All three dumps are near identical with a stop error code of 1 and all three blame ehrecvr.exe which is a process belonging to the Microsoft Media Center.
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_081510-21450-01.zip\081510-20982-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e15000 PsLoadedModuleList = 0xfffff800`03052e50
Debug session time: Sun Aug 15 07:36:21.072 2010 (GMT-4)
System Uptime: 0 days 0:06:57.586
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {7741ff2a, 0, fffd, fffff88006b5dca0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 000000007741ff2a, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000fffd, Thread->KernelApcDisable
Arg4: fffff88006b5dca0, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
+5e62952f01f6dcb0
00000000`7741ff2a ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: ehrecvr.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e86469 to fffff80002e86f00
STACK_TEXT:
fffff880`06b5da68 fffff800`02e86469 : 00000000`00000001 00000000`7741ff2a 00000000`00000000 00000000`0000fffd : nt!KeBugCheckEx
fffff880`06b5da70 fffff800`02e863a0 : fffffa80`03ca69e0 00000000`0181e258 fffff880`06b5dbc8 00000000`0000049c : nt!KiBugCheckDispatch+0x69
fffff880`06b5dbb0 00000000`7741ff2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`0181e208 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7741ff2a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`02e863a0 4883ec50 sub rsp,50h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_081510-21450-01.zip\081510-21450-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02e0d000 PsLoadedModuleList = 0xfffff800`0304ae50
Debug session time: Sun Aug 15 07:28:27.975 2010 (GMT-4)
System Uptime: 0 days 0:02:02.488
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {77c2ff2a, 0, fffd, fffff88008dadca0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 0000000077c2ff2a, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000fffd, Thread->KernelApcDisable
Arg4: fffff88008dadca0, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
+5e62952f0197daf4
00000000`77c2ff2a ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: ehrecvr.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e7e469 to fffff80002e7ef00
STACK_TEXT:
fffff880`08dada68 fffff800`02e7e469 : 00000000`00000001 00000000`77c2ff2a 00000000`00000000 00000000`0000fffd : nt!KeBugCheckEx
fffff880`08dada70 fffff800`02e7e3a0 : fffffa80`06383960 00000000`01e9e2d8 fffff880`08dadbc8 00000000`00000470 : nt!KiBugCheckDispatch+0x69
fffff880`08dadbb0 00000000`77c2ff2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`01e9e288 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77c2ff2a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`02e7e3a0 4883ec50 sub rsp,50h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
FAILURE_BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_081510-21450-01.zip\081710-24258-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02e1c000 PsLoadedModuleList = 0xfffff800`03059e50
Debug session time: Mon Aug 16 19:24:22.601 2010 (GMT-4)
System Uptime: 0 days 4:08:37.989
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1, {76f9ff2a, 0, fffd, fffff880072ddca0}
Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 0000000076f9ff2a, address of system function (system call)
Arg2: 0000000000000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 000000000000fffd, Thread->KernelApcDisable
Arg4: fffff880072ddca0, Previous KernelApcDisable
Debugging Details:
------------------
FAULTING_IP:
+5e62952f01abdf9c
00000000`76f9ff2a ?? ???
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: ehrecvr.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002e8bca9 to fffff80002e8c740
STACK_TEXT:
fffff880`072dda68 fffff800`02e8bca9 : 00000000`00000001 00000000`76f9ff2a 00000000`00000000 00000000`0000fffd : nt!KeBugCheckEx
fffff880`072dda70 fffff800`02e8bbe0 : fffffa80`0610fb60 00000000`0145e9a8 fffff880`072ddbc8 00000000`00000484 : nt!KiBugCheckDispatch+0x69
fffff880`072ddbb0 00000000`76f9ff2a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`0145e958 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f9ff2a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiSystemServiceExit+245
fffff800`02e8bbe0 4883ec50 sub rsp,50h
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiSystemServiceExit+245
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
BUCKET_ID: X64_0x1_nt!KiSystemServiceExit+245
Followup: MachineOwner
---------
In looking at the dumps for clues, I find some out of date drivers on your system.
hcw95bda.sys Fri Feb 15 12:55:35
2008
hcw95rc.sys Fri Feb 15 12:56:16
2008
LPCFilter.sys Tue Jun 30 19:57:52 2009
pgeffect.sys Mon Jun 22 05:00:11 2009
Rt64win7.sys Fri May 22 10:52:30 2009
RtHDMIVX.sys Wed May 20 06:04:50 2009
rtl8192se.sys Wed Aug 26 06:11:12 2009
Win 7 does not like outdated drivers. The can and do cause conflicts and corrupt memory. Try to update these drivers, especially the two dated 2008.
How To Find Drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads