Randomly getting BSOD

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80031f0020, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80031f0020
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b47fd0 to fffff80002ada640

STACK_TEXT:  
fffff880`03b04958 fffff800`02b47fd0 : 00000000`0000001a 00000000`00041790 fffffa80`031f0020 00000000`0000ffff : nt!KeBugCheckEx
fffff880`03b04960 fffff800`02ac7aef : fffffa80`00000000 00000000`181cffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`03b04b20 fffff800`02ad98d3 : ffffffff`ffffffff 00000000`0176f858 00000000`0176f850 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`03b04c20 00000000`779914fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0176f818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779914fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36024
fffff800`02b47fd0 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36024

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7951a

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002bf59bc, fffff88006474a50, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bf59bc, Address of the instruction which caused the bugcheck
Arg3: fffff88006474a50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+100
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx]

CONTEXT:  fffff88006474a50 -- (.cxr 0xfffff88006474a50)
rax=fffff8a001a56f60 rbx=0000000000000001 rcx=fffffa800395a320
rdx=ffeff8a001a500c0 rsi=0000000000000000 rdi=fffff8a001a56d60
rip=fffff80002bf59bc rsp=fffff88006475430 rbp=0000000000000000
 r8=ffeff8a001a500c0  r9=fffff8a001a544a0 r10=0000000000000001
r11=0000000000000000 r12=fffffa800395a140 r13=0000000000000000
r14=0000000000000015 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx] ds:002b:ffeff8a0`01a500c0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002bf59bc

STACK_TEXT:  
fffff880`06475430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100


FOLLOWUP_IP: 
nt!ExDeferredFreePool+100
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+100

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff88006474a50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

Followup: Pool_corruption
---------

---------

The same 1A (Memory Management) Errors.

Anyway, Please remove AVIRA for testing purpose. Use Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other security software:

Microsoft Security Essentials - Free Antivirus for Windows

Malwarebytes - Free

Good and Free system security combination.

Scan with Kaspersky TDSSKiller:Anti-rootkit utility TDSSKiller

ESET online scanner: Free Online Virus Scanner | ESET

Update the driver below:

Rt64win7.sys Thu Feb 26 15:04:13 2009 (49A65B0D)
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC
Driver Reference Table - Rt64win7.sys

Perform a clean install of a driver following: How to Clean Left Over Driver Files with Driver Sweeper

i uninstalled avira, and i install Malwarebytes - Free , Microsoft Security Essentials , ESET online scanner and in the scaning process i get bsod...
also Update the driver.

Do you have everything unplugged from the USB ports?

arso said:

I disconnected the hard disk and usb cable,
this morning two new bsod

When you posted this, were the external objects plugged in or out?

Enable Driver Verifier to see if it catches any misbehaving driver: Driver Verifier - Enable and Disable

Disable verifier