Well done on removing PxHlpa64.sys Sonic CD/DVD driver (used by many different CD/DVD programs) it was outdated and hence caused the BSOD with verifier enabled.
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C9, {228, fffff880019aaf74, fffff9801b5cae10, 0}
*** WARNING: Unable to verify timestamp for PxHlpa64.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHlpa64.sys
Probably caused by : PxHlpa64.sys ( PxHlpa64+2f74 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Debugging Details:
------------------
BUGCHECK_STR: 0xc9_228
DRIVER_VERIFIER_IO_VIOLATION_TYPE: 228
FAULTING_IP:
PxHlpa64+2f74
fffff880`019aaf74 49894818 mov qword ptr [r8+18h],rcx
FOLLOWUP_IP:
PxHlpa64+2f74
fffff880`019aaf74 49894818 mov qword ptr [r8+18h],rcx
IRP_ADDRESS: fffff9801b5cae10
DEVICE_OBJECT: fffffa8008fa3030
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from fffff8000355e4ec to fffff800030d0b80
STACK_COMMAND: .bugcheck ; kb
SYMBOL_NAME: PxHlpa64+2f74
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PxHlpa64
IMAGE_NAME: PxHlpa64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a416253
FAILURE_BUCKET_ID: X64_0xc9_228_VRF_PxHlpa64+2f74
BUCKET_ID: X64_0xc9_228_VRF_PxHlpa64+2f74
Followup: MachineOwner
---------
0: kd> lmvm PxHlpa64
start end module name
fffff880`019a8000 fffff880`019b3e00 PxHlpa64 T (no symbols)
Loaded symbol image file: PxHlpa64.sys
Image path: \SystemRoot\System32\Drivers\PxHlpa64.sys
Image name: PxHlpa64.sys
Timestamp: Wed Jun 24 05:16:35 2009 (4A416253)
CheckSum: 000111B7
ImageSize: 0000BE00
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
------------------------
Reduce the start-up items, Antivirus software is basically whats required.
------------------------
Norton is a frequent cause of BSOD's. I would recommend you uninstall it for the time being and use Microsoft Security Essentials & the Free version of Malwarebytes, update and make full scans separately:
Note
Do not start the trial version of MalwareBytes
------------------------
Make scans with these tools -
------------------------
Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
- Click on the
- Type CMD on Search
- Left click and Run as Administrator
- Type SFC /scannow - read here
Run Disk Check on your Hard Drive for file system errors and bad sectors on it - read here
Hardware Checks:
------------------------
Upload a screenshot using:
Test your Hard Drive(s) by running:
------------------------
Test and Diagnose RAM Issues with Memtest86+:
Tip
- Pay close attention to Part 3 of the tutorial "If you have errors"
-
Test the RAM with Memtest86+ for at least 7-10 passes. It may take up to 22 passes to find problems. Make sure to run it once after the system has been on for a few hours and is warm, and then also run it again when the system has been off for a few hours and is cold.
Monitor hardware temperature with system monitoring software like Speccy or HWMonitor. Upload a screen shot of the Summary tab as well:
- For how to upload a screenshot or file, read here
Post back with results
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89c0eb512, b3b7465eee8b8468, fffff80003198ca0, 1}
Probably caused by : memory_corruption ( nt!MiAllocateLowMemory+0 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89c0eb512, Reserved
Arg2: b3b7465eee8b8468, Reserved
Arg3: fffff80003198ca0, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
FAULTING_IP:
nt!MiAllocateLowMemory+0
fffff800`03198ca0 4c894c2420 mov qword ptr [rsp+20h],r9
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x109
PROCESS_NAME: System
CURRENT_IRQL: 0
STACK_TEXT:
fffff880`039855d8 00000000`00000000 : 00000000`00000109 a3a039d8`9c0eb512 b3b7465e`ee8b8468 fffff800`03198ca0 : nt!KeBugCheckEx
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiAllocateLowMemory+0
fffff800`03198ca0 4c894c2420 mov qword ptr [rsp+20h],r9
SYMBOL_NAME: nt!MiAllocateLowMemory+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 51db806a
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x109_1_nt!MiAllocateLowMemory+0
BUCKET_ID: X64_0x109_1_nt!MiAllocateLowMemory+0
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d89b991516, b3b7465eee15e46c, fffff80003199190, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
or data. See http://www.microsoft.com/whdc/driver/kernel/64bitPatching.mspx
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d89b991516, Reserved
Arg2: b3b7465eee15e46c, Reserved
Arg3: fffff80003199190, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
FAULTING_IP:
nt!IopGetPhysicalMemoryBlock+0
fffff800`03199190 48895c2410 mov qword ptr [rsp+10h],rbx
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x109
PROCESS_NAME: System
CURRENT_IRQL: 0
STACK_TEXT:
fffff880`039625d8 00000000`00000000 : 00000000`00000109 a3a039d8`9b991516 b3b7465e`ee15e46c fffff800`03199190 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80003199275 - nt!IopGetPhysicalMemoryBlock+e5
[ f8:fa ]
1 error : !nt (fffff80003199275)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
Quote