Frequent BSODs on new PC -- ntoskrnl.exe

ashground · 14 Jul 2010

- Windows 7 x64 Pro
- Clean install, less than a month ago
- Retail version (download)
- All new hardware (exept an old DVD drive)

I built a new computer around two months ago. I originally had Windows Server 2008 R2 as the OS, but after finding a number of compatibility problems with it, I formatted the drive and did a fresh install of Windows 7 x64 Pro. Ever since when, I've been experiencing random BSODs -- it doesn't matter if I'm playing a game, browsing the internet, or even if the computer is sitting idle, and it occurs irregularly, too.

Does anyone have a minute to help me track down the source of these crashes? I'm at a loss. This is the information from the latest crash from WhoCrashed:

Code:

On Tue 7/13/2010 4:36:08 AM your computer crashed
This was likely caused by the following module: ntoskrnl.exe
Bugcheck code: 0x1A (0x5003, 0xFFFFF70001080000, 0x117A4, 0xE8D801022F48)
Error: MEMORY_MANAGEMENT
Dump file: C:\Windows\Minidump\071310-34975-01.dmp
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System

And from the Event Viewer:

Code:

System 

  - Provider 

   [ Name]  Microsoft-Windows-Kernel-Power 
   [ Guid]  {331C3B3A-2005-44C2-AC5E-77220C37D6B4} 
 
   EventID 41 
 
   Version 2 
 
   Level 1 
 
   Task 63 
 
   Opcode 0 
 
   Keywords 0x8000000000000002 
 
  - TimeCreated 

   [ SystemTime]  2010-07-14T04:35:47.282433000Z 
 
   EventRecordID 7552 
 
   Correlation 
 
  - Execution 

   [ ProcessID]  4 
   [ ThreadID]  8 
 
   Channel System 
 
   Computer Hildebrandt-PC 
 
  - Security 

   [ UserID]  S-1-5-18 
 

- EventData 

  BugcheckCode 26 
  BugcheckParameter1 0x5003 
  BugcheckParameter2 0xfffff70001080000 
  BugcheckParameter3 0x117a4 
  BugcheckParameter4 0xe8d801022f48 
  SleepInProgress false 
  PowerButtonTimestamp 0

ttran · 14 Jul 2010

There is no minidump files in the one you uploaded. Are you sure it is BSODs? Are you using any program such as CCleaner or some clean tools like that?

ashground · 14 Jul 2010

Sorry, I must not have run the tool as administrator. I uploaded a new attachment -- it should have nine dumps in it.

ashground · 14 Jul 2010

Sorry for the bump, but the post had already drifted to page 3. Is anyone available to help me with this?

CarlTR6 · 14 Jul 2010

This will take a little bit to look at these. Another of the team may jump in in the meantime.

Your have a variety of error codes and this usually point to hardware or hardware related issues.

BugCheck 7F - Usual causes: Memory corruption, Hardware (memory in particular), Installing a faulty or mismatched hardware (especially memory) or a failure after installing it, 3rd party firewall, Device drivers, SCSI/network/BIOS updates needed, Improperly seated cards, Incompatible storage devices, Overclocking, Virus scanner, Backup tool, Bad motherboard, Missing Service Pack
BSOD Index

BugCheck 1A - Usual causes: Device driver, memory, kernel BSOD Index

BugCheck 3B - Usual causes: System service, Device driver, graphics driver, ?memory BSOD Index

BugCheck 1E - Usual causes: Device driver, hardware, System service, compatibility, Remote control programs, memory, BIOS
BSOD Index

BugCheck D1 - Usual causes: Device driver BSOD Index

BugCheck 34 - Usual causes: Insufficient physical memory, Indexing, Device driver BSOD Index

Here are the actual analyzes. Notice that memory and drivers show up in each of these dump files.

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\061810-24148-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02603000 PsLoadedModuleList = 0xfffff800`02840e50
Debug session time: Fri Jun 18 03:01:09.802 2010 (GMT-4)
System Uptime: 0 days 0:13:01.865
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, fffff80002687787}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: fffff80002687787

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff80002674469 to fffff80002674f00

STACK_TEXT:  
fffff880`02fdbce8 fffff800`02674469 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`02fdbcf0 fffff800`02672932 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02fdbe30 fffff800`02687787 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2
00000000`033085f5 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeAcquireQueuedSpinLock+0x93


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff8000268777b - nt!KeAcquireQueuedSpinLock+87
    [ 48:c8 ]
1 error : !nt (fffff8000268777b)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\062510-39686-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02814000 PsLoadedModuleList = 0xfffff800`02a51e50
Debug session time: Fri Jun 25 21:25:56.588 2010 (GMT-4)
System Uptime: 0 days 19:32:58.650
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 147de001, 7586, fffff70001080000}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+4a83 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 00000000147de001
Arg3: 0000000000007586
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Picasa3.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800028dadf3 to fffff80002884600

STACK_TEXT:  
fffff880`0579d928 fffff800`028dadf3 : 00000000`0000001a 00000000`00041284 00000000`147de001 00000000`00007586 : nt!KeBugCheckEx
fffff880`0579d930 fffff800`028b5315 : fffff700`01080000 d8600000`ad6ef867 99200000`77796c66 00000000`00000002 : nt! ?? ::FNODOBFM::`string'+0x4a83
fffff880`0579d970 fffff800`028c5fca : 00000000`00000000 00000000`18a9afff fffffa80`00000000 fffffa80`09f3f060 : nt!MiDeleteVirtualAddresses+0x4cc
fffff880`0579db30 fffff800`02883853 : ffffffff`ffffffff 00000000`07a7e810 00000000`07a7e808 00000000`00008000 : nt!NtFreeVirtualMemory+0x5ca
fffff880`0579dc20 00000000`7715ff3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`07a7e7d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7715ff3a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4a83
fffff800`028dadf3 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4a83

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

BUCKET_ID:  X64_0x1a_41284_nt!_??_::FNODOBFM::_string_+4a83

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\062610-28610-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a4e000 PsLoadedModuleList = 0xfffff800`02c8be50
Debug session time: Sun Jun 27 02:19:27.152 2010 (GMT-4)
System Uptime: 1 days 4:52:41.604
Loading Kernel Symbols
...............................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002a876fa, fffff880073d68d0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002a876fa, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff880073d68d0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MmGetSessionId+1e
fffff800`02a876fa 3b4241          cmp     eax,dword ptr [rdx+41h]

CONTEXT:  fffff880073d68d0 -- (.cxr 0xfffff880073d68d0)
rax=0000000000000001 rbx=fffffa8008ebd010 rcx=fffffa80071bb3c0
rdx=00000000ffffffff rsi=0000000000000000 rdi=fffffa80072ff960
rip=fffff80002a876fa rsp=fffff880073d72a8 rbp=fffffa80071bb3c0
 r8=0000000000000000  r9=fffff880073d72d0 r10=fffffa80075d0880
r11=fffff880073d7578 r12=0000000000000000 r13=8000080000000001
r14=8000080000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!MmGetSessionId+0x1e:
fffff800`02a876fa 3b4241          cmp     eax,dword ptr [rdx+41h] ds:002b:00000001`00000040=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  javaw.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002a876fa

STACK_TEXT:  
fffff880`073d72a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmGetSessionId+0x1e


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    fffff80002a876fb - nt!MmGetSessionId+1f
    [ c2:42 ]
1 error : !nt (fffff80002a876fb)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffff880073d68d0 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071010-20311-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a1e000 PsLoadedModuleList = 0xfffff800`02c5be50
Debug session time: Sat Jul 10 22:29:07.726 2010 (GMT-4)
System Uptime: 0 days 6:03:38.178
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071110-26332-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Sun Jul 11 21:41:23.430 2010 (GMT-4)
System Uptime: 0 days 5:18:03.492
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffff80082a774da, 2, 8, fffff80082a774da}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071010-20311-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a1e000 PsLoadedModuleList = 0xfffff800`02c5be50
Debug session time: Sat Jul 10 22:29:07.726 2010 (GMT-4)
System Uptime: 0 days 6:03:38.178
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+5cb3952f00bdd828
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88002ffdb48 -- (.exr 0xfffff88002ffdb48)
ExceptionAddress: fffff80002a96dd2 (nt!KiIdleLoop+0x0000000000000032)
   ExceptionCode: c0000096
  ExceptionFlags: 00000000
NumberParameters: 0

TRAP_FRAME:  fffff88002ffdbf0 -- (.trap 0xfffff88002ffdbf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000027194 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002a96dd2 rsp=fffff88002ffdd80 rbp=0000000000000000
 r8=000000000000872f  r9=0000000000000000 r10=0000000000016315
r11=fffffa80078c8e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
nt!KiIdleLoop+0x32:
fffff800`02a96dd2 440f22c1        mov     cr8,rcx
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a8632e to fffff80002a8e5d0

STACK_TEXT:  
fffff880`02ffcc38 fffff800`02a8632e : 00000000`00000000 00000000`0000000f fffff880`02ffd3b0 fffff800`02abb524 : nt!KeBugCheck
fffff880`02ffcc40 fffff800`02ab42ed : 00000000`0010001f fffff880`02ffd3b0 fffff880`02ffdbf0 fffff880`02ffdb48 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02ffcc70 fffff800`02abb950 : fffff800`02bddb24 fffff880`02ffcce8 fffff880`02ffdb48 fffff800`02a1e000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02ffcca0 fffff800`02ac88df : fffff880`02ffdb48 fffff880`02ffd3b0 fffff880`00000000 fffffa80`06bcc760 : nt!RtlDispatchException+0x410
fffff880`02ffd380 fffff800`02a8dc42 : fffff880`02ffdb48 fffff880`02fd5180 fffff880`02ffdbf0 fffff880`02fdffc0 : nt!KiDispatchException+0x16f
fffff880`02ffda10 fffff800`02a8c54a : fffff880`02fd5180 fffff880`02ffdc70 fffff880`02fd7d60 00000000`00000003 : nt!KiExceptionDispatch+0xc2
fffff880`02ffdbf0 fffff800`02a96dd2 : fffff880`02fd5180 fffff880`00000002 00000000`00000002 fffff880`00000000 : nt!KiGeneralProtectionFault+0x10a
fffff880`02ffdd80 00000000`00000000 : fffff880`02ffe000 fffff880`02ff8000 fffff880`02ffdd40 00000000`00000000 : nt!KiIdleLoop+0x32


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02a8632e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071210-23836-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a01000 PsLoadedModuleList = 0xfffff800`02c3ee50
Debug session time: Tue Jul 13 02:51:48.720 2010 (GMT-4)
System Uptime: 0 days 0:28:15.172
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {fffffa8086d04fd0, 2, 0, fffff88010bbcf0c}

Probably caused by : usbuhci.sys ( usbuhci!UhciProcessDoneAsyncTd+24 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffffa8086d04fd0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88010bbcf0c, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ca90e0
 fffffa8086d04fd0 

CURRENT_IRQL:  2

FAULTING_IP: 
usbuhci!UhciProcessDoneAsyncTd+24
fffff880`10bbcf0c 4c8b7f08        mov     r15,qword ptr [rdi+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  ffmpeg.exe

TRAP_FRAME:  fffff88002f93b50 -- (.trap 0xfffff88002f93b50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88002f93d48 rbx=0000000000000000 rcx=fffffa800801b6a0
rdx=fffff880067e40e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88010bbcf0c rsp=fffff88002f93ce0 rbp=fffff880067e1260
 r8=0000000000000000  r9=fffff880067e1260 r10=00000000ffffffff
r11=fffffa8006894410 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
usbuhci!UhciProcessDoneAsyncTd+0x24:
fffff880`10bbcf0c 4c8b7f08        mov     r15,qword ptr [rdi+8] ds:8010:00000000`00000008=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a70b69 to fffff80002a71600

STACK_TEXT:  
fffff880`02f93a08 fffff800`02a70b69 : 00000000`0000000a fffffa80`86d04fd0 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02f93a10 fffff800`02a6f7e0 : fffffa80`08656000 00000000`00000000 fffffa80`08688010 fffffa80`086579a0 : nt!KiBugCheckDispatch+0x69
fffff880`02f93b50 fffff880`10bbcf0c : 00000000`00000000 fffff880`0fead924 fffffa80`07e45000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`02f93ce0 fffff880`10bbd7c6 : fffffa80`06b78fd8 fffffa80`06b78f30 00000000`00000000 fffffa80`06b78ff0 : usbuhci!UhciProcessDoneAsyncTd+0x24
fffff880`02f93d50 fffff880`10bba2d6 : 00000000`00000002 fffffa80`06b78cf0 00000000`00000000 fffffa80`0801a1a0 : usbuhci!UhciPollAsyncEndpoint+0x5de
fffff880`02f93db0 fffff880`03f0de8b : fffffa80`0801a1a0 00000000`00000002 00000000`00000000 00000000`00000010 : usbuhci!UhciPollEndpoint+0x1a
fffff880`02f93de0 fffff880`03f129b1 : 00000000`00000010 00000000`00000004 fffffa80`06b78cf0 fffffa80`0801a050 : USBPORT!MPf_PollEndpoint+0x9b
fffff880`02f93e10 fffff880`03f1e043 : fffffa80`0801a1a0 00000000`00000010 fffffa80`0000000e 00000000`00000000 : USBPORT!USBPORT_iSetGlobalEndpointStateTx+0x7c1
fffff880`02f93e70 fffff880`03f0ef89 : fffffa80`0801a050 00000000`00000000 fffffa80`0801aa02 fffffa80`0801aa10 : USBPORT!USBPORT_Core_UsbHcIntDpc_Worker+0x1af
fffff880`02f93ed0 fffff800`02a7ccdc : fffff880`02f64180 fffffa80`0801aa10 fffffa80`0801aa28 00000000`00000000 : USBPORT!USBPORT_Xdpc_Worker+0x1d9
fffff880`02f93f00 fffff800`02a77765 : 0000057c`00000000 fffffa80`06d606e0 00000000`00000000 fffff880`03f0edb0 : nt!KiRetireDpcList+0x1bc
fffff880`02f93fb0 fffff800`02a7757c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`0753cbe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND:  kb

FOLLOWUP_IP: 
usbuhci!UhciProcessDoneAsyncTd+24
fffff880`10bbcf0c 4c8b7f08        mov     r15,qword ptr [rdi+8]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  usbuhci!UhciProcessDoneAsyncTd+24

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: usbuhci

IMAGE_NAME:  usbuhci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bcc03

FAILURE_BUCKET_ID:  X64_0xD1_usbuhci!UhciProcessDoneAsyncTd+24

BUCKET_ID:  X64_0xD1_usbuhci!UhciProcessDoneAsyncTd+24

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071210-24180-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a1a000 PsLoadedModuleList = 0xfffff800`02c57e50
Debug session time: Tue Jul 13 02:22:22.002 2010 (GMT-4)
System Uptime: 0 days 1:44:54.454
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 34, {50830, fffff880031935e8, fffff88003192e50, fffff80002aa7479}

Probably caused by : memory_corruption ( nt!MmCheckCachedPageStates+2f9 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CACHE_MANAGER (34)
    See the comment for FAT_FILE_SYSTEM (0x23)
Arguments:
Arg1: 0000000000050830
Arg2: fffff880031935e8
Arg3: fffff88003192e50
Arg4: fffff80002aa7479

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff880031935e8 -- (.exr 0xfffff880031935e8)
ExceptionAddress: fffff80002aa7479 (nt!MmCheckCachedPageStates+0x00000000000002f9)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  fffff88003192e50 -- (.cxr 0xfffff88003192e50)
rax=fffff8a00d088d80 rbx=00000000574d1921 rcx=0000000000000006
rdx=fffff80002a1a000 rsi=fffff6fcc00bb180 rdi=0000000000000000
rip=fffff80002aa7479 rsp=fffff88003193820 rbp=fffff88003193880
 r8=0000058000000000  r9=fffffa8000000008 r10=fffffa80021d6d40
r11=2aaaaaaaaaaaaaab r12=fffffa800105e730 r13=0000000000000000
r14=fffff6fcc00bb1f8 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0000  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
nt!MmCheckCachedPageStates+0x2f9:
fffff800`02aa7479 f0498344240801  lock add qword ptr [r12+8],1 ds:002b:fffffa80`0105e738=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x34

PROCESS_NAME:  System

CURRENT_IRQL:  2

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from fffff80002aceb8e to fffff80002aa7479

STACK_TEXT:  
fffff880`03193820 fffff800`02aceb8e : fffff980`1760b000 00000000`00045000 00000000`00000000 00000000`00000005 : nt!MmCheckCachedPageStates+0x2f9
fffff880`031939d0 fffff800`02ceff4a : 00000000`11180000 00000000`1118b000 00000000`00045000 00000000`00000001 : nt!CcFetchDataForRead+0x10e
fffff880`03193a30 fffff800`02a3cb1c : fffffa80`06713770 00000000`1118b000 00000000`00035000 fffff800`02c2f501 : nt!CcMapAndCopyFromCache+0xba
fffff880`03193ad0 fffff800`02a7e472 : fffffa80`06f327d0 fffff800`02c2f500 00000000`00000005 00000000`00000000 : nt!CcPerformReadAhead+0x3b8
fffff880`03193c00 fffff800`02a97861 : fffffa80`06739550 fffff800`02d87804 fffff800`02c91150 fffff800`00000000 : nt!CcWorkerThread+0x21e
fffff880`03193cb0 fffff800`02d2fa86 : 00000000`00000000 fffffa80`0674a1a0 00000000`00000080 fffffa80`06722040 : nt!ExpWorkerThread+0x111
fffff880`03193d40 fffff800`02a68b06 : fffff880`02f64180 fffffa80`0674a1a0 fffff880`02f6efc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03193d80 00000000`00000000 : fffff880`03194000 fffff880`0318e000 fffff880`031936e0 00000000`00000000 : nt!KxStartSystemThread+0x16


FOLLOWUP_IP: 
nt!MmCheckCachedPageStates+2f9
fffff800`02aa7479 f0498344240801  lock add qword ptr [r12+8],1

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MmCheckCachedPageStates+2f9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

STACK_COMMAND:  .cxr 0xfffff88003192e50 ; kb

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x34_nt!MmCheckCachedPageStates+2f9

BUCKET_ID:  X64_0x34_nt!MmCheckCachedPageStates+2f9

Followup: MachineOwner
---------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Owner\AppData\Local\Temp\Temp1_Windows crash reports.zip\Windows7_BSOD_jcgriff2\071310-34975-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a0d000 PsLoadedModuleList = 0xfffff800`02c4ae50
Debug session time: Wed Jul 14 00:34:07.474 2010 (GMT-4)
System Uptime: 0 days 1:06:45.926
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 117a4, e8d801022f48}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+29f97 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 00000000000117a4
Arg4: 0000e8d801022f48

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  Bridge.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002aecd98 to fffff80002a7d600

STACK_TEXT:  
fffff880`0727c9c8 fffff800`02aecd98 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`000117a4 : nt!KeBugCheckEx
fffff880`0727c9d0 fffff800`02a978a6 : 00000000`00000001 00000000`1786a000 fffff880`0727cc20 fffff680`000bc350 : nt! ?? ::FNODOBFM::`string'+0x29f97
fffff880`0727cac0 fffff800`02a7b6ee : 00000000`00000001 00000000`116f7d70 00000000`064fbc01 00000000`00000006 : nt!MmAccessFault+0x5c6
fffff880`0727cc20 00000000`4fe2d047 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`064fb8ac 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x4fe2d047


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+29f97
fffff800`02aecd98 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+29f97

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29f97

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+29f97

Followup: MachineOwner
---------

You have some obsolete drivers on your system. Win 7 does not like older drivers. They can cause instability and memory corruption.

adfs.SYS Thu Jun 26 16:52:37 2008
atksgt.sys Sun May 17 09:36:34 2009
GEARAspiWDM.sys Mon May 18 08:17:04 2009
lirsgt.sys Sun May 17 09:06:57 2009
PxHlpa64.sys Mon Dec 10 18:49:01 2007

1. Update these drivers, especially the two in red font.

How to update drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone - search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.
- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

After you have updated these drivers, reboot and see how your system runs. If you have another BSOD, please upload that dump and go to step 2.

2. In this step you will test your RAM. Download a copy of Memtest86+ - Advanced Memory Diagnostic Tool and burn the ISO to a CD using http://isorecorder.alexfeinman.com/W7. Boot from the CD, and leave it running for at least 7 passes. Post your results and we will go from there.

Petey7 · 14 Jul 2010

For a second I thought I knew what to tell you but now I can make no such promise.

I got a BSOD similar to the one you received (but not the same) after installing the exact version you mentioned on a new hard drive. The problem was that a driver was the 32-bit version instead of the 64-bit version. I'm thinking you might be experiencing a driver issue as well.

I see that he error is reported as "Memory Managment." This makes me think that it might be the ram on your computer. Windows has a built in program for testing ram. This will tell you how to run it. The test is really thorough and will tell you if there is an issue, such as a faulty stick.

Good luck and let us know if this helps or not.

ashground · 14 Jul 2010

I already ran Windows' memory diagnostics -- it reported everything as fine.

I should also note that when these BSODs started, I hadn't installed my motherboard drivers (since Windows did a decent job of detecting everything and I didn't want to install the crap that's bundled with the installs). When I noticed how frequent the BSODs were, I installed the drivers off the CD, but that's made no difference.

Petey7 · 14 Jul 2010

Did you have BSODs or any other issues before installing the drivers? If not, you might just want to not have the drivers. Sounds like a compatibility issue. You might be able to google common issues with your motherboard and see if anyone else has had the same problem.

Edit: forget the first part. I was not paying attention while reading your post. The part about googling common issues still stands. You might find something useful.

CarlTR6 · 14 Jul 2010

ashground, the windows built in memory diagnostics is not as reliable as we would like. Further check you RAM using the memtest as I posted above.

Here is some help with your drivers:

adfs.SYS is an Adobe File System Driver http://www.adobe.com

atksgt.sys belongs to the software atksgt by Tages SA.

GEARAspiWDM.sys is a CD-ROM Class Filter Driver by Gear Software http://www.gearsoftware.com

lirsgt.sys is part of a Copy Protection platform developed by Tages SA TAGES, the AAA Copy Protection System

PxHlpa64.sys is a Px Engine Device Driver for 64-bit Windows or PxHlpa belongs to the software PxHelp or PxHlpa by Sonic Solutions (www.sonic.com).

Please update these drivers or uninstall the software they are associated with.

ashground · 14 Jul 2010

Something's come up, so I won't be able to test my system tonight. I'll update the drivers, do some more testing, and post again when I have new information. Thanks a ton.