BSOD Windows Memory Management

Hi, protooluser; Tews is offline right now; so I have taken a look at all seven of your dumps from today. All of them relate to memory issues and that is not necessarily bad RAM; but it could be. Notice the usual causes.

Error code 1A (5X), MEMORY_MANAGEMENT. Usual causes: Device driver, memory, kernel

Error code 19, BAD_POOL_HEADER. Usual causes: Device driver

Error code 4E, PFN_LIST_CORRUPT. Usual causes: Device driver, ?memory

Code:

Kernel base = 0xfffff800`02a60000 PsLoadedModuleList = 0xfffff800`02c9de50
Debug session time: Tue Oct 19 09:25:24.799 2010 (GMT-4)
System Uptime: 0 days 0:14:13.734
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80026eabb0, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339d6 )

Followup: MachineOwner
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80026eabb0
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b4426e to fffff80002ad1f00

STACK_TEXT:  
fffff880`07446828 fffff800`02b4426e : 00000000`0000001a 00000000`00041790 fffffa80`026eabb0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`07446830 fffff800`02b055d9 : 00000003`00000000 00000000`0313afff fffff880`00000000 fffffa80`00000000 : nt! ?? ::FNODOBFM::`string'+0x339d6
fffff880`074469f0 fffff800`02de7e50 : fffffa80`06055220 0007ffff`00000000 fffffa80`071cbd30 fffffa80`071cbd30 : nt!MiRemoveMappedView+0xd9
fffff880`07446b10 fffff800`02de825b : 00000980`00000000 00000000`02fa0000 fffffa80`00000001 00000000`0027ec01 : nt!MiUnmapViewOfSection+0x1b0
fffff880`07446bd0 fffff800`02ad1153 : 00000000`00000000 00000000`02bf8f6c fffffa80`07164b30 00000000`00000004 : nt!NtUnmapViewOfSection+0x5f
fffff880`07446c20 00000000`76f7015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0027e2d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f7015a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+339d6
fffff800`02b4426e cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+339d6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339d6

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339d6

Followup: MachineOwner
---------

Kernel base = 0xfffff800`02a65000 PsLoadedModuleList = 0xfffff800`02ca2e50
Debug session time: Tue Oct 19 09:10:30.067 2010 (GMT-4)
System Uptime: 0 days 0:14:26.002
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 11d8ba, 2, 118d39}

Probably caused by : memory_corruption ( nt!MiBadShareCount+4c )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000000000000099, A PTE or PFN is corrupt
Arg2: 000000000011d8ba, page frame number
Arg3: 0000000000000002, current page state
Arg4: 0000000000118d39, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002b6532c to fffff80002ad6f00

STACK_TEXT:  
fffff880`0334d6e8 fffff800`02b6532c : 00000000`0000004e 00000000`00000099 00000000`0011d8ba 00000000`00000002 : nt!KeBugCheckEx
fffff880`0334d6f0 fffff800`02a793e7 : 00000000`00002138 fffffa80`03567ab0 00000000`00000000 fffff880`0334d9b8 : nt!MiBadShareCount+0x4c
fffff880`0334d730 fffff800`02deae35 : fffff980`0cd80000 fffff8a0`02a70840 00000000`00000001 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x2c1db
fffff880`0334da10 fffff800`02aefd47 : 00000000`00400000 fffffa80`04f55b40 00000000`00000000 00000000`00500000 : nt!CcUnmapVacb+0x5d
fffff880`0334da50 fffff800`02ac6ad4 : 00000000`00000001 fffffa80`0547a710 fffffa80`053ef101 00000000`00000000 : nt!CcUnmapVacbArray+0x1b7
fffff880`0334dae0 fffff800`02aca55c : fffffa80`053ef1f0 00000000`00000011 fffffa80`053ef1f0 fffffa80`00000000 : nt!CcDeleteSharedCacheMap+0x140
fffff880`0334db50 fffff800`02acad60 : fffff800`02cdc100 fffff880`0334dc58 00000000`00000000 fffff880`00000000 : nt!CcWriteBehind+0x5bc
fffff880`0334dc00 fffff800`02ae4161 : fffffa80`04f90800 fffff800`02dd0504 fffff800`02cdc140 00000000`00000005 : nt!CcWorkerThread+0x1c8
fffff880`0334dcb0 fffff800`02d7a166 : 00000000`00000000 fffffa80`04faa680 00000000`00000080 fffffa80`04f6b5f0 : nt!ExpWorkerThread+0x111
fffff880`0334dd40 fffff800`02ab5486 : fffff880`03167180 fffffa80`04faa680 fffff880`031720c0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0334dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiBadShareCount+4c
fffff800`02b6532c cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiBadShareCount+4c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

BUCKET_ID:  X64_0x4E_99_nt!MiBadShareCount+4c

Followup: MachineOwner
---------

Kernel base = 0xfffff800`02a4d000 PsLoadedModuleList = 0xfffff800`02c8ae50
Debug session time: Tue Oct 19 07:39:48.927 2010 (GMT-4)
System Uptime: 0 days 0:01:18.973
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff8a001c66250, 0, fffff8a001c66250}

Probably caused by : Pool_Corruption ( nt!ExFreePool+75b )

Followup: Pool_corruption
---------

6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff8a001c66250, the pool entry being checked.
Arg3: 0000000000000000, the read back flink freelist value (should be the same as 2).
Arg4: fffff8a001c66250, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002bf010b to fffff80002abef00

STACK_TEXT:  
fffff880`0334d508 fffff800`02bf010b : 00000000`00000019 00000000`00000003 fffff8a0`01c66250 00000000`00000000 : nt!KeBugCheckEx
fffff880`0334d510 fffff800`02bf24c1 : f8a001c8`20c00400 fffff8a0`01c108c0 fffff880`0334d718 fffff800`02a4d000 : nt!ExFreePool+0x75b
fffff880`0334d5a0 fffff800`02f0a73c : fffff800`02c5ec88 fffff800`02c61430 00000000`4b466650 00000000`00401802 : nt!ExFreePoolWithTag+0x411
fffff880`0334d650 fffff800`02bde439 : fffff880`0334d860 00000000`00000000 00000000`00000000 fffff8a0`01bca7a0 : nt!PfpRpFileKeyUpdate+0x4cc
fffff880`0334d6e0 fffff880`010de55d : 00000000`00000000 00000000`00000000 fffff880`0334d860 00000000`00000000 : nt!PfFileInfoNotify+0x549
fffff880`0334d770 fffff880`010de746 : fffff8a0`01c10960 fffff8a0`01c10960 00000000`00000000 00000000`00000000 : fileinfo!FIStreamLog+0x89
fffff880`0334d840 fffff880`0109765e : fffffa80`07c85428 00000000`00000000 ffffffff`ffffffff fffffa80`07cf0ee0 : fileinfo!FIStreamCleanup+0x96
fffff880`0334d890 fffff880`010b322d : fffff8a0`01c10918 fffff880`01089000 00000000`00000000 00000000`00000040 : fltmgr!DoFreeContext+0x7e
fffff880`0334d8c0 fffff880`010aebc1 : fffffa80`06079800 00000000`00000130 fffff8a0`01bca7a0 fffff8a0`01bca7a0 : fltmgr! ?? ::NNGAKEGL::`string'+0x1196
fffff880`0334d8f0 fffff880`010aeb7b : fffffa80`06079800 fffff8a0`01bcaa08 fffffa80`06079800 fffff800`02a9549a : fltmgr!CleanupStreamListCtrl+0x21
fffff880`0334d920 fffff800`02dab46e : 00000000`00000001 fffff880`012960b8 fffff8a0`01bca8d0 fffff880`012096e1 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`0334d950 fffff880`01295bcc : fffff8a0`01bca7a0 fffffa80`04f22040 fffff880`0334da28 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`0334d9a0 fffff880`012958d5 : fffff800`01010000 00000000`00000000 fffff800`02c62500 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`0334d9e0 fffff880`01208cb4 : fffff8a0`01bca6a0 fffff8a0`01bca7a0 fffff800`02c62500 fffff880`0334db52 : Ntfs!NtfsRemoveScb+0x61
fffff880`0334da20 fffff880`012932dc : fffff8a0`01bca670 fffff800`02c625a0 fffff880`0334db52 fffffa80`07216e40 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0334da50 fffff880`01211882 : fffffa80`07216e40 fffffa80`07216e40 fffff8a0`01bca670 00000000`00000000 : Ntfs!NtfsTeardownStructures+0xdc
fffff880`0334dad0 fffff880`012aa813 : fffffa80`07216e40 fffff800`02c625a0 fffff8a0`01bca670 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0334db10 fffff880`0128438f : fffffa80`07216e40 fffff8a0`01bca7a0 fffff8a0`01bca670 fffffa80`06028180 : Ntfs!NtfsCommonClose+0x353
fffff880`0334dbe0 fffff800`02acc161 : 00000000`00000000 fffff880`01284200 fffffa80`04f22001 8b48c38b`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0334dcb0 fffff800`02d62166 : 245c8948`ce8b4863 fffffa80`04f22040 00000000`00000080 fffffa80`04f03040 : nt!ExpWorkerThread+0x111
fffff880`0334dd40 fffff800`02a9d486 : fffff880`03167180 fffffa80`04f22040 fffff880`031720c0 000136e9`00000b5e : nt!PspSystemThreadStartup+0x5a
fffff880`0334dd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExFreePool+75b
fffff800`02bf010b cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExFreePool+75b

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExFreePool+75b

BUCKET_ID:  X64_0x19_3_nt!ExFreePool+75b

Followup: Pool_corruption
---------

All of your device drivers appear to be up to date. I see that you are running Windows Defender. I suggest that you download and install Microsoft Security Essentials. It will turn Windows Defender off. MSE supersedes Defender, offers more protection, and runs very smoothly on Win 7 systems. I can't say this will eliminate your crashes; but it is worth a try.

After you install MSE, please test your RAM with Memtest86. Follow the instructions in this tutorial: RAM - Test with Memtest86+. Run it for at least seven passes; this will take seven to eight hours. Errors will show up on your screen in red. Post your results.

If you get no errors with Memetest, turn on Driver Verifier. Follow the instructions in this tutorial:
Driver Verifier - Enable and Disable. Upload any dumps triggered by Driver Verifier.

Thanks for reporting back. It was, indeed, a RAM issue then. Your reporting your solution helps us help others. :) You can post your question about your RAM in the Hardware section. There are some really knowledgeable folks on RAM there. Good job on installing missing drivers and updating Windows.