEntry+8e )
Bugcheck code 0000003B
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002fd9d7e, Address of the instruction which caused the bugcheck
Arg3: fffff88009986b20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: SteamService.e
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Jul 15 11:38:06.206 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\071512-5007-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:07:14.377
BugCheck 1E, {ffffffffc0000005, 13, 8, 13}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+48d3d )
Bugcheck code 0000001E
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: 0000000000000013, The address that the exception occurred at
Arg3: 0000000000000008, Parameter 0 of the exception
Arg4: 0000000000000013, Parameter 1 of the exception
BUGCHECK_STR: 0x1E_c0000005_R
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: LMS.exe
FAILURE_BUCKET_ID: X64_0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_+48d3d
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Jul 15 11:28:50.649 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\071512-5038-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:05:21.820
BugCheck 3B, {c000001d, fffff80002c7553d, fffff8800887dff0, 0}
Probably caused by : ntkrnlmp.exe ( nt!ExpReleaseResourceForThreadLite+d )
Bugcheck code 0000003B
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff80002c7553d, Address of the instruction which caused the bugcheck
Arg3: fffff8800887dff0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: cpuz.exe
FAILURE_BUCKET_ID: X64_0x3B_nt!ExpReleaseResourceForThreadLite+d
MaxSpeed: 3400
CurrentSpeed: 3401
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Sun Jul 15 11:07:17.129 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\071512-6583-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 0:00:52.300
BugCheck 3B, {c0000005, fffff80002cc356c, fffff88008073040, 0}
Probably caused by : hardware ( win32k!NtUserCallOneParam+6a )
Bugcheck code 0000003B
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cc356c, Address of the instruction which caused the bugcheck
Arg3: fffff88008073040, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: RealTemp.exe
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Thu Jul 12 21:09:24.159 2012 (UTC + 0:00)
Loading Dump File [C:\Users\Tom\SysnativeBSODApps\071212-6364-01.dmp]
Built by: 7601.17835.amd64fre.win7sp1_gdr.120503-2030
System Uptime: 0 days 1:04:27.330
BugCheck D1, {0, 2, 1, fffff88001562053}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : hardware ( NETIO!RtlGetNextExpiredTimerWheelEntry+44 )
Bugcheck code 000000d1
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001562053, address which referenced memory
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_IP_MISALIGNED_NETIO.SYS
MaxSpeed: 3400
CurrentSpeed: 3430
BiosVersion = F5
BiosReleaseDate = 03/09/2012
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = To be filled by O.E.M.
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``[/code]

Code:


HECIx64.sys                 Thu Nov 10 00:52:25 2011 (4EBB2049)
HWiNFO64A.SYS               Thu May 10 14:05:19 2012 (4FABBD0F)
L1C62x64.sys                Wed Aug  3 07:21:09 2011 (4E38E8D5)
LEqdUsb.Sys                 Fri Sep  2 07:22:56 2011 (4E607640)
LHidEqd.Sys                 Fri Sep  2 07:22:59 2011 (4E607643)
LHidFilt.Sys                Fri Sep  2 07:23:09 2011 (4E60764D)
MpFilter.sys                Fri Aug 24 00:03:14 2012 (5036B6B2)
MpFilter.sys                Fri Mar  9 11:05:26 2012 (4F59E3F6)
PxHlpa64.sys                Tue Oct 20 19:08:42 2009 (4ADDFCAA)
ViaHub3.sys                 Fri Jan 20 04:39:13 2012 (4F18EFF1)
WinRing0x64.sys             Sat Jul 26 14:29:37 2008 (488B26C1)
amdxata.sys                 Fri Mar 19 16:18:18 2010 (4BA3A3CA)
avgidsdrivera.sys           Fri Dec 23 12:05:21 2011 (4EF46E81)
avgidsfiltera.sys           Fri Dec 23 12:05:40 2011 (4EF46E94)
avgidsha.sys                Thu Apr 19 03:19:15 2012 (4F8F7623)
avgldx64.sys                Wed Feb 22 03:57:53 2012 (4F4467C1)
avgmfx64.sys                Fri Dec 23 12:08:12 2011 (4EF46F2C)
avgrkx64.sys                Tue Jan 31 03:11:41 2012 (4F275BED)
avgtdia.sys                 Mon Mar 19 03:53:32 2012 (4F66ADBC)
avgtpx64.sys                Tue Aug 21 15:16:24 2012 (50339838)
cpuz135_x64.sys             Wed May 23 15:53:22 2012 (4FBCF9E2)
dc3d.sys                    Wed May 18 09:07:24 2011 (4DD37E3C)
dc3d.sys                    Sun May 27 15:20:12 2012 (4FC2381C)
intelppm.sys                Tue Jul 14 00:19:25 2009 (4A5BC0FD)
iusb3hcs.sys                Tue Mar 27 09:11:21 2012 (4F717629)
iusb3hub.sys                Tue Mar 27 09:09:29 2012 (4F7175B9)
iusb3xhc.sys                Tue Mar 27 09:09:32 2012 (4F7175BC)
netr28ux.sys                Thu Apr 28 07:18:18 2011 (4DB906AA)
nvhda64v.sys                Wed Apr 18 18:07:54 2012 (4F8EF4EA)
nvlddmkm.sys                Tue Oct  2 19:21:13 2012 (506B3099)
nvlddmkm.sys                Tue May 15 08:35:36 2012 (4FB20748)
point64.sys                 Sun May 27 15:20:05 2012 (4FC23815)
point64.sys                 Wed May 18 09:07:20 2011 (4DD37E38)
rikvm_38F51D56.sys          Fri Oct 29 11:52:09 2010 (4CCAA759)
ssudmdm.sys                 Fri May 11 08:32:16 2012 (4FACC080)
viahduaa.sys                Fri May  4 11:35:46 2012 (4FA3B102)
xhcdrv.sys                  Fri Jan 20 04:39:02 2012 (4F18EFE6)

Cuahchic · 24 Nov 2012

Hi Tom,

Many thanks for such a rapid response, I really appreciate you taking the time to help.

To answer your questions:

WinRing - Unfortunately, I have no idea what is using this. A quick Google shows Corsair Link 2 (which I don't have installed to the best of my knowledge) then a load of dodgy file threat type websites.
Sonic software - I have had a quick look and the only program I can see with Sonic in the name is SmartSound SonicFire Pro - do you want me to remove this? I'm not entirely sure what function this program provides as I don't recall installing it myself.

Sorry I can't provide much additional information.

Regards,

Colin

x BlueRobot · 24 Nov 2012

There are numerous issues with your system, with problems from drivers to hardware.

Hard Drive:

Memory:

RAM - Test with Memtest86+

Run Memtest86+ for least 7-8 passes, and preferrly overnight as it can take a while to fully complete.

Test each RAM stick individually, if an error is found then move the same RAM stick into the next DIMM slot and test again, if errors are found for the same RAM stick in every available slot then you have a faulty RAM module. On the other hand, if no errors are found in the next slot or the other slots for the same RAM module, then you have a faulty DIMM slot.

Test each RAM stick and every motherboard DIMM slot available.

Perform full scans with:

Remember to install the free version of Malwarebytes not the free trail ; untick the free trail box during installation.

Run some file system checks (will scan for corrupted system files):

SFC /SCANNOW : Run in Command Prompt at Boot

x BlueRobot · 24 Nov 2012

csrss.exe was found in your System Information File, and doing a quick search, it has been pointed to as a trojan, however, in some cases it can be a general system process.

What Is csrss.exe?

Code:

c:\windows\system32\csrss.exe

Uninstall AVG:

Code:

AVG TDI Driver	c:\windows\system32\drivers\avgtdia.sys

There were multiple instances of AVG drivers causing crashes to your system, use (as listed above):

These programs are much more stable with Windows 7 and also utilize less of the system's resources.

Cuahchic · 24 Nov 2012

Hi x BlueRobot,

Again, many thanks for taking the time to help.

Here is what I have tried so far (I have attached some screenshots as proof):

Disk Check - Complete on both disks with no errors.
SeaTools - I am installing this now to try, will report back shortly with the results.
memtest86+ - As mentioned I did try this but only for 2 attempts. Unfortunately I need the computer this evening but I plan to run this for 8-9 hours overnight. I will post back tomorrow with the results.
csrss.exe - I don't believe this is a trojan, see link and link. I have checked the process and can confirm it comes from the System32 folder, see attached screenshot.
AVG - As mentioned above some of the crash dumps I supplied were from earlier issues, I only included them for posterity. I have now uninstalled AVG. However, I did identify some files (see attached screenshot) leftover which I have now sent to the recycle bin. Could this have been the source of the problem?

I hope that helps. I will post back shortly with some more information on the unanswered queries.

Cheers,

Colin

x BlueRobot · 24 Nov 2012

Run the scans to make sure there is no possible virus infection, a crash has pointed to this process as a contributing factor, and therefore it would be better for you to least run the scans to make sure.

csrss.exe as you have rightly said is a genuine Windows process, but is there is chance it can become infected; also do not use any registry cleaners as suggested by the post on Yahoo Answers, they always tend to corrupt and delete important registry keys for Windows, leading to a unbootable system.

There two different instances of csrss.exe on your computer.

Cuahchic · 24 Nov 2012

Hi x BlueRobot,

Thanks for that information. I got MSE to scan the csrss file and it said no virus, but I am doing a full scan now to be sure. I also am undertaking a long generic scan of the E drive using SeaTools - is that what you would recommend? It's not the most intuitive software to use so any advice would be welcome.

Cheers,

Colin

PS - Both the C and E drives passed a short generic test under SeaTools. Would you recommend a long generic? If so, it might need to wait until tomorrow, as I would like to run memtest86+ overnight.

x BlueRobot · 24 Nov 2012

Yes a long test would be good as it would check much more than a short test :)

Also, scan with TDSS Anti-Rootkit Killer (scans in very short amount of time) and Malwarebytes, as sometimes one program can detect something which another program missed; make sure you have installed all the latest security definitions for MSE, otherwise it may not detect any spyware or malware since it can't define what a virus program is.

Cuahchic · 25 Nov 2012

Hi all,

I have now completed the following tasks:

Did a full system scan with fully up-to-date Microsoft Security Essentials, nothing found.
Did a scan with TDSS Killer and found nothing.
Scanned with Malwarebytes and found nothing.
Completed a long generic scan on drives C and E using SeaTools. No errors found.
Ran memtest86+ on both DIMMs overnight. This passed with 7 attempts in 7hrs 22min. I realise the instruction was to do each DIMM separately but due to time constraints I need to use the computer today. I will do each DIMM separately after my trip away with work but until then can we temporarily exclude the RAM as I don't believe this is the problem?

So, although nothing is 100% foolproof I believe we can rule out (I have attached some screenshots):

Hard drives (passed check disk and SeaTools)
Viruses/malware (passed MSE scan, TDSSKiller scan and Malwarebytes scan)
RAM (passed memtest86+ with both DIMMs). I will confirm this for definite later in the week when I am able to try each DIMM separately but please for now leave this to one side.

Has anyone got any alternative ideas? Tom mentioned something about drivers, how could we find out more about this?

My only further comment is in the attached files you will see that there is one audio item in device manager with a yellow triangle next to it. I did previously try and fix this but to no avail. Since the crash always occurs with Windows Media Player playing music, could this be related?

I hope someone might be able to help! Thanks for all the suggestions and support so far.

Cheers,

Colin