WIndows 7 64-bit BSOD - help needed

Hi,

I have been struggeling with WIndows 7 crashing now and again for almost 6 months, and I am at my wits end - simply cannot find any more things to test.
I have tested the memory (memtest), the harddrives, upgraded all drivers to latest version - but to no avail - windows still crashes randomly - and apparently the things causing it is also random (ref the blue screen information). Have attached the lastes 10 minidumps, and hope somebody can help me.

Cheers
Henrik

I'm having similar troubles, but it appears yours may be more straight forward. Here is the analysis of one of your dump files:

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Josh\Household\PC Build\Troubleshooting\021610-28626-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c07000 PsLoadedModuleList = 0xfffff800`02e44e50
Debug session time: Mon Feb 15 15:33:21.616 2010 (GMT-6)
System Uptime: 0 days 2:29:42.005
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1f, 2, 1, fffff8800433c7e4}

Probably caused by : usbehci.sys ( usbehci!EHCI_sMode_Transfer+2c8 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001f, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800433c7e4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eaf0e0
 000000000000001f 

CURRENT_IRQL:  2

FAULTING_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c6a0 -- (.trap 0xfffff80000b9c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000001f rbx=0000000000000000 rcx=fffffa80042df5a0
rdx=000000004f444648 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800433c7e4 rsp=fffff80000b9c830 rbp=fffffa80042b26a0
 r8=000000004f444648  r9=000000000000001f r10=0000000000000001
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
usbehci!EHCI_sMode_Transfer+0x2c8:
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h] ds:1c98:00000000`00000014=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c78469 to fffff80002c78f00

STACK_TEXT:  
fffff800`00b9c558 fffff800`02c78469 : 00000000`0000000a 00000000`0000001f 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c560 fffff800`02c770e0 : 00000000`00000000 fffffa80`04c9cdc0 fffff800`02c60ab4 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6a0 fffff880`0433c7e4 : 00000000`00000000 fffffa80`00000200 fffffa80`05dbc080 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c830 fffff880`04340e24 : fffffa80`03036bd8 00000000`0000001f fffff880`00000001 00000000`00000080 : usbehci!EHCI_sMode_Transfer+0x2c8
fffff800`00b9c8c0 fffff880`042e1f3c : 00000000`00000002 fffffa80`04c9ca10 00000000`00000005 fffffa80`042b1050 : usbehci!EHCI_SubmitTransfer+0xbc
fffff800`00b9c900 fffff880`042e69f8 : 00000000`00000000 00000000`00000004 fffffa80`04c9ca10 fffffa80`04c98d88 : USBPORT!MPf_SubmitTransfer+0x84
fffff800`00b9c950 fffff880`042f491d : fffffa80`042b11a0 00000000`00000000 00000000`00000010 fffffa80`03036840 : USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x808
fffff800`00b9c9b0 fffff880`042f408e : fffffa80`030196f0 fffffa80`03036840 00000000`00000000 fffffa80`206c6148 : USBPORT!USBPORT_Core_iSubmitTransferToMiniport+0x115
fffff800`00b9ca40 fffff800`031e862f : 00000000`00000000 00000000`0000001f 00000000`00000002 00000000`cd847d07 : USBPORT!USBPORT_Core_ProcessScatterGatherList+0x5b2
fffff800`00b9caf0 fffff800`031e8420 : fffffa80`042b1050 00000000`0000001f fffffa80`00000028 fffff880`042f5dd7 : hal!HalBuildScatterGatherList+0x203
fffff800`00b9cb60 fffff880`042f452e : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d20 fffffa80`03036840 : hal!HalGetScatterGatherList+0x44
fffff800`00b9cbc0 fffff880`042f1e86 : fffffa80`04c47c48 fffffa80`042b1050 fffff800`031e83dc fffffa80`042b11a0 : USBPORT!USBPORT_Core_iMapTransfer+0x24a
fffff800`00b9cc40 fffff880`042e2f89 : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d02 fffffa80`042b1d20 : USBPORT!USBPORT_Core_UsbMapDpc_Worker+0x296
fffff800`00b9cca0 fffff800`02c845dc : fffff800`02df1e80 fffffa80`042b1d20 fffffa80`042b1d38 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff800`00b9ccd0 fffff800`02c816fa : fffff800`02df1e80 fffff800`02dffc40 00000000`00000000 fffff880`042e2db0 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbehci!EHCI_sMode_Transfer+2c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbehci

IMAGE_NAME:  usbehci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bcc06

FAILURE_BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001f, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800433c7e4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  000000000000001f 

CURRENT_IRQL:  2

FAULTING_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c6a0 -- (.trap 0xfffff80000b9c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000001f rbx=0000000000000000 rcx=fffffa80042df5a0
rdx=000000004f444648 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800433c7e4 rsp=fffff80000b9c830 rbp=fffffa80042b26a0
 r8=000000004f444648  r9=000000000000001f r10=0000000000000001
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
usbehci!EHCI_sMode_Transfer+0x2c8:
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h] ds:1c98:00000000`00000014=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c78469 to fffff80002c78f00

STACK_TEXT:  
fffff800`00b9c558 fffff800`02c78469 : 00000000`0000000a 00000000`0000001f 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c560 fffff800`02c770e0 : 00000000`00000000 fffffa80`04c9cdc0 fffff800`02c60ab4 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6a0 fffff880`0433c7e4 : 00000000`00000000 fffffa80`00000200 fffffa80`05dbc080 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c830 fffff880`04340e24 : fffffa80`03036bd8 00000000`0000001f fffff880`00000001 00000000`00000080 : usbehci!EHCI_sMode_Transfer+0x2c8
fffff800`00b9c8c0 fffff880`042e1f3c : 00000000`00000002 fffffa80`04c9ca10 00000000`00000005 fffffa80`042b1050 : usbehci!EHCI_SubmitTransfer+0xbc
fffff800`00b9c900 fffff880`042e69f8 : 00000000`00000000 00000000`00000004 fffffa80`04c9ca10 fffffa80`04c98d88 : USBPORT!MPf_SubmitTransfer+0x84
fffff800`00b9c950 fffff880`042f491d : fffffa80`042b11a0 00000000`00000000 00000000`00000010 fffffa80`03036840 : USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x808
fffff800`00b9c9b0 fffff880`042f408e : fffffa80`030196f0 fffffa80`03036840 00000000`00000000 fffffa80`206c6148 : USBPORT!USBPORT_Core_iSubmitTransferToMiniport+0x115
fffff800`00b9ca40 fffff800`031e862f : 00000000`00000000 00000000`0000001f 00000000`00000002 00000000`cd847d07 : USBPORT!USBPORT_Core_ProcessScatterGatherList+0x5b2
fffff800`00b9caf0 fffff800`031e8420 : fffffa80`042b1050 00000000`0000001f fffffa80`00000028 fffff880`042f5dd7 : hal!HalBuildScatterGatherList+0x203
fffff800`00b9cb60 fffff880`042f452e : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d20 fffffa80`03036840 : hal!HalGetScatterGatherList+0x44
fffff800`00b9cbc0 fffff880`042f1e86 : fffffa80`04c47c48 fffffa80`042b1050 fffff800`031e83dc fffffa80`042b11a0 : USBPORT!USBPORT_Core_iMapTransfer+0x24a
fffff800`00b9cc40 fffff880`042e2f89 : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d02 fffffa80`042b1d20 : USBPORT!USBPORT_Core_UsbMapDpc_Worker+0x296
fffff800`00b9cca0 fffff800`02c845dc : fffff800`02df1e80 fffffa80`042b1d20 fffffa80`042b1d38 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff800`00b9ccd0 fffff800`02c816fa : fffff800`02df1e80 fffff800`02dffc40 00000000`00000000 fffff880`042e2db0 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbehci!EHCI_sMode_Transfer+2c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbehci

IMAGE_NAME:  usbehci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bcc06

FAILURE_BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001f, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff8800433c7e4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  000000000000001f 

CURRENT_IRQL:  2

FAULTING_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff80000b9c6a0 -- (.trap 0xfffff80000b9c6a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000001f rbx=0000000000000000 rcx=fffffa80042df5a0
rdx=000000004f444648 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800433c7e4 rsp=fffff80000b9c830 rbp=fffffa80042b26a0
 r8=000000004f444648  r9=000000000000001f r10=0000000000000001
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
usbehci!EHCI_sMode_Transfer+0x2c8:
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h] ds:1c98:00000000`00000014=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c78469 to fffff80002c78f00

STACK_TEXT:  
fffff800`00b9c558 fffff800`02c78469 : 00000000`0000000a 00000000`0000001f 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9c560 fffff800`02c770e0 : 00000000`00000000 fffffa80`04c9cdc0 fffff800`02c60ab4 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff800`00b9c6a0 fffff880`0433c7e4 : 00000000`00000000 fffffa80`00000200 fffffa80`05dbc080 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9c830 fffff880`04340e24 : fffffa80`03036bd8 00000000`0000001f fffff880`00000001 00000000`00000080 : usbehci!EHCI_sMode_Transfer+0x2c8
fffff800`00b9c8c0 fffff880`042e1f3c : 00000000`00000002 fffffa80`04c9ca10 00000000`00000005 fffffa80`042b1050 : usbehci!EHCI_SubmitTransfer+0xbc
fffff800`00b9c900 fffff880`042e69f8 : 00000000`00000000 00000000`00000004 fffffa80`04c9ca10 fffffa80`04c98d88 : USBPORT!MPf_SubmitTransfer+0x84
fffff800`00b9c950 fffff880`042f491d : fffffa80`042b11a0 00000000`00000000 00000000`00000010 fffffa80`03036840 : USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x808
fffff800`00b9c9b0 fffff880`042f408e : fffffa80`030196f0 fffffa80`03036840 00000000`00000000 fffffa80`206c6148 : USBPORT!USBPORT_Core_iSubmitTransferToMiniport+0x115
fffff800`00b9ca40 fffff800`031e862f : 00000000`00000000 00000000`0000001f 00000000`00000002 00000000`cd847d07 : USBPORT!USBPORT_Core_ProcessScatterGatherList+0x5b2
fffff800`00b9caf0 fffff800`031e8420 : fffffa80`042b1050 00000000`0000001f fffffa80`00000028 fffff880`042f5dd7 : hal!HalBuildScatterGatherList+0x203
fffff800`00b9cb60 fffff880`042f452e : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d20 fffffa80`03036840 : hal!HalGetScatterGatherList+0x44
fffff800`00b9cbc0 fffff880`042f1e86 : fffffa80`04c47c48 fffffa80`042b1050 fffff800`031e83dc fffffa80`042b11a0 : USBPORT!USBPORT_Core_iMapTransfer+0x24a
fffff800`00b9cc40 fffff880`042e2f89 : fffffa80`042b1050 00000000`00000000 fffffa80`042b1d02 fffffa80`042b1d20 : USBPORT!USBPORT_Core_UsbMapDpc_Worker+0x296
fffff800`00b9cca0 fffff800`02c845dc : fffff800`02df1e80 fffffa80`042b1d20 fffffa80`042b1d38 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff800`00b9ccd0 fffff800`02c816fa : fffff800`02df1e80 fffff800`02dffc40 00000000`00000000 fffff880`042e2db0 : nt!KiRetireDpcList+0x1bc
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbehci!EHCI_sMode_Transfer+2c8
fffff880`0433c7e4 448b4e14        mov     r9d,dword ptr [rsi+14h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbehci!EHCI_sMode_Transfer+2c8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbehci

IMAGE_NAME:  usbehci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bcc06

FAILURE_BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

BUCKET_ID:  X64_0xD1_usbehci!EHCI_sMode_Transfer+2c8

Followup: MachineOwner
---------

0: kd> lmvm usbehci
start             end                 module name
fffff880`04336000 fffff880`04347000   usbehci    (pdb symbols)          c:\websymbols\usbehci.pdb\85DFE88B18374AE5BC1F292492C09CAA1\usbehci.pdb
    Loaded symbol image file: usbehci.sys
    Mapped memory image file: c:\websymbols\usbehci.sys\4A5BCC0611000\usbehci.sys
    Image path: \SystemRoot\system32\DRIVERS\usbehci.sys
    Image name: usbehci.sys
    Timestamp:        Mon Jul 13 19:06:30 2009 (4A5BCC06)
    CheckSum:         000105CD
    ImageSize:        00011000
    File version:     6.1.7600.16385
    Product version:  6.1.7600.16385
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     USBEHCI.sys
    OriginalFilename: USBEHCI.sys
    ProductVersion:   6.1.7600.16385
    FileVersion:      6.1.7600.16385 (win7_rtm.090713-1255)
    FileDescription:  EHCI eUSB Miniport Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Looks like an issue with your EHCI eUSB Miniport Driver. See if you can update this driver or check your USB devices and the connectivity to your motherboard. See if that helps.

Good luck!

Henrik,

Looks like I replied too soon after only looking at one dmp file. Sorry for that.

Have you tried updating your BIOS? If so, I wonder if you have a defective motherboard possibly.

Have updated following

ASACPI.sys - updated to latest
pcouffin.sys Removed
wacommousefilter.sys - this is the latest driver available
3xHybr64.sys - updated to latest driver
PxHlpa64.sys These are showing under the dvd drives in the device manager - can't seem to find whatever program installed them (other than windows) - tried to remove - but windows keeps installing them again.

And unfortunately am still having BSODs - have attached the latest two.

Brgds
Henrik

I will try and disable my wacom tablet for awhile - to see if this helps.

It was actually memtest86+ that I had been running, but will try your suggestions with only on ram block to see if it helps.

The strange thing though, is that I do not get BSODs in Vista on the same machine....

Well, am certainly not improving. Experienced 6 BSODs with relative short timespan this evening (attached). Wondered about the last one saying it was NTFS.SYS - and error was "attempting to write to read only memory"??

hso said:

Well, am certainly not improving. Experienced 6 BSODs with relative short timespan this evening (attached). Wondered about the last one saying it was NTFS.SYS - and error was "attempting to write to read only memory"??

Its still hardware. Given the various sources I suspect memory.

I would
download memtestx86 and rub for 5 passes
run a system file check
(rype cmd in seearch>right click and run as admin>sfc /scannow)

and if you are overclocking stop

Let us know the results


Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\New folder\021710-29811-01 - Copy.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02c09000 PsLoadedModuleList = 0xfffff800`02e46e50
Debug session time: Wed Feb 17 12:21:01.693 2010 (GMT-5)
System Uptime: 0 days 22:10:04.488
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800836c958, fffff8800836c1b0, fffff80002f8c244}

Probably caused by : hardware ( Ntfs!NtfsReportDirNotify+e5 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800836c958
Arg3: fffff8800836c1b0
Arg4: fffff80002f8c244

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800836c958 -- (.exr 0xfffff8800836c958)
ExceptionAddress: fffff80002f8c244 (nt!FsRtlNotifyFilterReportChange+0x0000000000000288)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000000
Attempt to write to address 0000000000000000

CONTEXT:  fffff8800836c1b0 -- (.cxr 0xfffff8800836c1b0)
rax=0000000000000000 rbx=0000000038454531 rcx=fffff8a003b781d6
rdx=00000000052d98d0 rsi=fffff8a0087017f0 rdi=0000000000000000
rip=fffff80002f8c244 rsp=fffff8800836cb90 rbp=fffffa8003a25c10
 r8=0000000000000001  r9=fffff8a00d645e70 r10=fffffa800392e100
r11=0000000000000010 r12=fffff8a003ac1dd8 r13=fffffa80036f4820
r14=0000000000000036 r15=0000000000000001
iopl=0         ov up ei ng zr na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00254ac2
nt!FsRtlNotifyFilterReportChange+0x288:
fffff800`02f8c244 4c2454          and     al,54h
Resetting default scope

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  iTunes.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000000

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb10e0
 0000000000000000 

FOLLOWUP_IP: 
Ntfs!NtfsReportDirNotify+e5
fffff880`01248bf9 eb8d            jmp     Ntfs!NtfsReportDirNotify+0x74 (fffff880`01248b88)

FAULTING_IP: 
nt!FsRtlNotifyFilterReportChange+288
fffff800`02f8c244 4c2454          and     al,54h

BUGCHECK_STR:  0x24

MISALIGNED_IP: 
nt!FsRtlNotifyFilterReportChange+288
fffff800`02f8c244 4c2454          and     al,54h

LAST_CONTROL_TRANSFER:  from fffff88001248bf9 to fffff80002f8c244

STACK_TEXT:  
fffff880`0836cb90 fffff880`01248bf9 : fffffa80`036f4820 fffffa80`0392e6a8 fffff8a0`0d645e70 fffff8a0`00130036 : nt!FsRtlNotifyFilterReportChange+0x288
fffff880`0836ccd0 fffff880`012f2a35 : fffff8a0`00000000 fffff8a0`0d645b40 fffffa80`056636b0 fffff8a0`0d645e70 : Ntfs!NtfsReportDirNotify+0xe5
fffff880`0836cda0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsCreateNewFile+0xb55


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsReportDirNotify+e5

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff8800836c1b0 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------

causes

Code:

021710-26660-01 - Copy.dmp    2/17/2010 7:34:12 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    ffffffff`bfff8280    00000000`0000000b    00000000`00000001    fffff880`04f6f657    dxgmms1.sys    dxgmms1.sys+10657    x64    
021710-31434-01 - Copy.dmp    2/17/2010 7:40:52 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    00000000`00000166    00000000`00000002    00000000`00000001    fffff880`0460a442    dxgmms1.sys    dxgmms1.sys+a442    x64    
021710-30279-01 - Copy.dmp    2/17/2010 7:52:54 PM    DRIVER_IRQL_NOT_LESS_OR_EQUAL    0x000000d1    ffffffff`ffffffd4    00000000`00000002    00000000`00000000    fffff880`049d7652    mouclass.sys    mouclass.sys+1652    x64    
021710-24804-01 - Copy.dmp    2/17/2010 8:06:46 PM    ATTEMPTED_WRITE_TO_READONLY_MEMORY    0x000000be    fffff8a0`06f175ba    80000000`cd080101    fffff880`08ee34b0    00000000`0000000b    Ntfs.sys    Ntfs.sys+ba8cd    x64    
021710-29811-01 - Copy.dmp    2/17/2010 6:23:02 PM    NTFS_FILE_SYSTEM    0x00000024    00000000`001904fb    fffff880`0836c958    fffff880`0836c1b0    fffff800`02f8c244    Ntfs.sys    Ntfs.sys+213d8    x64

Ok, here's what I've done.
Figured that a new version of memtest86+ was available, compared to the one I used before.
I ran a memtest86+ (version 4.00) overnight = 20 passes. After 8 it found 5 errors.
I replaced the ram with some new ram - and ran the test again (9 passes) - no errors found.
Booted up the computer, and after aprox 45 minutes experienced my first BSOD - dump included.
any ideas?