You did just right. Thanks much. I looked at your six most recent dumps. They all indicate memory corruption. Memory corruption can be cause by drivers, incompatible hardware and software, bad RAM, bad motherboard, etc. You will hve to troubleshoot to determine the cause.
Code:
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0340d000 PsLoadedModuleList = 0xfffff800`0364ae50
Debug session time: Sun Nov 21 19:34:43.072 2010 (GMT-5)
System Uptime: 0 days 0:33:51.196
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa800415edb0, ffff, 0}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339c8 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa800415edb0
Arg3: 000000000000ffff
Arg4: 0000000000000000
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: dw20.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff800034f1058 to fffff8000347d740
STACK_TEXT:
fffff880`0c9d71d8 fffff800`034f1058 : 00000000`0000001a 00000000`00041790 fffffa80`0415edb0 00000000`0000ffff : nt!KeBugCheckEx
fffff880`0c9d71e0 fffff800`0345068a : fffffa80`08523060 fffffa80`00000001 00000000`000001a9 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x339c8
fffff880`0c9d7a90 fffff800`03762dcf : fffff8a0`033a9a50 00000000`00000001 00000000`00000000 fffffa80`0af59560 : nt!MmCleanProcessAddressSpace+0x96
fffff880`0c9d7ae0 fffff800`0373a85b : 00000000`00000000 00000000`00000001 00000000`7efdb000 00000000`00000000 : nt!PspExitThread+0x92f
fffff880`0c9d7ba0 fffff800`0347c993 : fffffa80`08523060 00000000`00000000 00000000`7efdb001 fffffa80`0af59560 : nt!NtTerminateProcess+0x25b
fffff880`0c9d7c20 00000000`77a6001a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0008e308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a6001a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+339c8
fffff800`034f1058 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+339c8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339c8
BUCKET_ID: X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+339c8
Followup: MachineOwner
---------
Debug session time: Sun Nov 21 20:05:52.745 2010 (GMT-5)
System Uptime: 0 days 0:10:45.869
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800d4595e8, fffff8800d458e50, fffff880016d9173}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFcbTableCompare+3 )
Followup: MachineOwner
---------
7: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800d4595e8
Arg3: fffff8800d458e50
Arg4: fffff880016d9173
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800d4595e8 -- (.exr 0xfffff8800d4595e8)
ExceptionAddress: fffff880016d9173 (Ntfs!NtfsFcbTableCompare+0x0000000000000003)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000120
Attempt to read from address 0000000000000120
CONTEXT: fffff8800d458e50 -- (.cxr 0xfffff8800d458e50)
rax=001100000002a899 rbx=0000000000000100 rcx=fffffa80082f6640
rdx=fffff8800d459920 rsi=fffff8800d459920 rdi=fffffa80082f6640
rip=fffff880016d9173 rsp=fffff8800d459828 rbp=fffff8800d4598f0
r8=0000000000000120 r9=0000ffffffffffff r10=0000000000020000
r11=fffff8800d459968 r12=fffff8800d4599c4 r13=0000000000000000
r14=0000000000000000 r15=fffffa80082f6180
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010206
Ntfs!NtfsFcbTableCompare+0x3:
fffff880`016d9173 498b08 mov rcx,qword ptr [r8] ds:002b:00000000`00000120=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000120
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036c10e0
0000000000000120
FOLLOWUP_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016d9173 498b08 mov rcx,qword ptr [r8]
FAULTING_IP:
Ntfs!NtfsFcbTableCompare+3
fffff880`016d9173 498b08 mov rcx,qword ptr [r8]
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff800034ae4cd to fffff880016d9173
STACK_TEXT:
fffff880`0d459828 fffff800`034ae4cd : fffffa80`057cf4d0 00000000`00000090 00000000`0000000e fffff800`0378f942 : Ntfs!NtfsFcbTableCompare+0x3
fffff880`0d459830 fffff800`034ae465 : fffff880`0d4599a0 fffffa80`05b0c4d0 fffffa80`057cf4d0 fffff800`00000000 : nt!FindNodeOrParent+0x3d
fffff880`0d459860 fffff880`016cb631 : 00110000`0002a899 fffff880`016d0195 fffff8a0`00000000 fffff980`033bf800 : nt!RtlLookupElementGenericTableFullAvl+0x15
fffff880`0d459890 fffff880`01697cf6 : fffffa80`057cf4d0 fffffa80`082f6180 fffffa80`057cf4d0 00110000`0002a899 : Ntfs!NtfsCreateFcb+0x79
fffff880`0d459970 fffff880`016bbb04 : fffff880`0ae564b0 fffffa80`05b0c4d0 fffffa80`057cf4d0 00000000`00000000 : Ntfs!NtfsOpenFile+0x1ca
fffff880`0d459b50 fffff880`01624c0d : fffffa80`057cf4d0 fffffa80`05b0c4d0 fffff880`0ae564b0 fffffa80`0a6a8000 : Ntfs!NtfsCommonCreate+0xc54
fffff880`0d459d30 fffff800`034815c7 : fffff880`0ae56420 00000000`003707c0 00000000`77654270 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`0d459d60 fffff800`03481581 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KySwitchKernelStackCallout+0x27
fffff880`0ae562f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFcbTableCompare+3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc14f
STACK_COMMAND: .cxr 0xfffff8800d458e50 ; kb
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
BUCKET_ID: X64_0x24_Ntfs!NtfsFcbTableCompare+3
Followup: MachineOwner
---------
Debug session time: Sat Nov 20 20:09:48.725 2010 (GMT-5)
System Uptime: 0 days 0:03:37.754
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff8000371e8df, fffff88009b9a070, 0}
Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+36b )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000371e8df, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88009b9a070, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiUnsecureVirtualMemory+15f
fffff800`0371e8df 488b0f mov rcx,qword ptr [rdi]
CONTEXT: fffff88009b9a070 -- (.cxr 0xfffff88009b9a070)
rax=0000000000000100 rbx=fffffa800abc3b60 rcx=0000000000000100
rdx=0000000000000000 rsi=fffffa800b4b3060 rdi=0000000000000100
rip=fffff8000371e8df rsp=fffff88009b9aa40 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=00000000000035be
r11=fffff88009b9aa50 r12=fffffa800b4b3278 r13=0000000000000005
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!MiUnsecureVirtualMemory+0x15f:
fffff800`0371e8df 488b0f mov rcx,qword ptr [rdi] ds:002b:00000000`00000100=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff96000105403 to fffff8000371e8df
STACK_TEXT:
fffff880`09b9aa40 fffff960`00105403 : 00000000`00000001 fffff900`c00bf010 fffff900`c2923b10 00000000`00000000 : nt!MiUnsecureVirtualMemory+0x15f
fffff880`09b9aa70 fffff960`001057b4 : ffffffff`00000000 fffff880`00000000 fffff900`c2923b10 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x36b
fffff880`09b9abc0 fffff960`000c66e5 : ffffffff`b00511ea fffff900`c2923b10 00000000`000011ea 00000000`7efdb000 : win32k!bDeleteSurface+0x34
fffff880`09b9abf0 fffff800`03476993 : fffffa80`0abc3b60 fffff880`09b9aca0 00000000`062d0b60 00000000`0000c03b : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`09b9ac20 00000000`72bc2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0016e968 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x72bc2dd9
FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+36b
fffff960`00105403 e90d020000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`00105615)
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+36b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c7dc13c
STACK_COMMAND: .cxr 0xfffff88009b9a070 ; kb
FAILURE_BUCKET_ID: X64_0x3B_win32k!SURFACE::bDeleteSurface+36b
BUCKET_ID: X64_0x3B_win32k!SURFACE::bDeleteSurface+36b
Followup: MachineOwner
---------
Debug session time: Sat Nov 20 20:28:13.204 2010 (GMT-5)
System Uptime: 0 days 0:01:22.233
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff800037a322c, 0, 100}
Probably caused by : memory_corruption ( nt!MiApplyCompressedFixups+40 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800037a322c, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000100, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!MiApplyCompressedFixups+40
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx]
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000100
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036f30e0
0000000000000100
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: Driver Sweeper
CURRENT_IRQL: 0
EXCEPTION_RECORD: fffff8800c791618 -- (.exr 0xfffff8800c791618)
ExceptionAddress: fffff800037a322c (nt!MiApplyCompressedFixups+0x0000000000000040)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000100
Attempt to read from address 0000000000000100
TRAP_FRAME: fffff8800c7916c0 -- (.trap 0xfffff8800c7916c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8a0023eb000 rbx=0000000000000000 rcx=fffffa800b29c2d0
rdx=fffff880029f6000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800037a322c rsp=fffff8800c791850 rbp=0000000000000003
r8=0000000000000100 r9=0000000000e70000 r10=0000000000000fff
r11=fffff880029f6000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!MiApplyCompressedFixups+0x40:
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx] ds:0488:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800034f5a39 to fffff800034bb740
STACK_TEXT:
fffff880`0c790e48 fffff800`034f5a39 : 00000000`0000001e ffffffff`c0000005 fffff800`037a322c 00000000`00000000 : nt!KeBugCheckEx
fffff880`0c790e50 fffff800`034bad82 : fffff880`0c791618 00000000`00000100 fffff880`0c7916c0 00000000`00e70000 : nt!KiDispatchException+0x1b9
fffff880`0c7914e0 fffff800`034b98fa : 00000000`00000000 00000000`00000100 00000000`00000000 fffffa80`0ad6b420 : nt!KiExceptionDispatch+0xc2
fffff880`0c7916c0 fffff800`037a322c : fffff700`01080000 00000000`00000000 00000000`00000001 00000000`00158234 : nt!KiPageFault+0x23a
fffff880`0c791850 fffff800`037a30b1 : fffff880`029f6000 00000000`00e70000 00000000`00174000 fffffa80`03a02750 : nt!MiApplyCompressedFixups+0x40
fffff880`0c7918a0 fffff800`03790344 : fffffa80`00000000 fffffa80`0b01b060 00000000`00000000 fffffa80`00000000 : nt!MiPerformFixups+0x65
fffff880`0c7918f0 fffff800`034acc4c : fffffa80`03a02750 fffffa80`081fd950 00000000`00000000 00000000`00000000 : nt!MiRelocateImagePfn+0x114
fffff880`0c791950 fffff800`034ad52b : fffffa80`081fd890 fffff880`0c791a80 fffffa80`0afdf6b8 fffffa80`0b01b060 : nt!MiWaitForInPageComplete+0x89c
fffff880`0c791a30 fffff800`034d68bb : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff683`00000000 : nt!MiIssueHardFault+0x28b
fffff880`0c791ac0 fffff800`034b982e : 00000000`00000000 00000000`00174288 000007ff`0076ca01 00000000`001ecde8 : nt!MmAccessFault+0x14bb
fffff880`0c791c20 000007fe`f1a28912 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`001ec230 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7fe`f1a28912
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiApplyCompressedFixups+40
fffff800`037a322c 0fb603 movzx eax,byte ptr [rbx]
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!MiApplyCompressedFixups+40
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
BUCKET_ID: X64_0x1E_nt!MiApplyCompressedFixups+40
Followup: MachineOwner
---------
In your dumps, two unloaded modules caught my eye. Unloaded modules are modules involved in the crash, but not necessarily the cause of the crash.
des2svr.exe - part of Gigabyte's Energy Saver program. Program Files\GIGABYTE\EnergySaver2\des2svr.exe.
Uninstall Gigabyte's Easy Saver program, as it is known to cause BSODs.
RTCore64.sys - RivaTuner/EVGA Precision/MSI Afterburner (known issues w/Win7),
RivaTuner. Uninstall this program. It is not compatible with Win 7
Out of date drivers can and do cause memory corruption and BSOD's. I find the following out of date drivers loading on your system. Those in red font are quite obsolete. Update or eliminate these drivers.
athrxu6.sys Wed Jul 04 22:58:34 2007 - Atheros Extensible Wireless LAN device driver OEM - none at
http://www.atheros.com/pt/index.html. This driver is way obsolete. Try to update this driver from your computer manufacturer's website. If there is no update, purcahse a new wireless adpater and uninstall this one.
gdrv.sys Thu Mar 12 23:22:29 2009 - GIGABYTE Tools, Uninstall Gigabyte's Easy Saver program, as it is known to cause BSODs.
GVTDrv64.sys Tue Sep 05 03:10:02 2006 - Gigabyte EasyTune6 driver (known issues w/Win7)
GIGABYTE - Support & Downloads - Utility - Motherboard. This is an XP driver. Uninstall this software.
iaStorV.sys Wed Apr 08 12:57:17 2009 - Intel Matrix Storage Manager driver (base)
http://downloadcenter.intel.com/Default.aspx. Update this driver.
RTCore64.sys - RivaTuner/EVGA Precision/MSI Afterburner (known issues w/Win7),
RivaTuner. Uninstall RivaTuner.
Update or eliminate the above drivers and/or programs. Reboot and run your system. Let's see if this resolves the problem. Post back and let us know. If you get another BSOD, upload it and we will go from there.
How to find drivers -
- I have listed links to most of the drivers in the code box above. Please use the links there to see what info I've found about those drivers.
- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads