Win7 64bit BSOD very often

[jormaxi123]

I have been lately getting BSODs. They happen usually when I open the computer for first time in a day. The computer can stay on for like 3 hours when I have got like 5 crashes. System specs are in my profile and dumps are attached on my post. I couldnt run the perfmon /report. My W7 is full retail and is the original OS on the system. The age of my computer is like 2yrs and the OS is the same age.

Edit:Because of the crashes I ran Memtest86+ on my old memory (same as my new but 4GB) and it gave about a million errors. I bought new memory and the computer still gets BSODs.

Edit2: Attached 1 dump file, going to attach more some time

Edit3: Added more dump files

 

[zigzag3143]

No dmps in upload try this method

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.
*If the files are too large please upload them to a file sharing service like "Rapidshare" and put a link to them in your reply.

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.
* Under the Advanced tab, click on the Startup and Recovery Settings... button.
* Ensure that Automatically restart is unchecked.
* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
* OK your way out.
* Reboot if changes have been made.

 

[jormaxi123]

Please someone I need help fast

 

[writhziden]

It is impossible to help fast without knowing what the problem is... Please do as zigzag3143 asked and we will be better equipped to help. What I mean is, upload the latest crash reports. Yours are now two weeks old.

 

[jormaxi123]

Do you mean uploading the dump files? Did it like 2 weeks ago

 

[writhziden]

Alright, I will analyze the two week old crashes...

Problem Devices:

MpKslf1f2acd0	ROOT\LEGACY_MPKSLF1F2ACD0\0000	This device is not present, is not working properly, or does not have all its drivers installed.

Antivirus Software:

msmpeng.exe	c:\program files\microsoft security client\antimalware\msmpeng.exe	936	8	200	1380	25.2.2012 11:19	3.0.8402.0	12,48 kt (12*784 tavua)	27.4.2011 18:21
nissrv.exe	c:\program files\microsoft security client\antimalware\nissrv.exe	2408	8	200	1380	25.2.2012 11:19	3.0.8402.0	281,52 kt (288*272 tavua)	27.4.2011 18:21
msseces.exe	c:\program files\microsoft security client\msseces.exe	3040	8	200	1380	25.2.2012 11:19	2.1.1116.0	1,37 Mt (1*436*736 tavua)	15.6.2011 15:35

Possible out of date drivers:

WmXlCore	fffff880`05956000	fffff880`05962600	Thu Jan 24 16:01:22 2008 (479918c2)	0000e492		WmXlCore.sys
WmBEnum	fffff880`05952000	fffff880`05955c00	Thu Jan 24 16:01:30 2008 (479918ca)	00006b51		WmBEnum.sys
vcsvad	fffff880`04855000	fffff880`0485f000	Sun Nov 16 02:51:18 2008 (491fed16)	0000affe		vcsvad.sys
hamachi	fffff880`0591a000	fffff880`05925000	Thu Feb 19 03:36:41 2009 (499d3639)	0000a5d7		hamachi.sys
lirsgt	fffff880`0850c000	fffff880`08519000	Sun May 17 07:06:57 2009 (4a100bf1)	0000f1b4		lirsgt.sys
atksgt	fffff880`084b4000	fffff880`08503000	Sun May 17 07:36:34 2009 (4a1012e2)	0004fc56		atksgt.sys
GEARAspiWDM	fffff880`0569c000	fffff880`056a9000	Mon May 18 06:17:04 2009 (4a1151c0)	000159b4		GEARAspiWDM.sys

WmXlCore.sys
WmBEnum.sys
vcsvad.sys
hamachi.sys
lirsgt.sys
atksgt.sys
GEARAspiWDM.sys

[list=1]
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-23119-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0301f000 PsLoadedModuleList = 0xfffff800`03264670
Debug session time: Mon Feb 27 07:42:54.856 2012 (UTC - 6:00)
System Uptime: 0 days 0:04:40.666
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image \SystemRoot\system32\DRIVERS\atikmdag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc000001d, fffff88004f45153, fffff88002bb99e8, fffff88002bb9240}

Probably caused by : atikmdag.sys ( atikmdag+4c7153 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc000001d, The exception code that was not handled
Arg2: fffff88004f45153, The address that the exception occurred at
Arg3: fffff88002bb99e8, Exception Record Address
Arg4: fffff88002bb9240, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
atikmdag+4c7153
fffff880`04f45153 27              ???

EXCEPTION_RECORD:  fffff88002bb99e8 -- (.exr 0xfffff88002bb99e8)
ExceptionAddress: fffff88004f45153 (atikmdag+0x00000000004c7153)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  fffff88002bb9240 -- (.cxr 0xfffff88002bb9240)
rax=0000000000000018 rbx=0000000000000018 rcx=0000000000000018
rdx=df56b045355788bc rsi=fffff880051d37b0 rdi=0000000000000001
rip=fffff88004f45153 rsp=fffff88002bb9c28 rbp=fffff88002bb9d30
 r8=fffff88004f45153  r9=fffff88002bb9c78 r10=000000b8452baad9
r11=0000000000000018 r12=0000000000000038 r13=0000000000000020
r14=0000000000000000 r15=0000000000000001
iopl=0         nv up di pl nz ac po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010016
atikmdag+0x4c7153:
fffff880`04f45153 27              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x7E

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from fffff88004f0956c to fffff88004f45153

FAILED_INSTRUCTION_ADDRESS: 
atikmdag+4c7153
fffff880`04f45153 27              ???

STACK_TEXT:  
fffff880`02bb9c28 fffff880`04f0956c : 00000000`00000004 00000000`00000000 00000000`0000b100 fffff880`051d3700 : atikmdag+0x4c7153
fffff880`02bb9c30 00000000`00000004 : 00000000`00000000 00000000`0000b100 fffff880`051d3700 fffff800`03211e80 : atikmdag+0x48b56c
fffff880`02bb9c38 00000000`00000000 : 00000000`0000b100 fffff880`051d3700 fffff800`03211e80 74737953`0023f5ad : 0x4


FOLLOWUP_IP: 
atikmdag+4c7153
fffff880`04f45153 27              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atikmdag+4c7153

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atikmdag

IMAGE_NAME:  atikmdag.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4edd8367

STACK_COMMAND:  .cxr 0xfffff88002bb9240 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_BAD_IP_atikmdag+4c7153

BUCKET_ID:  X64_0x7E_BAD_IP_atikmdag+4c7153

Followup: MachineOwner
---------

[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-23384-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03050000 PsLoadedModuleList = 0xfffff800`03295670
Debug session time: Mon Feb 27 07:37:32.899 2012 (UTC - 6:00)
System Uptime: 0 days 0:09:54.709
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+3063636333373736
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x1E_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  2

EXCEPTION_RECORD:  fffff8800311b3a8 -- (.exr 0xfffff8800311b3a8)
ExceptionAddress: fffff800030d84d3 (nt!KiProcessExpiredTimerList+0x0000000000000103)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800311b450 -- (.trap 0xfffff8800311b450)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=fffffa800703c100
rdx=0000000000000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800030d84d3 rsp=fffff8800311b5e0 rbp=fffffa800703c168
 r8=fffff880009eb301  r9=0000000000000002 r10=00000000000000ea
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po cy
nt!KiProcessExpiredTimerList+0x103:
fffff800`030d84d3 0fb6432b        movzx   eax,byte ptr [rbx+2Bh] ds:1a00:00000000`0000002b=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff800030c45fe to fffff800030ccc10

STACK_TEXT:  
fffff880`0311a488 fffff800`030c45fe : fffffa80`06e06770 00000000`00000002 fffff880`0311ac00 fffff800`030f8830 : nt!KeBugCheck
fffff880`0311a490 fffff800`030f84fd : fffff800`032d671c fffff800`03213c30 fffff800`03050000 fffff880`0311b3a8 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`0311a4c0 fffff800`030f72d5 : fffff800`032170fc fffff880`0311a538 fffff880`0311b3a8 fffff800`03050000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0311a4f0 fffff800`03108361 : fffff880`0311b3a8 fffff880`0311ac00 fffff880`00000000 fffff880`0311b608 : nt!RtlDispatchException+0x415
fffff880`0311abd0 fffff800`030cc2c2 : fffff880`0311b3a8 fffbfa80`0703c168 fffff880`0311b450 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0311b270 fffff800`030cabca : fffffa80`079fe988 00000000`0000e934 00000000`00000001 fffff880`018cef60 : nt!KiExceptionDispatch+0xc2
fffff880`0311b450 fffff800`030d84d3 : fffffa80`0703c120 fffffa80`0703c168 fffffa80`0703c168 00000000`00000102 : nt!KiGeneralProtectionFault+0x10a
fffff880`0311b5e0 fffff800`030d837e : 00000001`627982fa fffff880`0311bc58 00000000`000094ea fffff880`009ed2c8 : nt!KiProcessExpiredTimerList+0x103
fffff880`0311bc30 fffff800`030d8167 : 00000000`617a8ec1 00000000`000094ea 00000000`617a8ec0 00000000`000000ea : nt!KiTimerExpiration+0x1be
fffff880`0311bcd0 fffff800`030c496a : fffff880`009e9180 fffff880`009f4040 00000000`00000001 fffff800`00000000 : nt!KiRetireDpcList+0x277
fffff880`0311bd80 00000000`00000000 : fffff880`0311c000 fffff880`03116000 fffff880`0311bd40 00000000`00000000 : nt!KiIdleLoop+0x5a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`030c45fe 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

FAILURE_BUCKET_ID:  X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_0_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022712-22932-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03015000 PsLoadedModuleList = 0xfffff800`0325a670
Debug session time: Mon Feb 27 07:09:19.764 2012 (UTC - 6:00)
System Uptime: 0 days 0:00:57.935
Loading Kernel Symbols
...............................................................
................................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904fb, fffff8800719f278, fffff8800719ead0, fffff880012419a9}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCleanupIrpContext+119 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800719f278
Arg3: fffff8800719ead0
Arg4: fffff880012419a9

Debugging Details:
------------------


EXCEPTION_RECORD:  fffff8800719f278 -- (.exr 0xfffff8800719f278)
ExceptionAddress: fffff880012419a9 (Ntfs!NtfsCleanupIrpContext+0x0000000000000119)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff8800719ead0 -- (.cxr 0xfffff8800719ead0)
rax=00fff8800719f848 rbx=fffff8800719f6d0 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000001 rdi=fffff8800719f630
rip=fffff880012419a9 rsp=fffff8800719f4b0 rbp=fffff8800719f830
 r8=0000000000000000  r9=0000000000000727 r10=0000000000000001
r11=fffff8800719f630 r12=0000000000000001 r13=0000000000000702
r14=0000000000000001 r15=0000000000000000
iopl=0         nv up ei pl zr na po cy
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010247
Ntfs!NtfsCleanupIrpContext+0x119:
fffff880`012419a9 488b4818        mov     rcx,qword ptr [rax+18h] ds:002b:00fff880`0719f860=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  MsMpEng.exe

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032c4100
 ffffffffffffffff 

FOLLOWUP_IP: 
Ntfs!NtfsCleanupIrpContext+119
fffff880`012419a9 488b4818        mov     rcx,qword ptr [rax+18h]

FAULTING_IP: 
Ntfs!NtfsCleanupIrpContext+119
fffff880`012419a9 488b4818        mov     rcx,qword ptr [rax+18h]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from fffff880012403a0 to fffff880012419a9

STACK_TEXT:  
fffff880`0719f4b0 fffff880`012403a0 : fffff880`0719f6d0 00000000`00000001 fffff880`0719f830 fffffa80`09482410 : Ntfs!NtfsCleanupIrpContext+0x119
fffff880`0719f500 fffff880`01240a68 : fffff880`0719f6d0 fffffa80`09482410 fffff880`0719f801 fffffa80`09d9ec01 : Ntfs!NtfsCommonRead+0x1b74
fffff880`0719f6a0 fffff880`01168bcf : fffffa80`094827b0 fffffa80`09482410 fffffa80`09d9ec30 00000000`00000000 : Ntfs!NtfsFsdRead+0x1b8
fffff880`0719f8b0 fffff880`011676df : fffffa80`07cb2530 fffffa80`0944c601 fffffa80`07cb2500 fffffa80`09482410 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0719f940 fffff800`030b9bc5 : fffffa80`09482430 fffffa80`084119d0 fffffa80`09677a50 00000000`7562fcc8 : fltmgr!FltpDispatch+0xcf
fffff880`0719f9a0 fffff800`030b9699 : 00000000`00000001 00000000`00000001 fffffa80`09677990 00000000`0000ff01 : nt!IoPageRead+0x255
fffff880`0719fa30 fffff800`030a002a : 00000000`00000000 00000000`00000000 ffffffff`ffffffff 00000000`00000000 : nt!MiIssueHardFault+0x255
fffff880`0719fac0 fffff800`0308fd6e : 00000000`00000000 00000000`7562fcc8 00000000`00000b01 00000000`0002e174 : nt!MmAccessFault+0x146a
fffff880`0719fc20 00000000`77959c12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`024ad0b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77959c12


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCleanupIrpContext+119

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d79997b

STACK_COMMAND:  .cxr 0xfffff8800719ead0 ; kb

FAILURE_BUCKET_ID:  X64_0x24_Ntfs!NtfsCleanupIrpContext+119

BUCKET_ID:  X64_0x24_Ntfs!NtfsCleanupIrpContext+119

Followup: MachineOwner
---------
[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\minidump2\022612-23368-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`0305e000 PsLoadedModuleList = 0xfffff800`032a3670
Debug session time: Sun Feb 26 02:25:35.543 2012 (UTC - 6:00)
System Uptime: 0 days 0:13:50.714
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c000001d, fffff800030e274d, fffff8800ae2c130, 0}

Probably caused by : hardware ( nt!KeWaitForSingleObject+19d )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c000001d, Exception code that caused the bugcheck
Arg2: fffff800030e274d, Address of the instruction which caused the bugcheck
Arg3: fffff8800ae2c130, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP: 
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff              ???

CONTEXT:  fffff8800ae2c130 -- (.cxr 0xfffff8800ae2c130)
rax=0000000000000102 rbx=00000001ef25007a rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa8009473b30 rdi=fffffa8006b21b60
rip=fffff800030e274d rsp=fffff8800ae2cb10 rbp=0000000000000000
 r8=fffffa8009d790e8  r9=0000000000000000 r10=fffffffffffffffb
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=fffff8800ae2cbf8 r15=fffffa8006b21c68
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
nt!KeWaitForSingleObject+0x19d:
fffff800`030e274d ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x3B

PROCESS_NAME:  Skype.exe

CURRENT_IRQL:  0

MISALIGNED_IP: 
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff              ???

LAST_CONTROL_TRANSFER:  from fffff800033d144e to fffff800030e274d

STACK_TEXT:  
fffff880`0ae2cb10 fffff800`033d144e : fffff880`0ae2cc00 fffffa80`00000006 00000000`00000001 fffff880`0ae2cc00 : nt!KeWaitForSingleObject+0x19d
fffff880`0ae2cbb0 fffff800`030d9ed3 : fffffa80`06b21b60 00000000`00001028 fffff880`0ae2cbf8 fffffa80`09473b30 : nt!NtWaitForSingleObject+0xde
fffff880`0ae2cc20 00000000`73b22e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1887f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73b22e09


FOLLOWUP_IP: 
nt!KeWaitForSingleObject+19d
fffff800`030e274d ff              ???

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeWaitForSingleObject+19d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

STACK_COMMAND:  .cxr 0xfffff8800ae2c130 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  X64_IP_MISALIGNED

BUCKET_ID:  X64_IP_MISALIGNED

Followup: MachineOwner
---------



[*]
Loading Dump File [D:\Kingston\BSODDmpFiles\jormaxi123\022512-25552-01\022512-25552-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (6 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`03008000 PsLoadedModuleList = 0xfffff800`0324d670
Debug session time: Sat Feb 25 14:51:37.245 2012 (UTC - 6:00)
System Uptime: 0 days 0:08:47.416
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 815f001, 3848, fffff70001080000}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+3a2 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041284, A PTE or the working set list is corrupt.
Arg2: 000000000815f001
Arg3: 0000000000003848
Arg4: fffff70001080000

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_41284

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  chrome.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff800030dc5a7 to fffff80003084c40

STACK_TEXT:  
fffff880`08095498 fffff800`030dc5a7 : 00000000`0000001a 00000000`00041284 00000000`0815f001 00000000`00003848 : nt!KeBugCheckEx
fffff880`080954a0 fffff800`030f3e6c : fffffa80`02287380 84800000`b8268867 00000000`0815e000 84700000`b4267867 : nt! ?? ::FNODOBFM::`string'+0x4ac3
fffff880`080954e0 fffff800`030b8569 : 00000000`00000000 00000000`08243fff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35d20
fffff880`080956a0 fffff800`0339c221 : fffffa80`09c9a6c0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiRemoveMappedView+0xd9
fffff880`080957c0 fffff800`0339c623 : 00000000`00000000 00000000`08100000 fffffa80`00000001 00000000`00000000 : nt!MiUnmapViewOfSection+0x1b1
fffff880`08095880 fffff800`03083ed3 : 00000000`00010001 00000000`00000001 fffffa80`06d88b30 00000000`00000000 : nt!NtUnmapViewOfSection+0x5f
fffff880`080958d0 fffff800`03080470 : fffff960`001964ea 00000000`00000001 fffff900`c00be010 fffff900`c06f4880 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08095a68 fffff960`001964ea : 00000000`00000001 fffff900`c00be010 fffff900`c06f4880 00000000`00000000 : nt!KiServiceLinkage
fffff880`08095a70 fffff960`0019686c : ffffffff`00000000 fffff880`00000000 fffff900`c06f4880 00000000`00000000 : win32k!SURFACE::bDeleteSurface+0x3a2
fffff880`08095bc0 fffff960`001574c9 : ffffffff`99050db2 fffff900`c06f4880 00000000`00000db2 fffff800`030d0993 : win32k!bDeleteSurface+0x34
fffff880`08095bf0 fffff800`03083ed3 : fffffa80`06d88630 fffff900`c00be010 00000000`00000018 00000000`7efdb000 : win32k!NtGdiDeleteObjectApp+0xd5
fffff880`08095c20 00000000`75612e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`000de478 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x75612e09


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SURFACE::bDeleteSurface+3a2
fffff960`001964ea e9d6010000      jmp     win32k!SURFACE::bDeleteSurface+0x57d (fffff960`001966c5)

SYMBOL_STACK_INDEX:  8

SYMBOL_NAME:  win32k!SURFACE::bDeleteSurface+3a2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f10ff24

FAILURE_BUCKET_ID:  X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2

BUCKET_ID:  X64_0x1a_41284_win32k!SURFACE::bDeleteSurface+3a2

Followup: MachineOwner
---------
[/list]

1. Caused by your graphics card/graphics card driver(s). Other possible causes are Memory problems... BIOS... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
2. Possible causes are Memory problems... Viruses... Corrupted hard disk file system... Corrupted System Files... Lack of Windows updates... Drivers...
   Thanks to JMH for helping with my understanding of this crash.
3. Possible causes are Memory problems... Corrupted hard disk file system... Drivers... corrupted SCSI or IDE Drivers...
4. Indicates hardware... Other possible causes are Memory problems... Corrupted hard disk file system... Corrupted System Files... Graphics Driver... Drivers...
5. Possible causes are Memory problems... Drivers...

Thanks to Dave76 for help understanding possible causes.


You have a plethora of different types of crashes; this usually means a hardware issue, but it could also be Windows file corruption. Let's start with file corruption first.

• If you are overclocking any hardware, please stop.
  
  
• Run Disk Check with both boxes checked for all HDDs and with Automatically fix file system errors checked for all SSDs. Post back your logs for the checks after finding them using http://www.sevenforums.com/tutorials/96938-check-disk-chkdsk-read-event-viewer-log.html
  
  
• Run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html up to three times to fix all errors with a restart in between each. Post back if it continues to show errors after a fourth run or if the first run comes back with no integrity violations.