Solved Some different BSOD's can't fix any of them

dimyke · Oct 20, 2010

I searched a lot on the internet and my conclusion for each bsod is that the problem can be a lot of different things..
So i don't know what's wrong with my system.
Now i found this forum and i'll give it a try to post my problem

.

Well i built me own pc and i have some bsod's. It's my 4th own-built pc and the 3earlier worked awesome. 2 32 bits and 2 64 bits.
My system is a 64 bit
my OS is a downloaded home premium win 7 version from msdn (site/organisation for school stuff/programs i need)
so yeah kinda retail version?
I built this pc recently (september)

I tried a couple of things allready, like i have 4 memory slots for my RAM and i have 3x 2gb (all the same from ocz). So i checked the slots (all ok)
Ran some stress tests for my cpu (these were OK i thought 60° max and idle 41)
But didn't ran any tests on my video card.

all help is verry welcome and appreciated
Dimitri

zigzag3143 · Oct 20, 2010

dimyke said:
I searched a lot on the internet and my conclusion for each bsod is that the problem can be a lot of different things..
So i don't know what's wrong with my system.
Now i found this forum and i'll give it a try to post my problem .

Well i built me own pc and i have some bsod's. It's my 4th own-built pc and the 3earlier worked awesome. 2 32 bits and 2 64 bits.
My system is a 64 bit
my OS is a downloaded home premium win 7 version from msdn (site/organisation for school stuff/programs i need)
so yeah kinda retail version?
I built this pc recently (september)

I tried a couple of things allready, like i have 4 memory slots for my RAM and i have 3x 2gb (all the same from ocz). So i checked the slots (all ok)
Ran some stress tests for my cpu (these were OK i thought 60° max and idle 41)
But didn't ran any tests on my video card.

all help is verry welcome and appreciated
Dimitri

There are several causes all pointing to hardware. One sure problem is the Rt64win7.sys Realtek Ethernet driver.. I would update it and all the other dirvers listed below (especially the Teamviewer VPN)

Code:

PA707UCM.SYS        fffff880`0288d000    fffff880`02927000    0x0009a000    0x45513a06    11/7/2006 21:59:34  [COLOR=Red][B]Cammaestro 2+years old[/B][/COLOR]                      
Alpham264.sys        fffff880`02970000    fffff880`02975500    0x00005500    0x45ffae87    3/20/2007 05:51:03                        
Alpham164.sys        fffff880`02963000    fffff880`0296ff00    0x0000cf00    0x46a45f4f    7/23/2007 03:57:03                        
teamviewervpn.sys        fffff880`03eac000    fffff880`03eb9000    0x0000d000    0x4760f9c1    12/13/2007 05:22:09                        
seehcri.sys        fffff880`01000000    fffff880`0100c000    0x0000c000    0x478488bf    1/9/2008 04:41:35                        
spldr.sys        fffff880`015e4000    fffff880`015ec000    0x00008000    0x4a0858bb    5/11/2009 12:56:27                        
lirsgt.sys        fffff880`073d1000    fffff880`073de000    0x0000d000    0x4a100bf1    5/17/2009 09:06:57                        
atksgt.sys        fffff880`07379000    fffff880`073c8000    0x0004f000    0x4a1012e2    5/17/2009 09:36:34                        
GEARAspiWDM.sys        fffff880`040c5000    fffff880`040d2000    0x0000d000    0x4a1151c0    5/18/2009 08:17:04                        
amdxata.sys        fffff880`00ea4000    fffff880`00eaf000    0x0000b000    0x4a12f2eb    5/19/2009 13:56:59                        
Tpkd.sys        fffff880`013d9000    fffff880`013fc000    0x00023000    0x4a15c952    5/21/2009 17:36:18                        
PxHlpa64.sys        fffff880`01070000    fffff880`0107be00    0x0000be00    0x4a416253    6/23/2009 19:16:35

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Windows_NT6_BSOD_jcgriff2\091810-31168-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Sat Sep 18 11:00:00.056 2010 (GMT-4)
System Uptime: 0 days 0:20:26.461
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff880041b8180, fffff8800a752ea0, 0}

Probably caused by : Rt64win7.sys ( Rt64win7+e180 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880041b8180, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a752ea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Rt64win7+e180
fffff880`041b8180 0803            or      byte ptr [rbx],al

CONTEXT:  fffff8800a752ea0 -- (.cxr 0xfffff8800a752ea0)
rax=0000000000aad235 rbx=0000000000000000 rcx=00000000003f87ff
rdx=0000035c00000000 rsi=fffff8800a754100 rdi=fffffa8006f74000
rip=fffff880041b8180 rsp=fffff8800a753880 rbp=0000000000000000
 r8=0000000000000200  r9=0000000000000000 r10=0000000000000000
r11=000000000002020a r12=fffffa8007d46f00 r13=fffff8800a754100
r14=0000000000000098 r15=0000000000000098
iopl=0         nv up ei pl nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
Rt64win7+0xe180:
fffff880`041b8180 0803            or      byte ptr [rbx],al ds:002b:00000000`00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  vmware-hostd.e

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880041b8180

STACK_TEXT:  
fffff880`0a753880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Rt64win7+0xe180


FOLLOWUP_IP: 
Rt64win7+e180
fffff880`041b8180 0803            or      byte ptr [rbx],al

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Rt64win7+e180

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a8d7432

STACK_COMMAND:  .cxr 0xfffff8800a752ea0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_Rt64win7+e180

BUCKET_ID:  X64_0x3B_Rt64win7+e180

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff880041b8180, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a752ea0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
Rt64win7+e180
fffff880`041b8180 0803            or      byte ptr [rbx],al

CONTEXT:  fffff8800a752ea0 -- (.cxr 0xfffff8800a752ea0)
rax=0000000000aad235 rbx=0000000000000000 rcx=00000000003f87ff
rdx=0000035c00000000 rsi=fffff8800a754100 rdi=fffffa8006f74000
rip=fffff880041b8180 rsp=fffff8800a753880 rbp=0000000000000000
 r8=0000000000000200  r9=0000000000000000 r10=0000000000000000
r11=000000000002020a r12=fffffa8007d46f00 r13=fffff8800a754100
r14=0000000000000098 r15=0000000000000098
iopl=0         nv up ei pl nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
Rt64win7+0xe180:
fffff880`041b8180 0803            or      byte ptr [rbx],al ds:002b:00000000`00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  vmware-hostd.e

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to fffff880041b8180

STACK_TEXT:  
fffff880`0a753880 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Rt64win7+0xe180


FOLLOWUP_IP: 
Rt64win7+e180
fffff880`041b8180 0803            or      byte ptr [rbx],al

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Rt64win7+e180

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Rt64win7

IMAGE_NAME:  Rt64win7.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a8d7432

STACK_COMMAND:  .cxr 0xfffff8800a752ea0 ; kb

FAILURE_BUCKET_ID:  X64_0x3B_Rt64win7+e180

BUCKET_ID:  X64_0x3B_Rt64win7+e180

Followup: MachineOwner
---------

dimyke · Oct 20, 2010

Hey,
thanks for your answer
but you're saying that the crashes point to my hardware? Can you be more specific?
I'm also updating these drivers although i don't get where that teamviewer comes from? It's an program that i've installed what does that has to do with drivers? Certainly when i even don't use it at the time of any of my bsod's.
And how do i update those others things? Like PA707UCM.sys or Alpham264.sys?

I'm getting a bit confused with all the info that i'm getting from different sites and so. ):
and thank you for your quick reply ^^

zigzag3143 · Oct 20, 2010

dimyke said:
Hey,
thanks for your answer
but you're saying that the crashes point to my hardware? Can you be more specific?
I'm also updating these drivers although i don't get where that teamviewer comes from? It's an program that i've installed what does that has to do with drivers? Certainly when i even don't use it at the time of any of my bsod's.
And how do i update those others things? Like PA707UCM.sys or Alpham264.sys?

I'm getting a bit confused with all the info that i'm getting from different sites and so. ):
and thank you for your quick reply ^^

1-hardware. to be more specific we have to eliminate the things that we see now. Then we can isolate the specific piece of hardware.

2-Teamviewer is loaded wether you are using it or not, and yours is 2+years old. They do have a much newer client (im using it). You also have logmein from 2+years ago loaded

3-Updating drivers
How To Find Drivers:

- search Google for the name of the driver
- compare the Google results with what's installed on your system to figure out which device/program it belongs to
- visit the web site of the manufacturer of the hardware/program to get the latest drivers (DON'T use Windows Update or the Update driver function of Device Manager).
- if there are difficulties in locating them, post back with questions and someone will try and help you locate the appropriate program.

- - The most common drivers are listed on this page: Driver Reference
- - Driver manufacturer links are on this page: Drivers and Downloads

dimyke · Oct 21, 2010

hey,
thanks again, updated all drivers
(altough some were up to date, => manufacturers aren't updating them anymore :/)
What do I do now? Wait till new bsod's appear or be lucky and problem solved?

Thanks for all your help allready ^^

Dimitri

CarlTR6 · Oct 21, 2010

To support what Ken has said, out of date drivers can and do cause conflicts, memory corruption, and BSOD's.

PxHlpa64.sys 6/23/2009 - Sonic CD/DVD driver (used by many different CD/DVD programs) pxHelp20.sys programs
Go to C:\Windows\System32\drivers and rename PxHlpa64.sys to PxHlpa64.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished.

GEARAspiWDM.sys 5/18/2009 - I don't believe there is an update for this driver. It may work OK. You can ignore this one for now.

Tpkd.sys 5/21/2009 - InterLok system file belongs to the software InterLok(R) or InterLok Driver Kit or TPkd or Sonic RecordNow! or Adobe eBook Migration Utility or Interlok driver setup x or nGenius InfiniStream by PACE Anti-Piracy, Inc (www.paceap.com). If there is no update for this driver, I suggest you uninstall the software and upgrade to software that is certified compatible with Win 7.

amdxata.sys - there is no update for this driver. It should be OK.

atksgt.sys 5/17/2009 - part of a Copy Protection platform dveloped by Tages SA, TAGES, the AAA Copy Protection System. If there is no update for this driver, uninstall the software.

lirsgt.sys 5/17/2009 - part of a Copy Protection platform developed by Tages SA TAGES, the AAA Copy Protection System. See above.

spldr.sys - This is an MS system driver. It is fine. Ignore it.

seehcri.sys 1/9/2008 - Sony Ericsson Device 0016 (likely a phone) Sony Ericsson - Support - Softwaredownloads. This software/device is way obsolete. Update or uninstall.

Alpham164.sys 7/23/2007 - Ideazon ZBoard http://www.steelseries.com/download. This an XP driver, way obsolete. It is not compatible with Win 7. If you cannot update the driver or the software, uninstall.

Win 7 is an entirely different OS from XP and even different from Vista. Software and hardware designed and programmed for XP are not going to run on Win 7, except in the XP mode. That said, some Vista drivers do work with Win 7. Third party (non MS) drivers dated prior to 13 July 2009 are out of date. Some of the drivers with dates in 2009 will work; these are Vista drivers.

dimyke · Oct 21, 2010

CarlTR6 said:
To support what Ken has said, out of date drivers can and do cause conflicts, memory corruption, and BSOD's.

PxHlpa64.sys 6/23/2009 - Sonic CD/DVD driver (used by many different CD/DVD programs) pxHelp20.sys programs
Go to C:\Windows\System32\drivers and rename PxHlpa64.sys to PxHlpa64.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished.

GEARAspiWDM.sys 5/18/2009 - I don't believe there is an update for this driver. It may work OK. You can ignore this one for now.

Tpkd.sys 5/21/2009 - InterLok system file belongs to the software InterLok(R) or InterLok Driver Kit or TPkd or Sonic RecordNow! or Adobe eBook Migration Utility or Interlok driver setup x or nGenius InfiniStream by PACE Anti-Piracy, Inc (www.paceap.com). If there is no update for this driver, I suggest you uninstall the software and upgrade to software that is certified compatible with Win 7.

amdxata.sys - there is no update for this driver. It should be OK.

atksgt.sys 5/17/2009 - part of a Copy Protection platform dveloped by Tages SA, TAGES, the AAA Copy Protection System. If there is no update for this driver, uninstall the software.

lirsgt.sys 5/17/2009 - part of a Copy Protection platform developed by Tages SA TAGES, the AAA Copy Protection System. See above.

spldr.sys - This is an MS system driver. It is fine. Ignore it.

seehcri.sys 1/9/2008 - Sony Ericsson Device 0016 (likely a phone) Sony Ericsson - Support - Softwaredownloads. This software/device is way obsolete. Update or uninstall.

Alpham164.sys 7/23/2007 - Ideazon ZBoard http://www.steelseries.com/download. This an XP driver, way obsolete. It is not compatible with Win 7. If you cannot update the driver or the software, uninstall.

Click to expand...

Win 7 is an entirely different OS from XP and even different from Vista. Software and hardware designed and programmed for XP are not going to run on Win 7, except in the XP mode. That said, some Vista drivers do work with Win 7. Third party (non MS) drivers dated prior to 13 July 2009 are out of date. Some of the drivers with dates in 2009 will work; these are Vista drivers.

Hey,
thank you verry much for this answer. That's what i kinda asked in my earlier replies.
But i worked on it and spent a few hours googling what they ment.
When I installed this drivers a month or 2 ago there weren't any win7 drivers for them.
But now i found all win7 drivers.
And cheers on the LG cd/dvd driver, didn't found a solution for that one .
So now everything's updated the chance of a bsod should be smaller?

Thanks again
Dimitri

CarlTR6 · Oct 31, 2010

Updating these drivers should definitely improve your system's stability. Have you had any more BSOD'S?

dimyke · Nov 8, 2010

Hey Carl,
Yes i did had one more bsod since i tried to update all my drivers.
Idk what it said because i was gone when it appeared.
But part from that one bsod none. So that's quit an improvement i think.

Dimitri

CarlTR6 · Nov 9, 2010

Dimitri, that is good news. I am glad that things are better, much better. Can you upload that latest BSOD to us? Did you rename that PxHlpa64.sys driver?

dimyke · Nov 9, 2010

Hey carl,
i made a new rar file of all the bsods. There are 2 new bsods (apperiantly ==> didn't even know i had 2 since the last one). 3 november and 6 november.
And uuhm yeah i just renamed that file.. Probably i forgot to do it.

Thanks for helping again.

dimitri

Edit: I attached the rar-file in the first and this message

CarlTR6 · Nov 9, 2010

I looked at your two latest dumps. One blames NTFS.sys, which has to do with your file system and hard drive and it also indicates memory corruption. The second outright blames memory corruption.

Error code 24, NTFS_FILE_SYSTEM, Usual causes: Disk corruption, insufficient physical memory, Device driver, Indexing, Resident antivirus, backup, defrag programs, Disk/Drive failing/failure.

Error code 50, PAGE_FAULT_IN_NONPAGED_AREA. Usual causes: Defective hardware (particularly memory - but not just RAM), Faulty system service, Antivirus, Device driver, NTFS corruption, BIOS.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c51000 PsLoadedModuleList = 0xfffff800`02e8ee50
Debug session time: Sat Nov  6 15:10:51.673 2010 (GMT-5)
System Uptime: 0 days 9:15:11.452
Loading Kernel Symbols
...............................................................
................................................................
....................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800c648308, fffff8800c647b70, fffff80002c74920}

Probably caused by : Ntfs.sys ( Ntfs!NtfsAcquireAllFiles+5d )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800c648308
Arg3: fffff8800c647b70
Arg4: fffff80002c74920

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'fastfat' and 'spsys.sys' overlap

EXCEPTION_RECORD:  fffff8800c648308 -- (.exr 0xfffff8800c648308)
ExceptionAddress: fffff80002c74920 (nt!RtlRealSuccessor+0x0000000000000030)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800c647b70 -- (.cxr 0xfffff8800c647b70)
rax=004f005000450052 rbx=fffff8a012b31010 rcx=004f005000450052
rdx=fffff8800c6485d8 rsi=fffff8a000150010 rdi=fffffa800634b180
rip=fffff80002c74920 rsp=fffff8800c648548 rbp=fffff8800c648960
 r8=0000000000000000  r9=0000000000000000 r10=fffff8800c6485d8
r11=0000000000000000 r12=fffffa8009f716b0 r13=fffffa80061f6a00
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
nt!RtlRealSuccessor+0x30:
fffff800`02c74920 488b4908        mov     rcx,qword ptr [rcx+8] ds:002b:004f0050`0045005a=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef90e0
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsAcquireAllFiles+5d
fffff880`012eab8d 488bd8          mov     rbx,rax

FAULTING_IP: 
nt!RtlRealSuccessor+30
fffff800`02c74920 488b4908        mov     rcx,qword ptr [rcx+8]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff80002c9638c to fffff80002c74920

STACK_TEXT:  
fffff880`0c648548 fffff800`02c9638c : fffff880`0c648960 fffff880`012eabb4 00000000`00000000 fffffa80`061f6a00 : nt!RtlRealSuccessor+0x30
fffff880`0c648550 fffff880`012eab8d : fffff8a0`12b31010 fffff880`0c648960 fffff8a0`00150010 fffffa80`0634b180 : nt!RtlEnumerateGenericTableWithoutSplayingAvl+0x24
fffff880`0c648580 fffff880`0135983b : fffffa80`061f6a10 fffff8a0`12d618b0 00000000`00000001 fffff880`0c648960 : Ntfs!NtfsAcquireAllFiles+0x5d
fffff880`0c6485d0 fffff880`0135adfe : fffffa80`09f716b0 fffffa80`0b9bfc10 fffffa80`061f6a10 fffffa80`09e8c510 : Ntfs!NtfsDefragFileInternal+0xaa8
fffff880`0c6487a0 fffff880`0131a702 : fffff880`00000000 fffffa80`0b8e6920 fffffa80`0634b180 fffffa80`061f6a10 : Ntfs!NtfsDefragFile+0x43e
fffff880`0c648840 fffff880`012d32ed : fffffa80`09f716b0 00000000`00000000 fffff880`0c648960 00000000`00000000 : Ntfs! ?? ::NNGAKEGL::`string'+0x1cc89
fffff880`0c648880 fffff880`00e6b23f : fffff880`0c6489d0 fffffa80`0b9bfc10 fffff880`0c648901 fffffa80`09f716b0 : Ntfs!NtfsFsdFileSystemControl+0x13d
fffff880`0c648920 fffff880`00e8a91e : fffffa80`0622fcb0 fffffa80`073bc300 fffffa80`0622fc00 fffffa80`0b9bfc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0c6489b0 fffff800`02fdc707 : fffffa80`073bc300 fffff880`0c648ca0 fffffa80`0b9bfff8 fffffa80`0b9bfc10 : fltmgr!FltpFsControl+0xee
fffff880`0c648a10 fffff800`02fa5b1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`0c648b40 fffff800`02cc0993 : 00000000`00000000 00000000`0e8e0b00 00000000`00000000 fffff880`0c648c20 : nt!NtFsControlFile+0x56
fffff880`0c648bb0 00000000`774b00ea : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`012be7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774b00ea


SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  Ntfs!NtfsAcquireAllFiles+5d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc14f

STACK_COMMAND:  .cxr 0xfffff8800c647b70 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireAllFiles+5d

BUCKET_ID:  X64_0x24_Ntfs!NtfsAcquireAllFiles+5d

Followup: MachineOwner
---------

2: kd> lmtsmn
start             end                 module name
fffff880`01000000 fffff880`01057000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`02d71000 fffff880`02dfb000   afd      afd.sys      Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`04380000 fffff880`04396000   AgileVpn AgileVpn.sys Mon Jul 13 20:10:24 2009 (4A5BCCF0)
fffff880`0299d000 fffff880`029a9f00   Alpham164 Alpham164.sys Mon Jul 23 03:57:03 2007 (46A45F4F)
fffff880`029aa000 fffff880`029af500   Alpham264 Alpham264.sys Tue Mar 20 05:51:03 2007 (45FFAE87)
fffff880`03ea0000 fffff880`03eb5000   amdppm   amdppm.sys   Mon Jul 13 19:19:25 2009 (4A5BC0FD)
fffff880`00e5d000 fffff880`00e68000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`0430e000 fffff880`04316000   ASACPI   ASACPI.sys   Wed Jul 15 23:31:29 2009 (4A5E9F11)
fffff880`03e74000 fffff880`03e7a000   AsIO     AsIO.sys     Mon Aug 03 03:03:16 2009 (4A768BB4)
fffff880`02857000 fffff880`02860000   aswFsBlk aswFsBlk.SYS Tue Sep 07 10:47:09 2010 (4C86506D)
fffff880`02800000 fffff880`0283a000   aswMonFlt aswMonFlt.sys Tue Sep 07 10:47:32 2010 (4C865084)
fffff880`02c00000 fffff880`02c0a000   aswRdr   aswRdr.SYS   Tue Sep 07 10:47:47 2010 (4C865093)
fffff880`03e51000 fffff880`03e74000   aswSP    aswSP.SYS    Tue Sep 07 10:52:07 2010 (4C865197)
fffff880`02d61000 fffff880`02d71000   aswTdi   aswTdi.SYS   Tue Sep 07 10:52:27 2010 (4C8651AB)
fffff880`099f4000 fffff880`099ff000   asyncmac asyncmac.sys Mon Jul 13 20:10:13 2009 (4A5BCCE5)
fffff880`00e2a000 fffff880`00e33000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00e33000 fffff880`00e5d000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff880`04520000 fffff880`04540000   AtihdW76 AtihdW76.sys Thu Jul 15 08:46:49 2010 (4C3F0339)
fffff880`0480c000 fffff880`04fc7000   atikmdag atikmdag.sys Wed Aug 25 21:47:22 2010 (4C75C7AA)
fffff880`04051000 fffff880`0409b000   atikmpag atikmpag.sys Wed Aug 25 21:20:56 2010 (4C75C178)
fffff880`06d98000 fffff880`06de7000   atksgt   atksgt.sys   Sun May 17 09:36:34 2009 (4A1012E2)
fffff960`00910000 fffff960`00971000   ATMFD    ATMFD.DLL    Thu May 27 00:11:31 2010 (4BFDF0F3)
fffff880`0283a000 fffff880`02857000   avgntflt avgntflt.sys Thu Feb 11 10:12:02 2010 (4B741E42)
fffff880`03e2f000 fffff880`03e51000   avipbb   avipbb.sys   Mon Feb 22 05:08:50 2010 (4B8257B2)
fffff880`04322000 fffff880`04367000   ax0fe0mk ax0fe0mk.SYS Tue Jul 14 17:12:55 2009 (4A5CF4D7)
fffff880`019ea000 fffff880`019f1000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`03e1e000 fffff880`03e2f000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`0471a000 fffff880`04738000   bowser   bowser.sys   Mon Jul 13 19:23:50 2009 (4A5BC206)
fffff960`00660000 fffff960`00687000   cdd      cdd.dll      unavailable (00000000)
fffff880`00dc0000 fffff880`00dea000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00c00000 fffff880`00cc0000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01850000 fffff880`01880000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00d04000 fffff880`00d62000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`014fd000 fffff880`01570000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`04370000 fffff880`04380000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`06de7000 fffff880`06df0000   cpuz133_x64 cpuz133_x64.sys Tue May 11 05:58:57 2010 (4BE92A61)
fffff880`06400000 fffff880`0640e000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`03f70000 fffff880`03ff3000   csc      csc.sys      Mon Jul 13 19:24:26 2009 (4A5BC22A)
fffff880`03e00000 fffff880`03e1e000   dfsc     dfsc.sys     Mon Jul 13 19:23:44 2009 (4A5BC200)
fffff880`03f61000 fffff880`03f70000   discache discache.sys Mon Jul 13 19:37:18 2009 (4A5BC52E)
fffff880`0183a000 fffff880`01850000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0457d000 fffff880`0459f000   drmk     drmk.sys     Mon Jul 13 21:01:25 2009 (4A5BD8E5)
fffff880`0641a000 fffff880`06423000   dump_atapi dump_atapi.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0640e000 fffff880`0641a000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`06423000 fffff880`06436000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`06436000 fffff880`06442000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff880`0409b000 fffff880`0418f000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 21:00:14 2009 (4AC5509E)
fffff880`0418f000 fffff880`041d5000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:38:32 2009 (4A5BC578)
fffff880`09831000 fffff880`09867000   fastfat  fastfat.SYS  Mon Jul 13 19:23:28 2009 (4A5BC1F0)
fffff880`00cc0000 fffff880`00cd4000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`00e68000 fffff880`00eb4000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff880`01581000 fffff880`0158b000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`01800000 fffff880`0183a000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`018a8000 fffff880`018f2000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:21:08 2009 (4A5BC164)
fffff880`042e4000 fffff880`042f1000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`02c08000 fffff800`02c51000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`047ee000 fffff880`047fa000   hcmon    hcmon.sys    Thu Oct 22 06:00:49 2009 (4AE02D51)
fffff880`04fc7000 fffff880`04feb000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`045a5000 fffff880`045be000   HIDCLASS HIDCLASS.SYS Mon Jul 13 20:06:21 2009 (4A5BCBFD)
fffff880`045be000 fffff880`045c6080   HIDPARSE HIDPARSE.SYS Mon Jul 13 20:06:17 2009 (4A5BCBF9)
fffff880`06442000 fffff880`06450000   hidusb   hidusb.sys   Mon Jul 13 20:06:22 2009 (4A5BCBFE)
fffff880`04652000 fffff880`0471a000   HTTP     HTTP.sys     Mon Jul 13 19:22:16 2009 (4A5BC1A8)
fffff880`019c5000 fffff880`019ce000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`0426e000 fffff880`0427d000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`029b0000 fffff880`029be000   kbdhid   kbdhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff800`00bd4000 fffff800`00bde000   kdcom    kdcom.dll    Mon Jul 13 21:31:07 2009 (4A5BDFDB)
fffff880`0444a000 fffff880`0448d000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`013bb000 fffff880`013d5000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`013d5000 fffff880`01400000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`0459f000 fffff880`045a4200   ksthunk  ksthunk.sys  Mon Jul 13 20:00:19 2009 (4A5BCA93)
fffff880`06df0000 fffff880`06dfd000   lirsgt   lirsgt.sys   Sun May 17 09:06:57 2009 (4A100BF1)
fffff880`02891000 fffff880`028a6000   lltdio   lltdio.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`029d7000 fffff880`029fa000   luafv    luafv.sys    Mon Jul 13 19:26:13 2009 (4A5BC295)
fffff880`00ce3000 fffff880`00cf0000   mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Mon Jul 13 21:29:09 2009 (4A5BDF65)
fffff880`029c9000 fffff880`029d7000   monitor  monitor.sys  Mon Jul 13 19:38:52 2009 (4A5BC58C)
fffff880`0403f000 fffff880`0404e000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`045c7000 fffff880`045d4000   mouhid   mouhid.sys   Mon Jul 13 20:00:20 2009 (4A5BCA94)
fffff880`00e10000 fffff880`00e2a000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`04738000 fffff880`04750000   mpsdrv   mpsdrv.sys   Mon Jul 13 20:08:25 2009 (4A5BCC79)
fffff880`04750000 fffff880`0477d000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:52:19 2010 (4B88CF33)
fffff880`0477d000 fffff880`047cb000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:52:28 2010 (4B88CF3C)
fffff880`047cb000 fffff880`047ee000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:52:26 2010 (4B88CF3A)
fffff880`02d1a000 fffff880`02d25000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`011bd000 fffff880`011c7000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`00d62000 fffff880`00dc0000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`03f56000 fffff880`03f61000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`019b3000 fffff880`019c5000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`01400000 fffff880`014f2000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`043ba000 fffff880`043c6000   ndistapi ndistapi.sys Mon Jul 13 20:10:00 2009 (4A5BCCD8)
fffff880`043c6000 fffff880`043f5000   ndiswan  ndiswan.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`0450b000 fffff880`04520000   NDProxy  NDProxy.SYS  Mon Jul 13 20:10:05 2009 (4A5BCCDD)
fffff880`02c89000 fffff880`02c98000   netbios  netbios.sys  Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff880`02c0a000 fffff880`02c4f000   netbt    netbt.sys    Mon Jul 13 19:21:28 2009 (4A5BC178)
fffff880`0158b000 fffff880`015eb000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`02d25000 fffff880`02d36000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`03f4a000 fffff880`03f56000   nsiproxy nsiproxy.sys Mon Jul 13 19:21:02 2009 (4A5BC15E)
fffff800`02c51000 fffff800`0322d000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01218000 fffff880`013bb000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`019e1000 fffff880`019ea000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`028d5000 fffff880`0296f000   PA707UCM PA707UCM.SYS Tue Nov 07 20:59:34 2006 (45513A06)
fffff880`02c63000 fffff880`02c89000   pacer    pacer.sys    Mon Jul 13 20:09:41 2009 (4A5BCCC5)
fffff880`042f1000 fffff880`0430e000   parport  parport.sys  Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`011d4000 fffff880`011e9000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00f70000 fffff880`00fa3000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`01057000 fffff880`0105e000   pciide   pciide.sys   Mon Jul 13 19:19:49 2009 (4A5BC115)
fffff880`00e00000 fffff880`00e10000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`01570000 fffff880`01581000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`06c00000 fffff880`06ca6000   peauth   peauth.sys   Mon Jul 13 21:01:19 2009 (4A5BD8DF)
fffff880`04540000 fffff880`0457d000   portcls  portcls.sys  Mon Jul 13 20:06:27 2009 (4A5BCC03)
fffff880`00cf0000 fffff880`00d04000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`00cd4000 fffff880`00cdfe00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`04396000 fffff880`043ba000   rasl2tp  rasl2tp.sys  Mon Jul 13 20:10:11 2009 (4A5BCCE3)
fffff880`04200000 fffff880`0421b000   raspppoe raspppoe.sys Mon Jul 13 20:10:17 2009 (4A5BCCE9)
fffff880`0421b000 fffff880`0423c000   raspptp  raspptp.sys  Mon Jul 13 20:10:18 2009 (4A5BCCEA)
fffff880`0423c000 fffff880`04256000   rassstp  rassstp.sys  Mon Jul 13 20:10:25 2009 (4A5BCCF1)
fffff880`03ef9000 fffff880`03f4a000   rdbss    rdbss.sys    Mon Jul 13 19:24:09 2009 (4A5BC219)
fffff880`04263000 fffff880`0426e000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`02cff000 fffff880`02d08000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d08000 fffff880`02d11000   rdpencdd rdpencdd.sys Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`02d11000 fffff880`02d1a000   rdprefmp rdprefmp.sys Mon Jul 13 20:16:35 2009 (4A5BCE63)
fffff880`01979000 fffff880`019b3000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`028a6000 fffff880`028be000   rspndr   rspndr.sys   Mon Jul 13 20:08:50 2009 (4A5BCC92)
fffff880`04000000 fffff880`0403f000   Rt64win7 Rt64win7.sys Thu Aug 20 12:05:06 2009 (4A8D7432)
fffff880`0118e000 fffff880`011bd000   SCSIPORT SCSIPORT.SYS Mon Jul 13 20:01:04 2009 (4A5BCAC0)
fffff880`06ca6000 fffff880`06cb1000   secdrv   secdrv.SYS   Wed Sep 13 09:18:38 2006 (4508052E)
fffff880`04800000 fffff880`0480c000   seehcri  seehcri.sys  Wed Jan 09 03:41:35 2008 (478488BF)
fffff880`04316000 fffff880`04322000   serenum  serenum.sys  Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`02c98000 fffff880`02cb5000   serial   serial.sys   Mon Jul 13 20:00:40 2009 (4A5BCAA8)
fffff880`01971000 fffff880`01979000   spldr    spldr.sys    Mon May 11 12:56:27 2009 (4A0858BB)
fffff880`0105f000 fffff880`01185000   sptd     sptd.sys     Sun Oct 11 16:55:14 2009 (4AD24632)
fffff880`098ed000 fffff880`09983000   srv      srv.sys      Thu Aug 26 23:38:00 2010 (4C773318)
fffff880`09886000 fffff880`098ed000   srv2     srv2.sys     Thu Aug 26 23:37:46 2010 (4C77330A)
fffff880`04620000 fffff880`0464d000   srvnet   srvnet.sys   Thu Aug 26 23:37:24 2010 (4C7732F4)
fffff880`0296f000 fffff880`0297fd00   STREAM   STREAM.SYS   Mon Jul 13 20:06:18 2009 (4A5BCBFA)
fffff880`043f5000 fffff880`043f6480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Sun Jun 13 23:39:04 2010 (4C15A458)
fffff880`028be000 fffff880`028d0000   tcpipreg tcpipreg.sys Mon Jul 13 20:09:49 2009 (4A5BCCCD)
fffff880`02d54000 fffff880`02d61000   TDI      TDI.SYS      Mon Jul 13 19:21:18 2009 (4A5BC16E)
fffff880`02d36000 fffff880`02d54000   tdx      tdx.sys      Mon Jul 13 19:21:15 2009 (4A5BC16B)
fffff880`04256000 fffff880`04263000   teamviewervpn teamviewervpn.sys Thu Dec 13 04:22:09 2007 (4760F9C1)
fffff880`03ee5000 fffff880`03ef9000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff880`0194e000 fffff880`01971000   Tpkd     Tpkd.sys     Wed Dec 23 14:32:16 2009 (4B327040)
fffff960`005b0000 fffff960`005ba000   TSDDD    TSDDD.dll    Mon Jul 13 20:16:34 2009 (4A5BCE62)
fffff880`03e7a000 fffff880`03ea0000   tunnel   tunnel.sys   Mon Jul 13 20:09:37 2009 (4A5BCCC1)
fffff880`0448d000 fffff880`0449f000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`02980000 fffff880`0299d000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`065f8000 fffff880`065f9f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`042d3000 fffff880`042e4000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`044b1000 fffff880`0450b000   usbhub   usbhub.sys   Mon Jul 13 20:07:09 2009 (4A5BCC2D)
fffff880`04feb000 fffff880`04ff6000   usbohci  usbohci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`0427d000 fffff880`042d3000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`099b4000 fffff880`099cf000   USBSTOR  USBSTOR.SYS  Mon Jul 13 20:06:34 2009 (4A5BCC0A)
fffff880`011c7000 fffff880`011d4000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`019f1000 fffff880`019ff000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`06450000 fffff880`065f8000   viahduaa viahduaa.sys Tue Oct 20 23:30:30 2009 (4ADE8056)
fffff880`02cca000 fffff880`02cef000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`04600000 fffff880`04618000   vmci     vmci.sys     Thu Oct 22 05:26:48 2009 (4AE02558)
fffff880`029be000 fffff880`029c9000   VMkbd    VMkbd.sys    Thu Oct 22 06:51:05 2009 (4AE03919)
fffff880`044a7000 fffff880`044b1000   VMNET    VMNET.SYS    Mon Aug 10 08:04:50 2009 (4A800CE2)
fffff880`0449f000 fffff880`044a7000   vmnetadapter vmnetadapter.sys Mon Aug 10 08:04:53 2009 (4A800CE5)
fffff880`02881000 fffff880`02891000   vmnetbridge vmnetbridge.sys Mon Aug 10 08:05:58 2009 (4A800D26)
fffff880`06cb1000 fffff880`06cbb000   vmnetuserif vmnetuserif.sys Thu Oct 22 06:17:07 2009 (4AE03123)
fffff880`04618000 fffff880`04620000   VMparport VMparport.sys Thu Oct 22 05:24:21 2009 (4AE024C5)
fffff880`018f2000 fffff880`01902000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`06cc2000 fffff880`06d98000   vmx86    vmx86.sys    Thu Oct 22 07:36:57 2009 (4AE043D9)
fffff880`011e9000 fffff880`011fe000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00fa3000 fffff880`00fff000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01902000 fffff880`0194e000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`045d4000 fffff880`045e0000   vstor2_ws60 vstor2-ws60.sys Mon Oct 12 17:06:26 2009 (4AD39A52)
fffff880`03eca000 fffff880`03ee5000   wanarp   wanarp.sys   Mon Jul 13 20:10:21 2009 (4A5BCCED)
fffff880`02cef000 fffff880`02cff000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ebd000 fffff880`00f61000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f61000 fffff880`00f70000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`02c5a000 fffff880`02c63000   wfplwf   wfplwf.sys   Mon Jul 13 20:09:26 2009 (4A5BCCB6)
fffff960`00080000 fffff960`0038f000   win32k   win32k.sys   Tue Aug 31 22:58:04 2010 (4C7DC13C)
fffff880`04367000 fffff880`04370000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`01185000 fffff880`0118e000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`02c4f000 fffff880`02c5a000   ws2ifsl  ws2ifsl.sys  Mon Jul 13 20:10:33 2009 (4A5BCCF9)
fffff880`02860000 fffff880`02881000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)
fffff880`09800000 fffff880`09831000   WUDFRd   WUDFRd.sys   Mon Jul 13 20:06:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`09800000 fffff880`09871000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09983000 fffff880`099b4000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09871000 fffff880`09882000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09994000 fffff880`099c5000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09983000 fffff880`09994000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09853000 fffff880`09884000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09842000 fffff880`09853000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09811000 fffff880`09842000   WUDFRd.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09800000 fffff880`09811000   WinUsb.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`09983000 fffff880`099f4000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`01880000 fffff880`0188e000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0188e000 fffff880`0189a000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`0189a000 fffff880`018a3000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019ce000 fffff880`019e1000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffffff1375cc, 1, fffff880073b8d40, 2}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffffff1375cc, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff880073b8d40, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0a0e0
 ffffffffff1375cc 

FAULTING_IP: 
mrxsmb10!SmbCeDiscardTransactExchange+54
fffff880`073b8d40 0885c97413ff    or      byte ptr [rbp-0EC8B37h],al

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008495ea0 -- (.trap 0xfffff88008495ea0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800830edd0
rdx=fffff880084960f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880073b8d40 rsp=fffff88008496030 rbp=0000000000000103
 r8=fffffa8006da8e00  r9=0000000000000036 r10=fffffa8008b0dcf0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
mrxsmb10!SmbCeDiscardTransactExchange+0x54:
fffff880`073b8d40 0885c97413ff    or      byte ptr [rbp-0EC8B37h],al ss:0018:ffffffff`ff1375cc=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d518f2 to fffff80002cd2740

STACK_TEXT:  
fffff880`08495d38 fffff800`02d518f2 : 00000000`00000050 ffffffff`ff1375cc 00000000`00000001 fffff880`08495ea0 : nt!KeBugCheckEx
fffff880`08495d40 fffff800`02cd082e : 00000000`00000001 fffffa80`08b0dcf0 00000000`10000000 fffff880`07383027 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`08495ea0 fffff880`073b8d40 : 00000000`00000000 00000000`00000000 00001104`0000001a fffff8a0`02cd3620 : nt!KiPageFault+0x16e
fffff880`08496030 fffff880`07389f0f : fffffa80`08b0dcf0 fffffa80`06bd3010 fffffa80`08b0dcf0 00000000`00000000 : mrxsmb10!SmbCeDiscardTransactExchange+0x54
fffff880`08496070 fffff880`073861b1 : fffffa80`08b0dcf0 fffffa80`08b0dcf0 00000000`00000103 fffff880`073b5975 : mrxsmb10!SmbTransactExchangeFinalize+0x117
fffff880`084960b0 fffff880`073864eb : fffffa80`06bd3000 fffff880`08496390 fffffa80`08b0dcf0 00000000`00000001 : mrxsmb10!SmbCepFinalizeExchange+0xa1
fffff880`084960f0 fffff880`073b9124 : fffffa80`08b0dcf0 fffffa80`00000001 fffffa80`08b0dcf0 fffff880`084961b0 : mrxsmb10!SmbCeDecrementPendingOperationsAndFinalize+0x87
fffff880`08496120 fffff880`073b925d : fffffa80`08b0dcf0 00000000`00000000 fffff880`08496390 00000000`00000000 : mrxsmb10!SmbCeSubmitTransactionRequest+0x208
fffff880`08496170 fffff880`0737b1d0 : fffff880`08496420 fffff880`08496390 00000000`00000000 00000000`00000000 : mrxsmb10!SmbCeTransact+0x105
fffff880`08496250 fffff880`073a18cd : fffffa80`06bd3010 fffff8a0`041e22e0 00000000`05b5f740 00000000`00000000 : mrxsmb10!SmbCeTransact+0xf8
fffff880`084962e0 fffff880`073a06de : 00000000`00000001 fffff880`00000000 00000000`00000008 00000000`00001116 : mrxsmb10!MRxSmbFsCtlUserTransact+0x541
fffff880`084964e0 fffff880`0736e61e : 00000000`00000000 fffffa80`08592d60 fffff880`0736a200 fffff800`02c94f86 : mrxsmb10!MRxSmbFsCtl+0x2ae
fffff880`08496520 fffff880`03e58f71 : 00000000`00000006 fffffa80`084005c8 fffff880`00000000 000007ff`fff40000 : mrxsmb!MRxSmbFsCtl+0x92
fffff880`08496550 fffff880`03e5ded5 : 00000000`00000000 fffffa80`08592d60 fffffa80`06bd3010 fffffa80`06bd300d : rdbss!RxLowIoSubmit+0x291
fffff880`084965b0 fffff880`03e6d1b5 : 00000000`c0000010 fffff880`0849ec23 00000000`001401c8 00000000`00000000 : rdbss!RxLowIoFsCtlShell+0x1c5
fffff880`08496620 fffff880`03e35aa0 : 00000000`00000000 fffff880`084966c0 fffffa80`06bd3010 00000000`00000000 : rdbss!RxCommonDevFCBFsCtl+0x161
fffff880`08496680 fffff880`03e53614 : fffffa80`08592c00 fffffa80`07cad60d 00000000`084967f8 fffff8a0`02c271d0 : rdbss!RxFsdCommonDispatch+0x870
fffff880`08496770 fffff880`0736d2c4 : fffffa80`08592c00 fffff880`084967f8 fffffa80`08592d60 fffffa80`07cad620 : rdbss!RxFsdDispatch+0x224
fffff880`084967e0 fffff880`017f3271 : fffffa80`08207a30 fffffa80`08592c00 fffffa80`08ca7a40 fffff8a0`001301b0 : mrxsmb!MRxSmbFsdDispatch+0xc0
fffff880`08496820 fffff880`017f1138 : fffff8a0`001301b0 fffffa80`08207a30 00000000`00000001 00000000`00000000 : mup!MupiCallUncProvider+0x161
fffff880`08496890 fffff880`017f29e3 : fffffa80`08592c00 fffff880`08496960 fffffa80`08ca8c30 00000000`00000000 : mup!MupStateMachine+0x128
fffff880`084968e0 fffff880`00d7c23f : fffffa80`08592da8 fffffa80`08207a30 fffff880`08496900 fffff880`009e810d : mup!MupFsControl+0x7f
fffff880`08496920 fffff880`00d9b91e : fffffa80`061a1a60 fffffa80`084d1320 fffffa80`061a1a00 fffffa80`08592c00 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`084969b0 fffff800`02fed707 : fffffa80`084d1320 fffff880`08496ca0 fffffa80`08592df0 fffffa80`08592c00 : fltmgr!FltpFsControl+0xee
fffff880`08496a10 fffff800`02fb6b1a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IopXxxControlFile+0x607
fffff880`08496b40 fffff800`02cd1993 : fffff8a0`0000aa00 00000000`02cfa170 fffff8a0`0000aa00 fffff800`02f666e8 : nt!NtFsControlFile+0x56
fffff880`08496bb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !mrxsmb10
    fffff880073b8d40 - mrxsmb10!SmbCeDiscardTransactExchange+54
    [ 48:08 ]
1 error : !mrxsmb10 (fffff880073b8d40)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  X64_MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Obviously this dump occurred before you had updated or renamed drivers. In this dump I still see sptd.sys, an almost guaranteed BDSOD maker, loaded on your system as well as AVG. Make sure you have uninstall AVG and installed MSE. Also make sure you have uninstalled sptd.sys. ZigZag mentioned both of these back on the first page.

Go down the list below and make sure you have updated or uninstalled each of the drivers listed below. You have more than enough problem drivers to cause BSOD's. We really can't proceed any further until these drivers are taken care of. If you need help with any of them, please post back.

Alpham164 Alpham164.sys Mon Jul 23 03:57:03 2007 - Ideazon ZBoard http://www.steelseries.com/download. This an XP driver, way obsolete. It is not compatible with Win 7. If you cannot update the driver or the software, uninstall.

Alpham264.sys Tue Mar 20 05:51:03 2007 - Ideazon ZBoard http://www.steelseries.com/download. This an XP driver, way obsolete. It is not compatible with Win 7. If you cannot update the driver or the software, uninstall.

atksgt.sys Sun May 17 09:36:34 2009 - part of a Copy Protection platform dveloped by Tages SA, TAGES, the AAA Copy Protection System. If there is no update for this driver, uninstall the software.

lirsgt.sys Sun May 17 09:06:57 2009 - part of a Copy Protection platform developed by Tages SA TAGES, the AAA Copy Protection System. See above.

PA707UCM.SYS Tue Nov 07 20:59:34 2006 - PixArt Imaging Inc; may be a webcam. OEM - none at Welcome to PixArt Imaging Inc.. This is an XP driver. Uninstall the hardware or software it is associated with.

PxHlpa64.sys Tue Jun 23 19:16:35 2009 - Sonic CD/DVD driver (used by many different CD/DVD programs) pxHelp20.sys programs
Go to C:\Windows\System32\drivers and rename PxHlpa64.sys to PxHlpa64.BAK
This will break your CD/DVD program, but can easily be renamed after we've finished. I think you have renamed this one.

seehcri.sys Wed Jan 09 03:41:35 2008 - Sony Ericsson Device 0016 (likely a phone) Sony Ericsson - Support - Softwaredownloads. This software/device is way obsolete. Update or uninstall.

teamviewervpn.sys Thu Dec 13 04:22:09 2007 - TeamViewerVPN Network AdapterTeamViewer GmbH . Cpmpletely uninstall TeamViewer. Download and install the latest version.

dimyke · Nov 10, 2010

Hey carl,

I did updated my Ideazon ZBoard drivers.
I installed the (what steelseries calls) the win7 version of it. And apperiantly that's a win xp version.
If I unistall this driver i can't use my keyboard anymore?
So kinda hard to delete this driver :/

also updated this one:

atksgt.sys Sun May 17 09:36:34 2009 - part of a Copy Protection platform dveloped by Tages SA, TAGES, the AAA Copy Protection System. If there is no update for this driver, uninstall the software.

lirsgt.sys Sun May 17 09:06:57 2009 - part of a Copy Protection platform developed by Tages SA TAGES, the AAA Copy Protection System. See above.

but deleted it now.

I'll throw my webcam away then, it's a really old one but i can't find any updated drivers of it.

Also i updated the sony ericsson drivers.. There aren't any more update versions of this program?

I updated the teamviewer the first time but deleted it now

And i don't have AVG? I use antivir and avast.

and yeah i changed the .sys to .bak .
Anything more i should do/check?

Thanks for helping!
Dimitri

CarlTR6 · Nov 10, 2010

Good job and thanks for reporting back.

I'm sorry I meant Avira, not AVG; I went brain dead. Uninstall Avira using this removal tool: Tool. Avira is, as most third party antivirus are, known to cause BSOD's on some Win 7 systems. Running two antivirus programs can cause conflicts and is not recommended. There are exceptions to this. MSE and Avast generally run well together. However, even Avast has has caused BSOD's.

What are the dates of the Ideazon ZBoard drivers you installed? You can check the dates in C:\Windows\Syetem32\Drivers. If the dates are not 2009 or later, you will need to upgrade to a new keyboard. Renaming these drivers will break you keyboard.

Let us know.

dimyke · Nov 10, 2010

Well my pc says that the dates for the drivers are 20/03/2007 and 23/07/2007.
But when i go to my downloaded files and i look for the downloaded ideazon drivers then it says i downloaded them like a month ago (twice).
The first time by myself and the 2nd time because the drivers were "out of date". And if i download the drivers from the ideazon site it should be the latest drivers..
So it's kinda oquired that they aren't.

Is that tool the same as antivir removal tool?
Avira AntiVir Removal Tool - Download
==> stupid question, it isn't but i can't find any other :/
If i click on your tool it redericts me to the homepage.

Shall i unistall avast aswell? If i should wich (free) antivirus should i use then?

Thanks for the help again.

Dimitri

CarlTR6 · Nov 10, 2010

The "magic" date for third party Win 7 drivers is July 13, 2009 or later. Some Vista drivers do work with Win 7; these have a 2009 date prior to July 13. You, no doubt, have the latest Ideazon drivers available. This means that your keyboard is obsolete and not Win 7 compatible. Ideazon has chosen not to update this keyboard for Win 7. Upgrade to a new keyboard. Do you have another keyboard you can try? You can also try to uninstall your keyboard, reboot and it will try to use generic drivers. It will loose any extras in functionality. Be sure you back up those drivers first before trying this and create a restore point.

I remember now that Avira no longer has a removal tool. I searched all over for it. Uninstall it with Revo (free) uninstaller. Avast generally works well with Win 7. I would let it alone and see how your system does. I think that Avast and Avira are conflicting with each other and giving you problems. To answer your question, Microsoft Security Essentials is free and offers good protection. However, it does not have an email scanner.

And you are welcome for the help.

dimyke · Nov 10, 2010

Hey carl,

well yeah i can use my keyboard without any drivers but i'll loose the function buttons on the top. Also sometimes it gives some conflicts with the language settings.
but i can give it a try anyways because i don't have a spare keyboard anymore. I gave it away :/
And i'll give the uninstaller a try 2.

thanks!
Dimitri

CarlTR6 · Nov 10, 2010

Very good. Let us know how you do and how your system is doing.

CarlTR6 · Dec 5, 2010

Dimit6ri sent me the following PM:

I'm sending you this message because i don't want to bump my old post.

I just want to let you know that i hadn't any bsod's any more. So I think my problem i fixed thanks to your help. Now i know that out of date drivers can cause serious problems..

Thank you very much for all your help.

Cheers
Dimitri

I am glad his problem is solved and I thank him for reporting back. I will ask the moderators to mark this thread as solved.

Solved Some different BSOD's can't fix any of them

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

Antique Senior Member

My Computer My Computer

At a glance

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer