BSOD at random ntoskrnl.exe+7efc0

Hi all, This issue started for me yesterday, first my video converter kept freezing each time i tried to use it, then my world of warcraft kept crashing, i then tried to run the repair tool from outside of the game, and it started crashing too, ok, now i was suspicious and i bought SuperAntispyware, i started a scan with that one and my Norton (at the same time) and after about 2-3 minutes i got my first BSOD.

My PC restarted and I decided to restore a clean ghost partition of my system drive (equals a fresh windows install, but faster). So i would back up some files saved on my desktop, now IE kept crashing each time i tried to enter one of my drives. So i rebooted in safe mode and did the task with no issues, i decided to run SuperAntispyware while in safe mode and that went just fine. (it found a trojan and removed it).

So now i ran the ghost restore (from a boot CD) and got my system restored to a earlier date. now i just needed to update my Windows and Norton. And i got this BSOD (so my system isnt fully updated in the ZIP uploaded) . I hoped my fight would be over with this clean install, but it seems not.

In addition to the Zup from the SF Diagnostic tool i have some info from Blue Screen View
==================================================
Dump File : 040713-30342-01.dmp
Crash Time : 07-04-2013 03:28:07
Bug Check String : MEMORY_MANAGEMENT
Bug Check Code : 0x0000001a
Parameter 1 : 00000000`00000031
Parameter 2 : fffffa80`085f6900
Parameter 3 : fffff880`07312000
Parameter 4 : fffff8a0`102838a2
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+7efc0
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7601.17944 (win7sp1_gdr.120830-0333)
Processor : x64
Crash Address : ntoskrnl.exe+7efc0
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\040713-30342-01.dmp
Processors Count : 8
Major Version : 15
Minor Version : 7601
Dump File Size : 285.168
==================================================

Thanks in advance.

Jim Kromann

Start by testing ram:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {31, fffffa80085f6900, fffff88007312000, fffff8a0102838a2}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+7271 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000031, The subtype of the bugcheck.
Arg2: fffffa80085f6900
Arg3: fffff88007312000
Arg4: fffff8a0102838a2

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_31

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  ccsvchst.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000333e915 to fffff800030e5fc0

STACK_TEXT:  
fffff880`06eec848 fffff800`0333e915 : 00000000`0000001a 00000000`00000031 fffffa80`085f6900 fffff880`07312000 : nt!KeBugCheckEx
fffff880`06eec850 fffff800`033b9797 : fffffa80`00000000 fffffa80`09378060 00000000`0000034e fffff8a0`10275000 : nt! ?? ::NNGAKEGL::`string'+0x7271
fffff880`06eec8b0 fffff800`03114ceb : ffffffff`ffffffff fffff880`06eeca78 00000000`00008000 fffffa80`087bfc00 : nt!MiRelocateImagePfn+0xf7
fffff880`06eec910 fffff800`0310ccbf : fffffa80`09cc08f0 fffff880`06eeca80 fffffa80`0b3fa3f8 fffffa80`09cc08f0 : nt!MiWaitForInPageComplete+0x7ef
fffff880`06eec9f0 fffff800`030f365a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff fffff680`00000000 : nt!MiIssueHardFault+0x28b
fffff880`06eecac0 fffff800`030e40ee : 00000000`00000008 00000000`6a93b4e0 00000000`002b9a01 00000000`0ca3e4e8 : nt!MmAccessFault+0x146a
fffff880`06eecc20 00000000`6a93b4e0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`03ffb020 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x6a93b4e0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::NNGAKEGL::`string'+7271
fffff800`0333e915 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::NNGAKEGL::`string'+7271

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  503f82be

FAILURE_BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

BUCKET_ID:  X64_0x1a_31_nt!_??_::NNGAKEGL::_string_+7271

Followup: MachineOwner
---------

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.
RAM - Test with Memtest86+

   Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

jimkromann said:

PS : i dont understand the "code" you posted, what is that for?

Just for reference.