Getting Random BSOD Error Codes with Win 7 x64 Home Premium

biged · 21 Jan 2012

Bought a new (August 2011) HPE 510t desktop with:
Win Home Premium x64 (OEM)
8GB DDR3
1 TB SATA

All ran fine until I experienced BSOD (random codes - 3b, 21, 100007e, etc) for 2 weeks in December. Ran Drivetest and HP's memory utility - found nothing. Uninstalled several apps that seemed to resolve the problem.

BSOD (random codes) returned Jan 19 and again uninstalled all programs installed after Jan 12 - still getting BSOD.

I've uploaded multiple dmp files (I was unable to save the perfmon file - no option to save it).

I'm getting the impression there is a memory hardware issue. I could really use some help on this. Thanks. Ed

writhziden · 21 Jan 2012

Code:


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-17877-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e18000 PsLoadedModuleList = 0xfffff800`0305d670
Debug session time: Sat Jan 21 08:21:54.751 2012 (UTC - 7:00)
System Uptime: 0 days 0:11:06.000
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff80002fc4a9b, fffff88003593748, fffff88003592fa0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1df )

Followup: Pool_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002fc4a9b, The address that the exception occurred at
Arg3: fffff88003593748, Exception Record Address
Arg4: fffff88003592fa0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+1df
fffff800`02fc4a9b 4c395808        cmp     qword ptr [rax+8],r11

EXCEPTION_RECORD:  fffff88003593748 -- (.exr 0xfffff88003593748)
ExceptionAddress: fffff80002fc4a9b (nt!ExDeferredFreePool+0x00000000000001df)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88003592fa0 -- (.cxr 0xfffff88003592fa0)
rax=006e00720075006f rbx=0000000000000000 rcx=fffff8000301f900
rdx=fffffa8006ec8060 rsi=0000000000000000 rdi=fffffa800b3fe940
rip=fffff80002fc4a9b rsp=fffff88003593980 rbp=0000000000000000
 r8=fffffa800c3b6e00  r9=fffffa8006ec8000 r10=0000000000000001
r11=fffffa8006ec8010 r12=fffff8000301f340 r13=0000000000000000
r14=000000000000001a r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExDeferredFreePool+0x1df:
fffff800`02fc4a9b 4c395808        cmp     qword ptr [rax+8],r11 ds:002b:006e0072`00750077=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c7100
 ffffffffffffffff 

FOLLOWUP_IP: 
nt!ExDeferredFreePool+1df
fffff800`02fc4a9b 4c395808        cmp     qword ptr [rax+8],r11

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff80002fc41a1 to fffff80002fc4a9b

STACK_TEXT:  
fffff880`03593980 fffff800`02fc41a1 : 00000000`00000000 fffffa80`075dd340 00000000`00000000 fffffa80`0a788300 : nt!ExDeferredFreePool+0x1df
fffff880`03593a10 fffff800`02edaa0e : fffff800`030968c0 fffff880`03593b18 fffffa80`6b576343 fffff800`03096801 : nt!ExFreePoolWithTag+0x411
fffff880`03593ac0 fffff800`02e9f001 : fffffa80`06d7d7d0 fffff800`0318b901 fffff800`030968c0 fffff800`00000002 : nt!CcWorkerThread+0x29e
fffff880`03593b70 fffff800`0312ffee : 7367358c`640fbc95 fffffa80`06cf7b60 00000000`00000080 fffffa80`06c914a0 : nt!ExpWorkerThread+0x111
fffff880`03593c00 fffff800`02e865e6 : fffff880`03365180 fffffa80`06cf7b60 fffff880`0336ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03593c40 00000000`00000000 : fffff880`03594000 fffff880`0358e000 fffff880`03593440 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+1df

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff88003592fa0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExDeferredFreePool+1df

BUCKET_ID:  X64_0x7E_nt!ExDeferredFreePool+1df

Followup: Pool_corruption
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-21886-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e17000 PsLoadedModuleList = 0xfffff800`0305c670
Debug session time: Sat Jan 21 07:58:15.191 2012 (UTC - 7:00)
System Uptime: 0 days 0:26:47.440
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff88000e05959, fffff880087dea60, 0}

Unable to load image FP64.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for FP64.SYS
*** ERROR: Module load completed but symbols could not be loaded for FP64.SYS
Probably caused by : FP64.SYS ( FP64+5959 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff88000e05959, Address of the instruction which caused the bugcheck
Arg3: fffff880087dea60, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'IDSvia64' and 'IDSvia64.sys' overlap

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
FP64+5959
fffff880`00e05959 48393b          cmp     qword ptr [rbx],rdi

CONTEXT:  fffff880087dea60 -- (.cxr 0xfffff880087dea60)
rax=0000000000000001 rbx=002e003900410046 rcx=fffffa800ce864b0
rdx=fffff88000e0b230 rsi=fffff880087df8a0 rdi=fffffa800d98f330
rip=fffff88000e05959 rsp=fffff880087df440 rbp=fffffa800c077cc8
 r8=fffffa8007a00010  r9=fffffa800bf31a30 r10=fffff8000301e348
r11=0000000000000019 r12=fffffa8007a00010 r13=fffffa800d98f330
r14=0000000000000000 r15=fffffa800bf31a30
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
FP64+0x5959:
fffff880`00e05959 48393b          cmp     qword ptr [rbx],rdi ds:002b:002e0039`00410046=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffffa800c13b190 to fffff88000e05959

STACK_TEXT:  
fffff880`087df440 fffffa80`0c13b190 : fffff800`0319b668 fffffa80`00000000 fffffa80`06d37b01 fffffa80`0bf24750 : FP64+0x5959
fffff880`087df448 fffff800`0319b668 : fffffa80`00000000 fffffa80`06d37b01 fffffa80`0bf24750 fffff880`00e05a2e : 0xfffffa80`0c13b190
fffff880`087df450 fffff800`03191f95 : 00000000`00000045 fffffa80`0c077cc8 fffff880`087df8a0 fffffa80`0d98f3c8 : nt!IopAllocRealFileObject+0x128
fffff880`087df500 fffff800`0318e838 : fffffa80`094e1a50 fffff800`00000000 fffffa80`0c077b10 fffffa80`00000001 : nt!IopParseDevice+0x5a5
fffff880`087df690 fffff800`0318fa56 : 00000000`00000000 fffffa80`0c077b10 fffff880`087dfa00 fffffa80`06d01f30 : nt!ObpLookupObjectName+0x588
fffff880`087df780 fffff800`0316f9d6 : fffffa80`0954e8e0 00000000`02e1d520 00000000`00000001 00000000`01a90260 : nt!ObOpenObjectByName+0x306
fffff880`087df850 fffff800`02e92ed3 : fffffa80`0c126b60 00000000`00000000 fffffa80`0c126b60 fffffa80`0c002dd0 : nt!NtQueryAttributesFile+0x145
fffff880`087dfae0 00000000`776516ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02e1d488 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x776516ea


FOLLOWUP_IP: 
FP64+5959
fffff880`00e05959 48393b          cmp     qword ptr [rbx],rdi

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  FP64+5959

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: FP64

IMAGE_NAME:  FP64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4e7f7f4e

STACK_COMMAND:  .cxr 0xfffff880087dea60 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_FP64+5959

BUCKET_ID:  X64_0x3B_FP64+5959

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-25318-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e0c000 PsLoadedModuleList = 0xfffff800`03051670
Debug session time: Sat Jan 21 06:58:10.856 2012 (UTC - 7:00)
System Uptime: 0 days 0:15:08.104
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff88001174678, fffff880035c4798, fffff880035c3ff0}

Probably caused by : fltmgr.sys ( fltmgr!DoFreeContext+28 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88001174678, The address that the exception occurred at
Arg3: fffff880035c4798, Exception Record Address
Arg4: fffff880035c3ff0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
fltmgr!DoFreeContext+28
fffff880`01174678 66837f1820      cmp     word ptr [rdi+18h],20h

EXCEPTION_RECORD:  fffff880035c4798 -- (.exr 0xfffff880035c4798)
ExceptionAddress: fffff88001174678 (fltmgr!DoFreeContext+0x0000000000000028)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000005c006c0079
Attempt to read from address 0000005c006c0079

CONTEXT:  fffff880035c3ff0 -- (.cxr 0xfffff880035c3ff0)
rax=0000000000000000 rbx=fffffa800d31d790 rcx=fffffa800d31d790
rdx=fffffa800d31d790 rsi=0000000000000000 rdi=0000005c006c0061
rip=fffff88001174678 rsp=fffff880035c49d0 rbp=0000000000000000
 r8=0000000000000000  r9=fffff880035c4a18 r10=fffff80002e0c000
r11=fffffa800d31d7a8 r12=fffffa800d27e2d0 r13=0000000000000000
r14=fffffa800a055be0 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
fltmgr!DoFreeContext+0x28:
fffff880`01174678 66837f1820      cmp     word ptr [rdi+18h],20h ds:002b:0000005c`006c0079=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  STRING_DEREFERENCE

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000005c006c0079

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030bb100
 0000005c006c0079 

FOLLOWUP_IP: 
fltmgr!DoFreeContext+28
fffff880`01174678 66837f1820      cmp     word ptr [rdi+18h],20h

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff88001174f8a to fffff88001174678

STACK_TEXT:  
fffff880`035c49d0 fffff880`01174f8a : 00000000`00000000 fffffa80`0a055be0 00000000`00000000 fffffa80`0d31d7a8 : fltmgr!DoFreeContext+0x28
fffff880`035c4a00 fffff880`0119c0f1 : fffffa80`0d27e280 fffffa80`0d27e280 fffffa80`00000000 fffffa80`0d31d790 : fltmgr!DeleteContextFromStreamList+0x11a
fffff880`035c4a70 fffff880`011906ce : fffffa80`0972b580 00000000`00000001 fffffa80`0972b580 fffffa80`09f7f528 : fltmgr!FltpRemoveAllFileObjectContextsForInstance+0x21
fffff880`035c4aa0 fffff880`0118c705 : 00000000`00000001 fffffa80`0972b010 fffffa80`09419820 fffffa80`0a055be0 : fltmgr! ?? ::NNGAKEGL::`string'+0x168f
fffff880`035c4ad0 fffff880`0119d3c7 : fffffa80`09f7f528 00000000`00000001 fffffa80`09f7f520 fffffa80`06d05680 : fltmgr!FltpFreeInstance+0xd5
fffff880`035c4b40 fffff800`02e93001 : fffff880`01196e00 fffff800`03029201 fffffa80`06d05600 fffffa80`06d05680 : fltmgr!FltpCommonDetachVolumeWorker+0x17
fffff880`035c4b70 fffff800`03123fee : 00000000`00000000 fffffa80`06d05680 00000000`00000080 fffffa80`06c914a0 : nt!ExpWorkerThread+0x111
fffff880`035c4c00 fffff800`02e7a5e6 : fffff880`03365180 fffffa80`06d05680 fffff880`0336ffc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`035c4c40 00000000`00000000 : fffff880`035c5000 fffff880`035bf000 fffff880`035c44c0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  fltmgr!DoFreeContext+28

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fltmgr

IMAGE_NAME:  fltmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929c

STACK_COMMAND:  .cxr 0xfffff880035c3ff0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_fltmgr!DoFreeContext+28

BUCKET_ID:  X64_0x7E_fltmgr!DoFreeContext+28

Followup: MachineOwner
---------

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012012-16395-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e5d000 PsLoadedModuleList = 0xfffff800`030a2670
Debug session time: Fri Jan 20 19:19:16.953 2012 (UTC - 7:00)
System Uptime: 0 days 0:20:58.202
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ed1b65, fffff88007d406e0, 0}

Probably caused by : dxgmms1.sys ( dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+11e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ed1b65, Address of the instruction which caused the bugcheck
Arg3: fffff88007d406e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExpInterlockedPopEntrySListFault16+0
fffff800`02ed1b65 498b08          mov     rcx,qword ptr [r8]

CONTEXT:  fffff88007d406e0 -- (.cxr 0xfffff88007d406e0)
rax=00000000fcc5002b rbx=0000000000000000 rcx=fffff880009eba60
rdx=006e007200750070 rsi=0000000000000002 rdi=0000000000000000
rip=fffff80002ed1b65 rsp=fffff88007d410c0 rbp=fffff880009eba60
 r8=006e00720075006f  r9=fffff80002e5d000 r10=fffff880009eba60
r11=fffff880065bd8c0 r12=fffff80003064340 r13=0000000000000000
r14=0000000000000002 r15=000000006d4d6956
iopl=0         nv up ei pl nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
nt!ExpInterlockedPopEntrySListFault16:
fffff800`02ed1b65 498b08          mov     rcx,qword ptr [r8] ds:002b:006e0072`0075006f=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  WLXPGSS.SCR

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800030081de to fffff80002ed1b65

STACK_TEXT:  
fffff880`07d410c0 fffff800`030081de : fffffa80`0bc21000 fffff880`065c66d2 00000000`00001000 fffff8a0`00baf160 : nt!ExpInterlockedPopEntrySListFault16
fffff880`07d410d0 fffff880`065c6dee : fffff880`00000174 00000000`00000000 fffffa80`0bc21000 00000000`000007ff : nt!ExAllocatePoolWithTag+0xfe
fffff880`07d411c0 fffff880`065adaa7 : fffff8a0`03d540f0 fffff8a0`103a0420 fffff880`07d41330 00000000`00000000 : dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+0x11e
fffff880`07d412a0 fffff880`064f9469 : 00000000`00000000 fffff880`07d41770 00000000`00000000 fffff8a0`00c39ee0 : dxgmms1!VidMmOpenAllocation+0xeb
fffff880`07d412f0 fffff880`064f2610 : fffff880`07d41558 fffff8a0`1194d4e0 fffff880`07d41730 fffff880`07d41730 : dxgkrnl!DXGDEVICE::CreateVidMmAllocations<_DXGK_ALLOCATIONINFO>+0x291
fffff880`07d41380 fffff880`064f526b : fffff8a0`134a6000 fffff880`07d419f0 fffff880`07d41b01 00000000`00000000 : dxgkrnl!DXGDEVICE::CreateAllocation+0xca8
fffff880`07d41980 fffff960`001ff4ae : 00000000`06b3e4b0 00000000`40000e40 00000000`72fe2450 fffff800`000007d3 : dxgkrnl!DxgkCreateAllocation+0x42b
fffff880`07d41ab0 fffff800`02ed8ed3 : 00000000`3f80b686 fffff880`07d41b60 00000000`02ea58a0 00000000`0012001c : win32k!NtGdiDdDDICreateAllocation+0x12
fffff880`07d41ae0 00000000`730313aa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06b3e468 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x730313aa


FOLLOWUP_IP: 
dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+11e
fffff880`065c6dee 4989442420      mov     qword ptr [r12+20h],rax

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+11e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: dxgmms1

IMAGE_NAME:  dxgmms1.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce799c1

STACK_COMMAND:  .cxr 0xfffff88007d406e0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+11e

BUCKET_ID:  X64_0x3B_dxgmms1!VIDMM_GLOBAL::OpenOneAllocation+11e

Followup: MachineOwner
---------

Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
Folder Phantom Redux caused this crash.
fltmgr.sys is a driver responsible for your hard disk file system. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...
Caused by a DirectX driver/display card driver problem. Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Graphics Driver...

Thanks to Dave76 for help understanding possible causes.

Begin troubleshooting the common problems using the following steps.

Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you are overclocking anything, please stop.
Uninstall Folder Phantom Redux or the program that uses Folder Phantom Redux as it was the cause of many crashes on your system.
Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log
Run SFC /SCANNOW Command - System File Checker up to three times to fix all errors. Post back if it continues to show errors after the third run or if the first run comes back with no integrity violations.
Follow the steps for Diagnosing basic problems with DirectX. To re-install your display card drivers as outlined in the DirectX link, use the following steps.
1. Download the latest drivers for your display card(s)
2. Click Start Menu
3. Right Click My Computer/Computer
4. Click Manage
5. Click Device Manager from the list on the left
6. Expand Display adapters
7. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
8. Restart your computer after uninstalling drivers for all display cards
9. Install the latest driver for the display cards once Windows starts
Alternatively:
1. Login as an adminstrative user
2. Download the latest drivers for your display card(s)
3. Click Start Menu
4. Click Control Panel
5. Click Hardware and Sound
6. Click Device Manager (the last link under Devices and Printers)
7. Expand Display adapters
8. Do the following for each adapter (in case you have multiple display cards)
  - Right click the adapter
  - Click Uninstall (do not click OK in the dialog box that pops up after hitting Uninstall)
  - Put a tick in Delete driver software for this device (if this option is available, otherwise just hit OK) and hit OK
9. Restart your computer after uninstalling drivers for all display cards
10. Install the latest driver for the display cards once Windows starts

biged · 22 Jan 2012

Writhziden and Dave76,

Thanks for the help. I followed your advice and completed the first steps of the analysis.

1. I am not overclocking anything – nothing to do here.

2. I uninstalled Folder Phantom and got a BSOD BCC Code 21 while trying to reboot (new mini dump zip file attached). It is interesting that Folder Phantom only runs when I execute it and does not load on startup.

3. After I uninstalled Folder Phantom and rebooted, another program (WinTidy – a desktop icon organizer) failed to load. Error message said it was “unable to create Main Window and was shutting down.”

4. I ran the boot version (4.0a) of MEMTEST86 for 4 hours (6 passes) with no failures.

5. I ran Windows Memory Diagnostic tool overnight (first pass) and got no error log (the program said it would list results after it restarted Windows and I logged back in).

6. I am going to run Windows Memory Diagnostic tool again today (Second pass) as I need to go out for the day. It seems to take about 6-8 hours to run.

I have not had a chance to verify stability yet as I will not be using the computer today – tomorrow is the real test. Many thanks to you for all of your help – I really appreciate it.

Biged

writhziden · 22 Jan 2012

You may have to re-install WinTidy when this is all done for it to work properly. Sounds like Folder Phantom had been intertwined with that program during installation of it or of WinTidy (whichever was installed last).

Code:



Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-19422-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e5d000 PsLoadedModuleList = 0xfffff800`030a2670
Debug session time: Sat Jan 21 17:59:15.619 2012 (UTC - 7:00)
System Uptime: 0 days 0:26:43.493
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 21, {0, 0, 6e0072, 28ee6a}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

QUOTA_UNDERFLOW (21)
This bugcheck occurs if a kernel component mishandles quota charges and
returns more quota than was previously charged to a particular quota block.
Arguments:
Arg1: 0000000000000000, The process (if any) that was initially charged.
Arg2: 0000000000000000, The quota type in question (paged pool, nonpaged pool, etc.)
Arg3: 00000000006e0072, The initial charge amount to return.
Arg4: 000000000028ee6a, The remaining (unreturned) charge.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x21

PROCESS_NAME:  ccsvchst.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 0000000000000000

STACK_TEXT:  
00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0


STACK_COMMAND:  kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  INVALID_KERNEL_CONTEXT

Followup: MachineOwner
---------


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-21184-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e53000 PsLoadedModuleList = 0xfffff800`03098670
Debug session time: Sat Jan 21 10:30:58.117 2012 (UTC - 7:00)
System Uptime: 0 days 0:34:24.366
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800031abda8, fffff88008ff5dc0, 0}

Probably caused by : memory_corruption ( nt!MiRelocateImageAgain+48 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800031abda8, Address of the instruction which caused the bugcheck
Arg3: fffff88008ff5dc0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiRelocateImageAgain+48
fffff800`031abda8 f0480fba2e00    lock bts qword ptr [rsi],0

CONTEXT:  fffff88008ff5dc0 -- (.cxr 0xfffff88008ff5dc0)
rax=fffffa800d60f7b0 rbx=ffffffffffffffff rcx=fffffa800b82c5b0
rdx=fffffa800d686791 rsi=0000005c006c0061 rdi=fffffa800d60f760
rip=fffff800031abda8 rsp=fffff88008ff67a0 rbp=0000000000000080
 r8=fffffa800d686790  r9=fffff88008ff65d8 r10=fffffa80093e96c0
r11=fffff88008ff67c0 r12=fffffa800b82c5b0 r13=fffffa800d594350
r14=fffff8a00d9c8a80 r15=fffff8a00d9c8a80
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!MiRelocateImageAgain+0x48:
fffff800`031abda8 f0480fba2e00    lock bts qword ptr [rsi],0 ds:002b:0000005c`006c0061=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  WerFault.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800031cc9ff to fffff800031abda8

STACK_TEXT:  
fffff880`08ff67a0 fffff800`031cc9ff : 00000000`00000004 00000000`00000080 00000000`01000000 00000000`01000000 : nt!MiRelocateImageAgain+0x48
fffff880`08ff67f0 fffff800`031ab596 : fffff880`08ff6a40 fffff880`08ff6b60 00000000`00000000 fffff880`08ff6a38 : nt!MmCreateSection+0x2df
fffff880`08ff69f0 fffff800`02eceed3 : fffffa80`0d60f760 00000000`0026a2f8 fffff880`08ff6a88 00000000`0026a588 : nt!NtCreateSection+0x171
fffff880`08ff6a70 00000000`76ed17ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0026a2d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ed17ba


FOLLOWUP_IP: 
nt!MiRelocateImageAgain+48
fffff800`031abda8 f0480fba2e00    lock bts qword ptr [rsi],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiRelocateImageAgain+48

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff88008ff5dc0 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x3B_nt!MiRelocateImageAgain+48

BUCKET_ID:  X64_0x3B_nt!MiRelocateImageAgain+48

Followup: MachineOwner
---------


Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\biged\012112-29374-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e4a000 PsLoadedModuleList = 0xfffff800`0308f670
Debug session time: Sat Jan 21 09:56:01.031 2012 (UTC - 7:00)
System Uptime: 0 days 1:29:25.279
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ff6a9b, fffff880086beca0, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1df )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ff6a9b, Address of the instruction which caused the bugcheck
Arg3: fffff880086beca0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+1df
fffff800`02ff6a9b 4c395808        cmp     qword ptr [rax+8],r11

CONTEXT:  fffff880086beca0 -- (.cxr 0xfffff880086beca0)
rax=006e00720075006f rbx=0000000000000000 rcx=fffff80003051ae0
rdx=fffffa800a93b0c0 rsi=0000000000000000 rdi=fffffa8007782220
rip=fffff80002ff6a9b rsp=fffff880086bf680 rbp=0000000000000000
 r8=fffffa800cb438c0  r9=fffffa800a93b000 r10=0000000000000001
r11=fffffa800a93b010 r12=fffff80003051340 r13=0000000000000000
r14=0000000000000011 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!ExDeferredFreePool+0x1df:
fffff800`02ff6a9b 4c395808        cmp     qword ptr [rax+8],r11 ds:002b:006e0072`00750077=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  SeaPort.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002ff61a1 to fffff80002ff6a9b

STACK_TEXT:  
fffff880`086bf680 fffff800`02ff61a1 : 00000000`00000000 fffffa80`075df780 00000000`00000000 00000000`0039e120 : nt!ExDeferredFreePool+0x1df
fffff880`086bf710 fffff800`02e74292 : 00000000`00000000 00000000`00000001 00000000`6e496c41 00000000`00000000 : nt!ExFreePoolWithTag+0x411
fffff880`086bf7c0 fffff800`03168d15 : 00000000`00000001 fffffa80`0cb1f450 00000000`00000001 00000000`00000011 : nt!AlpcpFreeCompletionPacketLookaside+0x92
fffff880`086bf820 fffff800`02ed0af4 : 00000000`00000000 00000000`00000000 fffffa80`06d17b90 fffffa80`0c6f0700 : nt!AlpcpDeletePort+0x1d5
fffff880`086bf850 fffff800`031d3c37 : 00000000`00000000 fffff8a0`18ad6030 00000000`00000000 fffff800`00000038 : nt!ObfDereferenceObject+0xd4
fffff880`086bf8b0 fffff800`031d3d88 : 00000000`00000000 00000000`fffeffff fffff800`0303ae98 00000000`c0000000 : nt!AlpcpMessageDestroyProcedure+0x67
fffff880`086bf8f0 fffff800`031d3392 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`c0000000 : nt!AlpcpDestroyBlob+0x28
fffff880`086bf920 fffff800`031d43a6 : fffffa80`0c7009d0 fffff880`c0000000 00000000`c0000000 fffffa80`0c7009d0 : nt!AlpcpReceiveMessage+0x65f
fffff880`086bf9c0 fffff800`02ec5ed3 : fffffa80`0e809b60 fffff880`086bfb60 00000000`01b8e738 fffffa80`0c42ca50 : nt!NtAlpcSendWaitReceivePort+0x1e6
fffff880`086bfa70 00000000`76e21b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01b8e718 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76e21b6a


FOLLOWUP_IP: 
nt!ExDeferredFreePool+1df
fffff800`02ff6a9b 4c395808        cmp     qword ptr [rax+8],r11

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+1df

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff880086beca0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+1df

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+1df

Followup: Pool_corruption
---------

Caused by Norton Internet Security. Download and run the Norton Removal tool to remove Norton and replace with Microsoft Security Essentials - Free Antivirus for Windows to run with Windows firewall.
Possible causes are Memory problems... Corrupted hard disk system files... Corrupted System Files... Lack of Windows updates... Drivers...

Continue through the steps in my previous post.
Possible cause Drivers...

biged · 23 Jan 2012

My system has been stable all day today (I'm cautiously optimistic) but I plan to run the HDD test tonight (1TB may take a few hours) and post the logs. Lastly, I plan to run SCANNOW but am unsure as to how to execute the program and collect log files evena fter reading the instructions since they involve an "elevated command prompt." I am the administrator for this machine but keep getting an error something like "You are not authorized to use SFC." Folder Phantom seems like the culprit. NIS always hangs up when the OS does something it doesn't like. More later... Thanks again - what an education!

writhziden · 23 Jan 2012

The instructions for running an elevated command prompt are included in Elevated Command Prompt

biged · 23 Jan 2012

Ran HDD test /all ok (log attached). Will figure out SCANNOW tonight. System still stable.

writhziden · 23 Jan 2012

Your disk check came back with "Adding 1 bad clusters to the Bad Clusters File" and "Windows has made corrections to the file system." You should run with both boxes checked again to make sure all bad sectors/clusters have been recovered and the file system has been completely fixed. Run until you get the message that Windows has checked the file system and found no problems.

biged · 23 Jan 2012

ok - will do.

biged · 23 Jan 2012

Ran SCANNOW to verfiy system files - ran ok with no problems (attached screenshot).

Getting Random BSOD Error Codes with Win 7 x64 Home Premium

Getting Random BSOD Error Codes with Win 7 x64 Home Premium

Completed first steps you recommended.