Solved Randomly getting BSOD

[arso]

I disconnected the hard disk and usb cable,
this morning two new bsod

 

[koolkat77]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41790, fffffa80031f0020, ffff, 0}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+36024 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, A page table page has been corrupted. On a 64 bit OS, parameter 2
    contains the address of the PFN for the corrupted page table page.
    On a 32 bit OS, parameter 2 contains a pointer to the number of used
    PTEs, and parameter 3 contains the number of used PTEs.
Arg2: fffffa80031f0020
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41790

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002b47fd0 to fffff80002ada640

STACK_TEXT:  
fffff880`03b04958 fffff800`02b47fd0 : 00000000`0000001a 00000000`00041790 fffffa80`031f0020 00000000`0000ffff : nt!KeBugCheckEx
fffff880`03b04960 fffff800`02ac7aef : fffffa80`00000000 00000000`181cffff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x36024
fffff880`03b04b20 fffff800`02ad98d3 : ffffffff`ffffffff 00000000`0176f858 00000000`0176f850 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`03b04c20 00000000`779914fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0176f818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779914fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+36024
fffff800`02b47fd0 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+36024

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7951a

FAILURE_BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

BUCKET_ID:  X64_0x1a_41790_nt!_??_::FNODOBFM::_string_+36024

Followup: MachineOwner

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002bf59bc, fffff88006474a50, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+100 )

Followup: Pool_corruption
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002bf59bc, Address of the instruction which caused the bugcheck
Arg3: fffff88006474a50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!ExDeferredFreePool+100
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx]

CONTEXT:  fffff88006474a50 -- (.cxr 0xfffff88006474a50)
rax=fffff8a001a56f60 rbx=0000000000000001 rcx=fffffa800395a320
rdx=ffeff8a001a500c0 rsi=0000000000000000 rdi=fffff8a001a56d60
rip=fffff80002bf59bc rsp=fffff88006475430 rbp=0000000000000000
 r8=ffeff8a001a500c0  r9=fffff8a001a544a0 r10=0000000000000001
r11=0000000000000000 r12=fffffa800395a140 r13=0000000000000000
r14=0000000000000015 r15=0000000000000001
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExDeferredFreePool+0x100:
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx] ds:002b:ffeff8a0`01a500c0=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff80002bf59bc

STACK_TEXT:  
fffff880`06475430 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ExDeferredFreePool+0x100


FOLLOWUP_IP: 
nt!ExDeferredFreePool+100
fffff800`02bf59bc 4c8b02          mov     r8,qword ptr [rdx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExDeferredFreePool+100

FOLLOWUP_NAME:  Pool_corruption

IMAGE_NAME:  Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: Pool_Corruption

STACK_COMMAND:  .cxr 0xfffff88006474a50 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

BUCKET_ID:  X64_0x3B_nt!ExDeferredFreePool+100

Followup: Pool_corruption
---------

---------

The same 1A (Memory Management) Errors.

Anyway, Please remove AVIRA for testing purpose. Use Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other security software:

Microsoft Security Essentials - Free Antivirus for Windows

Malwarebytes - Free

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Scan with Kaspersky TDSSKiller:Anti-rootkit utility TDSSKiller

ESET online scanner: Free Online Virus Scanner | ESET

Update the driver below:

Rt64win7.sys Thu Feb 26 15:04:13 2009 (49A65B0D)
Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC
Driver Reference Table - Rt64win7.sys

Perform a clean install of a driver following: How to Clean Left Over Driver Files with Driver Sweeper

 

[arso]

i uninstalled avira, and i install Malwarebytes - Free , Microsoft Security Essentials , ESET online scanner and in the scaning process i get bsod...
also Update the driver.

 

[koolkat77]

Do you have everything unplugged from the USB ports?

 

[arso]

after the post #21, i connected again, but it is not problem i will disconnect...

 

[koolkat77]

I disconnected the hard disk and usb cable,
this morning two new bsod

When you posted this, were the external objects plugged in or out?

 

[arso]

plugged out,

I connected it again because without them i got two bsod and i thought that they are not the reason for bsod.

 

[koolkat77]

Enable Driver Verifier to see if it catches any misbehaving driver: Driver Verifier - Enable and Disable

 

[arso]

After i Enable Driver Verifier , i do not get bsod, but my computer 4 times is freeze and i need to restart from the Computer Case.

 

[koolkat77]

Disable verifier

 

[arso]

after i disable, get few bsod

 

[YoYo155]

Hi arso .

In conjunction to what koolkat77, suggested I recommend you physically remove one of the modules
(memory sticks) from the system and try it out in that configuration, if you're still having issues
try the other one.

On a different note,
I recommend installing the x86 (32bit) version of Windows with that hardware.
Also keep in mind that you motherboard's OEM is nothing special when it comes to
long-term support of Windows 7.

 

[arso]

Thank you for all help and advice,
koolkat77 as you said on the start, the problem was RAM memory ...
I changed it and now working perfect.