You are welcome. I will take a look now. Your latest dump shows error code 3B; the remaining three all show error code 1A.
3B, SYSTEM_SERVICE_EXCEPTION - usually caused by System service, Device driver, graphics driver, ?memory
Error code 1A, MEMORY_MANAGEMENT - usually caused by Device driver, memory, kernel
Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-26504-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e86e50
Debug session time: Sat Aug 28 22:48:14.980 2010 (GMT-4)
System Uptime: 0 days 0:00:53.057
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80002ce82b7, fffff88008ba4a40, 0}
Probably caused by : memory_corruption ( nt!MmCopyToCachedPage+227 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ce82b7, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88008ba4a40, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MmCopyToCachedPage+227
fffff800`02ce82b7 8b7838 mov edi,dword ptr [rax+38h]
CONTEXT: fffff88008ba4a40 -- (.cxr 0xfffff88008ba4a40)
rax=0000000000122a39 rbx=0000000000000000 rcx=0000000fffffffff
rdx=fffff80002c49000 rsi=ffffffffffffffff rdi=fffffa800751df50
rip=fffff80002ce82b7 rsp=fffff88008ba5410 rbp=fffff88008ba5480
r8=0000098000000000 r9=00000000016f3040 r10=0000058000000000
r11=0000000000000002 r12=fffff6fcc0042298 r13=0000000000000000
r14=0000000000001000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
nt!MmCopyToCachedPage+0x227:
fffff800`02ce82b7 8b7838 mov edi,dword ptr [rax+38h] ds:002b:00000000`00122a71=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002ce82b7
STACK_TEXT:
fffff880`08ba5410 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCopyToCachedPage+0x227
FOLLOWUP_IP:
nt!MmCopyToCachedPage+227
fffff800`02ce82b7 8b7838 mov edi,dword ptr [rax+38h]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MmCopyToCachedPage+227
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
STACK_COMMAND: .cxr 0xfffff88008ba4a40 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x3B_nt!MmCopyToCachedPage+227
BUCKET_ID: X64_0x3B_nt!MmCopyToCachedPage+227
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21512-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c0d000 PsLoadedModuleList = 0xfffff800`02e4ae50
Debug session time: Sat Aug 28 22:46:34.488 2010 (GMT-4)
System Uptime: 0 days 0:01:07.454
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa8000c87090, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa8000c87090
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cf0f9e to fffff80002c7d740
STACK_TEXT:
fffff880`08074968 fffff800`02cf0f9e : 00000000`0000001a 00000000`00041790 fffffa80`00c87090 00000000`0000ffff : nt!KeBugCheckEx
fffff880`08074970 fffff800`02cbf0da : 00000000`00000000 00000000`12680fff fffffa80`00000000 fffffa80`06b84320 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`08074b30 fffff800`02c7c993 : ffffffff`ffffffff 00000000`0994e8c0 00000000`0994e888 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`08074c20 00000000`777dff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0994e7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777dff3a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02cf0f9e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33906
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c63000 PsLoadedModuleList = 0xfffff800`02ea0e50
Debug session time: Sat Aug 28 22:44:20.285 2010 (GMT-4)
System Uptime: 0 days 0:00:29.251
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41284, 38bd001, 1192, fffff70001080000}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a83 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 00000000038bd001
Arg3: 0000000000001192
Arg4: fffff70001080000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41284
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: hamachi-2.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002d283b3 to fffff80002cd3740
STACK_TEXT:
fffff880`0471a218 fffff800`02d283b3 : 00000000`0000001a 00000000`00041284 00000000`038bd001 00000000`00001192 : nt!KeBugCheckEx
fffff880`0471a220 fffff800`02d06379 : fffffa80`063473f8 ffffffff`ffffffff fffffa80`070dd060 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`0471a260 fffff800`02d19b2b : 99200001`1be3d867 fffff680`0001c5e8 ffffffff`ffffffff 000fffff`ffffffff : nt!MiTerminateWsle+0x29
fffff880`0471a2a0 fffff800`02d14dee : 00000000`00000002 fffff880`00000000 fffffa80`06347060 fffffa80`063473f8 : nt!MiDecommitPages+0x20b
fffff880`0471ab30 fffff800`02cd2993 : ffffffff`ffffffff 00000000`02a5b5f8 00000000`02a5b5f0 00000000`00000001 : nt!NtFreeVirtualMemory+0x2de
fffff880`0471ac20 00000000`7743ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02a5b578 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7743ff3a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+4a83
fffff800`02d283b3 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+4a83
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83
BUCKET_ID: X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Owner\Downloads\dumps\082910-21231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c18000 PsLoadedModuleList = 0xfffff800`02e55e50
Debug session time: Sat Aug 28 22:52:37.305 2010 (GMT-4)
System Uptime: 0 days 0:00:35.271
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa800121b1e0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+33906 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800121b1e0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff80002cfbf9e to fffff80002c88740
STACK_TEXT:
fffff880`03837968 fffff800`02cfbf9e : 00000000`0000001a 00000000`00041790 fffffa80`0121b1e0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`03837970 fffff800`02cca0da : 00000000`00000000 00000000`0a8cffff fffffa80`00000000 fffffa80`06c8bb30 : nt! ?? ::FNODOBFM::`string'+0x33906
fffff880`03837b30 fffff800`02c87993 : ffffffff`ffffffff 00000000`0984ef78 00000000`0984ef70 fffffa80`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`03837c20 00000000`7748ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0984ef38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7748ff3a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+33906
fffff800`02cfbf9e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+33906
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+33906
Followup: MachineOwner
---------
These dumps did not give us a specific cause. One of the dumps did show 0xc0000005 which indicated corrupt memory. The dumps blamed various drivers/programs such as ntoskrnl.exe. This is a Microsoft core system program and is very unlikely to be the cause. When WinDebug cannot pinpot the cause, it often blames a Windows core system file.
Something is corrupting your memory and we will try to find out what. It could be bad RAM, faulty drivers, incompatible software or hardware, etc.
Let's start with testing your RAM with Memtest 86+.
RAM - Test with Memtest86+
Any errors will show up on your screen in red. Post back with the results.
Out of date drivers can cause problems with Win 7. The can and do corrupt memory and cause crashes. One of your drivers is slightly out of date and was blamed in one of the dumps as as the cause of the crash:
hamachi.sys Thu Feb 19 05:36:41 2009 - Hamachi Virtual Network Interface Driver is a driver file from company LogMeIn, Inc. belonging to product Hamachi Virtual Network Interface Driver. Update this driver or update the software (or both).
After you have updated this driver, reboot and run your system. Let's see how it does. Upload any new BSOD dump files to us and we will go from there.