You are correct, it is BugCheck 3B, c0000005. But notice the code that follows it. That is memory error, corrupted memory. The usual causes are System service, Device driver, graphics driver, ?memory.
Since the shop did a brand new install from their disk, I think we can rule out system service. The dump blames hardware:
Probably caused by : hardware. We know that you have a brand new hard drive just installed at the shop.
Code:
Kernel base = 0xfffff800`02c57000 PsLoadedModuleList = 0xfffff800`02e94e50
Debug session time: Sun Sep 12 16:19:33.930 2010 (GMT-4)
System Uptime: 0 days 2:02:09.085
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff96000105aa1, fffff88008bed970, 0}
Probably caused by : hardware ( win32k!XDCOBJ::RestoreAttributes+41 )
Followup: MachineOwner
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff96000105aa1, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff88008bed970, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
win32k!XDCOBJ::RestoreAttributes+41
fffff960`00105aa1 ff20 jmp qword ptr [rax]
CONTEXT: fffff88008bed970 -- (.cxr 0xfffff88008bed970)
rax=000000008b3f8bf0 rbx=fffff88008bee3d8 rcx=00000000003f0d00
rdx=fffff900c1705e80 rsi=fffffa800bcf6e50 rdi=000000000185000f
rip=fffff96000105aa1 rsp=fffff88008bee350 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000008
r11=00000000003f0b60 r12=fffff900c1af6630 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010286
win32k!XDCOBJ::RestoreAttributes+0x41:
fffff960`00105aa1 ff20 jmp qword ptr [rax] ds:002b:00000000`8b3f8bf0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
win32k!XDCOBJ::RestoreAttributes+41
fffff960`00105aa1 ff20 jmp qword ptr [rax]
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff96000105aa1
STACK_TEXT:
fffff880`08bee350 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : win32k!XDCOBJ::RestoreAttributes+0x41
FOLLOWUP_IP:
win32k!XDCOBJ::RestoreAttributes+41
fffff960`00105aa1 ff20 jmp qword ptr [rax]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!XDCOBJ::RestoreAttributes+41
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .cxr 0xfffff88008bed970 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: X64_IP_MISALIGNED
BUCKET_ID: X64_IP_MISALIGNED
Followup: MachineOwner
---------
We are going to have to approach this as though we have not worked with this machine before. So don't be surprised if we suggest things you have already tried.
Something jumps out at me in the unloaded modules in your dump. Besides being an obsolete RAID driver, it figured into the crash.
wdcsam64.sys Wed Apr 16 04:39:08 2008 - Western Digital External Drive RAID Manager
WD Support > Downloads > Select Product
You are not the first to have encountered a problem with this driver:
http://www.sevenforums.com/crashes-debugging/102785-multiple-assorted-bsods-2-days.html. Update this driver.
I also find another very out of date driver:
e1y60x64.sys Mon Aug 18 17:45:05 2008 - Intel(R) 82567LM Gigabit Network Connection
http://downloadcenter.intel.com/Default.aspx. Update this driver.
These two drivers are not engineered for Windows 7; they are obsolete. Obsolete drivers can and do cause memory corruption. The rest of your drivers look good and are up to date. After you have updated both of these drivers, reboot and see how your system runs. I want to take this one step at a time.