It still looks a whole lot like bad RAM to me.
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Jonathan\Desktop\030910-54943-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5d000 PsLoadedModuleList = 0xfffff800`02c9ae50
Debug session time: Mon Mar 8 19:03:39.594 2010 (GMT-5)
System Uptime: 0 days 22:18:44.607
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff88006cb7468, fffff88006cb6cc0, fffff88001233e71}
Probably caused by : Ntfs.sys ( Ntfs!NtfsTeardownFromLcb+f1 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88006cb7468
Arg3: fffff88006cb6cc0
Arg4: fffff88001233e71
Debugging Details:
------------------
EXCEPTION_RECORD: fffff88006cb7468 -- (.exr 0xfffff88006cb7468)
ExceptionAddress: fffff88001233e71 (Ntfs!NtfsTeardownFromLcb+0x00000000000000f1)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff88006cb6cc0 -- (.cxr 0xfffff88006cb6cc0)
rax=000000000000fffb rbx=fffff8a00e8cb5c0 rcx=0000000000000000
rdx=fffffa8003fb47f0 rsi=fffff88006cb7701 rdi=fffff8a015b504d0
rip=fffff88001233e71 rsp=fffff88006cb76a0 rbp=fffff88006cb7a80
r8=0000000000000000 r9=0000000000000000 r10=fffff80002a5d000
r11=fffff88006cb7670 r12=fffff8a00e8cb5c0 r13=fffdf8a00a06e7c0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
Ntfs!NtfsTeardownFromLcb+0xf1:
fffff880`01233e71 498b4d30 mov rcx,qword ptr [r13+30h] ds:002b:fffdf8a0`0a06e7f0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: VSSVC.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d050e0
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsTeardownFromLcb+f1
fffff880`01233e71 498b4d30 mov rcx,qword ptr [r13+30h]
FAULTING_IP:
Ntfs!NtfsTeardownFromLcb+f1
fffff880`01233e71 498b4d30 mov rcx,qword ptr [r13+30h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from fffff880012be400 to fffff88001233e71
STACK_TEXT:
fffff880`06cb76a0 fffff880`012be400 : fffffa80`03dbc010 fffffa80`04733180 fffff8a0`0e8cb5c0 fffff8a0`15b504d0 : Ntfs!NtfsTeardownFromLcb+0xf1
fffff880`06cb7730 fffff880`012a5c50 : fffffa80`03dbc010 00000000`00000000 00000000`00000001 fffffa80`03dbc000 : Ntfs!NtfsTeardownStructures+0x200
fffff880`06cb77b0 fffff880`012f6bbd : fffffa80`03dbc010 fffffa80`04733180 00000000`00000001 0000000f`ffffff00 : Ntfs!NtfsFlushVolume+0x530
fffff880`06cb78e0 fffff880`012f75f0 : fffffa80`03dbc010 fffffa80`08b2b010 fffffa80`0482a5d0 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`06cb79c0 fffff880`0107823f : fffffa80`08b2b3b0 fffffa80`08b2b010 fffffa80`03dbc010 fffff880`06cb79e8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`06cb7a30 fffff880`010766df : fffffa80`047633e0 00000000`00000000 fffffa80`04763300 fffffa80`08b2b010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`06cb7ac0 fffff800`02de2929 : 00000000`00000002 fffffa80`0482a5d0 00000000`00000000 fffffa80`08b2b010 : fltmgr!FltpDispatch+0xcf
fffff880`06cb7b20 fffff800`02d708ad : fffffa80`08b2b010 fffffa80`03fb47f0 fffffa80`0482a5d0 fffff880`02fd3180 : nt!IopSynchronousServiceTail+0xf9
fffff880`06cb7b90 fffff800`02ace153 : fffffa80`03fb47f0 00000000`ff712270 fffffa80`047633e0 fffffa80`0482a5d0 : nt!NtFlushBuffersFile+0x171
fffff880`06cb7c20 00000000`777c036a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02e3f778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777c036a
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsTeardownFromLcb+f1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff88006cb6cc0 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsTeardownFromLcb+f1
BUCKET_ID: X64_0x24_Ntfs!NtfsTeardownFromLcb+f1
Followup: MachineOwner
---------
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Jonathan\Desktop\030810-46035-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c4ae50
Debug session time: Sun Mar 7 17:27:58.002 2010 (GMT-5)
System Uptime: 2 days 15:56:53.015
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002d63d9c, 0, ffffffffffffffff}
Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002d63d9c, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiApplyCompressedFixups+40
fffff800`02d63d9c 0fb603 movzx eax,byte ptr [rbx]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb50e0
ffffffffffffffff
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002abea17 to fffff80002a7ef00
STACK_TEXT:
fffff880`084e4758 fffff800`02abea17 : 00000000`0000001e ffffffff`c0000005 fffff800`02d63d9c 00000000`00000000 : nt!KeBugCheckEx
fffff880`084e4760 fffff800`02a7e542 : fffff880`084e4f38 ffbff8a0`08fc9260 fffff880`084e4fe0 ffffffff`fec90000 : nt! ?? ::FNODOBFM::`string'+0x460da
fffff880`084e4e00 fffff800`02a7ce4a : 00000000`00000000 fffff8a0`08fc9000 fffffa80`00000000 00001f80`010111d0 : nt!KiExceptionDispatch+0xc2
fffff880`084e4fe0 fffff800`02d63d9c : fffffa80`065307b0 fffff8a0`08f87000 fffff8a0`08f87000 ffffffff`fec90000 : nt!KiGeneralProtectionFault+0x10a
fffff880`084e5170 fffff800`02d63c15 : fffff880`021c4000 ffffffff`fec90000 00000000`00161000 fffffa80`00a855e0 : nt!MiApplyCompressedFixups+0x40
fffff880`084e51c0 fffff800`02d5117c : 00000000`00000000 00000000`00000000 fffff6fc`40070e78 fffff800`00000000 : nt!MiPerformFixups+0x65
fffff880`084e5210 fffff800`02a60eed : 00000000`000381ca 00000000`00000161 fffff8a0`08f87b50 00000000`00000002 : nt!MiRelocateImagePfn+0x114
fffff880`084e5270 fffff800`02d63b71 : fffffa80`03df9490 fffff6fc`40070e78 fffff8a0`00000002 00000000`00000000 : nt!MiValidateImagePages+0x2bd
fffff880`084e5310 fffff800`02d63280 : ffffffff`ffffffff 00000000`00000001 fffff8a0`08fc2000 00000000`0000008f : nt!MiSwitchBaseAddress+0x61
fffff880`084e5340 fffff800`02d770ae : 00000000`00000004 00000000`01000000 00000000`00000000 00000000`00000000 : nt!MiRelocateImageAgain+0x100
fffff880`084e5390 fffff800`02d6c893 : fffff880`084e55f0 00000000`00000000 fffff880`084e5698 fffff880`084e55e8 : nt!MmCreateSection+0x302
fffff880`084e55a0 fffff800`02edb573 : 00000000`00000000 fffff8a0`0caba1e8 00000000`00000000 00000000`00000001 : nt!NtCreateSection+0x162
fffff880`084e5620 fffff800`02edbb01 : 00000000`00000000 fffff8a0`0caba1e8 fffffa80`0715b410 fffff880`00000060 : nt!PfpFileBuildReadSupport+0x163
fffff880`084e5710 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!PfpPrefetchFilesTrickle+0x121
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiApplyCompressedFixups+40
fffff800`02d63d9c 0fb603 movzx eax,byte ptr [rbx]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!MiApplyCompressedFixups+40
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
Followup: MachineOwner
---------