BSOD on user PC after 3-5 minutes, no applications running

[shawn9001]

I have already debugged the dump file will paste info:

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000000c08a5
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------

CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x24
PROCESS_NAME: WerFault.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
LAST_CONTROL_TRANSFER: from fffff8800144ebd5 to fffff80002a89bc0
STACK_TEXT:
fffff880`03cd95b8 fffff880`0144ebd5 : 00000000`00000024 00000000`000c08a5 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`03cd95c0 fffff880`01473008 : 00000001`00000000 00000000`00000000 00000000`00000000 00000a80`00000000 : Ntfs!NtfsPagingFileIo+0x155
fffff880`03cd96c0 fffff880`01045bcf : fffffa80`03914b28 fffffa80`039147d0 fffffa80`0383abb0 00000000`00000000 : Ntfs! ?? ::FNODOBFM::`string'+0x71b9
fffff880`03cd9770 fffff880`010446df : fffffa80`04618950 fffffa80`07713001 fffffa80`04618900 fffffa80`039147d0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`03cd9800 fffff800`02ab0e15 : fffffa80`039147f0 fffffa80`04c40070 fffffa80`0378ea60 fffff880`02f65180 : fltmgr!FltpDispatch+0xcf
fffff880`03cd9860 fffff800`02ab08e9 : fffff880`03cd9901 fffff880`03cd9901 fffffa80`0378e9a0 00000000`00000000 : nt!IoPageRead+0x255
fffff880`03cd98f0 fffff800`02a9728a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`000e0000 : nt!MiIssueHardFault+0x255
fffff880`03cd9980 fffff800`02a87cee : 00000000`00000001 00000000`002b0008 00000000`000cee01 00000000`002b2000 : nt!MmAccessFault+0x146a
fffff880`03cd9ae0 00000000`7710d8ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`000cedc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7710d8ae

STACK_COMMAND: kb
FOLLOWUP_IP:
Ntfs!NtfsPagingFileIo+155
fffff880`0144ebd5 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: Ntfs!NtfsPagingFileIo+155
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52e1be8a
IMAGE_VERSION: 6.1.7601.18378
FAILURE_BUCKET_ID: X64_0x24_Ntfs!NtfsPagingFileIo+155
BUCKET_ID: X64_0x24_Ntfs!NtfsPagingFileIo+155
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x24_ntfs!ntfspagingfileio+155
FAILURE_ID_HASH: {8018ac65-4151-0b56-5f0b-cec86356850c}
Followup: MachineOwner

 

[shawn9001]

another BSOD from same PC

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000040, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002ad393c, address which referenced memory
Debugging Details:
------------------

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002d04100
GetUlongFromAddress: unable to read from fffff80002d041c0
0000000000000040 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeWaitForSingleObject+13c
fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: WerFault.exe
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
TRAP_FRAME: fffff880086c7fc0 -- (.trap 0xfffff880086c7fc0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000305e rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ad393c rsp=fffff880086c8150 rbp=0000000000000000
r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
r11=fffff88002f65180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x13c:
fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7 ds:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002acc169 to fffff80002accbc0
STACK_TEXT:
fffff880`086c7e78 fffff800`02acc169 : 00000000`0000000a 00000000`00000040 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`086c7e80 fffff800`02acade0 : 00000000`00000000 fffff960`0023cf13 00000958`086c8070 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`086c7fc0 fffff800`02ad393c : 00000000`00000000 fffff960`00139cee fffff900`c21b6710 00000000`00000001 : nt!KiPageFault+0x260
fffff880`086c8150 fffff960`00166159 : 00000000`00000000 fffff960`00000006 00000000`00000000 00000ca0`00000000 : nt!KeWaitForSingleObject+0x13c
fffff880`086c81f0 fffff960`0029a47e : 00000000`00000000 fffff880`086c84c8 fffff880`086c8350 00000000`00000001 : win32k!SURFACE::Map+0xa1
fffff880`086c8240 fffff960`00176d98 : fffff900`c00be010 fffff880`086c8350 00000000`00000001 0000000f`0000014a : win32k!DEVLOCKOBJ::bMapTrgSurfaceView+0x3e
fffff880`086c8270 fffff960`00138a7f : fffff900`c22d3010 fffff880`086c8350 00000000`00000001 fffff880`086c84c8 : win32k!DEVLOCKOBJ::bPrepareTrgDco+0x98
fffff880`086c82a0 fffff960`0012e7a9 : fffff900`c00be010 00000000`00000000 fffff880`086c85c0 fffff960`00128d88 : win32k!DEVLOCKOBJ::bLock+0x423
fffff880`086c82e0 fffff800`02acbd5c : fffffa80`03f20940 00000000`00000000 00000000`00000005 00000000`00000020 : win32k!NtGdiFlushUserBatch+0xf9
fffff880`086c8540 000007fe`fd00119a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceGdiTebAccess+0x25
00000000`02d3ecb8 fffff800`02ac4210 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007fe`fd00119a
fffff880`086c8720 fffff880`086b7000 : 00000000`00000000 fffff900`c22e58a0 fffff960`001769d6 00000000`00000010 : nt!KiCallUserMode
fffff880`086c8728 00000000`00000000 : fffff900`c22e58a0 fffff960`001769d6 00000000`00000010 fffff880`086c8c70 : 0xfffff880`086b7000

STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!SURFACE::Map+a1
fffff960`00166159 4439ad00010000 cmp dword ptr [rbp+100h],r13d
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: win32k!SURFACE::Map+a1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 53f7e73f
IMAGE_VERSION: 6.1.7601.18577
FAILURE_BUCKET_ID: X64_0xA_win32k!SURFACE::Map+a1
BUCKET_ID: X64_0xA_win32k!SURFACE::Map+a1
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0xa_win32k!surface::map+a1
FAILURE_ID_HASH: {01320864-bf16-8609-44eb-8dfab62a041a}
Followup: MachineOwner
---------
2: kd> .trap 0xfffff880086c7fc0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000305e rbx=0000000000000000 rcx=0000000000000002
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002ad393c rsp=fffff880086c8150 rbp=0000000000000000
r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
r11=fffff88002f65180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x13c:
fffff800`02ad393c f00fba2e07 lock bts dword ptr [rsi],7 ds:00000000`00000000=????????
2: kd> lmvm win32k
start end module name
fffff960`000b0000 fffff960`003c9000 win32k (pdb symbols) c:\symbols\win32k.pdb\8550A726213B49C6AB862EFC270F9E212\win32k.pdb
Loaded symbol image file: win32k.sys
Mapped memory image file: c:\symbols\win32k.sys\53F7E73F319000\win32k.sys
Image path: win32k.sys
Image name: win32k.sys
Timestamp: Fri Aug 22 19:58:39 2014 (53F7E73F)
CheckSum: 00313AB8
ImageSize: 00319000
File version: 6.1.7601.18577
Product version: 6.1.7601.18577
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 6.1.7601.18577
FileVersion: 6.1.7601.18577 (win7sp1_gdr.140822-1508)
FileDescription: Multi-User Win32 Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.