Random BSoD

SLICKR · 06 Feb 2011

I should have posted it way back but now am getting desperate and scared. Its not even been 2 months since I had got my new rig. The spec are as followed

4GB DDR3 RAM
GPU : MSi HD 6850
AMD II X6 1075T 3.0Ghz
Windows7 x64 Ultimate

Am having random Blue Screen for the last 4-5 weeks. And am totally confused because when I play game the blue screen never shows up and sometimes it does but after 6-8 hours or as I said sometime it never does. When am not ingame it pops up in 3-2 min while am doing nothing or while am using the net.
It takes me a lot of restarts and shut downs to switch it back on or I have to keep the PC switched off for 10min then switch it back on.

-All the fans are up and running.
-I've formatted the PC [Still no LUCK]
-Tech guy came and changed the ram slots, formatted it again [2days back] No luck

-I've unchecked the Automatic Restart in Advance Settings.

Am a total rookie as I don't even know to remove a RAM from the slot

I assume its a hardware issue but am not able to figure out what Hardware is causing it.
Before the blue screen shows up I get a weird screen like its all horizontal pixel and a weird sound. Sometimes the blue screen never comes and the PC freezes on the weird screen.

Few errors.

There are 6 dump files I had and am posting all.

0x000000IE
3B
7B
1
A
IRQL_NOT_LESS_OR_EQUAL
SYSTEM_SERVICE_EXCEPTION
And few more.

Please help me out, am totally scared and the PC cost me a lot

I did not OC or do anything stupid with a new PC

Please!

There are 6 dump files I had and am posting all.

CarlTR6 · 06 Feb 2011

Hi, Slick, and welcome to the forum. I will look at your dumps but we need more that just the dumps to help you. Please read this tutorial and follow the instructions and post back: https://www.sevenforums.com/crashes-d...tructions.html

I looked at your four most recent dumps. All blame Windows system drivers or Windows system core files which are very unlikely to be the real cause.

I suggest that you uninstall Kaspersky using this removal tool: Tool. Your version of Kaspersky is a known cause of BSOD's on some Win 7 systems. Once you know your system is stable you can try Kaspersky again; but do not reinstall this version. Install the latest version. For now, while your are troubleshooting, download and install Microsoft Security Essentials.

Let's see how your system does. Post back and let us know. If you get another BSOD, up load it and we will go from there.

Code:

Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a67000 PsLoadedModuleList = 0xfffff800`02ca4e50
Debug session time: Fri Feb  4 01:09:36.297 2011 (GMT-5)
System Uptime: 0 days 1:17:45.372
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffffc9853375, 0, fffff960001a6295, 2}

Unable to load image \SystemRoot\System32\win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

Could not read faulting driver name
Probably caused by : win32k.sys ( win32k+156295 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffc9853375, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff960001a6295, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d0f0e0
 ffffffffc9853375 

FAULTING_IP: 
win32k+156295
fffff960`001a6295 85c0            test    eax,eax

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800a4c5840 -- (.trap 0xfffff8800a4c5840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000008 rsi=0000000000000000 rdi=0000000000000000
rip=fffff960001a6295 rsp=fffff8800a4c59d0 rbp=0000000001040058
 r8=00000000000001fe  r9=0000000000000001 r10=0000000056000000
r11=0000000000000800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
win32k+0x156295:
fffff960`001a6295 85c0            test    eax,eax
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002b56bc2 to fffff80002ad8f00

STACK_TEXT:  
fffff880`0a4c56d8 fffff800`02b56bc2 : 00000000`00000050 ffffffff`c9853375 00000000`00000000 fffff880`0a4c5840 : nt!KeBugCheckEx
fffff880`0a4c56e0 fffff800`02ad6fee : 00000000`00000000 00000000`00000800 006dec00`00000300 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x40f90
fffff880`0a4c5840 fffff960`001a6295 : fffff900`c00b9f20 00000000`01040058 00000000`00000001 fffff960`001140d1 : nt!KiPageFault+0x16e
fffff880`0a4c59d0 fffff900`c00b9f20 : 00000000`01040058 00000000`00000001 fffff960`001140d1 fffff900`c08275a0 : win32k+0x156295
fffff880`0a4c59d8 00000000`01040058 : 00000000`00000001 fffff960`001140d1 fffff900`c08275a0 fffff960`00095fd9 : 0xfffff900`c00b9f20
fffff880`0a4c59e0 00000000`00000001 : fffff960`001140d1 fffff900`c08275a0 fffff960`00095fd9 fffff880`0a4c5a80 : 0x1040058
fffff880`0a4c59e8 fffff960`001140d1 : fffff900`c08275a0 fffff960`00095fd9 fffff880`0a4c5a80 00000000`00001001 : 0x1
fffff880`0a4c59f0 fffff900`c08275a0 : fffff960`00095fd9 fffff880`0a4c5a80 00000000`00001001 00000000`00000001 : win32k+0xc40d1
fffff880`0a4c59f8 fffff960`00095fd9 : fffff880`0a4c5a80 00000000`00001001 00000000`00000001 fffff900`c0200840 : 0xfffff900`c08275a0
fffff880`0a4c5a00 fffff880`0a4c5a80 : 00000000`00001001 00000000`00000001 fffff900`c0200840 fffff900`c08275a0 : win32k+0x45fd9
fffff880`0a4c5a08 00000000`00001001 : 00000000`00000001 fffff900`c0200840 fffff900`c08275a0 00000000`01040058 : 0xfffff880`0a4c5a80
fffff880`0a4c5a10 00000000`00000001 : fffff900`c0200840 fffff900`c08275a0 00000000`01040058 00000000`01040058 : 0x1001
fffff880`0a4c5a18 fffff900`c0200840 : fffff900`c08275a0 00000000`01040058 00000000`01040058 00000000`00000000 : 0x1
fffff880`0a4c5a20 fffff900`c08275a0 : 00000000`01040058 00000000`01040058 00000000`00000000 00000000`00001001 : 0xfffff900`c0200840
fffff880`0a4c5a28 00000000`01040058 : 00000000`01040058 00000000`00000000 00000000`00001001 fffff960`00095e33 : 0xfffff900`c08275a0
fffff880`0a4c5a30 00000000`01040058 : 00000000`00000000 00000000`00001001 fffff960`00095e33 fffff900`c08275a0 : 0x1040058
fffff880`0a4c5a38 00000000`00000000 : 00000000`00001001 fffff960`00095e33 fffff900`c08275a0 00000000`00000000 : 0x1040058


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k+156295
fffff960`001a6295 85c0            test    eax,eax

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k+156295

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc5e1

FAILURE_BUCKET_ID:  X64_0x50_win32k+156295

BUCKET_ID:  X64_0x50_win32k+156295

Followup: MachineOwner
---------

Debug session time: Sat Feb  5 00:57:02.253 2011 (GMT-5)
System Uptime: 0 days 0:48:16.689
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+5de9952f00c6d918
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff88002ffc9f8 -- (.exr 0xfffff88002ffc9f8)
ExceptionAddress: fffff80002a8ddb2 (nt!KiTimerExpiration+0x00000000000000f2)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002ffcaa0 -- (.trap 0xfffff88002ffcaa0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffbff88002fd6fe8 rbx=0000000000000000 rcx=fffff88002fd6fe8
rdx=0000000000000053 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a8ddb2 rsp=fffff88002ffcc30 rbp=000000000002d553
 r8=fffffa8006020bb0  r9=00000000000000c1 r10=0000000000000053
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz ac po cy
nt!KiTimerExpiration+0xf2:
fffff800`02a8ddb2 48894808        mov     qword ptr [rax+8],rcx ds:ffbff880`02fd6ff0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a79c2e to fffff80002a81ed0

STACK_TEXT:  
fffff880`02ffbad8 fffff800`02a79c2e : 00000000`002cdaa8 00000006`be8169db fffff880`02ffc250 fffff800`02aaee28 : nt!KeBugCheck
fffff880`02ffbae0 fffff800`02aa7bed : fffff800`02c8ec24 fffff800`02bc7a3c fffff800`02a10000 fffff880`02ffc9f8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02ffbb10 fffff800`02aaf250 : fffff800`02bcfb5c fffff880`02ffbb88 fffff880`02ffc9f8 fffff800`02a10000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02ffbb40 fffff800`02abc1b5 : fffff880`02ffc9f8 fffff880`02ffc250 fffff880`00000000 fffff880`02fd4180 : nt!RtlDispatchException+0x410
fffff880`02ffc220 fffff800`02a81542 : fffff880`02ffc9f8 00000006`be8fb21c fffff880`02ffcaa0 fffff880`02fd6fe8 : nt!KiDispatchException+0x135
fffff880`02ffc8c0 fffff800`02a7fe4a : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`05358819 : nt!KiExceptionDispatch+0xc2
fffff880`02ffcaa0 fffff800`02a8ddb2 : 00000000`000207cc 00000000`00000948 00000000`00000000 00000000`0000b33b : nt!KiGeneralProtectionFault+0x10a
fffff880`02ffcc30 fffff800`02a8d697 : 00000001`fb9bdcc1 00000001`0002d554 00000001`fb9bdc33 00000000`00000053 : nt!KiTimerExpiration+0xf2
fffff880`02ffccd0 fffff800`02a8a6fa : fffff880`02fd4180 fffff880`02fdf040 00000000`00000001 fffff880`00000000 : nt!KiRetireDpcList+0x277
fffff880`02ffcd80 00000000`00000000 : fffff880`02ffd000 fffff880`02ff7000 fffff880`02ffcd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02a79c2e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------

Debug session time: Sat Feb  5 00:07:54.928 2011 (GMT-5)
System Uptime: 0 days 18:31:56.364
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002dbfaae, fffff88002792ab0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ObpWaitForMultipleObjects+173 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002dbfaae, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88002792ab0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ObpWaitForMultipleObjects+173
fffff800`02dbfaae 0fb64718        movzx   eax,byte ptr [rdi+18h]

CONTEXT:  fffff88002792ab0 -- (.cxr 0xfffff88002792ab0)
rax=00000000ffe0fffc rbx=fffff8a0073e96e0 rcx=ffbffa80067cfcf0
rdx=fffffa8003a1e001 rsi=0000000000000031 rdi=ffbffa80067cfcf0
rip=fffff80002dbfaae rsp=fffff88002793490 rbp=fffff88002793ca0
 r8=0000000000000008  r9=fffff8a00759d000 r10=fffffa8003ff3b60
r11=fffffffffffffd80 r12=fffff88002793b20 r13=fffff8a002955d80
r14=0000000000000030 r15=0000000000000039
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ObpWaitForMultipleObjects+0x173:
fffff800`02dbfaae 0fb64718        movzx   eax,byte ptr [rdi+18h] ds:002b:ffbffa80`067cfd08=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002dbfaae

STACK_TEXT:  
fffff880`02793490 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObpWaitForMultipleObjects+0x173


FOLLOWUP_IP: 
nt!ObpWaitForMultipleObjects+173
fffff800`02dbfaae 0fb64718        movzx   eax,byte ptr [rdi+18h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ObpWaitForMultipleObjects+173

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff88002792ab0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ObpWaitForMultipleObjects+173

BUCKET_ID:  X64_0x3B_nt!ObpWaitForMultipleObjects+173

Followup: MachineOwner
---------

SLICKR · 06 Feb 2011

Hey Carl, thanks for the assist. I've included the file with the post and I got unique error few minutes back. Yes, it was blue screen though it goes something like this.

stop:c0000211 unknown hard error
\systemroot\system32\ntdll.dll

I hope this error cracks few codes :|

DeanP · 06 Feb 2011

Hello,

I would update this driver,

AtiPcie.sys Wed May 06 03:00:22 2009
ATI PCIe Motherboard/Chipset
AMD.com | Support & Downloads

I would also remove Daemon Tools/Alcohol 120%. They use a file sptd.sys, which is notorious of causing BSOD. Use this SPTD removal tool when done: DuplexSecure - Downloads

Use MagicDisc is an alternative: Freeware MagicISO Virtual CD/DVD-ROM(MagicDisc) Overview

BSOD BUGCHECK SUMMARY:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C0000221, {fffff8a0001607f0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: fffff8a0001607f0
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc0000221

ERROR_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_PARAMETER1:  fffff8a0001607f0

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_PARAMETER3:  0000000000000000

EXCEPTION_PARAMETER4: 0

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800020ca09f to fffff80001e7df00

STACK_TEXT:  
fffff880`009a91e8 fffff800`020ca09f : 00000000`0000004c 00000000`c0000221 fffff880`009a9288 fffffa80`04c13c10 : nt!KeBugCheckEx
fffff880`009a91f0 fffff800`01eca544 : 7ff00000`00000000 00000000`00000000 00000000`00000000 fffff700`01080000 : nt!ExpSystemErrorHandler2+0x5ff
fffff880`009a9420 fffff800`022ad4b1 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`00350000 : nt!ExpSystemErrorHandler+0xd4
fffff880`009a9460 fffff800`022ad8b6 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`00350000 : nt!ExpRaiseHardError+0xe1
fffff880`009a9790 fffff800`022aed66 : 00000000`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9988 : nt!ExRaiseHardError+0x1d6
fffff880`009a9890 fffff800`022c1f6f : 00000000`c0000221 00000000`08000000 fffff800`02348828 ffffffff`80000060 : nt!NtRaiseHardError+0x1e4
fffff880`009a9930 fffff800`022c22c9 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`023789f0 : nt!PspLocateSystemDll+0xbf
fffff880`009a9a00 fffff800`023ab97d : fffff800`00812870 00000000`00000002 00000000`00000000 fffff800`01ff6e80 : nt!PsLocateSystemDlls+0x69
fffff880`009a9a40 fffff800`023aeb20 : fffff800`00841522 fffff800`00000010 ffffffff`80000028 fffff800`00812870 : nt!IoInitSystem+0x85d
fffff880`009a9b40 fffff800`022ff419 : 00000000`00000000 fffffa80`03a17040 00000000`00000080 fffffa80`03972b30 : nt!Phase1InitializationDiscard+0x1290
fffff880`009a9d10 fffff800`02121166 : 00000000`00000000 00000000`00000080 00000000`00000000 fffff800`01e5c479 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`01e5c486 : fffff800`01ff6e80 fffffa80`03a17040 fffff800`02004c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExpSystemErrorHandler2+5ff
fffff800`020ca09f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExpSystemErrorHandler2+5ff

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

Followup: MachineOwner
---------

0: kd> lmtsmn
start             end                 module name
fffff880`0102f000 fffff880`01086000   ACPI     ACPI.sys     Tue Jul 14 11:19:34 2009 (4A5BC106)
fffff880`00fcc000 fffff880`00fd7000   amdxata  amdxata.sys  Wed May 20 05:56:59 2009 (4A12F2EB)
fffff880`00ead000 fffff880`00eb6000   atapi    atapi.sys    Tue Jul 14 11:19:47 2009 (4A5BC113)
fffff880`00eb6000 fffff880`00ee0000   ataport  ataport.SYS  Tue Jul 14 11:19:52 2009 (4A5BC118)
fffff880`0149c000 fffff880`014a4000   AtiPcie  AtiPcie.sys  Wed May 06 03:00:22 2009 (4A005486)
fffff880`00d1b000 fffff880`00ddb000   CI       CI.dll       Tue Jul 14 13:32:13 2009 (4A5BE01D)
fffff880`013b0000 fffff880`013e0000   CLASSPNP CLASSPNP.SYS Tue Jul 14 11:19:58 2009 (4A5BC11E)
fffff880`00cbd000 fffff880`00d1b000   CLFS     CLFS.SYS     Tue Jul 14 11:19:57 2009 (4A5BC11D)
fffff880`01524000 fffff880`01597000   cng      cng.sys      Tue Jul 14 11:49:40 2009 (4A5BC814)
fffff880`013e0000 fffff880`013ee000   crashdmp crashdmp.sys Tue Jul 14 12:01:01 2009 (4A5BCABD)
fffff880`01486000 fffff880`0149c000   disk     disk.sys     Tue Jul 14 11:19:57 2009 (4A5BC11D)
fffff880`01200000 fffff880`01209000   dump_atapi dump_atapi.sys Tue Jul 14 11:19:47 2009 (4A5BC113)
fffff880`013ee000 fffff880`013fa000   dump_dumpata dump_dumpata.sys Tue Jul 14 11:19:47 2009 (4A5BC113)
fffff880`010b2000 fffff880`010c5000   dump_dumpfve dump_dumpfve.sys Tue Jul 14 11:21:51 2009 (4A5BC18F)
fffff880`00fd7000 fffff880`00feb000   fileinfo fileinfo.sys Tue Jul 14 11:34:25 2009 (4A5BC481)
fffff880`00c00000 fffff880`00c4c000   fltmgr   fltmgr.sys   Tue Jul 14 11:19:59 2009 (4A5BC11F)
fffff880`015a8000 fffff880`015b2000   Fs_Rec   Fs_Rec.sys   Tue Jul 14 11:19:45 2009 (4A5BC111)
fffff880`0144c000 fffff880`01486000   fvevol   fvevol.sys   Tue Jul 14 11:22:15 2009 (4A5BC1A7)
fffff880`015b2000 fffff880`015fc000   fwpkclnt fwpkclnt.sys Tue Jul 14 11:21:08 2009 (4A5BC164)
fffff800`023e9000 fffff800`02432000   hal      hal.dll      Tue Jul 14 13:27:36 2009 (4A5BDF08)
fffff880`017f4000 fffff880`017fd000   hwpolicy hwpolicy.sys Tue Jul 14 11:19:22 2009 (4A5BC0FA)
fffff880`00e73000 fffff880`00e93000   jraid    jraid.sys    Tue Jan 12 00:28:18 2010 (4B4B0B52)
fffff800`00ba3000 fffff800`00bad000   kdcom    kdcom.dll    Tue Jul 14 13:31:07 2009 (4A5BDFDB)
fffff880`016b5000 fffff880`016c3000   klbg     klbg.sys     Thu Oct 15 06:18:13 2009 (4AD607D5)
fffff880`0150a000 fffff880`01524000   ksecdd   ksecdd.sys   Tue Jul 14 11:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Tue Jul 14 11:50:34 2009 (4A5BC84A)
fffff880`00c9c000 fffff880`00ca9000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Tue Jul 14 13:29:09 2009 (4A5BDF65)
fffff880`00e93000 fffff880`00ead000   mountmgr mountmgr.sys Tue Jul 14 11:19:54 2009 (4A5BC11A)
fffff880`01086000 fffff880`01090000   msisadrv msisadrv.sys Tue Jul 14 11:19:26 2009 (4A5BC0FE)
fffff880`014ac000 fffff880`0150a000   msrpc    msrpc.sys    Tue Jul 14 11:21:32 2009 (4A5BC17C)
fffff880`016a3000 fffff880`016b5000   mup      mup.sys      Tue Jul 14 11:23:45 2009 (4A5BC201)
fffff880`016c8000 fffff880`017ba000   ndis     ndis.sys     Tue Jul 14 11:21:40 2009 (4A5BC184)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Tue Jul 14 11:21:46 2009 (4A5BC18A)
fffff800`01e0c000 fffff800`023e9000   nt       ntkrnlmp.exe Tue Jul 14 11:40:48 2009 (4A5BC600)
fffff880`0120d000 fffff880`013b0000   Ntfs     Ntfs.sys     Tue Jul 14 11:20:47 2009 (4A5BC14F)
fffff880`0109d000 fffff880`010b2000   partmgr  partmgr.sys  Tue Jul 14 11:19:58 2009 (4A5BC11E)
fffff880`00f99000 fffff880`00fcc000   pci      pci.sys      Tue Jul 14 11:19:51 2009 (4A5BC117)
fffff880`00e5c000 fffff880`00e63000   pciide   pciide.sys   Tue Jul 14 11:19:49 2009 (4A5BC115)
fffff880`00e63000 fffff880`00e73000   PCIIDEX  PCIIDEX.SYS  Tue Jul 14 11:19:48 2009 (4A5BC114)
fffff880`01597000 fffff880`015a8000   pcw      pcw.sys      Tue Jul 14 11:19:27 2009 (4A5BC0FF)
fffff880`00ca9000 fffff880`00cbd000   PSHED    PSHED.dll    Tue Jul 14 13:32:23 2009 (4A5BE027)
fffff880`017ba000 fffff880`017f4000   rdyboost rdyboost.sys Tue Jul 14 11:34:34 2009 (4A5BC48A)
fffff880`01000000 fffff880`0102f000   SCSIPORT SCSIPORT.SYS Tue Jul 14 12:01:04 2009 (4A5BCAC0)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Tue Jul 14 11:25:34 2009 (4A5BC26E)
fffff880`01090000 fffff880`0109d000   vdrvroot vdrvroot.sys Tue Jul 14 12:01:31 2009 (4A5BCADB)
fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Tue Jul 14 11:42:54 2009 (4A5BC67E)
fffff880`011e6000 fffff880`011fb000   volmgr   volmgr.sys   Tue Jul 14 11:19:57 2009 (4A5BC11D)
fffff880`00e00000 fffff880`00e5c000   volmgrx  volmgrx.sys  Tue Jul 14 11:20:33 2009 (4A5BC141)
fffff880`01400000 fffff880`0144c000   volsnap  volsnap.sys  Tue Jul 14 11:20:08 2009 (4A5BC128)
fffff880`00ee6000 fffff880`00f8a000   Wdf01000 Wdf01000.sys Tue Jul 14 11:22:07 2009 (4A5BC19F)
fffff880`00f8a000 fffff880`00f99000   WDFLDR   WDFLDR.SYS   Tue Jul 14 11:19:54 2009 (4A5BC11A)
fffff880`011dd000 fffff880`011e6000   WMILIB   WMILIB.SYS   Tue Jul 14 11:19:51 2009 (4A5BC117)

Unloaded modules:
fffff880`0169b000 fffff880`016a3000   spldr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff880`010b8000 fffff880`011dd000   sptd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00125000

SLICKR · 06 Feb 2011

Thanks you. And I have my AMD drive up to date. And I never use Daemon Tool as I prefer Magic Disc. I've gone through few forums and I read that I would wanna replace the file "ntdll.dll"
ntdll.dll free download - DLL-files.com
I just want to make sure, if its safe enough!? And I heard it could be an issue with my Hardisk too. As its not even been 2months, all my parts are under warranty. Do you think I should call up the seagate guys? Or proceed with the replacing of the .dll file.
Thanks for your assist.

DeanP · 06 Feb 2011

If you don't have Daemon Tools/Alcohol 120% installed on your computer. Use the SPTD uninstaller to delete sptd.sys from your computer. Select Uninstall; DO NOT SELECT RE-INSTALL

SLICKR · 06 Feb 2011

It says no SPTD was detected.
-

Someone please please help me out here

CarlTR6 · 07 Feb 2011

I would not download ntdll.dll from any source other than Microsoft. It is a Windows system file, the NT Layer DLL, and is the file that contains NT kernel functions. I do not see ntdll mentioned in your dumps. It was probably affected by something else and showing up in the error you saw.

Dean is spot on. Both of your dumps show sptd.sys as an unloaded module meaning it was unloaded from memory during the crash. I am unable to determine the program on your computer it is associated with. Using Windows Explorer, do a search of your C: drive for sptd.sys and rename every instance of it you find from .sys to .old. Reboot and it should not load. This will break the program it is associated with and you can uninstall that program when you find it.

I see that you have not yet uninstalled Kaspersky; please do so as suggested above. Note the usual causes below.

Bugcheck A, IRQL_NOT_LESS_OR_EQUAL. Usual causes: Kernel mode driver, System Service, BIOS, Windows, Virus scanner, Backup tool, compatibility

Bugcheck (c0000221, Unknown bugcheck code and description. It results from a bad checksum.

Follow both of the suggestions above, reboot and see how your system runs. Post back and let us know.

Code:

Windows 7 Kernel Version 7600 MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`01e0c000 PsLoadedModuleList = 0xfffff800`02049e50
Debug session time: Sat Feb  5 22:36:49.479 2011 (GMT-5)
System Uptime: 0 days 0:00:13.979
Loading Kernel Symbols
...................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C0000221, {fffff8a0001607f0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExpSystemErrorHandler2+5ff )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (c0000221)
Unknown bugcheck description
Arguments:
Arg1: fffff8a0001607f0
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0xc0000221

ERROR_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_CODE: (NTSTATUS) 0xc0000221 - {Bad Image Checksum}  The image %hs is possibly corrupt. The header checksum does not match the computed checksum.

EXCEPTION_PARAMETER1:  fffff8a0001607f0

EXCEPTION_PARAMETER2:  0000000000000000

EXCEPTION_PARAMETER3:  0000000000000000

EXCEPTION_PARAMETER4: 0

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800020ca09f to fffff80001e7df00

STACK_TEXT:  
fffff880`009a91e8 fffff800`020ca09f : 00000000`0000004c 00000000`c0000221 fffff880`009a9288 fffffa80`04c13c10 : nt!KeBugCheckEx
fffff880`009a91f0 fffff800`01eca544 : 7ff00000`00000000 00000000`00000000 00000000`00000000 fffff700`01080000 : nt!ExpSystemErrorHandler2+0x5ff
fffff880`009a9420 fffff800`022ad4b1 : 00000000`c0000221 00000000`00000001 00000000`00000001 00000000`00350000 : nt!ExpSystemErrorHandler+0xd4
fffff880`009a9460 fffff800`022ad8b6 : fffffa80`c0000221 00000000`00000001 fffffa80`00000001 00000000`00350000 : nt!ExpRaiseHardError+0xe1
fffff880`009a9790 fffff800`022aed66 : 00000000`c0000221 00000000`00000001 00000000`00000001 fffff880`009a9988 : nt!ExRaiseHardError+0x1d6
fffff880`009a9890 fffff800`022c1f6f : 00000000`c0000221 00000000`08000000 fffff800`02348828 ffffffff`80000060 : nt!NtRaiseHardError+0x1e4
fffff880`009a9930 fffff800`022c22c9 : 00000000`002a0028 00000000`00000000 00000000`00000001 fffff800`023789f0 : nt!PspLocateSystemDll+0xbf
fffff880`009a9a00 fffff800`023ab97d : fffff800`00812870 00000000`00000002 00000000`00000000 fffff800`01ff6e80 : nt!PsLocateSystemDlls+0x69
fffff880`009a9a40 fffff800`023aeb20 : fffff800`00841522 fffff800`00000010 ffffffff`80000028 fffff800`00812870 : nt!IoInitSystem+0x85d
fffff880`009a9b40 fffff800`022ff419 : 00000000`00000000 fffffa80`03a17040 00000000`00000080 fffffa80`03972b30 : nt!Phase1InitializationDiscard+0x1290
fffff880`009a9d10 fffff800`02121166 : 00000000`00000000 00000000`00000080 00000000`00000000 fffff800`01e5c479 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`01e5c486 : fffff800`01ff6e80 fffffa80`03a17040 fffff800`02004c40 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a93f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!ExpSystemErrorHandler2+5ff
fffff800`020ca09f cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!ExpSystemErrorHandler2+5ff

FOLLOWUP_NAME:  MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

BUCKET_ID:  X64_0xc0000221_nt!ExpSystemErrorHandler2+5ff

Followup: MachineOwner
---------

Debug session time: Sat Feb  5 18:30:40.936 2011 (GMT-5)
System Uptime: 0 days 1:03:56.372
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {28, 2, 0, fffff80002b10090}

Probably caused by : memory_corruption ( nt!MiFindNodeOrParent+0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000028, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002b10090, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d040e0
 0000000000000028 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiFindNodeOrParent+0
fffff800`02b10090 48f7412800ffffff test    qword ptr [rcx+28h],0FFFFFFFFFFFFFF00h

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  wordpad.exe

TRAP_FRAME:  fffff8800472d820 -- (.trap 0xfffff8800472d820)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000000e rbx=0000000000000000 rcx=000000000021e5b0
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=0000000077299031 rsp=000000000021e270 rbp=000000000021e5b0
 r8=000000000021e3d8  r9=000000000021e408 r10=0000000000000003
r11=000000000000000e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
0033:00000000`77299031 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002acd469 to fffff80002acdf00

STACK_TEXT:  
fffff880`0472d0b8 fffff800`02acd469 : 00000000`0000000a 00000000`00000028 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0472d0c0 fffff800`02acc0e0 : fffff8a0`087a9010 fffffa80`04bf7cc8 fffff880`0472d378 fffff880`0472d5f0 : nt!KiBugCheckDispatch+0x69
fffff880`0472d200 fffff800`02b10090 : fffff800`02b13e17 00000000`000006ab 00000000`000003cf 00000000`000006ab : nt!KiPageFault+0x260
fffff880`0472d398 fffff800`02b13e17 : 00000000`000006ab 00000000`000003cf 00000000`000006ab fffff800`02afe26a : nt!MiFindNodeOrParent
fffff880`0472d3a0 fffff800`02b13d9d : fffff700`01080488 00000000`00000000 fffff880`0472d4f8 00000000`00000000 : nt!MiLocateAddressInTree+0x17
fffff880`0472d3d0 fffff800`02b13ea8 : 00000000`00000000 00000000`00000000 fffffa80`04bf7d38 fffffa80`04bf7d38 : nt!MiGetSharedProtosAtDpcLevel+0xbd
fffff880`0472d420 fffff800`02a6a19b : fffff700`01080000 fffffa80`0000ad70 fffff680`003b94c8 fffffa80`040959f8 : nt!MiGetSharedProtos+0x18
fffff880`0472d450 fffff800`02b3d39e : 00000000`000006ab fffffa80`04bf69b0 00000000`00000000 fffffa80`0439bf68 : nt! ?? ::FNODOBFM::`string'+0x92bb
fffff880`0472d480 fffff800`02af4353 : 6ab00000`0039d025 00000000`0039d121 fffff880`0472d610 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x29915
fffff880`0472d510 fffff800`02ae9d9e : 00000000`00000000 00000000`77299031 fffff680`003b94c8 fffffa80`040959f8 : nt!MiResolveProtoPteFault+0x1d3
fffff880`0472d5b0 fffff800`02ae7f23 : 00000000`00000000 00000000`77299031 00000000`00000000 fffff800`00000000 : nt!MiDispatchFault+0x1de
fffff880`0472d6c0 fffff800`02acbfee : 00000000`00000008 00000000`00000086 00000000`77333501 0000000f`ffffffff : nt!MmAccessFault+0x343
fffff880`0472d820 00000000`77299031 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0021e270 fffff800`02ac5840 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77299031
fffff880`0472dc30 00000000`77129000 : fffff880`00000003 ffff0000`0000027f 00000000`000a0000 fffffa80`00000000 : nt!KiCallUserMode
fffff880`0472dc38 fffff880`00000003 : ffff0000`0000027f 00000000`000a0000 fffffa80`00000000 fffff880`0472edb0 : 0x77129000
fffff880`0472dc40 ffff0000`0000027f : 00000000`000a0000 fffffa80`00000000 fffff880`0472edb0 00000000`00000000 : 0xfffff880`00000003
fffff880`0472dc48 00000000`000a0000 : fffffa80`00000000 fffff880`0472edb0 00000000`00000000 00000000`00000000 : 0xffff0000`0000027f
fffff880`0472dc50 fffffa80`00000000 : fffff880`0472edb0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xa0000
fffff880`0472dc58 fffff880`0472edb0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`00000000
fffff880`0472dc60 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffff880`0472edb0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiFindNodeOrParent+0
fffff800`02b10090 48f7412800ffffff test    qword ptr [rcx+28h],0FFFFFFFFFFFFFF00h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiFindNodeOrParent+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiFindNodeOrParent+0

BUCKET_ID:  X64_0xA_nt!MiFindNodeOrParent+0

Followup: MachineOwner
---------

1: kd> lmtsmn
start             end                 module name
fffff880`048b0000 fffff880`048ee000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`01191000 fffff880`011e8000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`04533000 fffff880`045bd000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04941000 fffff880`04957000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0591e000 fffff880`05932000   amdiox64 amdiox64.sys Thu Feb 18 10:17:53 2010 (4B7D5A21)
fffff880`02c26000 fffff880`02c3b000   amdppm   amdppm.sys   Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00e7d000 fffff880`00e88000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`04a00000 fffff880`04a08000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
fffff880`02dda000 fffff880`02de0000   AsIO     AsIO.sys     Mon Aug 03 03:03:16 2009 (4A768BB4)
fffff880`00e4a000 fffff880`00e53000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e53000 fffff880`00e7d000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`059b3000 fffff880`059d3000   AtihdW76 AtihdW76.sys Wed Nov 17 07:02:04 2010 (4CE3C43C)
fffff880`04a2f000 fffff880`05266000   atikmdag atikmdag.sys Tue Jan 04 21:48:52 2011 (4D23DC14)
fffff880`0480d000 fffff880`0485a000   atikmpag atikmpag.sys Tue Jan 04 21:19:38 2011 (4D23D53A)
fffff880`01400000 fffff880`01408000   AtiPcie  AtiPcie.sys  Tue May 05 11:00:22 2009 (4A005486)
fffff880`010c3000 fffff880`010ca000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02dc9000 fffff880`02dda000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`03ce7000 fffff880`03d05000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`006a0000 fffff960`006c7000   cdd      cdd.dll      Mon Jul 13 21:25:40 2009 (4A5BDE94)
fffff880`06f00000 fffff880`06f1d000   cdfs     cdfs.sys     Mon Jul 13 19:19:46 2009 (4A5BC112)
fffff880`01033000 fffff880`0105d000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00ccc000 fffff880`00d8c000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01200000 fffff880`01230000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c6e000 fffff880`00ccc000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0148b000 fffff880`014fe000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04a11000 fffff880`04a21000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06f9d000 fffff880`06fab000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`02d28000 fffff880`02dab000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`02dab000 fffff880`02dc9000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`02d19000 fffff880`02d28000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`015e7000 fffff880`015fd000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0583d000 fffff880`0585f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`06fb7000 fffff880`06fc0000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06fab000 fffff880`06fb7000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06fc0000 fffff880`06fd3000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`06f1d000 fffff880`06f29000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`05266000 fffff880`0535a000   dxgkrnl  dxgkrnl.sys  Mon Jul 13 19:38:56 2009 (4A5BC590)
fffff880`0535a000 fffff880`053a0000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`00e88000 fffff880`00e9c000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`00d8c000 fffff880`00dd8000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`0150f000 fffff880`01519000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`015ad000 fffff880`015e7000   fvevol   fvevol.sys   Mon Jul 13 19:22:15 2009 (4A5BC1A7)
fffff880`01600000 fffff880`0164a000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff800`02a13000 fffff800`02a5c000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`053a0000 fffff880`053c4000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`06f37000 fffff880`06f50000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`06f50000 fffff880`06f58080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`06f29000 fffff880`06f37000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`03c1f000 fffff880`03ce7000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`017f6000 fffff880`017ff000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`00e10000 fffff880`00e30000   jraid    jraid.sys    Mon Jan 11 06:28:18 2010 (4B4B0B52)
fffff880`02c3b000 fffff880`02c4a000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06f8f000 fffff880`06f9d000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00ba8000 fffff800`00bb2000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0400a000 fffff880`04533000   kl1      kl1.sys      Tue Sep 01 07:29:21 2009 (4A9D0591)
fffff880`0159f000 fffff880`015ad000   klbg     klbg.sys     Wed Oct 14 13:18:13 2009 (4AD607D5)
fffff880`0105d000 fffff880`010ba000   klif     klif.sys     Wed Nov 11 08:32:16 2009 (4AFABCE0)
fffff880`045ec000 fffff880`045f6000   klim6    klim6.sys    Tue Nov 03 08:33:29 2009 (4AF03129)
fffff880`06f68000 fffff880`06f72000   klmouflt klmouflt.sys Fri Oct 02 11:38:29 2009 (4AC61E75)
fffff880`058db000 fffff880`0591e000   ks       ks.sys       Mon Jul 13 20:00:31 2009 (4A5BCA9F)
fffff880`01471000 fffff880`0148b000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`017b9000 fffff880`017e4000   ksecpkg  ksecpkg.sys  Mon Jul 13 19:50:34 2009 (4A5BC84A)
fffff880`0585f000 fffff880`05864200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`06c23000 fffff880`06c38000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`06c00000 fffff880`06c23000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`0589c000 fffff880`058d8880   mcdbus   mcdbus.sys   Tue Feb 24 05:34:07 2009 (49A3CD1F)
fffff880`00c4d000 fffff880`00c5a000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`06fd3000 fffff880`06fe1000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`02c4a000 fffff880`02c59000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`06f5b000 fffff880`06f68000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00e30000 fffff880`00e4a000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`03d05000 fffff880`03d1d000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`03d1d000 fffff880`03d49000   mrxsmb   mrxsmb.sys   Mon Jul 13 19:23:59 2009 (4A5BC20F)
fffff880`03d49000 fffff880`03d96000   mrxsmb10 mrxsmb10.sys Mon Jul 13 19:24:08 2009 (4A5BC218)
fffff880`03d96000 fffff880`03db9000   mrxsmb20 mrxsmb20.sys Mon Jul 13 19:24:05 2009 (4A5BC215)
fffff880`01128000 fffff880`01133000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011e8000 fffff880`011f2000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`01413000 fffff880`01471000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02d0e000 fffff880`02d19000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`017e4000 fffff880`017f6000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01667000 fffff880`01759000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04a21000 fffff880`04a2d000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`0497b000 fffff880`049aa000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0599e000 fffff880`059b3000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`00e9c000 fffff880`00eab000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`00c00000 fffff880`00c45000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`01759000 fffff880`017b9000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01133000 fffff880`01144000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`02d02000 fffff880`02d0e000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02a5c000 fffff800`03039000   nt       ntkrnlmp.exe Mon Jul 13 19:40:48 2009 (4A5BC600)
fffff880`0124a000 fffff880`013ed000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`010ba000 fffff880`010c3000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`045c6000 fffff880`045ec000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`00f68000 fffff880`00f7d000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`01000000 fffff880`01033000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`00fee000 fffff880`00ff5000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e00000 fffff880`00e10000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`014fe000 fffff880`0150f000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`0706c000 fffff880`07112000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`05800000 fffff880`0583d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00c5a000 fffff880`00c6e000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`04957000 fffff880`0497b000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`049aa000 fffff880`049c5000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`049c5000 fffff880`049e6000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`049e6000 fffff880`04a00000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`02cb1000 fffff880`02d02000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04800000 fffff880`0480b000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`0110d000 fffff880`01116000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`01116000 fffff880`0111f000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`0111f000 fffff880`01128000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01565000 fffff880`0159f000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`06c38000 fffff880`06c50000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`048ee000 fffff880`04941000   Rt64win7 Rt64win7.sys Sun May 30 23:46:43 2010 (4C033123)
fffff880`06cd9000 fffff880`06eff300   RTKVHD64 RTKVHD64.sys Fri Jan 29 01:48:35 2010 (4B6284C3)
fffff880`01162000 fffff880`01191000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`07112000 fffff880`0711d000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`053ed000 fffff880`053f9000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02c65000 fffff880`02c82000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`0165a000 fffff880`01662000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`080c6000 fffff880`0815e000   srv      srv.sys      Mon Jul 13 19:25:11 2009 (4A5BC257)
fffff880`0715c000 fffff880`071c5000   srv2     srv2.sys     Mon Jul 13 19:25:02 2009 (4A5BC24E)
fffff880`0711d000 fffff880`0714a000   srvnet   srvnet.sys   Mon Jul 13 19:24:58 2009 (4A5BC24A)
fffff880`058d9000 fffff880`058da480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01801000 fffff880`019fe000   tcpip    tcpip.sys    Mon Jul 13 19:25:34 2009 (4A5BC26E)
fffff880`0714a000 fffff880`0715c000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`01144000 fffff880`01151000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`00dd8000 fffff880`00df6000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`02c9d000 fffff880`02cb1000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00520000 fffff960`0052a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`02c00000 fffff880`02c26000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`05932000 fffff880`05944000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`06f72000 fffff880`06f8f000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`06f59000 fffff880`06f5af00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`053dc000 fffff880`053ed000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`053cf000 fffff880`053dc000   usbfilter usbfilter.sys Tue Dec 22 03:26:22 2009 (4B3082AE)
fffff880`05944000 fffff880`0599e000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`053c4000 fffff880`053cf000   usbohci  usbohci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0485a000 fffff880`048b0000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`011f2000 fffff880`011ff000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`010ca000 fffff880`010d8000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`010d8000 fffff880`010fd000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0164a000 fffff880`0165a000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00f7d000 fffff880`00f92000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00f92000 fffff880`00fee000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01519000 fffff880`01565000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`02c82000 fffff880`02c9d000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`010fd000 fffff880`0110d000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00eb5000 fffff880`00f59000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f59000 fffff880`00f68000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`045bd000 fffff880`045c6000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00070000 fffff960`0037f000   win32k   win32k.sys   Mon Jul 13 19:40:17 2009 (4A5BC5E1)
fffff880`04a08000 fffff880`04a11000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`01159000 fffff880`01162000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)

Unloaded modules:
fffff880`08000000 fffff880`08071000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0815e000 fffff880`081cf000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01230000 fffff880`0123e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0123e000 fffff880`0124a000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01408000 fffff880`01411000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`013ed000 fffff880`01400000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01034000 fffff880`01159000   sptd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000

DeanP · 07 Feb 2011

Just to add Carl's good suggestion,

I suggest you put Microsoft Security Essentials as replacement: http://www.microsoft.com/security_essentials/
You may want to read this Kaspersky KB Article regarding on removing Kaspersky products: Removal tool for Kaspersky Lab products

SLICKR · 10 Feb 2011

I did uninstall it now. And I switched off my PC for the last as BSoD was just kicking me on my head. Removed one Stick [RAM] so running on 2GB DDR3 now. No BSOD yet.
Fingers Crossed.
--
Edit

Its gone, am gonna replace my other stick very soon.

Thank you guys, much obliged.