I am looking at your three most recent dumps and they point to a hardware issue, memory corruption.
Error code D1, DRIVER_IRQL_NOT_LESS_OR_EQUAL - usual causes are a device driver.
Error code 3B, SYSTEM_SERVICE_EXCEPTION - usual causes are System service, Device driver, graphics driver, ?memory
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\A-Rar\082410-20061-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02819000 PsLoadedModuleList = 0xfffff800`02a56e50
Debug session time: Tue Aug 24 09:33:54.691 2010 (GMT-4)
System Uptime: 0 days 17:37:46.640
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff880041312db, fffff8800642eb10, 0}
Probably caused by : dxgkrnl.sys ( dxgkrnl!DXGDEVICE::DestroyResource+6f )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880041312db, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800642eb10, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
dxgkrnl!DXGDEVICE::DestroyResource+6f
fffff880`041312db 4c8b4b18 mov r9,qword ptr [rbx+18h]
CONTEXT: fffff8800642eb10 -- (.cxr 0xfffff8800642eb10)
rax=0000000000000001 rbx=0000000000000000 rcx=fffffa8007546e10
rdx=0000000000000000 rsi=0000000000000000 rdi=fffff8a002aa6000
rip=fffff880041312db rsp=fffff8800642f4e0 rbp=fffff8a002aa7300
r8=0000000000000000 r9=0000000000000000 r10=fffff880009e6660
r11=fffff8a0090332c0 r12=fffff8a009033201 r13=fffff8a002833d00
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202
dxgkrnl!DXGDEVICE::DestroyResource+0x6f:
fffff880`041312db 4c8b4b18 mov r9,qword ptr [rbx+18h] ds:002b:00000000`00000018=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880041312db
STACK_TEXT:
fffff880`0642f4e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dxgkrnl!DXGDEVICE::DestroyResource+0x6f
FOLLOWUP_IP:
dxgkrnl!DXGDEVICE::DestroyResource+6f
fffff880`041312db 4c8b4b18 mov r9,qword ptr [rbx+18h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: dxgkrnl!DXGDEVICE::DestroyResource+6f
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgkrnl
IMAGE_NAME: dxgkrnl.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ac5509e
STACK_COMMAND: .cxr 0xfffff8800642eb10 ; kb
FAILURE_BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyResource+6f
BUCKET_ID: X64_0x3B_dxgkrnl!DXGDEVICE::DestroyResource+6f
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\A-Rar\082310-27908-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02819000 PsLoadedModuleList = 0xfffff800`02a56e50
Debug session time: Mon Aug 23 15:51:53.197 2010 (GMT-4)
System Uptime: 1 days 10:57:47.608
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffff8800801a3a0, 2, 0, fffff88003c65102}
Probably caused by : tcpip.sys ( tcpip!IppSendDatagramsCommon+732 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff8800801a3a0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88003c65102, address which referenced memory
Debugging Details:
------------------
OVERLAPPED_MODULE: Address regions for 'cdfs' and 'AAMW_IFS64.s' overlap
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac10e0
fffff8800801a3a0
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!IppSendDatagramsCommon+732
fffff880`03c65102 440fb68424f0020000 movzx r8d,byte ptr [rsp+2F0h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff880073a9f20 -- (.trap 0xfffff880073a9f20)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000010 rbx=0000000000000000 rcx=fffffa80092cefd0
rdx=0000000000000060 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003c65102 rsp=fffff880073aa0b0 rbp=0000000000000000
r8=00000000000029bc r9=0000000000000012 r10=0000000000000000
r11=fffffa80092cefd0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
tcpip!IppSendDatagramsCommon+0x732:
fffff880`03c65102 440fb68424f0020000 movzx r8d,byte ptr [rsp+2F0h] ss:0018:fffff880`073aa3a0=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002888ca9 to fffff80002889740
STACK_TEXT:
fffff880`073a9dd8 fffff800`02888ca9 : 00000000`0000000a fffff880`0801a3a0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`073a9de0 fffff800`02887920 : 00000000`0023c380 00000000`00000010 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`073a9f20 fffff880`03c65102 : fffffa80`093351d0 00000000`00005000 fffffa80`07a264c0 00000000`00000000 : nt!KiPageFault+0x260
fffff880`073aa0b0 fffff880`03c76815 : fffff880`073aa760 fffff880`03ac4f07 fffff880`03d6c9a0 fffffa80`093351d0 : tcpip!IppSendDatagramsCommon+0x732
fffff880`073aa380 fffff880`03c5cccb : fffffa80`05f56cf0 00000000`00000001 fffffa80`00000022 fffffa80`06e3b640 : tcpip!IpNlpFastSendDatagram+0x775
fffff880`073aa710 fffff880`03cbb41a : 00000000`0000f016 fffff880`00000001 00000000`d4020002 00000000`00000010 : tcpip!TcpTcbHeaderSend+0x48b
fffff880`073aa8c0 fffff880`03c78334 : 00000000`ae238000 00000000`0ea41001 fffffa80`06e36860 fffff880`051726eb : tcpip! ?? ::FNODOBFM::`string'+0x3d728
fffff880`073aaa70 fffff880`03c7c86a : fffffa80`06767e80 fffffa80`06b28d00 fffffa80`06667e01 00000000`00000000 : tcpip!TcpTcbReceive+0x694
fffff880`073aac20 fffff880`03c7c3b7 : fffffa80`06e3b662 fffffa80`06759000 00000000`00000000 fffff880`03c5f700 : tcpip!TcpMatchReceive+0x1fa
fffff880`073aad70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : tcpip!TcpPreValidatedReceive+0x177
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!IppSendDatagramsCommon+732
fffff880`03c65102 440fb68424f0020000 movzx r8d,byte ptr [rsp+2F0h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: tcpip!IppSendDatagramsCommon+732
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c15a458
FAILURE_BUCKET_ID: X64_0xD1_tcpip!IppSendDatagramsCommon+732
BUCKET_ID: X64_0xD1_tcpip!IppSendDatagramsCommon+732
Followup: MachineOwner
---------
******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {18, 2, 0, fffff88003a593f6}
Unable to load image \SystemRoot\System32\Drivers\Mpfp.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Mpfp.sys
*** ERROR: Module load completed but symbols could not be loaded for Mpfp.sys
Probably caused by : Mpfp.sys ( Mpfp+f3f6 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000018, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88003a593f6, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002afa0e0
0000000000000018
CURRENT_IRQL: 2
FAULTING_IP:
Mpfp+f3f6
fffff880`03a593f6 48394818 cmp qword ptr [rax+18h],rcx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88002dda780 -- (.trap 0xfffff88002dda780)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80078f6f20
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88003a593f6 rsp=fffff88002dda910 rbp=0000000000000001
r8=fffffa8005558f00 r9=0000000000000000 r10=fffffa800523dd30
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
Mpfp+0xf3f6:
fffff880`03a593f6 48394818 cmp qword ptr [rax+18h],rcx ds:d6b0:00000000`00000018=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800028c1ca9 to fffff800028c2740
STACK_TEXT:
fffff880`02dda638 fffff800`028c1ca9 : 00000000`0000000a 00000000`00000018 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02dda640 fffff800`028c0920 : 00000000`00000000 fffffa80`078f6f20 00000000`00000000 00000000`00000003 : nt!KiBugCheckDispatch+0x69
fffff880`02dda780 fffff880`03a593f6 : fffffa80`05220000 fffffa80`05558e10 01cb4519`0209a2e0 00000000`00000001 : nt!KiPageFault+0x260
fffff880`02dda910 fffffa80`05220000 : fffffa80`05558e10 01cb4519`0209a2e0 00000000`00000001 00000000`00000000 : Mpfp+0xf3f6
fffff880`02dda918 fffffa80`05558e10 : 01cb4519`0209a2e0 00000000`00000001 00000000`00000000 00000000`00000000 : 0xfffffa80`05220000
fffff880`02dda920 01cb4519`0209a2e0 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : 0xfffffa80`05558e10
fffff880`02dda928 00000000`00000001 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff880`03a5956d : 0x1cb4519`0209a2e0
fffff880`02dda930 00000000`00000000 : 00000000`00000000 00000000`00000001 fffff880`03a5956d fffffa80`078f6f20 : 0x1
STACK_COMMAND: kb
FOLLOWUP_IP:
Mpfp+f3f6
fffff880`03a593f6 48394818 cmp qword ptr [rax+18h],rcx
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: Mpfp+f3f6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Mpfp
IMAGE_NAME: Mpfp.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c3f641b
FAILURE_BUCKET_ID: X64_0xD1_Mpfp+f3f6
BUCKET_ID: X64_0xD1_Mpfp+f3f6
Followup: MachineOwner
--------
My first recommendation is immediately uninstall McAfee using this tool > Info > Tool. McAfee is a known cause of BSOD's on some Win 7 systems. One of your dumps pointed to a driver that McAfee interferes with. Download and install Microsoft Security Essentials and make sure Windows Firewall is turned on.
Are you running Ashampoo Anti-Malware or Ashshampoo Tune up? The driver, AAMW_IFS64.sys, was indicated in one of your dumps. Uninstall this program using Revo (free) uninstaller.
I find the following older drivers on your system. Win 7 does not like older drivers. They can and do cause memory corruption. Update these drivers from the manufacturers websites rather than using Windows Update or Device Manager.
ISODrv64.sys Tue Feb 10 04:22:18 2009
nvlddmkm.sys Thu May 14 16:48:07 2009
nvm62x64.sys Fri Oct 17 17:01:06
2008
nvstor.sys Wed May 20 02:45:37 2009
How To Find Drivers:
- I have listed links to most of the drivers in the code box below. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (
DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.