bsod help

Wait for the next BSOD. I'll run an analysis on it.
If I can't figure it out from that, then we'll move on to the Driver Verifier thing.

OK, nothing more significant in the dump files - so I'll suggest running Driver Verifier.
Please read the instructions thoroughly before starting - as Driver Verifier can render your system unbootable.

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Automatically select unsigned drivers" and click "Next"
If no drivers show up, then select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out.

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

I've reached my limit on RapidShare and it won't allow me to download any more.

Please repost it to another free file hosting service (I like http://www.box.net )
You'll have to share the file out, then it'll give you a link to post here.

You don't need the huge dump files. Minidump files work just as well and are easier to manipulate.

To set your system to capture minidumps, please follow the instructions here: http://www.carrona.org/setmini.html

This one works, but it's slow as molasses. I'll be back with the analysis when it's done.

Are you running Driver Verifier? If not, please keep it running until we get a Driver Verifier error (or we solve it another way).

Got the dump file and ran the analysis. It's a STOP 0x3B - System Service Exception It's not a Driver Verifier error - but if Driver Verifier was running when it happened, it gives us a clue that this is a program/service rather than a driver.
More info on the error here: BSOD Index

It occurred in CODWaW.exe and it was an exception while accessing memory.

Each time a MEMORY.dmp file is generated - it wipes out the old one. So I'd suggest saving them in another location (adding a date to the file name) in order to have a record of what's going on. Once the system is generating minidumps this'll be taken care of automatically.

2 more things to do while waiting for the next memory dump.
- Go to Start and type in "msinfo32" (without the quotes) and press Enter.
Save the report as an .nfo file, zip it up and upload the .zip file with your next post
- Download and run the free Windows 7 Upgrade Advisor ( http://www.microsoft.com/downloads/d...displaylang=en ) Save the report in whatever format that it suggests, zip it up and upload it with your next post also.

Dump file analysis:

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a61000 PsLoadedModuleList = 0xfffff800`02c9ee50
Debug session time: Mon Sep 14 14:39:13.093 2009 (GMT-4)
System Uptime: 0 days 0:04:28.701
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Loading unloaded module list
...
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002ad70b6, fffff88007fe5130, 0}

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
Probably caused by : ntkrnlmp.exe ( nt!KeSetEvent+226 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002ad70b6, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88007fe5130, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 00000000`7efdf018).  Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KeSetEvent+226
fffff800`02ad70b6 488b09          mov     rcx,qword ptr [rcx]

CONTEXT:  fffff88007fe5130 -- (.cxr 0xfffff88007fe5130)
rax=fffffa8007b84728 rbx=fffffa8007b84720 rcx=00fffa8007b84728
rdx=0000000000000001 rsi=0000000000000000 rdi=fffff880009f2180
rip=fffff80002ad70b6 rsp=fffff88007fe5b10 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000038 r10=00fffa8007b84728
r11=00000000001f0003 r12=000000007efaa001 r13=0000000006f0fd20
r14=0000000006f0f170 r15=0000000073a92450
iopl=0         nv up ei pl nz na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010207
nt!KeSetEvent+0x226:
fffff800`02ad70b6 488b09          mov     rcx,qword ptr [rcx] ds:002b:00fffa80`07b84728=????????????????
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  CoDWaW.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002decdf0 to fffff80002ad70b6

STACK_TEXT:  
fffff880`07fe5b10 fffff800`02decdf0 : 00000000`00000000 fffff880`00000001 fffffa80`03a37000 00000000`00000001 : nt!KeSetEvent+0x226
fffff880`07fe5b80 fffff800`02ad2153 : fffffa80`078834c0 fffff880`07fe5c60 00000000`00000000 fffffa80`07b84720 : nt!NtSetEvent+0x90
fffff880`07fe5be0 00000000`73a92dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`06f0f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73a92dd9


FOLLOWUP_IP: 
nt!KeSetEvent+226
fffff800`02ad70b6 488b09          mov     rcx,qword ptr [rcx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeSetEvent+226

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

STACK_COMMAND:  .cxr 0xfffff88007fe5130 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!KeSetEvent+226

BUCKET_ID:  X64_0x3B_nt!KeSetEvent+226

Followup: MachineOwner
---------