BSOD w/ viewing photos w/ Windows Live Photo Gallery error 0x0000001e

[live4nhl773377]

I have had a problem with my Gateway NV73 laptop where I would get a BSOD whenever I was viewing video on the internet, viewing pictures in my photo editing program and now after about 5 minutes of just using the internet. The BSOD would come up in a square in the center of the screen and dissappear within seconds. Then the system would still show the power light as on but a blank screen and unresponsive. I would press and hold power button until shutdown and try to restart but only the fan sound was working but nothing else. And after about 30 to 40 minutes later it would boot up just fine, but would then crash after minutes of using it. I tried to get the info needed from the dump files but I literally had to do the whole process stated above many times and I saved the minidump files to my network drive so I could post this on my desktop computer. Please help, I am pulling my hair out trying to figure this out.

Gateway Laptop Model NV73
AMD processor
3GB Ram
Windows 7 Home Premium 64 bit OEM
Laptop is about 17 months old

I attached a text file with the contents of one of the minidump files but also pasted the results below:

Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [X:\032012-25194-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03260650
Debug session time: Tue Mar 20 01:09:31.387 2012 (UTC - 4:00)
System Uptime: 0 days 0:13:01.010
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..........
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8800334f9f8, 1, fffff800033a7c8d, 1}

Could not read faulting driver name
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrnlmp.exe ( nt!AlpcpReceiveSynchronousReply+ed )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800334f9f8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800033a7c8d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000001, (reserved)
Debugging Details:
------------------

Could not read faulting driver name
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ca100
GetUlongFromAddress: unable to read from fffff800032ca1c0
fffff8800334f9f8 Nonpaged pool
FAULTING_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800734f7d0 -- (.trap 0xfffff8800734f7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffdfff rbx=0000000000000000 rcx=fffff8a00322a708
rdx=fffffa8002884b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033a7c8d rsp=fffff8800734f960 rbp=fffffa8002884b60
r8=fffffa8003541bb8 r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!AlpcpReceiveSynchronousReply+0xed:
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi ds:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000302ce64 to fffff80003098d40
STACK_TEXT:
fffff880`0734f668 fffff800`0302ce64 : 00000000`00000050 fffff880`0334f9f8 00000000`00000001 fffff880`0734f7d0 : nt!KeBugCheckEx
fffff880`0734f670 fffff800`03096e6e : 00000000`00000001 fffff880`0334f9f8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45792
fffff880`0734f7d0 fffff800`033a7c8d : 00000000`00000000 fffffa80`02884f20 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0734f960 fffff800`033a72e0 : 00000000`00000000 00000000`011e0340 00000000`00299dd8 00000000`00004801 : nt!AlpcpReceiveSynchronousReply+0xed
fffff880`0734f9c0 fffff800`033a50db : fffffa80`02708e60 fffffa80`00020000 00000000`011e0340 00000000`00299dd8 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0734fb00 fffff800`03097fd3 : fffffa80`02884b60 fffff880`0734fca0 00000000`0153e3a0 00000980`00000000 : nt!NtAlpcSendWaitReceivePort+0x1ab
fffff880`0734fbb0 00000000`77181b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0153e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181b6a

STACK_COMMAND: kb
FOLLOWUP_IP:
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24 mov qword ptr [r12],rdi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!AlpcpReceiveSynchronousReply+ed
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4ec79dd2
FAILURE_BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
BUCKET_ID: X64_0x50_nt!AlpcpReceiveSynchronousReply+ed
Followup: MachineOwner
---------

 

[JMH]

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[live4nhl773377]

Thanks for your help! Attached is the zip file of the dump files.

 

[writhziden]

Possible out of date drivers:

mdmxsdk	fffff880`02be9000	fffff880`02bed280	Mon Jun 19 15:27:26 2006 (449716be)	00010210		mdmxsdk.sys
CAX_CNXT	fffff880`058b8000	fffff880`05983000	Fri Feb 13 14:19:32 2009 (4995e3e4)	000b6489		CAX_CNXT.sys
CAXHWAZL	fffff880`04109000	fffff880`0415b000	Fri Feb 13 14:20:54 2009 (4995e436)	0004f091		CAXHWAZL.sys
CAX_DPV	fffff880`0545f000	fffff880`055d3000	Fri Feb 13 14:24:50 2009 (4995e522)	00176feb		CAX_DPV.sys
NTIDrvr	fffff880`045c1000	fffff880`045c9000	Tue Mar 24 21:09:39 2009 (49c9a073)	0000e15e		NTIDrvr.sys
DKbFltr	fffff880`0441e000	fffff880`0442a000	Wed Mar 25 21:15:42 2009 (49caf35e)	0000809a		DKbFltr.sys
usbfilter	fffff880`045db000	fffff880`045e7000	Fri Apr 03 05:39:51 2009 (49d5f587)	000128e6		usbfilter.sys
UBHelper	fffff880`045b9000	fffff880`045c1000	Mon Apr 27 02:48:19 2009 (49f57153)	0000589c		UBHelper.sys
XAudio64	fffff880`05f09000	fffff880`05f11000	Wed Apr 29 12:21:07 2009 (49f89a93)	00002a9e		XAudio64.sys
AtiPcie	fffff880`01830000	fffff880`01838000	Tue May 05 09:00:22 2009 (4a005486)	000134c7		AtiPcie.sys
k57nd60a	fffff880`04a00000	fffff880`04a51000	Sun Jun 07 01:36:34 2009 (4a2b6e02)	000539bb		k57nd60a.sys
RtHDMIVX	fffff880`04073000	fffff880`040a3880	Wed Jun 24 04:23:22 2009 (4a41fe9a)	00032def		RtHDMIVX.sys

mdmxsdk.sys
CAX_CNXT.sys
CAXHWAZL.sys
CAX_DPV.sys
NTIDrvr.sys
DKbFltr.sys
usbfilter.sys
UBHelper.sys
XAudio64.sys
AtiPcie.sys
k57nd60a.sys
RtHDMIVX.sys

[list=1][*]Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032112-20560-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`03050000 PsLoadedModuleList = 0xfffff800`03294650
Debug session time: Tue Mar 20 23:09:58.169 2012 (UTC - 6:00)
System Uptime: 0 days 11:22:46.792
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5001, fffff70001080000, 574, 57e00fffffe}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+38efb )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005001, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000000574
Arg4: 0000057e00fffffe

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5001

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  ncwmodulelist.

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8000313eae7 to fffff800030ccd40

STACK_TEXT:  
fffff880`08dd69a8 fffff800`0313eae7 : 00000000`0000001a 00000000`00005001 fffff700`01080000 00000000`00000574 : nt!KeBugCheckEx
fffff880`08dd69b0 fffff800`030d9389 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff800`00000000 : nt! ?? ::FNODOBFM::`string'+0x38efb
fffff880`08dd6ac0 fffff800`030cae6e : 00000000`00000000 00000000`004a0008 00000000`00b19901 00000000`00000000 : nt!MmAccessFault+0x359
fffff880`08dd6c20 00000000`7789a7fc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0012f430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7789a7fc


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+38efb
fffff800`0313eae7 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+38efb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb

BUCKET_ID:  X64_0x1a_5001_nt!_??_::FNODOBFM::_string_+38efb

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-25194-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0301c000 PsLoadedModuleList = 0xfffff800`03260650
Debug session time: Mon Mar 19 23:09:31.387 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:01.010
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8800334f9f8, 1, fffff800033a7c8d, 1}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!AlpcpReceiveSynchronousReply+ed )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800334f9f8, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff800033a7c8d, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000001, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032ca100
 fffff8800334f9f8 

FAULTING_IP: 
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24        mov     qword ptr [r12],rdi

MM_INTERNAL_CODE:  1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  services.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff8800734f7d0 -- (.trap 0xfffff8800734f7d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000ffffdfff rbx=0000000000000000 rcx=fffff8a00322a708
rdx=fffffa8002884b60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800033a7c8d rsp=fffff8800734f960 rbp=fffffa8002884b60
 r8=fffffa8003541bb8  r9=0000000000000000 r10=fffffffffffffffd
r11=fffff880009e8180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!AlpcpReceiveSynchronousReply+0xed:
fffff800`033a7c8d 49893c24        mov     qword ptr [r12],rdi ds:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8000302ce64 to fffff80003098d40

STACK_TEXT:  
fffff880`0734f668 fffff800`0302ce64 : 00000000`00000050 fffff880`0334f9f8 00000000`00000001 fffff880`0734f7d0 : nt!KeBugCheckEx
fffff880`0734f670 fffff800`03096e6e : 00000000`00000001 fffff880`0334f9f8 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x45792
fffff880`0734f7d0 fffff800`033a7c8d : 00000000`00000000 fffffa80`02884f20 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0734f960 fffff800`033a72e0 : 00000000`00000000 00000000`011e0340 00000000`00299dd8 00000000`00004801 : nt!AlpcpReceiveSynchronousReply+0xed
fffff880`0734f9c0 fffff800`033a50db : fffffa80`02708e60 fffffa80`00020000 00000000`011e0340 00000000`00299dd8 : nt!AlpcpProcessSynchronousRequest+0x33d
fffff880`0734fb00 fffff800`03097fd3 : fffffa80`02884b60 fffff880`0734fca0 00000000`0153e3a0 00000980`00000000 : nt!NtAlpcSendWaitReceivePort+0x1ab
fffff880`0734fbb0 00000000`77181b6a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0153e638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77181b6a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!AlpcpReceiveSynchronousReply+ed
fffff800`033a7c8d 49893c24        mov     qword ptr [r12],rdi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!AlpcpReceiveSynchronousReply+ed

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ec79dd2

FAILURE_BUCKET_ID:  X64_0x50_nt!AlpcpReceiveSynchronousReply+ed

BUCKET_ID:  X64_0x50_nt!AlpcpReceiveSynchronousReply+ed

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\032012-34757-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17727.amd64fre.win7sp1_gdr.111118-2330
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a2650
Debug session time: Mon Mar 19 22:28:57.349 2012 (UTC - 6:00)
System Uptime: 0 days 0:06:37.973
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff800030cbcbe, 0, ffffffffffffffff}

Probably caused by : fileinfo.sys ( fileinfo!FIPfFilePfLinkDereference+2b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800030cbcbe, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'WSDPrint' and 'WUDFRd.sys' overlap

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExfAcquirePushLockExclusive+1e
fffff800`030cbcbe 488b19          mov     rbx,qword ptr [rcx]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000330c100
 ffffffffffffffff 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80003125a08 to fffff800030dad40

STACK_TEXT:  
fffff880`03affb58 fffff800`03125a08 : 00000000`0000001e ffffffff`c0000005 fffff800`030cbcbe 00000000`00000000 : nt!KeBugCheckEx
fffff880`03affb60 fffff800`030da3c2 : fffff880`03b00338 fffffa80`0233be00 fffff880`03b003e0 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x48d2d
fffff880`03b00200 fffff800`030d8cca : fffffa80`05356060 00000000`00000000 fffffa80`05621b10 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`03b003e0 fffff800`030cbcbe : fffffa80`021cfb30 fffff8a0`097e9860 fffffa80`021de660 fffffa80`05356060 : nt!KiGeneralProtectionFault+0x10a
fffff880`03b00570 fffff880`010cc973 : fffff8a0`00000000 fffff8a0`00000000 fffffa80`0233be00 fffff8a0`03fe4d10 : nt!ExfAcquirePushLockExclusive+0x1e
fffff880`03b005f0 fffff880`010cb8ec : fffff8a0`0ef1c4e0 fffffa80`023a4e60 fffffa80`0233be18 fffffa80`0233be18 : fileinfo!FIPfFilePfLinkDereference+0x2b
fffff880`03b00620 fffff880`010ca6b4 : fffff8a0`0efe4d10 00000000`00000000 fffff880`03b006b0 00000000`000007ff : fileinfo!FIPfFileOpenRemove+0x9c
fffff880`03b00660 fffff800`03448625 : fffffa80`0601a570 fffff8a0`0f000000 fffff880`03b00840 00000000`00000001 : fileinfo!FIPfInterfaceClose+0x90
fffff880`03b00690 fffff800`034f45e9 : fffff880`03b00780 fffff8a0`0f000000 fffff880`4c526650 fffff880`00000087 : nt!PfpOpenHandleClose+0x55
fffff880`03b006e0 fffff800`035372d3 : fffff8a0`0f003bc0 00000000`00000000 fffffa80`04c0b810 fffff880`03b00778 : nt!PfpReadSupportCleanup+0x49
fffff880`03b00710 fffff800`0353f27e : fffff8a0`00000000 fffff8a0`00000003 fffff8a0`0000013b fffff8a0`00000000 : nt!PfpPrefetchFilesTrickle+0x293
fffff880`03b00810 fffff800`0353fe17 : 00000000`00000000 fffff880`03b00ca0 fffff880`03b00a08 fffff8a0`04994060 : nt!PfpPrefetchRequestPerform+0x30e
fffff880`03b00960 fffff800`0354c3ee : fffff880`03b00a08 fffff880`03b00c01 fffffa80`0552d430 00000000`00000000 : nt!PfpPrefetchRequest+0x176
fffff880`03b009d0 fffff800`03550c1a : 00000000`00000000 00000000`0000004f 00000000`00000000 ffffffff`ffffff01 : nt!PfSetSuperfetchInformation+0x1ad
fffff880`03b00ab0 fffff800`030d9fd3 : fffffa80`05621b10 00000000`00000000 00000000`00000001 00000000`0000ac96 : nt!NtSetSystemInformation+0xc8d
fffff880`03b00c20 00000000`76f02a0a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c7f4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76f02a0a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
fileinfo!FIPfFilePfLinkDereference+2b
fffff880`010cc973 83c9ff          or      ecx,0FFFFFFFFh

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  fileinfo!FIPfFilePfLinkDereference+2b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: fileinfo

IMAGE_NAME:  fileinfo.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc481

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b

BUCKET_ID:  X64_0x1E_c0000005_fileinfo!FIPfFilePfLinkDereference+2b

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\live4nhl773377\020812-22401-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0304c000 PsLoadedModuleList = 0xfffff800`03291670
Debug session time: Tue Feb  7 22:59:17.902 2012 (UTC - 6:00)
System Uptime: 0 days 1:30:33.525
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffa7fffffffd0, 2, 1, fffff800030d925c}

Probably caused by : memory_corruption ( nt!MiInsertPageInFreeOrZeroedList+54c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa7fffffffd0, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800030d925c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800032fb100
 fffffa7fffffffd0 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiInsertPageInFreeOrZeroedList+54c
fffff800`030d925c 498930          mov     qword ptr [r8],rsi

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  fffff880009a9970 -- (.trap 0xfffff880009a9970)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=ffffffffffffffd0
rdx=ffffffffffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030d925c rsp=fffff880009a9b00 rbp=fffff880009a9b40
 r8=fffffa7fffffffd0  r9=0000000000000000 r10=fffffa80020fd048
r11=fffff800032fe4c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
nt!MiInsertPageInFreeOrZeroedList+0x54c:
fffff800`030d925c 498930          mov     qword ptr [r8],rsi ds:fffffa7f`ffffffd0=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030c81e9 to fffff800030c8c40

STACK_TEXT:  
fffff880`009a9828 fffff800`030c81e9 : 00000000`0000000a fffffa7f`ffffffd0 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009a9830 fffff800`030c6e60 : fffff980`1aeb3000 fffff880`00e34fb0 00000000`00000000 fffffa80`01c20630 : nt!KiBugCheckDispatch+0x69
fffff880`009a9970 fffff800`030d925c : fffffa80`021b3710 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff880`009a9b00 fffff800`03090d6e : fffffa80`01c20630 00000000`00096021 00000000`00000002 00000000`00000000 : nt!MiInsertPageInFreeOrZeroedList+0x54c
fffff880`009a9c10 fffff800`03363fee : fffffa80`021b3650 00000000`00000080 fffffa80`021b3b30 fffff800`030ba5d9 : nt!MmZeroPageThread+0x8f5
fffff880`009a9d40 fffff800`030ba5e6 : fffff800`0323ee80 fffffa80`021b3650 fffff800`0324ccc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a99b0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiInsertPageInFreeOrZeroedList+54c
fffff800`030d925c 498930          mov     qword ptr [r8],rsi

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!MiInsertPageInFreeOrZeroedList+54c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c

BUCKET_ID:  X64_0xA_nt!MiInsertPageInFreeOrZeroedList+54c

Followup: MachineOwner
---------


[/list]

1. Possible causes are Memory problems... Drivers...
2. Possible causes are Memory problems... Graphics card memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Missing Windows Updates... Antivirus Software... Drivers...
3. Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
4. Possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... BIOS... Lack of Windows updates... Antivirus Software... Backup... Hardware...

We will start with the common problems first (see bold possible causes). Do the following steps and test by doing your normal routine after each step to see if stability increases (the memory tests you can run concurrently as they will not increase stability unless you are forced to move modules around). Post back your results after each step, and if you get a blue screen crash, upload the files again and await further instructions after we are able to analyze the crash.

If you can do your normal routine for a few weeks without a crash, and your crashes are usually more frequent than that, then the problem is likely solved.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html.
  For any drives that do not give the message:
  Windows has checked the file system and found no problems
  run disk check again as above. In other words, if it says:
  Windows has made corrections to the file system
  after running the disk check, run the disk check again.
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.
  
  
  
• Run the boot version of Memtest86+ paying close attention to Parts 2 and 3 of the tutorial. Also, in case Memtest86+ misses anything and comes up with no errors, run the extended version of the Windows Memory Diagnostics Tool for at least five passes. These you may want to run overnight since they take a long time to complete (run them an hour before bed each of the next two nights and check before going to sleep that they are still running).
  
  If you swap any memory components, follow these steps for ESD safety:
  1. Shut down and turn off your computer.
  2. Unplug all power supplies to the computer (AC Power then battery for laptops, AC power for desktops)
  3. Hold down the power button for 30 seconds to close the circuit and ensure all power drains from components.
  4. Make sure you are grounded by using proper grounding techniques, i.e. work on an anti-static workbench, anti-static desk, or an anti-static pad. Hold something metallic while touching it to the anti-static surface, or use an anti-static wristband to attach to the anti-static material while working.
  Once these steps have been followed, it is safe to remove and replace components within your computer.
  
  
• An underlying driver may be incompatible\conflicting with your system. Run Driver Verifier to find any issues. To run Driver Verifier, do the following:
  
  a. Backup your system and user files
  b. Create a system restore point
  c. If you do not have a Windows 7 DVD, Create a system repair disc
  d. Run Driver Verifier and in step 3, only select Standard settings. Do not select the other two settings in the red boxes.
  
  If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.
  
  Thanks to zigzag3143 for contributing to the Verifier steps.
  If you are unable to start Windows with all drivers being verified or if the blue screen crashes fail to create .dmp files, run them in groups of 5 or 10 until you find a group that causes blue screen crashes and stores the blue screen .dmp files.​
  The idea with Verifier is to cause the system to crash, so do the things you normally do that cause crashes. After you have a few crashes, upload the crash reports for us to take a look and try to find patterns.