Random blue screen of death

autoset · 05 Oct 2010

I really need help on this, this happens at random during start up or shut down of the PC mostly. It might do it every now and then during normal use.Example when playing a game, or using photoshop.

Ive attached the rar files as described in the how to. Please help. My system info:

OS

Windows 7 64 bit (retail)CPU

Intel Core i7 920@2.67 GHz Motherboard

EVEA X58 3X SLI Memory

Corsair DOMINATOR DDR3 6GB (on 2GB now)Graphics Card(s)

GeForce GTX 285 Sound Card

Realtec HD Audio, Intergrated Hard Drives

VelociRaptor 300GB, Seagate 1.36 TB, Seagate 200GB PSU

CORSAIR TX750W

yowanvista · 05 Oct 2010

If you are using McAfee replace it with MSE: http://www.microsoft.com/security_essentials/

This was likely caused by the following module: mpfp.sys
Bugcheck code: 0x50 (0xFFFFFFFFC08603DD, 0x0, 0xFFFFF88003B20F16, 0x2)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Dump file: C:\Windows\Minidump\100510-20982-01.dmp

nvlddmkm.sys part of the Nvidia drivers is also causing BSODs
Causes: bad memory/incorrect RAM voltages/timings/bad driver/bad PSU/overheating GPU or faulty graphics card

Remove the current drivers using driver sweeper: Guru3D - Driver Sweeper
Then reinstall the current Nvidia display drivers in safe mode

This was likely caused by the following module: nvlddmkm.sys
Bugcheck code: 0xD1 (0xFFFFFA804B95C444, 0x2, 0x1, 0xFFFFF8800FCEADB7)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
Dump file: C:\Windows\Minidump\092810-16302-01.dmp
file path: C:\Windows\system32\drivers\nvlddmkm.sys
product: NVIDIA Windows Kernel Mode Driver, Version 258.96
company: NVIDIA Corporation

Update your direct X: Download details: DirectX End-User Runtime Web Installer

This was likely caused by the following module: dxgkrnl.sys
Bugcheck code: 0x50 (0xFFFFFA8051B80454, 0x1, 0xFFFFF8800432AACF, 0x5)
Error: PAGE_FAULT_IN_NONPAGED_AREA
Dump file: C:\Windows\Minidump\071010-17565-01.dmp
file path: C:\Windows\system32\drivers\dxgkrnl.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics Kernel

CarlTR6 · 06 Oct 2010

I looked at your four most recent dumps. All of them indicate a hardware or hardware related problem and they all reference corrupted memory.

error code 50 (2X), PAGE_FAULT_IN_NONPAGED_AREA - Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS

error code 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED - Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control,

error code A, IRQL_NOT_LESS_OR_EQUAL - Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Notice the things in common in the usual causes.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffffa805af48a40, 1, fffff880042350ff, 5}


Could not read faulting driver name
Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa805af48a40, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880042350ff, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b20e0
 fffffa805af48a40 

FAULTING_IP: 
dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7
fffff880`042350ff 44894018        mov     dword ptr [rax+18h],r8d

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff880098bcfe0 -- (.trap 0xfffff880098bcfe0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880098bd178 rbx=0000000000000000 rcx=fffffa80049f7200
rdx=0000000000001000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880042350ff rsp=fffff880098bd178 rbp=0000000000000000
 r8=0000000000001000  r9=0000000000000003 r10=fffff88002ef8900
r11=0000000000001000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+0x7:
fffff880`042350ff 44894018        mov     dword ptr [rax+18h],r8d ds:5c70:fffff880`098bd190=0c9c9660
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ef98c1 to fffff80002e7a740

STACK_TEXT:  
fffff880`098bce78 fffff800`02ef98c1 : 00000000`00000050 fffffa80`5af48a40 00000000`00000001 fffff880`098bcfe0 : nt!KeBugCheckEx
fffff880`098bce80 fffff800`02e7882e : 00000000`00000001 fffffa80`0490e060 00000000`00000000 fffff800`03009888 : nt! ?? ::FNODOBFM::`string'+0x40e8b
fffff880`098bcfe0 fffff880`042350ff : fffff880`04234cc7 fffffa80`05c19000 fffffa80`0490e060 fffff8a0`0c9c9660 : nt!KiPageFault+0x16e
fffff880`098bd178 fffff880`04234cc7 : fffffa80`05c19000 fffffa80`0490e060 fffff8a0`0c9c9660 fffffa80`04d97a00 : dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+0x7
fffff880`098bd180 fffff880`04220974 : 00000000`00000174 00000000`00001000 fffff8a0`02a5dc90 00000000`000007ff : dxgmms1!VIDMM_PROCESS_HEAP::Allocate+0xcf
fffff880`098bd220 fffff880`0421af38 : 00000000`00000000 00000000`00000000 fffffa80`07f2e000 fffff8a0`02a5dc90 : dxgmms1!VIDMM_GLOBAL::OpenLocalAllocation+0x570
fffff880`098bd2c0 fffff880`04201aa7 : fffff8a0`0018aaf0 fffff8a0`0c114b70 fffff880`098bd430 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+0x268
fffff880`098bd3a0 fffff880`043253a1 : fffff8a0`0b382560 fffff880`098bd870 00000000`00000000 00000000`00000000 : dxgmms1!VidMmOpenAllocation+0xeb
fffff880`098bd3f0 fffff880`0431e554 : fffff880`098bd658 fffff8a0`0b1340a0 fffff880`098bd830 fffff880`098bd830 : dxgkrnl!DXGDEVICE::CreateVidMmAllocations<_DXGK_ALLOCATIONINFO>+0x28d
fffff880`098bd480 fffff880`043211af : fffff8a0`0c36c000 fffff880`098bdaf0 fffff880`098bdc01 00000000`00000000 : dxgkrnl!DXGDEVICE::CreateAllocation+0xca8
fffff880`098bda80 fffff960`0023b336 : 00000000`0283b110 00000000`40000040 00000000`11e7ad40 00000000`000007d3 : dxgkrnl!DxgkCreateAllocation+0x42b
fffff880`098bdbb0 fffff800`02e79993 : 00000000`00000008 00000000`11e7aac0 00000000`00278a01 00000000`00000004 : win32k!NtGdiDdDDICreateAllocation+0x12
fffff880`098bdbe0 00000000`753b119a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0283b0c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x753b119a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7
fffff880`042350ff 44894018        mov     dword ptr [rax+18h],r8d

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc578

FAILURE_BUCKET_ID:  X64_0x50_dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7

BUCKET_ID:  X64_0x50_dxgmms1!VIDMM_PROCESS_HEAP::AllocateSmallAllocation+7

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002edccdc, fffff8800337e828, fffff8800337e090}

Probably caused by : nvlddmkm.sys ( nvlddmkm+1d679a )

Followup: MachineOwner
---------

7: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002edccdc, The address that the exception occurred at
Arg3: fffff8800337e828, Exception Record Address
Arg4: fffff8800337e090, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeWaitForSingleObject+17c
fffff800`02edccdc 4c8938          mov     qword ptr [rax],r15

EXCEPTION_RECORD:  fffff8800337e828 -- (.exr 0xfffff8800337e828)
ExceptionAddress: fffff80002edccdc (nt!KeWaitForSingleObject+0x000000000000017c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800337e090 -- (.cxr 0xfffff8800337e090)
rax=99fff88010b61df8 rbx=0000000000000000 rcx=fffff88010b61df8
rdx=0000000000000000 rsi=fffff88010b61df0 rdi=fffffa80042f2b60
rip=fffff80002edccdc rsp=fffff8800337ea60 rbp=0000000000000000
 r8=fffff78000000008  r9=0000000000000000 r10=0000000000000000
r11=fffff88003167180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=fffffa80042f2c68
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!KeWaitForSingleObject+0x17c:
fffff800`02edccdc 4c8938          mov     qword ptr [rax],r15 ds:002b:99fff880`10b61df8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310b0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
nvlddmkm+1d679a
fffff880`1009e79a ??              ???

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff8801009e79a to fffff80002edccdc

STACK_TEXT:  
fffff880`0337ea60 fffff880`1009e79a : 00000000`00000000 fffff880`00000000 fffff880`0337ec00 fffffa80`042f2b00 : nt!KeWaitForSingleObject+0x17c
fffff880`0337eb00 00000000`00000000 : fffff880`00000000 fffff880`0337ec00 fffffa80`042f2b00 fffff880`03167180 : nvlddmkm+0x1d679a


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nvlddmkm+1d679a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nvlddmkm

IMAGE_NAME:  nvlddmkm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4bb7d7fd

STACK_COMMAND:  .cxr 0xfffff8800337e090 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nvlddmkm+1d679a

BUCKET_ID:  X64_0x7E_nvlddmkm+1d679a

Followup: MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa80278e1010, 2, 1, fffff80002f7eab7}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa80278e1010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002f7eab7, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800030f80e0
 fffffa80278e1010 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02f7eab7 480fb328        btr     qword ptr [rax],rbp

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff8800318c900 -- (.trap 0xfffff8800318c900)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8007ae1010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f7eab7 rsp=fffff8800318ca90 rbp=00000000ff000000
 r8=fffff8800318cac0  r9=0000058000000000 r10=fffff800030fa840
r11=fffff8800318cb50 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`02f7eab7 480fb328        btr     qword ptr [rax],rbp ds:fffffa80`07ae1010=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ebfca9 to fffff80002ec0740

STACK_TEXT:  
fffff880`0318c7b8 fffff800`02ebfca9 : 00000000`0000000a fffffa80`278e1010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`0318c7c0 fffff800`02ebe920 : 9ed19ed1`00000000 fffffa80`042f1040 fffffa80`04356010 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff880`0318c900 fffff800`02f7eab7 : 00000000`00000000 fffffa80`042f1040 fffffa80`07799f70 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0318ca90 fffff800`02f20fff : ff000000`000003e0 fffffa80`042d6b60 fffffa80`03a8a620 00000580`00000000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`0318cb10 fffff800`02e8b36a : ffffffff`ffffffff fffffa80`042f1040 ffffffff`ffffffff fffff800`031a5f43 : nt! ?? ::FNODOBFM::`string'+0x16ec0
fffff880`0318cb80 fffff800`02e8b492 : fffff6fc`40029fe0 00000000`00000007 00000000`00000006 00000000`00000000 : nt!MiDeleteKernelStackPages+0xf6
fffff880`0318cbd0 fffff800`02ea0494 : fffff6fc`40029fe0 00000000`00000000 00000000`00000003 fffffa80`091f0060 : nt!MiDeleteKernelStack+0x36
fffff880`0318cc20 fffff800`02ea15b5 : 00000000`00000000 fffffa80`091f03f0 fffffa80`091f03f0 fffff6fc`40029fe0 : nt!MmDeleteKernelStack+0x198
fffff880`0318cc80 fffff800`02ecd961 : fffff800`02ea1530 fffff800`03065650 fffffa80`042f1040 00000000`00000000 : nt!PspReaper+0x85
fffff880`0318ccb0 fffff800`03164c06 : efa9efa9`f10ef10e fffffa80`042f1040 00000000`00000080 fffffa80`042d6040 : nt!ExpWorkerThread+0x111
fffff880`0318cd40 fffff800`02e9ec26 : fffff880`02f67180 fffffa80`042f1040 fffff880`02f720c0 dbfedbfe`66e366e3 : nt!PspSystemThreadStartup+0x5a
fffff880`0318cd80 00000000`00000000 : fffff880`0318d000 fffff880`03187000 fffff880`0318c9f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02f7eab7 480fb328        btr     qword ptr [rax],rbp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiReleaseConfirmedPageFileSpace+87

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87

BUCKET_ID:  X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87

Followup: MachineOwner
---------

As yowanvista suggested, uninstall McAfee; it is well known for causing BSOD's on some Win 7 systems. Use this uninstall tool: Info > Tool. Let's eliminate this known cause of BSOD's and replace it with Microsoft Security Essentials.

You have some out of date drivers on your system. These can and do cause memory corruption and crashes. The drivers in red font are particularly obsolete. Update these drivers.

PxHlpa64.sys Tue Jun 23 19:16:35 2009 - Sonic CD/DVD driver (used by many different CD/DVD programs) pxHelp20.sys programs
Go to C:\Windows\System32\drivers and rename PxHlpa64.sys to PxHlpa64.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished.

RecFltr.sys Wed Jan 17 20:23:09 2007 - Reclusa Keyboard Software Download. If you cannot update this driver; you will need to upgrade your keyboard to one certified to be compatible with Win 7.

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek

Sahdad64.sys Mon Oct 27 23:56:11 2008 - Unknown driver - suspect it's part of Saitek device (Saitek HDD Filter Driver)Download drivers and software for Saitek products

Saibad64.sys Mon Oct 27 23:56:15 2008 - Saitek Volume Filter DriverDownload drivers and software for Saitek products

SaibVdAd64.sys Mon Oct 27 23:56:20 2008 - Saitek Virtual Disk DriverDownload drivers and software for Saitek products

Update the drivers from the manufacturers' websites. Let us know if you need help with this. The 2007 and 2008 drivers will create problems for you.

After you uninstall McAfee and update your drivers, reboot and run your system. If you get another BSOD, upload it to us. We will go from there.

autoset · 07 Oct 2010

Thank you so very much. I will complete this over the weekend and post results!

CarlTR6 · 07 Oct 2010

You are welcome. If you need help, please post. I wish you success. :)

autoset · 08 Oct 2010

I am at a loss, I dont know what drivers to get as it presents several options.

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Latest PCIe GBE (GigaBit Ethernet) drivers here: Realtek

Sahdad64.sys Mon Oct 27 23:56:11 2008 - Unknown driver - suspect it's part of Saitek device (Saitek HDD Filter Driver)Download drivers and software for Saitek products

Saibad64.sys Mon Oct 27 23:56:15 2008 - Saitek Volume Filter DriverDownload drivers and software for Saitek products

SaibVdAd64.sys Mon Oct 27 23:56:20 2008 - Saitek Virtual Disk DriverDownload drivers and software for Saitek products

CarlTR6 · 08 Oct 2010

Try this one for Rt64win7.sys. It should be just the driver. Win7 and WinServer 2008 R2 Driver7.0262010/9/23540k

I can't help you with your Saiteck device since I do not know what your device is. You have to enter either the model of the device you have or the type of device. However, I did not see Win 7 mentioned on the site, only XP. If there are no Win 7 drivers, you will need to uninstall the device and up grade to one compatible with Win 7.