System_Service_Exception bsod windows 07 x64

SooConfused · 15 Jan 2011

Keep getting Sytem_Service_Exception bsod. I have reached the limits of my limited knowledge of programs and i dont know what to do anymore. I ma using windows 07 x64 and it was at first bsoding due to Memory_Management.

I reinstalled windows and it bsoded during installation until i formatted the hardrive. its seems to be at random although it has happened twice went opening up and closing AVG free 2011.
I would include the memory dump of the bsods but i am afraid i dont know how to.

The computor is newly built, and in the first version of windows driver verifier showed that my graphics card driver, ATI radeon 5770 was faulty. i have not used verifier in the reinstalled verion although i have used memtest multiple times and no problems have been detetcted.
Afetr removing the faulty driver in the uninstalled version, it made no difference except to remove the IRQL_not_less_or_equal, but it did not help with Memory_management Bsod.

The power supply supplied a very small SATA power supply so i had to buy a molex extender. Due to this, during the first installationi think it may not have installed properly because the power supply was not correctly fitted to the hadrive. Since the reisallation i have no Memory_management Bsod.

Recently i scaned with sfc/scannow to find no problems. In safe mode after a bsod i used avg to scan for viruses. During which it bsoded with APX_index_Mismatch.
I hope that all made sense, thank you in advance.

CarlTR6 · 15 Jan 2011

Hi SooConfused and welcome to the forum. Please read this thread, follow the instructions and post back. We will be glad to help you.

https://www.sevenforums.com/crashes-d...tructions.html

SooConfused · 30 Jan 2011

Sorry it has taken so long to reply, but i have done some changes to the system.

First of all, i have reinstalled windows from a different (and it seems not corrupt disk). I still however get System_service_exception and IRQL_not_less_or_equal. In the hours of research i have done, i have downloaded bluescreenviewer and it points the driver problem to ntoskrnl. I then found a hotfix to this problem, but on a thread who has almost the exact situation i have, they say that this does not sort the problem. Only his motherboard was different, and they were explaining about going into the bios to change ACPI function, but i have a Gigabyte motherboard.

This is the thread:

BSoD IRQL not less or equal / stop 0x00000000A when using pc for a long time

I am currently using the computor as a test to see if the hotfix has worked, but it happens on rare occasions and i will have to wait to see results. I will upload the .dmp files soon.

Thank you.

SooConfused · 30 Jan 2011

another update on troubleshooting, while running the BSOD Dump & System File Collection app, the computor bsodded. I believe it was loading and crashed around then point when it searching for conflicts/sharing. I am also listing the bugchecks the top one being most recent and what occurred during BSOD Dump & System File Collection app.

0x0000003b
0x0000000a
0x0000000e
0x0000000a
0x00000024
0x0000001e

SooConfused · 30 Jan 2011

This is the BSOD Dump & System File Collection app results when running it in safe mode. Also, i got a new bsod caused apparently by a NTFS file system after the hotfix.

SooConfused · 31 Jan 2011

One last update, upon checking system settings i have found that the ATI Radeon HD 5700 series has an IRQL of 4294967294 and the realtek family PCI-E gigabit ethernet NIC has 4294967293. Bearing in mind this is a jump from an IRQL of 190, the driver verifier (when last used with a different system) said that the driver was faulty and the blue screen sometimes says IRQL_NOT_LESS_OR_EVEN

CarlTR6 · 31 Jan 2011

Thanks for uploading the files. I looked at your five most recent dumps. The bugchecks are listed from oldest to latest. Notice the usual causes. Four different bugcheck codes in five bugchecks indicates a hardware or hardware related (drivers) problem.

Bugcheck A, IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility.

Bugcheck 7E, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED. Usual causes: Insufficient disk space, Device driver, Video card, BIOS, Breakpoint with no debugger attached, Hardware incompatibility, Faulty system service, Memory, 3rd party remote control.

Bugcheck 3B, SYSTEM_SERVICE_EXCEPTION. Usual causes: System service, Device driver, graphics driver, ?memory

Bugcheck 24, NTFS_FILE_SYSTEM. Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure.

I recommend that you completely uninstall AVG using this removal tool: Tool (64 bit). If you have Identity Protection installed, remove it with this tool: Tool. AVG is a known cause of BSOD's on some Win 7 systems. Download and install Microsoft Security Essentials in its place.

Update this driver through the link provided:

Rt64win7.sys Thu Feb 26 04:04:13 2009 - Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC. Realtek.

Reboot and let's see how your system does. See if this fixes the problem or, at least, makes your system more stable. Please post back and let us know.

If you get another BSOD, upload it and test your RAM with Memtest 86+following the instruction in this tutorial: RAM - Test with Memtest86+. Run Memtest from a cold boot after your computer has been off for an hour or so. Let it run for 7 passes; this will take 6-8 hours. Post back with your results.

If, and only if, you get no errors with Memtest, enable Driver Verifier carefully following the instructions in this tutorial: Driver Verifier - Enable and Disable. Upload an and all dumps triggered by Driver Verifier.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a08000 PsLoadedModuleList = 0xfffff800`02c45e50
Debug session time: Sat Jan 29 15:17:25.885 2011 (GMT-5)
System Uptime: 0 days 0:21:34.321
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {28, 2, 0, fffff80002aba518}

Probably caused by : memory_corruption ( nt!MiFindNodeOrParent+0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002aba518, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cb00e0
 0000000000000028 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiFindNodeOrParent+0
fffff800`02aba518 48f7412800ffffff test    qword ptr [rcx+28h],0FFFFFFFFFFFFFF00h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  fffff8800550f400 -- (.trap 0xfffff8800550f400)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002aba518 rsp=fffff8800550f598 rbp=0000000000000000
 r8=fffff8800550f5e0  r9=0000000000000000 r10=fffffa8003c82270
r11=0000058000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!MiFindNodeOrParent:
fffff800`02aba518 48f7412800ffffff test    qword ptr [rcx+28h],0FFFFFFFFFFFFFF00h ds:3000:00000000`00000028=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a77ca9 to fffff80002a78740

STACK_TEXT:  
fffff880`0550f2b8 fffff800`02a77ca9 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0550f2c0 fffff800`02a76920 : 00000000`00000000 fffffa80`03c822b8 00000000`00000001 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0550f400 fffff800`02aba518 : fffff800`02abe2d7 00000000`000007ff 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`0550f598 fffff800`02abe2d7 : 00000000`000007ff 00000000`00000000 00000000`00000000 00001f80`00000000 : nt!MiFindNodeOrParent
fffff880`0550f5a0 fffff800`02abe25d : fffff8a0`002feb68 00000000`00000000 fffff880`0550f7c0 00000000`00000001 : nt!MiLocateAddressInTree+0x17
fffff880`0550f5d0 fffff800`02abe368 : 00000000`00000002 fffffa80`03c82328 00000000`000000ce fffffa80`03c82328 : nt!MiGetSharedProtosAtDpcLevel+0xbd
fffff880`0550f620 fffff800`02a161cb : 000067ee`7ebfd87d 00000000`00000000 00000000`00000000 fffff800`02a9b139 : nt!MiGetSharedProtos+0x18
fffff880`0550f650 fffff800`02b2ac4b : 00000000`00029a55 02000000`00050954 00000000`000018c0 fffff800`02d3f35b : nt! ?? ::FNODOBFM::`string'+0x927b
fffff880`0550f680 fffff800`02b2b7cb : 00000000`00000000 00000000`00000004 fffffa80`03ea3250 fffffa80`03ea3000 : nt!MiIdentifyPfn+0x39b
fffff880`0550f720 fffff800`02e8a595 : fffffa80`03ea3000 fffff880`0550fca0 fffff880`0550f7f8 00000000`00000000 : nt!MmQueryPfnList+0xbb
fffff880`0550f760 fffff800`02dcf8b8 : 00000000`00000006 00000000`00000000 fffffa80`03ea3000 fffff800`02a08001 : nt!PfpPfnPrioRequest+0x115
fffff880`0550f7b0 fffff800`02d763c3 : 00000000`00000000 fffff800`02a08000 fffffa80`04693000 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0x472ad
fffff880`0550f840 fffff800`02d771e5 : 00000000`01b0bd88 fffff800`02a7e652 00000000`01b0bde0 00000000`01b0bda8 : nt!ExpQuerySystemInformation+0x11c2
fffff880`0550fbe0 fffff800`02a77993 : fffffa80`05ae3b60 00000000`021bbb30 00000000`021bea88 00000000`041d2050 : nt!NtQuerySystemInformation+0x4d
fffff880`0550fc20 00000000`777c00ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01b0bca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777c00ba


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiFindNodeOrParent+0
fffff800`02aba518 48f7412800ffffff test    qword ptr [rcx+28h],0FFFFFFFFFFFFFF00h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiFindNodeOrParent+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiFindNodeOrParent+0

BUCKET_ID:  X64_0xA_nt!MiFindNodeOrParent+0

Followup: MachineOwner
---------

Debug session time: Sat Jan 29 15:49:02.194 2011 (GMT-5)
System Uptime: 0 days 0:30:40.004
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002a21b6c, fffff88002fa0fd8, fffff88002fa0840}

Probably caused by : cng.sys ( cng!GatherRandomKey+294 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002a21b6c, The address that the exception occurred at
Arg3: fffff88002fa0fd8, Exception Record Address
Arg4: fffff88002fa0840, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExpGetLookasideInformation+8c
fffff800`02a21b6c 0fb742c0        movzx   eax,word ptr [rdx-40h]

EXCEPTION_RECORD:  fffff88002fa0fd8 -- (.exr 0xfffff88002fa0fd8)
Cannot read Exception record @ fffff88002fa0fd8

CONTEXT:  fffff88002fa0840 -- (.cxr 0xfffff88002fa0840)
rax=0000000000000090 rbx=0000000000000ff4 rcx=fffff8800b4c43b0
rdx=ffeff88002d63da0 rsi=0000000000000000 rdi=0000000000000001
rip=fffff80002a21b6c rsp=fffff88002fa1210 rbp=0000000000000092
 r8=fffff80002c18720  r9=0000000000000000 r10=0000000000000000
r11=0000fffffffff000 r12=fffff88002fa12e0 r13=0000000000000000
r14=000000000001fe90 r15=fffff88002fa1840
iopl=0         nv up ei ng nz na pe cy
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
nt!ExpGetLookasideInformation+0x8c:
fffff800`02a21b6c 0fb742c0        movzx   eax,word ptr [rdx-40h] ds:002b:ffeff880`02d63d60=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  NULL_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cab0e0
 0000000000000000 

FOLLOWUP_IP: 
cng!GatherRandomKey+294
fffff880`010d6b04 85c0            test    eax,eax

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002d717bb to fffff80002a21b6c

STACK_TEXT:  
fffff880`02fa1210 fffff800`02d717bb : 00000000`00000000 fffff800`00000ff4 fffff880`02fa12e0 00000000`00000000 : nt!ExpGetLookasideInformation+0x8c
fffff880`02fa12a0 fffff800`02d721e5 : fffff8a0`0942c170 00000000`00000000 00000000`00000004 00000000`00000000 : nt!ExpQuerySystemInformation+0x15bc
fffff880`02fa1640 fffff800`02a72993 : fffff8a0`09440000 fffff800`02a7193d 00000000`00000041 fffffa80`04805060 : nt!NtQuerySystemInformation+0x4d
fffff880`02fa1680 fffff800`02a6ef30 : fffff880`010d6b04 00000000`00020000 fffff880`02fa1844 fffff8a0`0942c148 : nt!KiSystemServiceCopyEnd+0x13
fffff880`02fa1818 fffff880`010d6b04 : 00000000`00020000 fffff880`02fa1844 fffff8a0`0942c148 fffff800`02a80c3e : nt!KiServiceLinkage
fffff880`02fa1820 fffff880`010d656d : fffffa80`04805060 00000000`00000000 fffff800`20206f49 fffff800`02a7e2a1 : cng!GatherRandomKey+0x294
fffff880`02fa1be0 fffff800`02d6fc5d : 00000000`00000000 fffff800`02c78fa0 00000000`00000000 fffffa80`039f2b60 : cng!scavengingWorkItemRoutine+0x3d
fffff880`02fa1c80 fffff800`02a80961 : fffff800`02ccb700 fffff800`02ccb7b4 fffffa80`039f2b60 00000000`00000000 : nt!IopProcessWorkItem+0x3d
fffff880`02fa1cb0 fffff800`02d17c06 : 00000000`00000000 fffffa80`039f2b60 00000000`00000080 fffffa80`039db040 : nt!ExpWorkerThread+0x111
fffff880`02fa1d40 fffff800`02a51c26 : fffff880`02d63180 fffffa80`039f2b60 fffff880`02d6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fa1d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  cng!GatherRandomKey+294

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: cng

IMAGE_NAME:  cng.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc814

STACK_COMMAND:  .cxr 0xfffff88002fa0840 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_cng!GatherRandomKey+294

BUCKET_ID:  X64_0x7E_cng!GatherRandomKey+294

Followup: MachineOwner
---------

Debug session time: Sun Jan 30 14:25:29.064 2011 (GMT-5)
System Uptime: 0 days 0:43:52.874
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002a7a7b1, fffff88007b20180, 0}

Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+121 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a7a7b1, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88007b20180, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeSetEvent+121
fffff800`02a7a7b1 488908          mov     qword ptr [rax],rcx

CONTEXT:  fffff88007b20180 -- (.cxr 0xfffff88007b20180)
rax=fffdfa8003dcd5a8 rbx=fffffa8003dcd5a0 rcx=fffffa8003dcd5a8
rdx=fffffa8003de7768 rsi=0000000000000000 rdi=fffff80002bf0e80
rip=fffff80002a7a7b1 rsp=fffff88007b20b50 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=fffffa80039f6570
r11=00000000001f0003 r12=000000000012e001 r13=0000000000000005
r14=0000000000000007 r15=000007fee3d67740
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!KeSetEvent+0x121:
fffff800`02a7a7b1 488908          mov     qword ptr [rax],rcx ds:002b:fffdfa80`03dcd5a8=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  WmiPrvSE.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002d93154 to fffff80002a7a7b1

STACK_TEXT:  
fffff880`07b20b50 fffff800`02d93154 : fffff880`00000000 fffff880`00000001 fffffa80`039f6500 fffffa80`03dcd5a8 : nt!KeSetEvent+0x121
fffff880`07b20bc0 fffff800`02a75993 : fffffa80`03ba4510 fffff880`00000000 000007fe`00000000 fffffa80`03dcd5a0 : nt!NtSetEvent+0x90
fffff880`07b20c20 00000000`771efe3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0123cd78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771efe3a


FOLLOWUP_IP: 
nt!KeSetEvent+121
fffff800`02a7a7b1 488908          mov     qword ptr [rax],rcx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeSetEvent+121

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

STACK_COMMAND:  .cxr 0xfffff88007b20180 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KeSetEvent+121

BUCKET_ID:  X64_0x3B_nt!KeSetEvent+121

Followup: MachineOwner
---------

Debug session time: Sun Jan 30 15:19:04.460 2011 (GMT-5)
System Uptime: 0 days 0:53:07.270
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88007572048, fffff880075718b0, fffff80002a7fcfc}

Unable to load image \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for AVGIDSFilter.Sys
*** ERROR: Module load completed but symbols could not be loaded for AVGIDSFilter.Sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsFlushUserStream+92 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88007572048
Arg3: fffff880075718b0
Arg4: fffff80002a7fcfc

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88007572048 -- (.exr 0xfffff88007572048)
ExceptionAddress: fffff80002a7fcfc (nt!IoGetRelatedDeviceObject+0x000000000000000c)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff880075718b0 -- (.cxr 0xfffff880075718b0)
rax=ffdffa80048eb820 rbx=0000000000000000 rcx=fffffa800493f970
rdx=fffffa800493f970 rsi=0000000000000000 rdi=fffffa800493f970
rip=fffff80002a7fcfc rsp=fffff88007572288 rbp=fffffa8004976840
 r8=0000000000000009  r9=fffff880009e9100 r10=0000000000000000
r11=0000000000000000 r12=fffff880075722c0 r13=fffffa800493f970
r14=fffffa80045b7b00 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010282
nt!IoGetRelatedDeviceObject+0xc:
fffff800`02a7fcfc 488b4008        mov     rax,qword ptr [rax+8] ds:002b:ffdffa80`048eb828=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  VSSVC.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ca80e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFlushUserStream+92
fffff880`01304642 389c24a0000000  cmp     byte ptr [rsp+0A0h],bl

FAULTING_IP: 
nt!IoGetRelatedDeviceObject+c
fffff800`02a7fcfc 488b4008        mov     rax,qword ptr [rax+8]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002d62864 to fffff80002a7fcfc

STACK_TEXT:  
fffff880`07572288 fffff800`02d62864 : 00000000`00000000 fffff880`01296d80 fffffa80`04b27030 00000000`00000000 : nt!IoGetRelatedDeviceObject+0xc
fffff880`07572290 fffff800`02a5c923 : fffff880`07572728 fffff880`07572700 fffffa80`04976840 00000000`00000000 : nt!FsRtlAcquireFileForCcFlushEx+0x3c
fffff880`07572530 fffff800`02a5c4fa : 00000000`00000000 fffff980`013d6100 00000000`00000000 fffff880`012ed961 : nt!MmFlushSection+0x1c3
fffff880`075725f0 fffff880`01304642 : fffffa80`03a34398 00000000`00000000 fffff8a0`00000000 00000000`00000001 : nt!CcFlushCache+0x88a
fffff880`075726f0 fffff880`012b39e7 : 00000000`00000000 fffff8a0`00203140 00000000`00000000 00000000`00000001 : Ntfs!NtfsFlushUserStream+0x92
fffff880`07572770 fffff880`01304bbd : fffffa80`06823010 fffffa80`04b27180 fffffa80`06231901 fffffa80`010a2600 : Ntfs!NtfsFlushVolume+0x2c7
fffff880`075728a0 fffff880`013055f0 : fffffa80`06823010 fffffa80`040ab9c0 fffffa80`03c32550 00000000`00000000 : Ntfs!NtfsCommonFlushBuffers+0x459
fffff880`07572980 fffff880`0100c23f : fffffa80`040abda8 fffffa80`040ab9c0 fffffa80`06823010 fffff880`075729a8 : Ntfs!NtfsFsdFlushBuffers+0x104
fffff880`075729f0 fffff880`0100a6df : fffffa80`0495dbf0 00000000`00000000 fffffa80`0495db00 fffffa80`040ab9c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`07572a80 fffff880`061bf656 : 00000000`00000002 00000000`00000801 fffffa80`045b7b60 00000000`02cef4d0 : fltmgr!FltpDispatch+0xcf
fffff880`07572ae0 00000000`00000002 : 00000000`00000801 fffffa80`045b7b60 00000000`02cef4d0 00000000`00000000 : AVGIDSFilter+0x2656
fffff880`07572ae8 00000000`00000801 : fffffa80`045b7b60 00000000`02cef4d0 00000000`00000000 fffffa80`06314060 : 0x2
fffff880`07572af0 fffffa80`045b7b60 : 00000000`02cef4d0 00000000`00000000 fffffa80`06314060 fffffa80`040ab9c0 : 0x801
fffff880`07572af8 00000000`02cef4d0 : 00000000`00000000 fffffa80`06314060 fffffa80`040ab9c0 fffff800`02d86ca9 : 0xfffffa80`045b7b60
fffff880`07572b00 00000000`00000000 : fffffa80`06314060 fffffa80`040ab9c0 fffff800`02d86ca9 fffffa80`06314060 : 0x2cef4d0


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Ntfs!NtfsFlushUserStream+92

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff880075718b0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushUserStream+92

BUCKET_ID:  X64_0x24_Ntfs!NtfsFlushUserStream+92

Followup: MachineOwner
---------

SooConfused · 01 Feb 2011

I have again reinstalled windows due to a stupid mistake on my part. I dont have AVG or Identity protection, and i still get bsods.

Also, i think i may be missing something here but the link goes to a poor website were i cannot find anything bout the driver proposed.

When updating, the windows update failed to update the realtek ethernet driver, or any security updates that were planned as well.

During the last 2 days, i have got 6 different bsods. I have not the time at the momnet to run the bsod memory dump collection app in safe mode but i will in a few hours.

I have run the memtest before, but not like that, and it found no errors. I assume that the memtest is on the windows CD but i dont know how to run it 7 times in a row.

One last thing, the computor crashed on "Rate my computor".

The bsods are as follows:

BSOD Index
BSOD Index
BSOD Index
BSOD Index
BSOD Index
BSOD Index

I will upload more information soon.

CarlTR6 · 01 Feb 2011

Memtest has to be downloaded. It is independent of Windows and runs outside of Windows. Windows 7 does have built in memory checker; but it is not as thorough nor as aggressive as Memtest. Memtest86+ - Advanced Memory Diagnostic Tool

Looking at all of the different error codes, leads me to suspect either hardware issue or a critical driver issue. How long were your uptimes beofre the set of crashes you referenced above?

Go ahead and run Memtest86+ plus form a cold boot. It will keep running until you stop it. Let it make at least seven passes. Report back and let us know if there are any errors.

SooConfused · 01 Feb 2011

new bsod dmp files are uploaded. A recent BSOD meant that action centre found three new problems,

"Troubleshoot a problem with windows internet explorer"
"Install your videocard driver"
"Download and install a driver update"

The last one is for a USB controller and while installing, the system bsodded, and now installation says something about a file, but when installing memtest86 to my usb, the installer crashed and it said that there was a problem with windows installer.

I shall run memtest tomorrow. I intean to run when i am not present, do i need to supervise the test?