BSOD help

[NeoCeasar]

ok, so i am running win 7 ultimate 64 bit, GA78LMT-S2P mobo, Phenom IIx4 b50, 8GB ram, radeon hd 6450 video card. For some reason if i am trying to do alot of stuff, the screen will freeze for a second, then flicker, and come back displaying a "your display driver has stopped working", this will happen a couple times, then BSOD's.

 

[Arc]

Hi NeoCeasar.

The BSOD is caused by Symantec Real Time Storage Protection x64
(c:\windows\system32\drivers\n360x64\1404000.028\srtsp64.sys).

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff87f8413e028, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880040f06ee, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000005, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044be100
GetUlongFromAddress: unable to read from fffff800044be1c0
 fffff87f8413e028 Nonpaged pool

FAULTING_IP: 
SRTSP64+706ee
fffff880`040f06ee ??              ???

MM_INTERNAL_CODE:  5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  WmiPrvSE.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8801b337220 -- (.trap 0xfffff8801b337220)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88004080000 rbx=0000000000000000 rcx=0000000000000004
rdx=fffff880040f06ee rsi=0000000000000000 rdi=0000000000000000
rip=fffff880040f06ee rsp=fffff8801b3373b0 rbp=0000000000000000
 r8=0000000000000040  r9=fffffa8006c99f20 r10=0000000001200000
r11=fffff8801b3372f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
SRTSP64+0x706ee:
fffff880`040f06ee ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800043035b3 to fffff80004286bc0

STACK_TEXT:  
fffff880`1b3370b8 fffff800`043035b3 : 00000000`00000050 fffff87f`8413e028 00000000`00000000 fffff880`1b337220 : nt!KeBugCheckEx
fffff880`1b3370c0 fffff800`04284cee : 00000000`00000000 fffff87f`8413e028 fffffa80`0ce58000 fffff8a0`008b1570 : nt! ?? ::FNODOBFM::`string'+0x43801
fffff880`1b337220 fffff880`040f06ee : 00000000`00000000 fffff8a0`008b1570 fffff8a0`0702d4e0 fffffa80`08a83c10 : nt!KiPageFault+0x16e
fffff880`1b3373b0 00000000`00000000 : fffff8a0`008b1570 fffff8a0`0702d4e0 fffffa80`08a83c10 00000000`00000000 : SRTSP64+0x706ee


STACK_COMMAND:  kb

FOLLOWUP_IP: 
SRTSP64+706ee
fffff880`040f06ee ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  SRTSP64+706ee

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: SRTSP64

IMAGE_NAME:  SRTSP64.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  5175b92c

FAILURE_BUCKET_ID:  X64_0x50_SRTSP64+706ee

BUCKET_ID:  X64_0x50_SRTSP64+706ee

Followup: MachineOwner
---------

2: kd> lmvm SRTSP64
start             end                 module name
fffff880`04080000 fffff880`04146000   SRTSP64  T (no symbols)           
    Loaded symbol image file: SRTSP64.SYS
    Image path: SRTSP64.SYS
    Image name: SRTSP64.SYS
    Timestamp:        Tue Apr 23 03:56:52 2013 (5175B92C)
    CheckSum:         000CF107
    ImageSize:        000C6000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Uninstall Norton and all Symentec products using Norton Removal tool. Use Microsoft Security Essentials as your antivirus with windows inbuilt firewall, and free MBAM as the on demand scanner.
Download, install and update those, and then run full system scans with both of them, one by one.

Also uninstall MagicISO.

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Let us know the results.

 

[NeoCeasar]

After attempting suggestions...

I have uninstalled magic ISO & Norton with the norton removal tool and installed & updated security essentials. I am not sure how you mean by "free MBAM as the on demand scanner" . But continued to run each scan, individually, as well as adjust startup options. The problem is not as persistent as before, but is still happening, so here is my new dmp

 

[Arc]

"free MBAM as the on demand scanner" means, the free version of MBAM, to use only for scanning the computer for virus, whenever is needed, at least once a week.

The latest BSOD is nt very specific, but it is a stop 0x50. So test your RAM modules for possible errors.
How to Test and Diagnose RAM Issues with Memtest86+
Run memtest for at least 8 passes, preferably overnight.

If it start showing errors/red lines, stop testing. A single error is enough to determine that something is going bad there.

If memtest86+ results no error, enable Driver Verifier to monitor the drivers.
Driver Verifier - Enable and Disable
Run Driver Verifier for 24 hours or the occurrence of the next crash, whichever is earlier.

   Information

Why Driver Verifier:
It puts a stress on the drivers, ans so it makes the unstable drivers crash. Hopefully the driver that crashes is recorded in the memory dump.

How Can we know that DV is enabled:
It will make the system bit of slow, laggy.

   Warning

Before enabling DV, make it sure that you have earlier System restore points made in your computer. You can check it easily by using CCleaner looking at Tools > System Restore.

If there is no points, make a System Restore Point manually before enabling DV.

   Tip

• If you fail to get on the Desktop because of DV, Boot into Advanced Boot Options > Safe mode. Disable DV there. Now boot normally again, and try following the instruction of enabling DV again.
• If you cannot boot in Safe mode too, do a System Restore to a point you made earlier.

Also, can the system for possible virus infection with the following programs, as the BSOD was happened during running MBAM.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Let us know the results, with the subsequent crash dumps, if any.
______________________________________________________________________________

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff88008574be0, 0, fffff8000458076f, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!IopAllocRealFileObject+2cf )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88008574be0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8000458076f, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044af100
GetUlongFromAddress: unable to read from fffff800044af1c0
 fffff88008574be0 Nonpaged pool

FAULTING_IP: 
nt!IopAllocRealFileObject+2cf
fffff800`0458076f 488b88d0000000  mov     rcx,qword ptr [rax+0D0h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  mbamservice.ex

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88007d74430 -- (.trap 0xfffff88007d74430)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff88007d74b10 rbx=0000000000000000 rcx=fffff8a01d9c9f80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8000458076f rsp=fffff88007d745c0 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000000 r10=fffff88002f65180
r11=fffffa8007a3d7f0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!IopAllocRealFileObject+0x2cf:
fffff800`0458076f 488b88d0000000  mov     rcx,qword ptr [rax+0D0h] ds:fffff880`07d74be0=0000000000000000
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800042f5bf0 to fffff80004277bc0

STACK_TEXT:  
fffff880`07d742c8 fffff800`042f5bf0 : 00000000`00000050 fffff880`08574be0 00000000`00000000 fffff880`07d74430 : nt!KeBugCheckEx
fffff880`07d742d0 fffff800`04275cee : 00000000`00000000 fffff880`08574be0 00000000`008deb00 fffff880`07d749e0 : nt! ?? ::FNODOBFM::`string'+0x4518f
fffff880`07d74430 fffff800`0458076f : fffffa80`00000000 fffff800`04404d01 00000000`00000060 fffff880`07d745f8 : nt!KiPageFault+0x16e
fffff880`07d745c0 fffff800`045772ed : 00000000`00000045 fffffa80`0ea6bcc8 fffffa80`07948940 fffffa80`07948940 : nt!IopAllocRealFileObject+0x2cf
fffff880`07d74670 fffff800`04572db8 : fffffa80`07948940 fffff800`00000000 fffffa80`0ea6bb10 00000000`00000001 : nt!IopParseDevice+0x1384
fffff880`07d747d0 fffff800`04573fd6 : 00000000`00000000 fffffa80`0ea6bb10 fffff880`07d74ca0 fffffa80`06a76f30 : nt!ObpLookupObjectName+0x588
fffff880`07d748c0 fffff800`04552066 : fffffa80`001f0003 00000000`008de358 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByName+0x306
fffff880`07d74990 fffff800`04276e53 : fffffa80`096c6060 00000000`00000158 fffffa80`096c6060 fffffa80`00000000 : nt!NtQueryAttributesFile+0x145
fffff880`07d74c20 00000000`778f168a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`008de318 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x778f168a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IopAllocRealFileObject+2cf
fffff800`0458076f 488b88d0000000  mov     rcx,qword ptr [rax+0D0h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!IopAllocRealFileObject+2cf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  521ea035

FAILURE_BUCKET_ID:  X64_0x50_nt!IopAllocRealFileObject+2cf

BUCKET_ID:  X64_0x50_nt!IopAllocRealFileObject+2cf

Followup: MachineOwner
---------