Windows 7: Blue screen error: With various Error Code (Help pls)

fildoo · 05 Jul 2010

Hi folks,

Recently I built a new system and installed with Windows 7 64bit. Since then, I have been encountering various blue screen errors, after installing various software. However, at the basic (without installing any programs) it work fine.

PC Configuration:

Processor: AMD Phenom (TM) II X4 965 Processor 3.40GHZ
Graphic card: ATI HD 5850
RAM: OCZ DDR3 PC1333MHZ 2 GB Gold x 2
HDD: Samsung 1TB Sata2

Error Encounter today:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 1a
BCP1: 0000000000000403
BCP2: FFFFF68000010050
BCP3: B39000003C932867
BCP4: FFFFF6FC80614CCA
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1Not sure if anyone able to assist in this. Been troubleshooting it for a month. Thanks. I also attached the Dump files.

Davidxtux · 05 Jul 2010

Run chkdsk /r from an elevated command prompt. Also, run memtest to test your ram.

CarlTR6 · 05 Jul 2010

That is a lot of dumps, 28! I looked at the six most recent and saw five different error codes. A variety of error codes usually indicates hardware or hardware related problem.

Quote:

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

STOP 0x00000024: NTFS_FILE_SYSTEM

Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

Usual causes: System service, Device driver, graphics driver, ?memory

Look through the usual causes. These are what you will be troubleshooting. Davidxtux has started you on the right path. Follow his suggestions.

Quote:

CHKDSK /R /F:
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe"

Download a copy of Memtest86+ - Advanced Memory Diagnostic Tool and burn the ISO to a CD using http://isorecorder.alexfeinman.com/Windows 7.Boot from the CD, and leave it running for at least 5 passes.

Here are the dmp analyzes:

Code:

  Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-17050-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03251000 PsLoadedModuleList = 0xfffff800`0348ee50
Debug session time: Wed Jun 30 09:33:41.236 2010 (GMT-4)
System Uptime: 0 days 6:06:25.922
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 6b05c, 0, 11685c}

Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000006b05c, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000011685c, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800033512bc to fffff800032c1600

STACK_TEXT:  
fffff880`080dbb78 fffff800`033512bc : 00000000`0000004e 00000000`00000099 00000000`0006b05c 00000000`00000000 : nt!KeBugCheckEx
fffff880`080dbb80 fffff800`032ab994 : 00000000`00000000 fffffa80`0168bdf0 00000000`00002001 80000000`783f5882 : nt!MiBadShareCount+0x4c
fffff880`080dbbc0 fffff800`035b3203 : fffffa80`04552c10 00000000`00000000 fffffa80`04552c10 00000000`00002001 : nt!MiDeleteSegmentPages+0x404
fffff880`080dbc70 fffff800`032f4e5c : fffffa80`04552c00 00000000`00000000 fffffa80`04552c10 00000000`00000000 : nt!MiSegmentDelete+0x7b
fffff880`080dbcb0 fffff800`035db170 : fffffa80`05e5dbe0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0x26c
fffff880`080dbdd0 fffff800`035db57b : 00000000`00000000 00000000`053f0000 fffffa80`00000001 00000000`00000000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`080dbe90 fffff800`032c0853 : 00000000`0000570f fffff800`0343d480 fffffa80`03a029e0 fffffa80`03ce0720 : nt!NtUnmapViewOfSection+0x5f
fffff880`080dbee0 fffff800`032bcdf0 : fffff880`03e4577a 00000000`80000000 00000000`00000013 00000000`2a677641 : nt!KiSystemServiceCopyEnd+0x13
fffff880`080dc078 fffff880`03e4577a : 00000000`80000000 00000000`00000013 00000000`2a677641 00000000`00000001 : nt!KiServiceLinkage
fffff880`080dc080 00000000`80000000 : 00000000`00000013 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 : avgldx64+0x277a
fffff880`080dc088 00000000`00000013 : 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 : 0x80000000
fffff880`080dc090 00000000`2a677641 : 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 : 0x13
fffff880`080dc098 00000000`00000001 : fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 : 0x2a677641
fffff880`080dc0a0 fffff880`03e80fa0 : fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 : 0x1
fffff880`080dc0a8 fffff880`03e68eb5 : 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 : avgldx64+0x3dfa0
fffff880`080dc0b0 00000000`00000020 : fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 : avgldx64+0x25eb5
fffff880`080dc0b8 fffff8a0`08a0a0a8 : 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 : 0x20
fffff880`080dc0c0 00000000`000493e0 : fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 : 0xfffff8a0`08a0a0a8
fffff880`080dc0c8 fffff880`03e80fa0 : fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 00000000`00000000 : 0x493e0
fffff880`080dc0d0 fffff880`080dc4b0 : fffff880`080dc110 00000000`00000000 00000000`00000000 00000000`0000004c : avgldx64+0x3dfa0
fffff880`080dc0d8 fffff880`080dc110 : 00000000`00000000 00000000`00000000 00000000`0000004c fffff880`03e5cf49 : 0xfffff880`080dc4b0
fffff880`080dc0e0 00000000`00000000 : 00000000`00000000 00000000`0000004c fffff880`03e5cf49 00000000`00000000 : 0xfffff880`080dc110


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`033512bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------
 

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-29390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`0305ce50
Debug session time: Wed Jun 30 03:25:46.168 2010 (GMT-4)
System Uptime: 0 days 0:10:16.853
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002fc30bf, fffff8800998adf0, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002fc30bf, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800998adf0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10

CONTEXT:  fffff8800998adf0 -- (.cxr 0xfffff8800998adf0)
rax=0065006300720075 rbx=0000000000000000 rcx=fffffa8003965190
rdx=fffff8a00ccb8c50 rsi=0000000000000000 rdi=fffff8a00e356c00
rip=fffff80002fc30bf rsp=fffff8800998b7c0 rbp=0000000000000000
 r8=006f0073006f0072  r9=fffff8a00ccb93c0 r10=fffff8a00ccb93d0
r11=0000000000000001 r12=fffffa8003964500 r13=0000000000000000
r14=0000000000000003 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExDeferredFreePool+0x233:
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10 ds:002b:00650063`0072007d=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  avgchsva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002fc30bf

STACK_TEXT:  
fffff880`0998b7c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x233


FOLLOWUP_IP: 
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+233

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff8800998adf0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

Followup: Pool_corruption
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14617-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e52000 PsLoadedModuleList = 0xfffff800`0308fe50
Debug session time: Wed Jun 30 16:21:47.817 2010 (GMT-4)
System Uptime: 0 days 0:50:32.503
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88007ba8228, fffff88007ba7a90, fffff80002e7f217}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCachedRead+180 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007ba8228
Arg3: fffff88007ba7a90
Arg4: fffff80002e7f217

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88007ba8228 -- (.exr 0xfffff88007ba8228)
ExceptionAddress: fffff80002e7f217 (nt!MiInvalidateCollidedIos+0x0000000000000047)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88007ba7a90 -- (.cxr 0xfffff88007ba7a90)
rax=006100730070005c rbx=0000000000000000 rcx=fffffa80045277a0
rdx=0000000000000000 rsi=fffffa80045277a0 rdi=ffffffffffffffff
rip=fffff80002e7f217 rsp=fffff88007ba8460 rbp=fffffa80045277a0
 r8=003400360057004f  r9=fffffa8005527890 r10=fffffa80045277a0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000058000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MiInvalidateCollidedIos+0x47:
fffff800`02e7f217 4c8900          mov     qword ptr [rax],r8 ds:002b:00610073`0070005c=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fa0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCachedRead+180
fffff880`0125afc0 84c0            test    al,al

FAULTING_IP: 
nt!MiInvalidateCollidedIos+47
fffff800`02e7f217 4c8900          mov     qword ptr [rax],r8

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002eb3cf6 to fffff80002e7f217

STACK_TEXT:  
fffff880`07ba8460 fffff800`02eb3cf6 : 00000000`00000000 fffffa80`045277a0 00000000`00000000 fffffa80`06300800 : nt!MiInvalidateCollidedIos+0x47
fffff880`07ba84b0 fffff800`02f06c8c : fffffa80`045277a0 00000000`00000000 00000000`00000000 00000000`00000052 : nt!MiWaitForInPageComplete+0xa4a
fffff880`07ba8590 fffff800`031e090b : 00000000`00000000 00000000`00052c00 fffffa80`03cdef20 00000000`000fd4e0 : nt!CcFetchDataForRead+0x20c
fffff880`07ba85f0 fffff880`0125afc0 : fffff8a0`00000000 fffff880`00000005 fffffa80`0002d400 fffff880`012ae001 : nt!CcCopyRead+0x16b
fffff880`07ba86b0 fffff880`0125f303 : 00000000`00052c00 fffff8a0`0173f670 fffff880`07ba88e0 fffff880`07ba87d8 : Ntfs!NtfsCachedRead+0x180
fffff880`07ba8710 fffff880`01261f78 : fffffa80`059767e0 fffffa80`03dd2780 fffff880`07ba8801 fffffa80`05cfe900 : Ntfs!NtfsCommonRead+0x583
fffff880`07ba88b0 fffff880`0107a23f : fffffa80`03dd2b20 fffffa80`03dd2780 fffffa80`05cfe930 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`07ba8960 fffff880`010786df : fffffa80`04906de0 00000000`00000001 fffffa80`04906d00 fffffa80`03dd2780 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07ba89f0 fffff800`031d9c49 : 00000000`00000000 fffffa80`03cdef20 00000000`00000001 fffffa80`03dd2780 : fltmgr!FltpDispatch+0xcf
fffff880`07ba8a50 fffff800`031e1453 : fffffa80`03cdef20 fffffa80`03cdef20 fffffa80`03cdef20 fffff880`009e7180 : nt!IopSynchronousServiceTail+0xf9
fffff880`07ba8ac0 fffff800`02ec1853 : 00000000`0000016c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`07ba8bb0 00000000`74132dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001be5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74132dd9


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Ntfs!NtfsCachedRead+180

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88007ba7a90 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCachedRead+180

BUCKET_ID:  X64_0x24_Ntfs!NtfsCachedRead+180

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14820-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`03095e50
Debug session time: Wed Jun 30 15:30:44.737 2010 (GMT-4)
System Uptime: 0 days 0:38:50.048
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff880079caa8c, fffff880031c3eb8, fffff880031c3720}

Probably caused by : avgldx64.sys ( avgldx64+28a8c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880079caa8c, The address that the exception occurred at
Arg3: fffff880031c3eb8, Exception Record Address
Arg4: fffff880031c3720, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
avgldx64+28a8c
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4]

EXCEPTION_RECORD:  fffff880031c3eb8 -- (.exr 0xfffff880031c3eb8)
ExceptionAddress: fffff880079caa8c (avgldx64+0x0000000000028a8c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000063eb62c
Attempt to read from address 00000000063eb62c

CONTEXT:  fffff880031c3720 -- (.cxr 0xfffff880031c3720)
rax=00000000052b0008 rbx=fffff880079dffa0 rcx=000000000113b620
rdx=0000000000632440 rsi=000000000000002c rdi=0000000000003757
rip=fffff880079caa8c rsp=fffff880031c40f0 rbp=000000000063246c
 r8=0000000000000000  r9=0000000000000000 r10=305a28f2f699a73f
r11=0000000000000000 r12=00000000063eb628 r13=0000000000a4e4c4
r14=0000000000a87626 r15=000000000000002c
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
avgldx64+0x28a8c:
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4] ds:002b:00000000`063eb62c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000063eb62c

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031000e0
 00000000063eb62c 

FOLLOWUP_IP: 
avgldx64+28a8c
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff880079dffa0 to fffff880079caa8c

STACK_TEXT:  
fffff880`031c40f0 fffff880`079dffa0 : fffff880`079dffa0 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 : avgldx64+0x28a8c
fffff880`031c40f8 fffff880`079dffa0 : 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 00000000`00560723 : avgldx64+0x3dfa0
fffff880`031c4100 00000000`052b0008 : fffff8a0`07976018 00000000`052b0008 00000000`00560723 00152410`00000000 : avgldx64+0x3dfa0
fffff880`031c4108 fffff8a0`07976018 : 00000000`052b0008 00000000`00560723 00152410`00000000 00000000`052b0008 : 0x52b0008
fffff880`031c4110 00000000`052b0008 : 00000000`00560723 00152410`00000000 00000000`052b0008 00000000`00632440 : 0xfffff8a0`07976018
fffff880`031c4118 00000000`00560723 : 00152410`00000000 00000000`052b0008 00000000`00632440 00000000`05820008 : 0x52b0008
fffff880`031c4120 00152410`00000000 : 00000000`052b0008 00000000`00632440 00000000`05820008 00000000`057b77d8 : 0x560723
fffff880`031c4128 00000000`052b0008 : 00000000`00632440 00000000`05820008 00000000`057b77d8 00000000`00000000 : 0x152410`00000000
fffff880`031c4130 00000000`00632440 : 00000000`05820008 00000000`057b77d8 00000000`00000000 fffff880`031c4370 : 0x52b0008
fffff880`031c4138 00000000`05820008 : 00000000`057b77d8 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 : 0x632440
fffff880`031c4140 00000000`057b77d8 : 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 : 0x5820008
fffff880`031c4148 00000000`00000000 : fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 00000000`00000000 : 0x57b77d8


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  avgldx64+28a8c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: avgldx64

IMAGE_NAME:  avgldx64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b737eff

STACK_COMMAND:  .cxr 0xfffff880031c3720 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_avgldx64+28a8c

BUCKET_ID:  X64_0x7E_avgldx64+28a8c

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-19172-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e50000 PsLoadedModuleList = 0xfffff800`0308de50
Debug session time: Wed Jun 30 14:51:17.709 2010 (GMT-4)
System Uptime: 0 days 5:17:04.005
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, a8e67, 0, a9167}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000a8e67, page frame number
Arg3: 0000000000000000, current page state
Arg4: 00000000000a9167, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SearchFilterHo

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f502bc to fffff80002ec0600

STACK_TEXT:  
fffff880`07c11108 fffff800`02f502bc : 00000000`0000004e 00000000`00000099 00000000`000a8e67 00000000`00000000 : nt!KeBugCheckEx
fffff880`07c11110 fffff800`02f32937 : fffff880`02fd5180 fffff800`02ef4326 00000000`00000000 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`07c11150 fffff800`02e94b43 : fffffa80`03d47060 fffff700`000002c0 0000007f`fffffff8 fffff8a0`0326fc28 : nt! ?? ::FNODOBFM::`string'+0x3227e
fffff880`07c111e0 fffff800`02e935a2 : fffffa80`03d47060 fffffa80`0000006f 00000000`000000dd fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`07c11a90 fffff800`031a6c4f : fffff8a0`082269a0 00000000`00000001 00000000`00000000 fffffa80`03fc6340 : nt!MmCleanProcessAddressSpace+0x96
fffff880`07c11ae0 fffff800`0317e6eb : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`07c11ba0 fffff800`02ebf853 : fffffa80`03d47060 00000000`00000000 00000000`00153b01 fffffa80`03fc6340 : nt!NtTerminateProcess+0x25b
fffff880`07c11c20 00000000`775e017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000afd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775e017a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f502bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070510-17456-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e67000 PsLoadedModuleList = 0xfffff800`030a4e50
Debug session time: Mon Jul  5 03:12:30.128 2010 (GMT-4)
System Uptime: 0 days 0:31:45.813
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000010050, b39000003c932867, fffff6fc80614cca}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f32 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000010050
Arg3: b39000003c932867
Arg4: fffff6fc80614cca

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f49608 to fffff80002ed7600

STACK_TEXT:  
fffff880`0a4cb7b8 fffff800`02f49608 : 00000000`0000001a 00000000`00000403 fffff680`00010050 b3900000`3c932867 : nt!KeBugCheckEx
fffff880`0a4cb7c0 fffff800`02f08251 : 00000000`00000000 fffff680`00010440 fffffa80`063bdb30 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31f32
fffff880`0a4cb970 fffff800`02f18fca : 00000000`00000000 00000000`02088fff fffffa80`00000000 fffffa80`063bdb30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0a4cbb30 fffff800`02ed6853 : ffffffff`ffffffff 00000000`0302db90 00000000`0302db58 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0a4cbc20 00000000`76de009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0302dac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+31f32
fffff800`02f49608 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+31f32

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

Followup: MachineOwner
---------

Three of these dumps show that AVG antivirus was involved in the crash and one points to AVG as the direct cause. AVG is known to cause BSOD's on some Win 7 systems. I suggest you uninstall AVG using the uninstall tool > Info > Tool (32bit) - Tool (64 bit) Replace it with Microsoft Security Essentials while you are troubleshooting.

fildoo · 06 Jul 2010

Thnks, Carl n David. I just done chkdsk, and replaced avg with win essential. Then Im downloading the memtest, and I will keep u guys posted.

Alecto · 06 Jul 2010

I purchased a brand new HP laptop in February and bought Windows 7 separately. Constant BSOD. More than a dozen separate calls to the HP "Hotline" who told me it must be Windows 7 and to return the disk as it was obviously faulty. I uninstalled completely and took the disk back to the sellers who laughed and said sure, we'll swap for a brand new disk. I did so, reinstalled and sure enough BSOD. Almost always when I was using Word but sometimes even when I was just surfing the net. So I get really furious at HP; obviously I must have a faulty laptop. They make me do a total reset (lose everything returning to factory settings but sure, if it works I don't care). It's now fixed. Right up until I reinstall Windows 7. So I send the laptop back to HP and get a loaner laptop with Windows 7 preinstalled. It's a totally different brand - Lenovo Think Pad (as it was from the purchaser and not HP). BSOD.

So the only thing these two laptops have in common is Windows 7. I'm going to guess that something in Windows 7 is not compatible with hardware commonly found on laptops because every thread here is about uninstalling programs that I don't even have on this laptop. I get my old laptop back on Monday so I'm guessing I should go out and buy another type of software. Is there a version that has fewer BSODs than Windows 7? Windows 2005 maybe? I don't need to do anything very difficult, just save some PDFs and Word Documents. But the BSOD 3 and 4 times per night is beyond frustrating.

fildoo · 06 Jul 2010

Just as I was replying to the thread, my newly built system encountered another Bluescreen, with the following error:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7600.2.0.0.768.3
Locale ID: 1033

Additional information about the problem:
BCCode: 4e
BCP1: 0000000000000099
BCP2: 00000000000445D9
BCP3: 0000000000000000
BCP4: 00000000000446D9
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

JMH · 06 Jul 2010

Quote: Originally Posted by Alecto

I purchased a brand new HP laptop in February and bought Windows 7 separately. Constant BSOD. More than a dozen separate calls to the HP "Hotline" who told me it must be Windows 7 and to return the disk as it was obviously faulty. I uninstalled completely and took the disk back to the sellers who laughed and said sure, we'll swap for a brand new disk. I did so, reinstalled and sure enough BSOD. Almost always when I was using Word but sometimes even when I was just surfing the net. So I get really furious at HP; obviously I must have a faulty laptop. They make me do a total reset (lose everything returning to factory settings but sure, if it works I don't care). It's now fixed. Right up until I reinstall Windows 7. So I send the laptop back to HP and get a loaner laptop with Windows 7 preinstalled. It's a totally different brand - Lenovo Think Pad (as it was from the purchaser and not HP). BSOD.

So the only thing these two laptops have in common is Windows 7. I'm going to guess that something in Windows 7 is not compatible with hardware commonly found on laptops because every thread here is about uninstalling programs that I don't even have on this laptop. I get my old laptop back on Monday so I'm guessing I should go out and buy another type of software. Is there a version that has fewer BSODs than Windows 7? Windows 2005 maybe? I don't need to do anything very difficult, just save some PDFs and Word Documents. But the BSOD 3 and 4 times per night is beyond frustrating.

Hi Alecto & welcome,

As your comments & questions don't relate to what is going on here I suggest that you start your own thread seeking help.

Jan.

fildoo · 06 Jul 2010

Quote: Originally Posted by CarlTR6

That is a lot of dumps, 28! I looked at the six most recent and saw five different error codes. A variety of error codes usually indicates hardware or hardware related problem.

Quote:

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

STOP 0x0000004E: PFN_LIST_CORRUPT

Usual causes: Device driver, ?memory

STOP 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

STOP 0x00000024: NTFS_FILE_SYSTEM

Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure

STOP 0x0000003B: SYSTEM_SERVICE_EXCEPTION

Usual causes: System service, Device driver, graphics driver, ?memory

Look through the usual causes. These are what you will be troubleshooting. Davidxtux has started you on the right path. Follow his suggestions.

Quote:

CHKDSK /R /F:
Run CHKDSK /R /F from an elevated (Run as adminstrator) Command Prompt. Please do this for each hard drive on your system.
When it tells you it can't do it right now - and asks you if you'd like to do it at the next reboot - answer Y (for Yes) and press Enter. Then reboot and let the test run. It may take a while for it to run, but keep an occasional eye on it to see if it generates any errors. See "CHKDSK LogFile" below in order to check the results of the test.

Elevated Command Prompt:
Go to Start and type in "cmd.exe"

Download a copy of Memtest86+ - Advanced Memory Diagnostic Tool and burn the ISO to a CD using http://isorecorder.alexfeinman.com/Windows 7.Boot from the CD, and leave it running for at least 5 passes.

Here are the dmp analyzes:

Code:

  Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-17050-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`03251000 PsLoadedModuleList = 0xfffff800`0348ee50
Debug session time: Wed Jun 30 09:33:41.236 2010 (GMT-4)
System Uptime: 0 days 6:06:25.922
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 6b05c, 0, 11685c}

Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000006b05c, page frame number
Arg3: 0000000000000000, current page state
Arg4: 000000000011685c, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff800033512bc to fffff800032c1600

STACK_TEXT:  
fffff880`080dbb78 fffff800`033512bc : 00000000`0000004e 00000000`00000099 00000000`0006b05c 00000000`00000000 : nt!KeBugCheckEx
fffff880`080dbb80 fffff800`032ab994 : 00000000`00000000 fffffa80`0168bdf0 00000000`00002001 80000000`783f5882 : nt!MiBadShareCount+0x4c
fffff880`080dbbc0 fffff800`035b3203 : fffffa80`04552c10 00000000`00000000 fffffa80`04552c10 00000000`00002001 : nt!MiDeleteSegmentPages+0x404
fffff880`080dbc70 fffff800`032f4e5c : fffffa80`04552c00 00000000`00000000 fffffa80`04552c10 00000000`00000000 : nt!MiSegmentDelete+0x7b
fffff880`080dbcb0 fffff800`035db170 : fffffa80`05e5dbe0 0007ffff`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0x26c
fffff880`080dbdd0 fffff800`035db57b : 00000000`00000000 00000000`053f0000 fffffa80`00000001 00000000`00000000 : nt!MiUnmapViewOfSection+0x1b0
fffff880`080dbe90 fffff800`032c0853 : 00000000`0000570f fffff800`0343d480 fffffa80`03a029e0 fffffa80`03ce0720 : nt!NtUnmapViewOfSection+0x5f
fffff880`080dbee0 fffff800`032bcdf0 : fffff880`03e4577a 00000000`80000000 00000000`00000013 00000000`2a677641 : nt!KiSystemServiceCopyEnd+0x13
fffff880`080dc078 fffff880`03e4577a : 00000000`80000000 00000000`00000013 00000000`2a677641 00000000`00000001 : nt!KiServiceLinkage
fffff880`080dc080 00000000`80000000 : 00000000`00000013 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 : avgldx64+0x277a
fffff880`080dc088 00000000`00000013 : 00000000`2a677641 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 : 0x80000000
fffff880`080dc090 00000000`2a677641 : 00000000`00000001 fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 : 0x13
fffff880`080dc098 00000000`00000001 : fffff880`03e80fa0 fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 : 0x2a677641
fffff880`080dc0a0 fffff880`03e80fa0 : fffff880`03e68eb5 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 : 0x1
fffff880`080dc0a8 fffff880`03e68eb5 : 00000000`00000020 fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 : avgldx64+0x3dfa0
fffff880`080dc0b0 00000000`00000020 : fffff8a0`08a0a0a8 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 : avgldx64+0x25eb5
fffff880`080dc0b8 fffff8a0`08a0a0a8 : 00000000`000493e0 fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 : 0x20
fffff880`080dc0c0 00000000`000493e0 : fffff880`03e80fa0 fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 : 0xfffff8a0`08a0a0a8
fffff880`080dc0c8 fffff880`03e80fa0 : fffff880`080dc4b0 fffff880`080dc110 00000000`00000000 00000000`00000000 : 0x493e0
fffff880`080dc0d0 fffff880`080dc4b0 : fffff880`080dc110 00000000`00000000 00000000`00000000 00000000`0000004c : avgldx64+0x3dfa0
fffff880`080dc0d8 fffff880`080dc110 : 00000000`00000000 00000000`00000000 00000000`0000004c fffff880`03e5cf49 : 0xfffff880`080dc4b0
fffff880`080dc0e0 00000000`00000000 : 00000000`00000000 00000000`0000004c fffff880`03e5cf49 00000000`00000000 : 0xfffff880`080dc110


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`033512bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------
 

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\063010-29390-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e1f000 PsLoadedModuleList = 0xfffff800`0305ce50
Debug session time: Wed Jun 30 03:25:46.168 2010 (GMT-4)
System Uptime: 0 days 0:10:16.853
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002fc30bf, fffff8800998adf0, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+233 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002fc30bf, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800998adf0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10

CONTEXT:  fffff8800998adf0 -- (.cxr 0xfffff8800998adf0)
rax=0065006300720075 rbx=0000000000000000 rcx=fffffa8003965190
rdx=fffff8a00ccb8c50 rsi=0000000000000000 rdi=fffff8a00e356c00
rip=fffff80002fc30bf rsp=fffff8800998b7c0 rbp=0000000000000000
 r8=006f0073006f0072  r9=fffff8a00ccb93c0 r10=fffff8a00ccb93d0
r11=0000000000000001 r12=fffffa8003964500 r13=0000000000000000
r14=0000000000000003 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExDeferredFreePool+0x233:
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10 ds:002b:00650063`0072007d=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  avgchsva.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002fc30bf

STACK_TEXT:  
fffff880`0998b7c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x233


FOLLOWUP_IP: 
nt!ExDeferredFreePool+233
fffff800`02fc30bf 4c395008        cmp     qword ptr [rax+8],r10

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+233

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff8800998adf0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+233

Followup: Pool_corruption
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14617-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e52000 PsLoadedModuleList = 0xfffff800`0308fe50
Debug session time: Wed Jun 30 16:21:47.817 2010 (GMT-4)
System Uptime: 0 days 0:50:32.503
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88007ba8228, fffff88007ba7a90, fffff80002e7f217}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCachedRead+180 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007ba8228
Arg3: fffff88007ba7a90
Arg4: fffff80002e7f217

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88007ba8228 -- (.exr 0xfffff88007ba8228)
ExceptionAddress: fffff80002e7f217 (nt!MiInvalidateCollidedIos+0x0000000000000047)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88007ba7a90 -- (.cxr 0xfffff88007ba7a90)
rax=006100730070005c rbx=0000000000000000 rcx=fffffa80045277a0
rdx=0000000000000000 rsi=fffffa80045277a0 rdi=ffffffffffffffff
rip=fffff80002e7f217 rsp=fffff88007ba8460 rbp=fffffa80045277a0
 r8=003400360057004f  r9=fffffa8005527890 r10=fffffa80045277a0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000001
r14=0000000000000000 r15=0000058000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MiInvalidateCollidedIos+0x47:
fffff800`02e7f217 4c8900          mov     qword ptr [rax],r8 ds:002b:00610073`0070005c=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030fa0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCachedRead+180
fffff880`0125afc0 84c0            test    al,al

FAULTING_IP: 
nt!MiInvalidateCollidedIos+47
fffff800`02e7f217 4c8900          mov     qword ptr [rax],r8

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002eb3cf6 to fffff80002e7f217

STACK_TEXT:  
fffff880`07ba8460 fffff800`02eb3cf6 : 00000000`00000000 fffffa80`045277a0 00000000`00000000 fffffa80`06300800 : nt!MiInvalidateCollidedIos+0x47
fffff880`07ba84b0 fffff800`02f06c8c : fffffa80`045277a0 00000000`00000000 00000000`00000000 00000000`00000052 : nt!MiWaitForInPageComplete+0xa4a
fffff880`07ba8590 fffff800`031e090b : 00000000`00000000 00000000`00052c00 fffffa80`03cdef20 00000000`000fd4e0 : nt!CcFetchDataForRead+0x20c
fffff880`07ba85f0 fffff880`0125afc0 : fffff8a0`00000000 fffff880`00000005 fffffa80`0002d400 fffff880`012ae001 : nt!CcCopyRead+0x16b
fffff880`07ba86b0 fffff880`0125f303 : 00000000`00052c00 fffff8a0`0173f670 fffff880`07ba88e0 fffff880`07ba87d8 : Ntfs!NtfsCachedRead+0x180
fffff880`07ba8710 fffff880`01261f78 : fffffa80`059767e0 fffffa80`03dd2780 fffff880`07ba8801 fffffa80`05cfe900 : Ntfs!NtfsCommonRead+0x583
fffff880`07ba88b0 fffff880`0107a23f : fffffa80`03dd2b20 fffffa80`03dd2780 fffffa80`05cfe930 00000000`00000001 : Ntfs!NtfsFsdRead+0x1b8
fffff880`07ba8960 fffff880`010786df : fffffa80`04906de0 00000000`00000001 fffffa80`04906d00 fffffa80`03dd2780 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07ba89f0 fffff800`031d9c49 : 00000000`00000000 fffffa80`03cdef20 00000000`00000001 fffffa80`03dd2780 : fltmgr!FltpDispatch+0xcf
fffff880`07ba8a50 fffff800`031e1453 : fffffa80`03cdef20 fffffa80`03cdef20 fffffa80`03cdef20 fffff880`009e7180 : nt!IopSynchronousServiceTail+0xf9
fffff880`07ba8ac0 fffff800`02ec1853 : 00000000`0000016c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`07ba8bb0 00000000`74132dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`001be5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74132dd9


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Ntfs!NtfsCachedRead+180

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff88007ba7a90 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCachedRead+180

BUCKET_ID:  X64_0x24_Ntfs!NtfsCachedRead+180

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-14820-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e58000 PsLoadedModuleList = 0xfffff800`03095e50
Debug session time: Wed Jun 30 15:30:44.737 2010 (GMT-4)
System Uptime: 0 days 0:38:50.048
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
Unable to load image \SystemRoot\System32\Drivers\avgldx64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for avgldx64.sys
*** ERROR: Module load completed but symbols could not be loaded for avgldx64.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff880079caa8c, fffff880031c3eb8, fffff880031c3720}

Probably caused by : avgldx64.sys ( avgldx64+28a8c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880079caa8c, The address that the exception occurred at
Arg3: fffff880031c3eb8, Exception Record Address
Arg4: fffff880031c3720, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
avgldx64+28a8c
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4]

EXCEPTION_RECORD:  fffff880031c3eb8 -- (.exr 0xfffff880031c3eb8)
ExceptionAddress: fffff880079caa8c (avgldx64+0x0000000000028a8c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000063eb62c
Attempt to read from address 00000000063eb62c

CONTEXT:  fffff880031c3720 -- (.cxr 0xfffff880031c3720)
rax=00000000052b0008 rbx=fffff880079dffa0 rcx=000000000113b620
rdx=0000000000632440 rsi=000000000000002c rdi=0000000000003757
rip=fffff880079caa8c rsp=fffff880031c40f0 rbp=000000000063246c
 r8=0000000000000000  r9=0000000000000000 r10=305a28f2f699a73f
r11=0000000000000000 r12=00000000063eb628 r13=0000000000a4e4c4
r14=0000000000a87626 r15=000000000000002c
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
avgldx64+0x28a8c:
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4] ds:002b:00000000`063eb62c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  00000000063eb62c

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800031000e0
 00000000063eb62c 

FOLLOWUP_IP: 
avgldx64+28a8c
fffff880`079caa8c 458b442404      mov     r8d,dword ptr [r12+4]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff880079dffa0 to fffff880079caa8c

STACK_TEXT:  
fffff880`031c40f0 fffff880`079dffa0 : fffff880`079dffa0 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 : avgldx64+0x28a8c
fffff880`031c40f8 fffff880`079dffa0 : 00000000`052b0008 fffff8a0`07976018 00000000`052b0008 00000000`00560723 : avgldx64+0x3dfa0
fffff880`031c4100 00000000`052b0008 : fffff8a0`07976018 00000000`052b0008 00000000`00560723 00152410`00000000 : avgldx64+0x3dfa0
fffff880`031c4108 fffff8a0`07976018 : 00000000`052b0008 00000000`00560723 00152410`00000000 00000000`052b0008 : 0x52b0008
fffff880`031c4110 00000000`052b0008 : 00000000`00560723 00152410`00000000 00000000`052b0008 00000000`00632440 : 0xfffff8a0`07976018
fffff880`031c4118 00000000`00560723 : 00152410`00000000 00000000`052b0008 00000000`00632440 00000000`05820008 : 0x52b0008
fffff880`031c4120 00152410`00000000 : 00000000`052b0008 00000000`00632440 00000000`05820008 00000000`057b77d8 : 0x560723
fffff880`031c4128 00000000`052b0008 : 00000000`00632440 00000000`05820008 00000000`057b77d8 00000000`00000000 : 0x152410`00000000
fffff880`031c4130 00000000`00632440 : 00000000`05820008 00000000`057b77d8 00000000`00000000 fffff880`031c4370 : 0x52b0008
fffff880`031c4138 00000000`05820008 : 00000000`057b77d8 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 : 0x632440
fffff880`031c4140 00000000`057b77d8 : 00000000`00000000 fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 : 0x5820008
fffff880`031c4148 00000000`00000000 : fffff880`031c4370 fffff880`079c8ec9 00000000`00000000 00000000`00000000 : 0x57b77d8


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  avgldx64+28a8c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: avgldx64

IMAGE_NAME:  avgldx64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4b737eff

STACK_COMMAND:  .cxr 0xfffff880031c3720 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_avgldx64+28a8c

BUCKET_ID:  X64_0x7E_avgldx64+28a8c

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070110-19172-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e50000 PsLoadedModuleList = 0xfffff800`0308de50
Debug session time: Wed Jun 30 14:51:17.709 2010 (GMT-4)
System Uptime: 0 days 5:17:04.005
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, a8e67, 0, a9167}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 00000000000a8e67, page frame number
Arg3: 0000000000000000, current page state
Arg4: 00000000000a9167, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  SearchFilterHo

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002f502bc to fffff80002ec0600

STACK_TEXT:  
fffff880`07c11108 fffff800`02f502bc : 00000000`0000004e 00000000`00000099 00000000`000a8e67 00000000`00000000 : nt!KeBugCheckEx
fffff880`07c11110 fffff800`02f32937 : fffff880`02fd5180 fffff800`02ef4326 00000000`00000000 00000000`00000001 : nt!MiBadShareCount+0x4c
fffff880`07c11150 fffff800`02e94b43 : fffffa80`03d47060 fffff700`000002c0 0000007f`fffffff8 fffff8a0`0326fc28 : nt! ?? ::FNODOBFM::`string'+0x3227e
fffff880`07c111e0 fffff800`02e935a2 : fffffa80`03d47060 fffffa80`0000006f 00000000`000000dd fffff800`00000000 : nt!MiDeleteAddressesInWorkingSet+0x307
fffff880`07c11a90 fffff800`031a6c4f : fffff8a0`082269a0 00000000`00000001 00000000`00000000 fffffa80`03fc6340 : nt!MmCleanProcessAddressSpace+0x96
fffff880`07c11ae0 fffff800`0317e6eb : 00000000`00000000 00000000`00000001 000007ff`fffde000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`07c11ba0 fffff800`02ebf853 : fffffa80`03d47060 00000000`00000000 00000000`00153b01 fffffa80`03fc6340 : nt!NtTerminateProcess+0x25b
fffff880`07c11c20 00000000`775e017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000afd98 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x775e017a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02f502bc cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp2_Dump2.zip\070510-17456-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e67000 PsLoadedModuleList = 0xfffff800`030a4e50
Debug session time: Mon Jul  5 03:12:30.128 2010 (GMT-4)
System Uptime: 0 days 0:31:45.813
Loading Kernel Symbols
...............................................................
................................................................
....................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000010050, b39000003c932867, fffff6fc80614cca}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f32 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000010050
Arg3: b39000003c932867
Arg4: fffff6fc80614cca

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  audiodg.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002f49608 to fffff80002ed7600

STACK_TEXT:  
fffff880`0a4cb7b8 fffff800`02f49608 : 00000000`0000001a 00000000`00000403 fffff680`00010050 b3900000`3c932867 : nt!KeBugCheckEx
fffff880`0a4cb7c0 fffff800`02f08251 : 00000000`00000000 fffff680`00010440 fffffa80`063bdb30 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x31f32
fffff880`0a4cb970 fffff800`02f18fca : 00000000`00000000 00000000`02088fff fffffa80`00000000 fffffa80`063bdb30 : nt!MiDeleteVirtualAddresses+0x408
fffff880`0a4cbb30 fffff800`02ed6853 : ffffffff`ffffffff 00000000`0302db90 00000000`0302db58 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0a4cbc20 00000000`76de009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0302dac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76de009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+31f32
fffff800`02f49608 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+31f32

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

Followup: MachineOwner
---------

Three of these dumps show that AVG antivirus was involved in the crash and one points to AVG as the direct cause. AVG is known to cause BSOD's on some Win 7 systems. I suggest you uninstall AVG using the uninstall tool > Info > Tool (32bit) - Tool (64 bit) Replace it with Microsoft Security Essentials while you are troubleshooting.

Hi carl,

I had removed avg, and done memtest with 8 passes. Then soon after the memtest I encountered another BSOD. Here the attached miniDump, please advise what should i do?

CarlTR6 · 06 Jul 2010

I assume memtest showed no errors? This latest dump gives a stop error code of 1A.

Quote:

STOP 0x0000001A: MEMORY_MANAGEMENT

Usual causes: Device driver, memory, kernel

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_miniDump(4).zip\070610-14570-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02e03000 PsLoadedModuleList = 0xfffff800`03040e50
Debug session time: Tue Jul  6 10:49:41.350 2010 (GMT-4)
System Uptime: 0 days 0:22:28.020
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {403, fffff68000094050, e59000003c427867, fffff6fc001e2138}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+31f32 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000403, The subtype of the bugcheck.
Arg2: fffff68000094050
Arg3: e59000003c427867
Arg4: fffff6fc001e2138

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_403

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002ee5608 to fffff80002e73600

STACK_TEXT:  
fffff880`095d07b8 fffff800`02ee5608 : 00000000`0000001a 00000000`00000403 fffff680`00094050 e5900000`3c427867 : nt!KeBugCheckEx
fffff880`095d07c0 fffff800`02ea4251 : 00000000`00000000 fffff680`00094ff8 fffffa80`05abe2f0 00000000`00116001 : nt! ?? ::FNODOBFM::`string'+0x31f32
fffff880`095d0970 fffff800`02eb4fca : 00000000`00000000 00000000`12b41fff fffffa80`00000000 fffffa80`05abe2f0 : nt!MiDeleteVirtualAddresses+0x408
fffff880`095d0b30 fffff800`02e72853 : ffffffff`ffffffff 00000000`092cd6e0 00000000`092cd6a8 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`095d0c20 00000000`77b4009a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`092cd618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77b4009a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+31f32
fffff800`02ee5608 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+31f32

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

BUCKET_ID:  X64_0x1a_403_nt!_??_::FNODOBFM::_string_+31f32

Followup: MachineOwner
---------

To recap, you have run memtest and uninstalled AVG.

Did you run dskchk and SFC? If not, please run both of those. If SFC finds problems but does not fix some of them, run it again.

After you complete dskchk and SFC, turn on Driver Verifier.

Quote:

Follow these instructions for enabling driver verifier: Using Driver Verifier to identify issues with Drivers
Please follow these instructions in order to run it:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Windows 7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.

If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users

Driver verifier will most like cause a BSOD's; that is the way it works. Post any BSOD's ASAP.

fildoo · 06 Jul 2010

yea i done the memtest, and no error shown. Firstly, I uninstalled AVG, then chkdsk, following memtest with no error ( to confirm error with be shown as number right?). Since, all done. till now there 3 BSOD.

Windows 7: Blue screen error: With various Error Code (Help pls)

Blue screen error: With various Error Code (Help pls) problems?