Code:
  1. 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\BSODDmpFiles\Shhut3\020912-16551-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e51000 PsLoadedModuleList = 0xfffff800`03096670
Debug session time: Thu Feb  9 19:16:11.923 2012 (GMT-7)
System Uptime: 0 days 6:14:06.250
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff88008c7a718, fffff88008c79f70, fffff880012e5550}

Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+227 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff88008c7a718
Arg3: fffff88008c79f70
Arg4: fffff880012e5550

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff88008c7a718 -- (.exr 0xfffff88008c7a718)
ExceptionAddress: fffff880012e5550 (Ntfs!NtfsFindPrefixHashEntry+0x0000000000000227)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88008c79f70 -- (.cxr 0xfffff88008c79f70)
rax=0000000000000032 rbx=fffff8a002e72340 rcx=000000000000048a
rdx=0000000000000001 rsi=fffff8a000216140 rdi=fffffa80049b5350
rip=fffff880012e5550 rsp=fffff88008c7a950 rbp=0000000000000000
 r8=0000000022958e45  r9=0000000000000000 r10=0000000000000003
r11=fffff88008c7a998 r12=37fff8a003ab2ed8 r13=fffff88007982ab0
r14=0000000000000245 r15=0000000000000e45
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
Ntfs!NtfsFindPrefixHashEntry+0x227:
fffff880`012e5550 498b7c2418      mov     rdi,qword ptr [r12+18h] ds:002b:37fff8a0`03ab2ef0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  msnmsgr.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80003100100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsFindPrefixHashEntry+227
fffff880`012e5550 498b7c2418      mov     rdi,qword ptr [r12+18h]

FAULTING_IP: 
Ntfs!NtfsFindPrefixHashEntry+227
fffff880`012e5550 498b7c2418      mov     rdi,qword ptr [r12+18h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012e3fd2 to fffff880012e5550

STACK_TEXT:  
fffff880`08c7a950 fffff880`012e3fd2 : fffffa80`06c886f0 fffffa80`049b5350 fffff8a0`00216140 00000000`00000701 : Ntfs!NtfsFindPrefixHashEntry+0x227
fffff880`08c7aa80 fffff880`012e1911 : fffffa80`06c886f0 fffffa80`05cf6c10 fffff880`08c7ac50 fffff880`08c7aca0 : Ntfs!NtfsFindStartingNode+0x452
fffff880`08c7ab50 fffff880`0124aa3d : fffffa80`06c886f0 fffffa80`05cf6c10 fffff880`07982ab0 fffffa80`062cfa00 : Ntfs!NtfsCommonCreate+0x3e1
fffff880`08c7ad30 fffff800`02ec5757 : fffff880`07982a20 00000000`00166fd0 00000000`773a45c0 00000000`00000000 : Ntfs!NtfsCommonCreateCallout+0x1d
fffff880`08c7ad60 fffff800`02ec5711 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`079828f0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsFindPrefixHashEntry+227

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce792f9

STACK_COMMAND:  .cxr 0xfffff88008c79f70 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsFindPrefixHashEntry+227

BUCKET_ID:  X64_0x24_Ntfs!NtfsFindPrefixHashEntry+227

Followup: MachineOwner
---------
  2. 
Loading Dump File [E:\BSODDmpFiles\Shhut3\020912-15740-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e05000 PsLoadedModuleList = 0xfffff800`0304a670
Debug session time: Thu Feb  9 12:44:22.944 2012 (GMT-7)
System Uptime: 0 days 1:04:34.645
Loading Kernel Symbols
...............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffefffffff0000, 0, fffff80002ecaafc, 7}


Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiCaptureProtectionFromProto+1c )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffefffffff0000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002ecaafc, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000007, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030b4100
 ffffefffffff0000 

FAULTING_IP: 
nt!MiCaptureProtectionFromProto+1c
fffff800`02ecaafc 488b01          mov     rax,qword ptr [rcx]

MM_INTERNAL_CODE:  7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  SearchIndexer.

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800964a7e0 -- (.trap 0xfffff8800964a7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000011 rbx=0000000000000000 rcx=ffffefffffff0000
rdx=fffff8800964aac8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ecaafc rsp=fffff8800964a970 rbp=0000000000000001
 r8=0000000000681000  r9=fffffa800701f780 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!MiCaptureProtectionFromProto+0x1c:
fffff800`02ecaafc 488b01          mov     rax,qword ptr [rcx] ds:cab0:ffffefff`ffff0000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e2c347 to fffff80002e81c40

STACK_TEXT:  
fffff880`0964a678 fffff800`02e2c347 : 00000000`00000050 ffffefff`ffff0000 00000000`00000000 fffff880`0964a7e0 : nt!KeBugCheckEx
fffff880`0964a680 fffff800`02e7fd6e : 00000000`00000000 ffffefff`ffff0000 fffffa80`03bfd800 ffffefff`ffff0000 : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`0964a7e0 fffff800`02ecaafc : 00000000`00000000 fffff800`02f82cc1 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0964a970 fffff800`02ede398 : 4c100000`9c38f025 ffffefff`ffff0000 00000000`00000001 fffffa80`0701fb18 : nt!MiCaptureProtectionFromProto+0x1c
fffff880`0964a9c0 fffff800`02e4d831 : 00000000`00000000 fffffa80`0706c6a0 fffff6fb`7da00000 efffffff`00000420 : nt! ?? ::FNODOBFM::`string'+0x1443c
fffff880`0964aa00 fffff800`02e4d493 : fffffa80`0706c6a0 fffffa80`0701f780 fffffa80`0701f780 00000000`00680000 : nt!MiQueryAddressState+0x2b1
fffff880`0964aa50 fffff800`0315c724 : fffff880`0964aca0 00000000`00681000 fffffa80`0706c6a0 fffff780`00000000 : nt!MiQueryAddressSpan+0x73
fffff880`0964aac0 fffff800`02e80ed3 : 00000000`0000015c fffffa80`03bfd8e0 fffff880`0964abc8 00000000`0027ab78 : nt!NtQueryVirtualMemory+0x382
fffff880`0964abb0 00000000`77a3154a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0027ab58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77a3154a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCaptureProtectionFromProto+1c
fffff800`02ecaafc 488b01          mov     rax,qword ptr [rcx]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiCaptureProtectionFromProto+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x50_nt!MiCaptureProtectionFromProto+1c

BUCKET_ID:  X64_0x50_nt!MiCaptureProtectionFromProto+1c

Followup: MachineOwner
---------
  1. Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...
  2. Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Drivers...

Thanks to Dave76 for help understanding possible causes.



We will start with the common problems first (see bold possible causes). Do the following steps and test after each to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

  • If you are overclocking any hardware, please stop.


  • Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).

    If you swap any memory components, follow these steps for ESD safety:
    1. Shut down and turn off your computer.
    2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
    3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
    4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.

    Once these steps have been followed, it is safe to remove and replace components within your computer.



  • Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using Check Disk (chkdsk) - Read Event Viewer Log




Please remove Daemon Tools, as it uses a driver called dtsoftbus01.sys that is known to cause BSODs.

I prefer TotalMounter as my CD/DVD virtualization software as it allows me to burn images to a virtual CD/DVD if I just want an ISO file instead of a disc, and it is free.

Many use MagicISO - Convert BIN to ISO, Create, Edit, Burn, Extract ISO file, ISO/BIN converter/extractor/editor as well, which is also free.