3 BSOD's in 4 days - all different (revised w/ attachments)

chayden · 16 Dec 2010

I have an HP HDX 16 premium notebook (64 bit), which I purchased in August '09.
It came with Vista but upgraded as soon as possible to Windows 7 Ultimate (free upgrade was part of the purchase deal). I think it is OEM. I had a problem in May of 2010 with the system not accepting windows updates, and was directed to do a complete reinstall (ie starting with the vista then the upgrade) so I assume this is not the full retail version. Other than this I have not had any serious problems till now.

However, in the last few days I have gotten 3 blue screens for no apparent reason.

I have attached the required information. In addition, here is what I have done to troubleshoot:

1. I ran the Windows Memory Diagnostic from Administrative Tools and it indicated the memory had no problems.
2. I ran 2 virus scans (Malware Bytes and Kaspersky Anti-Virus Tool) and no viruses were identified.

Recent new hardware:
• a logictech m310 mouse (3 weeks ago & driver appears fine)
• a new power cord (purchased on ebay 3 weeks ago, but with the exact same model number as the original)
• an old line conditioner - connected 1 or 2 days before first bsod (hasn’t been used in several years but appears to be functioning fine - but timing here correlates with bsod's). Today I disconnected it.

Could any of these be causing the problem?

I am hoping someone can put all this information together to help me identify the probable cause of the blue screens.

Thanks for your help.

CarlTR6 · 16 Dec 2010

Hi, chayden; welcome to the forum. I looked at you three most recent dumps. Each has a different error code and each indicates memory corruption. Thus you will have to troubleshoot by a process of elimination.

To begin this process, I recommend that you uninstall Kaspersky using this removal tool: Tool. Kaspersky is a known cause of BSOD's on some Win 7 systems. ONce your system is stable, you can try Kaspersky again; but I do not recommend doing so. Download and install Microsoft Security Essentials while you are troubleshooting and make sure Windows Firewall is turned on.

You have three outdated drivers loaded on your system. Two of them are quite obsolete. Outdated drivers can and do cause conflicts, memory corruption and BSOD's. Update or rename these drivers.

enecir.sys Thu Sep 04 05:47:58 2008 - ENE Consumer IR Driver for eHome. OEM - none at http://www.ene.com.tw/en/index.asp. You can try to update this driver through the HP website. If there is no update availalbe, rename the driver. See note below.

HpqKbFiltr.sys Wed Apr 29 09:48:30 2009 - HP Quick Launch Buttons HpqKbFiltr Keyboard Filter driver. http://www.hp.com/#Support. Update ths driver.

MRESP50a64.SYS Sat Nov 19 03:14:28 2005 - NDIS Protocol kernel driver. I was unable to find manufacturer of this driver. Motive? It is way obsolete and is an XP driver. I suggest that you rename this driver and see what it breaks.

Note

Renaming drivers: Create a restore point. Navigate to C:\Windows\System32\Drivers, locate the driver and rename it from .sys to .old. Reboot and the driver will not load. If you do not find the driver, do a search of your C: drive for the specific driver.

Uninstall Kaspsersky and update or rename these three drivers. Reboot ans let's see how your system runs. Update us and let us know. If you get another BSOD, upload it and we will go from there.

Code:

Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e4ee50
Debug session time: Sun Dec 12 13:00:30.994 2010 (GMT-5)
System Uptime: 0 days 3:42:07.054
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa7ff5afffd8, 2, 1, fffff80002ca23a4}

Probably caused by : memory_corruption ( nt!MiUnlinkFreeOrZeroedPage+1ca )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa7ff5afffd8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ca23a4, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb90e0
 fffffa7ff5afffd8 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiUnlinkFreeOrZeroedPage+1ca
fffff800`02ca23a4 48893cc2        mov     qword ptr [rdx+rax*8],rdi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880009a9a10 -- (.trap 0xfffff880009a9a10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffffffeb5fffa rbx=0000000000000000 rcx=0000000000000006
rdx=fffffa8000000008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ca23a4 rsp=fffff880009a9ba0 rbp=0000000000000004
 r8=0000000000000000  r9=0000000000000000 r10=fffffa8003c00ac0
r11=fffff880009a9c08 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!MiUnlinkFreeOrZeroedPage+0x1ca:
fffff800`02ca23a4 48893cc2        mov     qword ptr [rdx+rax*8],rdi ds:fffffa7f`f5afffd8=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c80ca9 to fffff80002c81740

STACK_TEXT:  
fffff880`009a98c8 fffff800`02c80ca9 : 00000000`0000000a fffffa7f`f5afffd8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009a98d0 fffff800`02c7f920 : 00000000`00000000 fffffa80`00e7b4c0 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`009a9a10 fffff800`02ca23a4 : 00000000`00000000 00000000`00000000 fffffa80`03cd05b0 fffff800`02cc8985 : nt!KiPageFault+0x260
fffff880`009a9ba0 fffff800`02cc84c6 : 00000000`0000003f 00000000`00000004 00000000`00000002 00000000`00000000 : nt!MiUnlinkFreeOrZeroedPage+0x1ca
fffff880`009a9c10 fffff800`02f25c06 : fffffa80`03cd05b0 00000000`00000080 fffffa80`03cd0b30 fffff800`02c5fc19 : nt!MmZeroPageThread+0x551
fffff880`009a9d40 fffff800`02c5fc26 : fffff800`02dfbe80 fffffa80`03cd05b0 fffff800`02e09c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiUnlinkFreeOrZeroedPage+1ca
fffff800`02ca23a4 48893cc2        mov     qword ptr [rdx+rax*8],rdi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiUnlinkFreeOrZeroedPage+1ca

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiUnlinkFreeOrZeroedPage+1ca

BUCKET_ID:  X64_0xA_nt!MiUnlinkFreeOrZeroedPage+1ca

Followup: MachineOwner
---------

Debug session time: Sun Dec 12 20:28:24.291 2010 (GMT-5)
System Uptime: 0 days 7:26:52.351
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff900c2331d18, 0, fffff960001178f9, 2}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!FindTimer+59 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff900c2331d18, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960001178f9, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efd0e0
 fffff900c2331d18 

FAULTING_IP: 
win32k!FindTimer+59
fffff960`001178f9 4c396b28        cmp     qword ptr [rbx+28h],r13

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  OUTLOOK.EXE

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88003712a00 -- (.trap 0xfffff88003712a00)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000005b06 rbx=0000000000000000 rcx=fffff9600033dec0
rdx=0000000000005b06 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001178f9 rsp=fffff88003712b90 rbp=fffff900c2331d60
 r8=0000000000000000  r9=0000000000000001 r10=fffff960000e4734
r11=000000007efdb000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe cy
win32k!FindTimer+0x59:
fffff960`001178f9 4c396b28        cmp     qword ptr [rbx+28h],r13 ds:7355:00000000`00000028=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d448f2 to fffff80002cc5740

STACK_TEXT:  
fffff880`03712898 fffff800`02d448f2 : 00000000`00000050 fffff900`c2331d18 00000000`00000000 fffff880`03712a00 : nt!KeBugCheckEx
fffff880`037128a0 fffff800`02cc382e : 00000000`00000000 fffff900`c2331cf0 00000000`00000000 fffff960`000ee113 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`03712a00 fffff960`001178f9 : 00000000`7efdb000 00000000`00000000 00000000`00005b06 fffff800`02cd11e3 : nt!KiPageFault+0x16e
fffff880`03712b90 fffff960`000e4796 : 00000000`00000000 00000000`00005b06 fffff880`03712ca0 00000000`00005b06 : win32k!FindTimer+0x59
fffff880`03712be0 fffff800`02cc4993 : fffffa80`03ea5060 00000000`0e2af6f0 00000000`001fb5ca 00000000`00000020 : win32k!NtUserKillTimer+0x62
fffff880`03712c20 00000000`733d2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0027ea78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x733d2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!FindTimer+59
fffff960`001178f9 4c396b28        cmp     qword ptr [rbx+28h],r13

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!FindTimer+59

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c7dc13c

FAILURE_BUCKET_ID:  X64_0x50_win32k!FindTimer+59

BUCKET_ID:  X64_0x50_win32k!FindTimer+59

Followup: MachineOwner
---------

Debug session time: Tue Dec 14 22:27:59.112 2010 (GMT-5)
System Uptime: 0 days 0:17:05.047
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {3, fffff80002e171e0, fffff80000000048, 52800001000}

Unable to load image kl1.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for kl1.sys
*** ERROR: Module load completed but symbols could not be loaded for kl1.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+a56 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000003, the pool freelist is corrupt.
Arg2: fffff80002e171e0, the pool entry being checked.
Arg3: fffff80000000048, the read back flink freelist value (should be the same as 2).
Arg4: 0000052800001000, the read back blink freelist value (should be the same as 2).

Debugging Details:
------------------


BUGCHECK_STR:  0x19_3

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  McciServiceHos

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002dbad6f to fffff80002c87740

STACK_TEXT:  
fffff880`0c765498 fffff800`02dbad6f : 00000000`00000019 00000000`00000003 fffff800`02e171e0 fffff800`00000048 : nt!KeBugCheckEx
fffff880`0c7654a0 fffff800`02ca8536 : ffffffff`00000000 00000000`00000008 fffffa80`0435a7d0 fffff880`00000000 : nt!ExDeferredFreePool+0xa56
fffff880`0c765590 fffff880`02ce5a1b : 00000000`00000000 00000000`00000001 00000000`00000000 0000ffff`00001f80 : nt!ExAllocatePoolWithQuotaTag+0x56
fffff880`0c7655e0 fffff880`02ce6d8a : fffff880`0c7658a0 00000000`00000070 fffffa80`03fb6d38 fffff880`0c7658a0 : nsiproxy!NsippProbeAndAllocateParameters+0x447
fffff880`0c765740 fffff880`02ce88e8 : fffffa80`03fb6d38 fffffa80`03fb6c20 00000000`c0000001 fffffa80`03fb6c58 : nsiproxy!NsippEnumerateObjectsAllParameters+0x266
fffff880`0c765930 fffff880`02ce89db : 00000000`000009c4 fffff800`02dbb4d3 fffa8005`1d249000 00000000`000000ff : nsiproxy!NsippDispatchDeviceControl+0x70
fffff880`0c765970 fffff880`03a02dbe : 00000000`0012001b 00000000`00000000 00000000`0012001b 00000000`c0000001 : nsiproxy!NsippDispatch+0x4b
fffff880`0c7659a0 00000000`0012001b : 00000000`00000000 00000000`0012001b 00000000`c0000001 00000000`00000000 : kl1+0x2dbe
fffff880`0c7659a8 00000000`00000000 : 00000000`0012001b 00000000`c0000001 00000000`00000000 00000000`00000000 : 0x12001b


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExDeferredFreePool+a56
fffff800`02dbad6f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExDeferredFreePool+a56

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a56

BUCKET_ID:  X64_0x19_3_nt!ExDeferredFreePool+a56

Followup: Pool_corruption
---------

1: kd> lmtsmn
start             end                 module name
fffff880`0533b000 fffff880`05379000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`053ef000 fffff880`053fb000   Accelerometer Accelerometer.sys Fri Feb 26 11:12:18 2010 (4B87F2E2)
fffff880`00f82000 fffff880`00fd9000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`03f29000 fffff880`03fb3000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`02c00000 fffff880`02c16000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`00df3000 fffff880`00dfe000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`0a918000 fffff880`0a923000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`00c76000 fffff880`00c7f000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00dae000 fffff880`00dd8000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`00d8d000 fffff880`00d99000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`01866000 fffff880`0186d000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02dab000 fffff880`02dbc000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`05400000 fffff880`0541e000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`006f0000 fffff960`00717000   cdd      cdd.dll      Wed May 19 15:48:26 2010 (4BF4408A)
fffff880`01986000 fffff880`019b0000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00e0f000 fffff880`00ecf000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`0455a000 fffff880`0456c000   circlass circlass.sys Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`0191e000 fffff880`0194e000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00ce7000 fffff880`00d45000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`02df8000 fffff880`02dfc500   CmBatt   CmBatt.sys   Mon Jul 13 19:31:03 2009 (4A5BC3B7)
fffff880`01114000 fffff880`01187000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e00000 fffff880`00e09000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`04800000 fffff880`04810000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`08e14000 fffff880`08e22000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02d0a000 fffff880`02d8d000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02d8d000 fffff880`02dab000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02cfb000 fffff880`02d0a000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`01908000 fffff880`0191e000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`08ecf000 fffff880`08ef1000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`08e39000 fffff880`08e4c000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`08e2e000 fffff880`08e39000   dump_msahci dump_msahci.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`08e22000 fffff880`08e2e000   dump_pciidex dump_pciidex.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`08fc0000 fffff880`08fcc000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`04080000 fffff880`04174000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`04174000 fffff880`041ba000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`053c6000 fffff880`053e2000   enecir   enecir.sys   Thu Sep 04 05:47:58 2008 (48BFAECE)
fffff880`010a2000 fffff880`010b6000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`01056000 fffff880`010a2000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`013e7000 fffff880`013f1000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`018ce000 fffff880`01908000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`0148b000 fffff880`014d5000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`053e2000 fffff880`053ef000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`031f3000 fffff800`0323c000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`041c7000 fffff880`041eb000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`08ef7000 fffff880`08f53000   HdAudio  HdAudio.sys  Mon Jul 13 20:06:59 2009 (4A5BCC23)
fffff880`08f64000 fffff880`08f7d000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`08f53000 fffff880`08f64000   hidir    hidir.sys    Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`08f7d000 fffff880`08f85080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`08fcc000 fffff880`08fda000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`01209000 fffff880`01213000   hpdskflt hpdskflt.sys Fri Feb 26 11:12:18 2010 (4B87F2E2)
fffff880`05622000 fffff880`0562e000   HpqKbFiltr HpqKbFiltr.sys Wed Apr 29 09:48:30 2009 (49F85AAE)
fffff880`0551b000 fffff880`055e3000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`01200000 fffff880`01209000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`053a8000 fffff880`053c6000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`02de2000 fffff880`02df8000   intelppm intelppm.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`05600000 fffff880`05622000   jmcr     jmcr.sys     Mon Oct 20 05:31:04 2008 (48FC4FD8)
fffff880`0562e000 fffff880`0563d000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`08f86000 fffff880`08f94000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bb1000 fffff800`00bbb000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`03a00000 fffff880`03f29000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffff880`013f1000 fffff880`013ff000   klbg     klbg.sys     Wed Oct 14 13:18:13 2009 (4AD607D5)
fffff880`01800000 fffff880`0185d000   klif     klif.sys     Wed Nov 11 08:32:16 2009 (4AFABCE0)
fffff880`0103a000 fffff880`01044000   klim6    klim6.sys    Tue Nov 03 08:33:29 2009 (4AF03129)
fffff880`041eb000 fffff880`041f5000   klmouflt klmouflt.sys Fri Oct 02 11:38:29 2009 (4AC61E75)
fffff880`04517000 fffff880`0455a000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013bc000 fffff880`013d6000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`08ef1000 fffff880`08ef6200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`08fda000 fffff880`08fef000   LHidFilt LHidFilt.Sys Tue Aug 24 13:21:36 2010 (4C73FFA0)
fffff880`05488000 fffff880`0549d000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`08e00000 fffff880`08e14000   LMouFilt LMouFilt.Sys Tue Aug 24 13:21:43 2010 (4C73FFA7)
fffff880`0194e000 fffff880`01971000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00c8f000 fffff880`00cd3000   mcupdate mcupdate.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`08e7a000 fffff880`08e88000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`04067000 fffff880`04076000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`08f94000 fffff880`08fa1000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00c5c000 fffff880`00c76000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`0a90c000 fffff880`0a918000   MRESP50a64 MRESP50a64.SYS Sat Nov 19 03:14:28 2005 (437EDEE4)
fffff880`0541e000 fffff880`0544b000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0a235000 fffff880`0a283000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`0a283000 fffff880`0a2a6000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`00dd8000 fffff880`00de3000   msahci   msahci.sys   Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`019b0000 fffff880`019bb000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fe2000 fffff880`00fec000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`010b6000 fffff880`01114000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02cf0000 fffff880`02cfb000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`015e6000 fffff880`015f8000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`014f4000 fffff880`015e6000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`01044000 fffff880`01050000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`054f0000 fffff880`05503000   ndisuio  ndisuio.sys  Mon Jul 13 20:09:25 2009 (4A5BCCB5)
fffff880`04485000 fffff880`044b4000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`045d8000 fffff880`045ed000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02c55000 fffff880`02c64000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`03fb3000 fffff880`03ff8000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`0563d000 fffff880`05d9c000   NETw5s64 NETw5s64.sys Wed Jan 13 11:37:13 2010 (4B4DF6B9)
fffff880`019bb000 fffff880`019cc000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02ce4000 fffff880`02cf0000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02c17000 fffff800`031f3000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01219000 fffff880`013bc000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`0185d000 fffff880`01866000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`05339000 fffff880`0533a180   nvBridge nvBridge.kmd Sat Oct 03 13:34:49 2009 (4AC78B39)
fffff880`04815000 fffff880`05338180   nvlddmkm nvlddmkm.sys Sat Oct 03 14:02:29 2009 (4AC791B5)
fffff880`0549d000 fffff880`054f0000   nwifi    nwifi.sys    Mon Jul 13 20:07:23 2009 (4A5BCC3B)
fffff880`011d3000 fffff880`011f9000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00d78000 fffff880`00d8d000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d45000 fffff880`00d78000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00de3000 fffff880`00df3000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`013d6000 fffff880`013e7000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`0a2a6000 fffff880`0a34c000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`08e92000 fffff880`08ecf000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cd3000 fffff880`00ce7000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`02c16000 fffff880`02c3a000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`044b4000 fffff880`044cf000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`044cf000 fffff880`044f0000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`044f0000 fffff880`0450a000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02c93000 fffff880`02ce4000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`0450a000 fffff880`04515000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`018b0000 fffff880`018b9000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`018b9000 fffff880`018c2000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`018c2000 fffff880`018cb000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01000000 fffff880`0103a000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`05503000 fffff880`0551b000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`05da9000 fffff880`05df8000   Rt64win7 Rt64win7.sys Sat Dec 19 04:11:30 2009 (4B2C98C2)
fffff880`05379000 fffff880`053a8000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`0a34c000 fffff880`0a357000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`014e5000 fffff880`014ed000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0a876000 fffff880`0a90c000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`0a396000 fffff880`0a3fd000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`0a357000 fffff880`0a384000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`04400000 fffff880`0447b000   stwrt64  stwrt64.sys  Tue Jul 21 18:42:28 2009 (4A664454)
fffff880`04515000 fffff880`04516480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01603000 fffff880`01800000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`0a384000 fffff880`0a396000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`019ea000 fffff880`019f7000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`019cc000 fffff880`019ea000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02c7f000 fffff880`02c93000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`005a0000 fffff960`005aa000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02dbc000 fffff880`02de2000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`0456c000 fffff880`0457e000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`08fa1000 fffff880`08fbe000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`08fbe000 fffff880`08fbff00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`04056000 fffff880`04067000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0457e000 fffff880`045d8000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04000000 fffff880`04056000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`041ba000 fffff880`041c7000   usbuhci  usbuhci.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`08e4c000 fffff880`08e79200   usbvideo usbvideo.sys Wed Mar 03 23:40:57 2010 (4B8F39D9)
fffff880`00fec000 fffff880`00ff9000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`0186d000 fffff880`0187b000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`0187b000 fffff880`018a0000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`014d5000 fffff880`014e5000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00d99000 fffff880`00dae000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01187000 fffff880`011d3000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`05d9c000 fffff880`05da9000   vwifibus vwifibus.sys Mon Jul 13 20:07:21 2009 (4A5BCC39)
fffff880`02c3f000 fffff880`02c55000   vwififlt vwififlt.sys Mon Jul 13 20:07:22 2009 (4A5BCC3A)
fffff880`02c64000 fffff880`02c7f000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`018a0000 fffff880`018b0000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ecf000 fffff880`00f73000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f73000 fffff880`00f82000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`019f7000 fffff880`01a00000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`000d0000 fffff960`003df000   win32k   win32k.sys   Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`04076000 fffff880`0407f000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fd9000 fffff880`00fe2000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`05467000 fffff880`05488000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`0a923000 fffff880`0a994000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0194e000 fffff880`0195c000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0195c000 fffff880`01968000   dump_pciidex
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01968000 fffff880`01973000   dump_msahci.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01973000 fffff880`01986000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

chayden · 17 Dec 2010

Hi Carl:
Thanks for your analysis. I realized in following your directions that there were other troubleshooting steps I had forgotten to mention that I did before contacting you initially. (But after the blue screens).

First, I had downloaded new drivers -- for NVIDIA graphics card and for an audio codec. And I had updated the BIOS (which was only a few months newer than what I had, but did anyway).
Second, I had run Wise Registry Cleaner.

Since my troubleshooting (and before contacting you) I have not had any blue screens.

But I attempted to follow your directions with the following results.

I deleted Kaspersky, installed Microsoft Security Essentials and turned on the Windows Defender and Firewall (must say I am not happy about this -- have never had problems with Kaspersky and while I'm sure MS Essentials is a good product I don't believe it is nearly as comprehensive as Kaspersky. I want to solve my problem though so I am trying all suggestions.)

Next I downloaded the new driver for the quick launch buttons. I hadn't bothered updating the driver earlier because I don't use the quick launch button feature. Also, I had the auto startup turned off in msconfig. Could the out of date driver have caused a bluescreen?.

Then I renamed enecir.sys -- couldn't find a newer version on the HP site.

Finally, I looked for mresp50a64.sys and couldn't find in driver folder -- then couldn't find in a search either. Nothing came close. Where did you get the info about this driver on my computer?

So -- doesn't seem like much has changed...
What do we know? What next?

Thanks for your help.

CarlTR6 · 17 Dec 2010

Hi chayden,

Once you get your system stable, you can certainly reinstall Kaspersky. I would not if it were me simply because MSE (not Defender) is good and lighter weight. If you reinstall it and start getting BSOD's again, you will know Kaspersky is the cause. I run Avast which works well with Win 7. The only thing I do not like about MSE is the lack of an email scanner. Many third party security programs cause problems with Win 7 and there are valid reasons why this happens.

Look in the code box in my post above and scroll down to the last dump listed there. Toward the bottom is a list of all your drivers loaded on the system. You will see mresp50a64.sys there. The drivers are in alphabetical order. Do you have anything by Motive installed on your system? Did you do a search of your C: drive for this driver? Sometimes these drivers are in the Programs Files folder, either in a specific program folder or in the Common Files folder. On your computer, it is located here: C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS. How's that for a fast search?

Yes, an out of date driver can cause a BSOD, some more so than others. Third party drivers dated prior to July 13, 2009 are not designed and programmed for Win 7. Generally speaking, the older they are, the worse they are. Win 7 is not an evolution from XP; it is a totally new OS. Win 7 is different even from Vista. Hardware and software designed for XP will not run on Win 7 without problems except in Win 7's XP mode. Some Vista drivers will work with Win 7. The July 13th date does not hold true for Windows (MS drivers).

Regarding your quick launch button, whether you use it or not, the driver loads on your system in case you do decide to use it.

At this point, it seems that you have eliminated most if not all of the known potential BSOD causes - and that it what troubleshooting is, a process of elimination. Run your system and see how it does. Barring a hard issue like bad RAM, faulty PSU, etc., my guess is that outdated drivers were the cause of your problem. YOu only know by running your system and seeing if the BSOD's have stopped. Please updated us and let us know.